0000000000000}}}, 0xb8}}, 0x0) [ 2373.188371] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2373.199803] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2373.276975] hfs: dir_umask requires a value [ 2373.285380] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2373.299444] hfs: unable to parse mount options [ 2374.818959] Bluetooth: hci0: command 0x1003 tx timeout [ 2374.824511] Bluetooth: hci0: sending frame failed (-49) [ 2375.219162] Bluetooth: hci1: command 0x1003 tx timeout [ 2375.224671] Bluetooth: hci1: sending frame failed (-49) 03:08:03 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455c8, 0x0) 03:08:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xd63c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:08:03 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x500000000000000}}}, 0xb8}}, 0x0) [ 2375.982377] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2375.984848] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2376.898907] Bluetooth: hci0: command 0x1001 tx timeout [ 2376.904330] Bluetooth: hci0: sending frame failed (-49) [ 2377.299095] Bluetooth: hci1: command 0x1001 tx timeout [ 2377.304507] Bluetooth: hci1: sending frame failed (-49) [ 2378.098909] Bluetooth: hci2: command 0x1003 tx timeout [ 2378.104385] Bluetooth: hci2: sending frame failed (-49) [ 2378.978905] Bluetooth: hci0: command 0x1009 tx timeout [ 2379.378916] Bluetooth: hci1: command 0x1009 tx timeout [ 2380.179034] Bluetooth: hci2: command 0x1001 tx timeout [ 2380.184438] Bluetooth: hci2: sending frame failed (-49) [ 2382.259037] Bluetooth: hci2: command 0x1009 tx timeout 03:08:10 executing program 0 (fault-call:3 fault-nth:51): perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 03:08:10 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x4c000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:08:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xd73c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:08:10 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x600000000000000}}}, 0xb8}}, 0x0) 03:08:10 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5450, 0x0) [ 2383.666999] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2383.676259] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2383.688152] Bluetooth: hci0: Frame reassembly failed (-84) 03:08:11 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x700000000000000}}}, 0xb8}}, 0x0) 03:08:11 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xd83c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2383.734293] FAULT_INJECTION: forcing a failure. [ 2383.734293] name failslab, interval 1, probability 0, space 0, times 0 [ 2383.749720] hfs: dir_umask requires a value [ 2383.767368] hfs: unable to parse mount options [ 2383.796486] CPU: 1 PID: 25492 Comm: syz-executor.0 Not tainted 4.19.79 #0 [ 2383.803472] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2383.812833] Call Trace: [ 2383.815439] dump_stack+0x172/0x1f0 [ 2383.819090] should_fail.cold+0xa/0x1b [ 2383.822986] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2383.828097] ? lock_downgrade+0x880/0x880 [ 2383.832265] __should_failslab+0x121/0x190 [ 2383.836519] should_failslab+0x9/0x14 [ 2383.840326] kmem_cache_alloc+0x2ae/0x700 [ 2383.844483] ? lock_downgrade+0x880/0x880 [ 2383.848746] __kernfs_new_node+0xef/0x680 [ 2383.852905] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 2383.857668] ? wait_for_completion+0x440/0x440 [ 2383.862267] ? mutex_unlock+0xd/0x10 [ 2383.865984] ? kernfs_activate+0x192/0x1f0 [ 2383.870234] kernfs_new_node+0x99/0x130 [ 2383.874226] __kernfs_create_file+0x51/0x33b [ 2383.878648] sysfs_add_file_mode_ns+0x222/0x560 [ 2383.883335] internal_create_group+0x383/0xc30 [ 2383.887940] ? remove_files.isra.0+0x190/0x190 [ 2383.892526] ? kernfs_put+0x3c2/0x5d0 [ 2383.896332] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2383.901874] ? kernfs_create_link+0x1d2/0x250 [ 2383.906387] sysfs_create_groups+0x9b/0x141 [ 2383.910738] device_add+0x87e/0x1760 [ 2383.914485] ? get_device_parent.isra.0+0x570/0x570 [ 2383.919559] rfkill_register+0x1bf/0xb50 [ 2383.923651] hci_register_dev+0x385/0x880 [ 2383.927826] hci_uart_tty_ioctl+0x761/0xaf0 [ 2383.932161] tty_ioctl+0x8b5/0x1510 [ 2383.935797] ? hci_uart_init_work+0x140/0x140 [ 2383.940304] ? tty_vhangup+0x30/0x30 [ 2383.944026] ? mark_held_locks+0x100/0x100 [ 2383.945674] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2383.948283] ? __fget+0x340/0x540 [ 2383.948305] ? __might_sleep+0x95/0x190 [ 2383.964387] ? tty_vhangup+0x30/0x30 [ 2383.968110] do_vfs_ioctl+0xd5f/0x1380 [ 2383.972007] ? selinux_file_ioctl+0x46f/0x5e0 [ 2383.976511] ? selinux_file_ioctl+0x125/0x5e0 [ 2383.981012] ? ioctl_preallocate+0x210/0x210 [ 2383.985438] ? selinux_file_mprotect+0x620/0x620 [ 2383.990231] ? iterate_fd+0x360/0x360 03:08:11 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000}}}, 0xb8}}, 0x0) [ 2383.994110] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2383.999654] ? fput+0x128/0x1a0 [ 2384.002950] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2384.011365] ? security_file_ioctl+0x8d/0xc0 [ 2384.015791] ksys_ioctl+0xab/0xd0 [ 2384.019259] __x64_sys_ioctl+0x73/0xb0 [ 2384.023154] do_syscall_64+0xfd/0x620 [ 2384.026987] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2384.032188] RIP: 0033:0x459a59 [ 2384.035388] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2384.054296] RSP: 002b:00007f13ec7e5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2384.062018] RAX: ffffffffffffffda RBX: 00007f13ec7e5c90 RCX: 0000000000459a59 [ 2384.069291] RDX: 0000000000000000 RSI: 00000000400455c8 RDI: 0000000000000004 [ 2384.076656] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2384.083937] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f13ec7e66d4 [ 2384.086618] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2384.091215] R13: 00000000004c27a1 R14: 00000000004d61b0 R15: 0000000000000005 [ 2384.107455] Bluetooth: hci1: Frame reassembly failed (-84) [ 2384.133728] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:08:11 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xd93c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2384.214366] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2385.699000] Bluetooth: hci0: command 0x1003 tx timeout [ 2385.704539] Bluetooth: hci0: sending frame failed (-49) 03:08:13 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:08:13 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x60000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:08:13 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000}}}, 0xb8}}, 0x0) [ 2386.179221] Bluetooth: hci1: command 0x1003 tx timeout [ 2386.184607] Bluetooth: hci1: sending frame failed (-49) [ 2386.234686] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2386.251341] hfs: dir_umask requires a value [ 2386.262034] Bluetooth: hci2: Frame reassembly failed (-84) [ 2386.267070] hfs: unable to parse mount options [ 2387.778976] Bluetooth: hci0: command 0x1001 tx timeout [ 2387.784465] Bluetooth: hci0: sending frame failed (-49) [ 2388.259125] Bluetooth: hci1: command 0x1001 tx timeout [ 2388.264593] Bluetooth: hci1: sending frame failed (-49) [ 2388.339095] Bluetooth: hci2: command 0x1003 tx timeout [ 2388.344600] Bluetooth: hci2: sending frame failed (-49) [ 2389.858984] Bluetooth: hci0: command 0x1009 tx timeout [ 2390.339023] Bluetooth: hci1: command 0x1009 tx timeout [ 2390.419091] Bluetooth: hci2: command 0x1001 tx timeout [ 2390.424521] Bluetooth: hci2: sending frame failed (-49) [ 2392.499092] Bluetooth: hci2: command 0x1009 tx timeout 03:08:21 executing program 0 (fault-call:3 fault-nth:52): perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 03:08:21 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xda3c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:08:21 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0xf00000000000000}}}, 0xb8}}, 0x0) 03:08:21 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x68000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:08:21 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5451, 0x0) 03:08:21 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000}}}, 0xb8}}, 0x0) [ 2394.557884] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2394.568212] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2394.578293] hfs: dir_umask requires a value [ 2394.594496] Bluetooth: hci0: Frame reassembly failed (-84) [ 2394.598974] hfs: unable to parse mount options 03:08:21 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xdb3c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2394.661410] FAULT_INJECTION: forcing a failure. [ 2394.661410] name failslab, interval 1, probability 0, space 0, times 0 [ 2394.697853] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2394.697939] CPU: 0 PID: 25522 Comm: syz-executor.0 Not tainted 4.19.79 #0 [ 2394.713548] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2394.722925] Call Trace: [ 2394.725545] dump_stack+0x172/0x1f0 [ 2394.729209] should_fail.cold+0xa/0x1b [ 2394.733129] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2394.738254] ? lock_downgrade+0x880/0x880 [ 2394.742449] __should_failslab+0x121/0x190 [ 2394.746711] should_failslab+0x9/0x14 [ 2394.750535] kmem_cache_alloc+0x2ae/0x700 [ 2394.754788] ? lock_downgrade+0x880/0x880 [ 2394.758990] __kernfs_new_node+0xef/0x680 [ 2394.763174] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 2394.767962] ? wait_for_completion+0x440/0x440 [ 2394.772594] ? mutex_unlock+0xd/0x10 [ 2394.776535] ? kernfs_activate+0x192/0x1f0 [ 2394.780800] kernfs_new_node+0x99/0x130 [ 2394.784806] __kernfs_create_file+0x51/0x33b [ 2394.789291] sysfs_add_file_mode_ns+0x222/0x560 [ 2394.794004] internal_create_group+0x383/0xc30 [ 2394.798630] ? remove_files.isra.0+0x190/0x190 [ 2394.803230] ? kernfs_put+0x3c2/0x5d0 [ 2394.807051] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2394.812607] ? kernfs_create_link+0x1d2/0x250 [ 2394.817139] sysfs_create_groups+0x9b/0x141 [ 2394.821493] device_add+0x87e/0x1760 [ 2394.825250] ? get_device_parent.isra.0+0x570/0x570 [ 2394.830310] rfkill_register+0x1bf/0xb50 [ 2394.834401] hci_register_dev+0x385/0x880 [ 2394.838588] hci_uart_tty_ioctl+0x761/0xaf0 [ 2394.842934] tty_ioctl+0x8b5/0x1510 [ 2394.846586] ? hci_uart_init_work+0x140/0x140 [ 2394.851102] ? tty_vhangup+0x30/0x30 [ 2394.854950] ? mark_held_locks+0x100/0x100 [ 2394.859243] ? __fget+0x340/0x540 [ 2394.862732] ? __might_sleep+0x95/0x190 [ 2394.866730] ? tty_vhangup+0x30/0x30 [ 2394.870472] do_vfs_ioctl+0xd5f/0x1380 [ 2394.874384] ? selinux_file_ioctl+0x46f/0x5e0 [ 2394.879937] ? selinux_file_ioctl+0x125/0x5e0 [ 2394.884457] ? ioctl_preallocate+0x210/0x210 [ 2394.888890] ? selinux_file_mprotect+0x620/0x620 [ 2394.893683] ? iterate_fd+0x360/0x360 [ 2394.897504] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2394.903065] ? fput+0x128/0x1a0 [ 2394.906379] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2394.911933] ? security_file_ioctl+0x8d/0xc0 [ 2394.916373] ksys_ioctl+0xab/0xd0 [ 2394.919869] __x64_sys_ioctl+0x73/0xb0 [ 2394.923805] do_syscall_64+0xfd/0x620 [ 2394.927659] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2394.932879] RIP: 0033:0x459a59 [ 2394.936094] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2394.955016] RSP: 002b:00007f13ec7e5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 03:08:22 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x6b6b6b00, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 2394.962750] RAX: ffffffffffffffda RBX: 00007f13ec7e5c90 RCX: 0000000000459a59 [ 2394.970034] RDX: 0000000000000000 RSI: 00000000400455c8 RDI: 0000000000000004 [ 2394.977317] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2394.984605] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f13ec7e66d4 [ 2394.991892] R13: 00000000004c27a1 R14: 00000000004d61b0 R15: 0000000000000005 [ 2395.007151] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2395.016752] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2395.030769] Bluetooth: hci1: Frame reassembly failed (-84) 03:08:22 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000}}}, 0xb8}}, 0x0) [ 2395.162733] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:08:23 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x40049409, 0x0) 03:08:23 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xdc000000, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:08:23 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x6c000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 2396.462969] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2396.515212] hfs: dir_umask requires a value [ 2396.529802] hfs: unable to parse mount options [ 2396.659510] Bluetooth: hci0: command 0x1003 tx timeout [ 2396.665036] Bluetooth: hci0: sending frame failed (-49) [ 2397.058913] Bluetooth: hci1: command 0x1003 tx timeout [ 2397.064475] Bluetooth: hci1: sending frame failed (-49) [ 2398.578959] Bluetooth: hci2: command 0x1003 tx timeout [ 2398.584440] Bluetooth: hci2: sending frame failed (-49) [ 2398.739119] Bluetooth: hci0: command 0x1001 tx timeout [ 2398.744522] Bluetooth: hci0: sending frame failed (-49) [ 2399.138909] Bluetooth: hci1: command 0x1001 tx timeout [ 2399.144374] Bluetooth: hci1: sending frame failed (-49) [ 2400.658909] Bluetooth: hci2: command 0x1001 tx timeout [ 2400.664325] Bluetooth: hci2: sending frame failed (-49) [ 2400.819042] Bluetooth: hci0: command 0x1009 tx timeout [ 2401.218906] Bluetooth: hci1: command 0x1009 tx timeout [ 2402.738990] Bluetooth: hci2: command 0x1009 tx timeout 03:08:32 executing program 0 (fault-call:3 fault-nth:53): perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 03:08:32 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x4800000000000000}}}, 0xb8}}, 0x0) 03:08:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xdc3c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:08:32 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x74000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:08:32 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5452, 0x0) [ 2405.406948] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2405.430627] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2405.432062] hfs: dir_umask requires a value 03:08:32 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x4c00000000000000}}}, 0xb8}}, 0x0) [ 2405.460593] Bluetooth: hci0: Frame reassembly failed (-84) [ 2405.466519] Bluetooth: hci0: Frame reassembly failed (-84) [ 2405.468967] hfs: unable to parse mount options [ 2405.493088] FAULT_INJECTION: forcing a failure. [ 2405.493088] name failslab, interval 1, probability 0, space 0, times 0 [ 2405.505219] CPU: 0 PID: 25552 Comm: syz-executor.0 Not tainted 4.19.79 #0 [ 2405.512190] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2405.512199] Call Trace: [ 2405.512223] dump_stack+0x172/0x1f0 [ 2405.512254] should_fail.cold+0xa/0x1b [ 2405.531702] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2405.536838] ? lock_downgrade+0x880/0x880 [ 2405.541031] __should_failslab+0x121/0x190 [ 2405.545279] should_failslab+0x9/0x14 [ 2405.545298] kmem_cache_alloc+0x2ae/0x700 [ 2405.545314] ? lock_downgrade+0x880/0x880 [ 2405.557394] ? kasan_check_write+0x14/0x20 [ 2405.557426] __kernfs_new_node+0xef/0x680 [ 2405.565799] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 2405.570624] ? mutex_unlock+0xd/0x10 [ 2405.574341] ? kernfs_activate+0x192/0x1f0 [ 2405.574368] ? kernfs_add_one+0x131/0x4d0 [ 2405.574398] kernfs_new_node+0x99/0x130 [ 2405.586738] kernfs_create_dir_ns+0x52/0x160 [ 2405.586767] internal_create_group+0x1cb/0xc30 [ 2405.595741] ? internal_create_group+0x79a/0xc30 [ 2405.600532] ? remove_files.isra.0+0x190/0x190 [ 2405.605149] ? remove_files.isra.0+0x190/0x190 [ 2405.605166] ? kernfs_put+0x3c2/0x5d0 [ 2405.605189] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2405.619268] ? kernfs_create_link+0x1d2/0x250 [ 2405.623783] sysfs_create_group+0x20/0x30 [ 2405.623804] dpm_sysfs_add+0x26/0x210 [ 2405.623828] device_add+0xa47/0x1760 [ 2405.635478] ? get_device_parent.isra.0+0x570/0x570 [ 2405.635516] rfkill_register+0x1bf/0xb50 [ 2405.644581] hci_register_dev+0x385/0x880 [ 2405.648767] hci_uart_tty_ioctl+0x761/0xaf0 [ 2405.653106] tty_ioctl+0x8b5/0x1510 [ 2405.653126] ? hci_uart_init_work+0x140/0x140 [ 2405.653146] ? tty_vhangup+0x30/0x30 [ 2405.661244] ? mark_held_locks+0x100/0x100 [ 2405.661287] ? __fget+0x340/0x540 [ 2405.672673] ? __might_sleep+0x95/0x190 [ 2405.672693] ? tty_vhangup+0x30/0x30 [ 2405.681000] do_vfs_ioctl+0xd5f/0x1380 [ 2405.681022] ? selinux_file_ioctl+0x46f/0x5e0 [ 2405.681039] ? selinux_file_ioctl+0x125/0x5e0 [ 2405.693932] ? ioctl_preallocate+0x210/0x210 [ 2405.698367] ? selinux_file_mprotect+0x620/0x620 [ 2405.704125] ? iterate_fd+0x360/0x360 [ 2405.707957] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2405.713517] ? fput+0x128/0x1a0 [ 2405.716837] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2405.722396] ? security_file_ioctl+0x8d/0xc0 [ 2405.726833] ksys_ioctl+0xab/0xd0 [ 2405.730315] __x64_sys_ioctl+0x73/0xb0 [ 2405.734231] do_syscall_64+0xfd/0x620 [ 2405.738063] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2405.743279] RIP: 0033:0x459a59 [ 2405.746499] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2405.765432] RSP: 002b:00007f13ec7e5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2405.773174] RAX: ffffffffffffffda RBX: 00007f13ec7e5c90 RCX: 0000000000459a59 [ 2405.780458] RDX: 0000000000000000 RSI: 00000000400455c8 RDI: 0000000000000004 [ 2405.787740] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2405.795196] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f13ec7e66d4 [ 2405.802479] R13: 00000000004c27a1 R14: 00000000004d61b0 R15: 0000000000000005 03:08:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xdd3c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:08:33 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x7a000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 2405.830659] Bluetooth: hci1: Frame reassembly failed (-84) [ 2405.864645] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:08:33 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x6000000000000000}}}, 0xb8}}, 0x0) [ 2405.901393] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2405.954883] hfs: dir_umask requires a value [ 2405.975687] hfs: unable to parse mount options [ 2405.982266] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:08:33 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x40086602, 0x0) 03:08:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xde3c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:08:33 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x6800000000000000}}}, 0xb8}}, 0x0) [ 2406.691030] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2406.710316] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2406.749747] Bluetooth: hci2: Frame reassembly failed (-84) [ 2406.755957] Bluetooth: hci2: Frame reassembly failed (-84) [ 2407.539072] Bluetooth: hci0: command 0x1003 tx timeout [ 2407.544472] Bluetooth: hci0: sending frame failed (-49) [ 2407.859017] Bluetooth: hci1: command 0x1003 tx timeout [ 2407.864428] Bluetooth: hci1: sending frame failed (-49) [ 2408.818906] Bluetooth: hci2: command 0x1003 tx timeout [ 2408.824314] Bluetooth: hci2: sending frame failed (-49) [ 2409.618940] Bluetooth: hci0: command 0x1001 tx timeout [ 2409.624332] Bluetooth: hci0: sending frame failed (-49) [ 2409.938912] Bluetooth: hci1: command 0x1001 tx timeout [ 2409.944316] Bluetooth: hci1: sending frame failed (-49) [ 2410.898928] Bluetooth: hci2: command 0x1001 tx timeout [ 2410.904513] Bluetooth: hci2: sending frame failed (-49) [ 2411.699044] Bluetooth: hci0: command 0x1009 tx timeout [ 2412.018906] Bluetooth: hci1: command 0x1009 tx timeout [ 2412.978952] Bluetooth: hci2: command 0x1009 tx timeout 03:08:43 executing program 0 (fault-call:3 fault-nth:54): perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 03:08:43 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x8cffffff, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:08:43 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x6c00000000000000}}}, 0xb8}}, 0x0) 03:08:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xdf3c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:08:43 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x545d, 0x0) [ 2416.305083] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2416.317677] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2416.340929] Bluetooth: hci0: Frame reassembly failed (-84) [ 2416.374781] FAULT_INJECTION: forcing a failure. [ 2416.374781] name failslab, interval 1, probability 0, space 0, times 0 [ 2416.391463] CPU: 0 PID: 25579 Comm: syz-executor.0 Not tainted 4.19.79 #0 [ 2416.398452] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2416.407831] Call Trace: [ 2416.410449] dump_stack+0x172/0x1f0 [ 2416.414821] should_fail.cold+0xa/0x1b [ 2416.416112] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2416.418737] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2416.418760] ? lock_downgrade+0x880/0x880 [ 2416.418794] __should_failslab+0x121/0x190 [ 2416.435660] should_failslab+0x9/0x14 [ 2416.435680] kmem_cache_alloc+0x2ae/0x700 [ 2416.435699] ? lock_downgrade+0x880/0x880 [ 2416.443739] __kernfs_new_node+0xef/0x680 [ 2416.443767] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 2416.443787] ? wait_for_completion+0x440/0x440 [ 2416.452072] ? mutex_unlock+0xd/0x10 [ 2416.452091] ? kernfs_activate+0x192/0x1f0 03:08:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xe03c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2416.452120] kernfs_new_node+0x99/0x130 [ 2416.452146] __kernfs_create_file+0x51/0x33b [ 2416.452173] sysfs_add_file_mode_ns+0x222/0x560 [ 2416.452207] internal_create_group+0x383/0xc30 [ 2416.461747] ? remove_files.isra.0+0x190/0x190 [ 2416.469996] ? kernfs_put+0x3c2/0x5d0 [ 2416.470019] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2416.470038] ? kernfs_create_link+0x1d2/0x250 [ 2416.470070] sysfs_create_groups+0x9b/0x141 [ 2416.470097] device_add+0x87e/0x1760 [ 2416.470128] ? get_device_parent.isra.0+0x570/0x570 [ 2416.470160] rfkill_register+0x1bf/0xb50 [ 2416.470185] hci_register_dev+0x385/0x880 [ 2416.470217] hci_uart_tty_ioctl+0x761/0xaf0 [ 2416.470241] tty_ioctl+0x8b5/0x1510 [ 2416.483527] ? hci_uart_init_work+0x140/0x140 [ 2416.483550] ? tty_vhangup+0x30/0x30 [ 2416.483566] ? mark_held_locks+0x100/0x100 [ 2416.501202] ? __fget+0x340/0x540 [ 2416.501237] ? __might_sleep+0x95/0x190 [ 2416.501260] ? tty_vhangup+0x30/0x30 [ 2416.501285] do_vfs_ioctl+0xd5f/0x1380 [ 2416.501303] ? selinux_file_ioctl+0x46f/0x5e0 [ 2416.501318] ? selinux_file_ioctl+0x125/0x5e0 [ 2416.501340] ? ioctl_preallocate+0x210/0x210 [ 2416.519397] ? selinux_file_mprotect+0x620/0x620 [ 2416.519436] ? iterate_fd+0x360/0x360 [ 2416.519458] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2416.519475] ? fput+0x128/0x1a0 [ 2416.519504] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2416.519522] ? security_file_ioctl+0x8d/0xc0 [ 2416.537057] ksys_ioctl+0xab/0xd0 [ 2416.537087] __x64_sys_ioctl+0x73/0xb0 [ 2416.537110] do_syscall_64+0xfd/0x620 [ 2416.537136] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2416.556690] RIP: 0033:0x459a59 [ 2416.556708] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2416.556719] RSP: 002b:00007f13ec7e5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2416.556741] RAX: ffffffffffffffda RBX: 00007f13ec7e5c90 RCX: 0000000000459a59 [ 2416.556753] RDX: 0000000000000000 RSI: 00000000400455c8 RDI: 0000000000000004 03:08:43 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x7400000000000000}}}, 0xb8}}, 0x0) [ 2416.556766] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2416.577398] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f13ec7e66d4 [ 2416.577410] R13: 00000000004c27a1 R14: 00000000004d61b0 R15: 0000000000000005 [ 2416.695790] Bluetooth: hci1: Frame reassembly failed (-84) 03:08:44 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x97ffffff, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:08:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xe13c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2416.734552] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2416.810087] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:08:44 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x40087602, 0x0) 03:08:44 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x7a00000000000000}}}, 0xb8}}, 0x0) 03:08:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xe23c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2416.949344] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2416.969037] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2416.997675] Bluetooth: hci2: Frame reassembly failed (-84) [ 2418.418937] Bluetooth: hci0: command 0x1003 tx timeout [ 2418.424369] Bluetooth: hci0: sending frame failed (-49) [ 2418.738919] Bluetooth: hci1: command 0x1003 tx timeout [ 2418.744308] Bluetooth: hci1: sending frame failed (-49) [ 2419.059048] Bluetooth: hci2: command 0x1003 tx timeout [ 2419.064449] Bluetooth: hci2: sending frame failed (-49) [ 2420.499118] Bluetooth: hci0: command 0x1001 tx timeout [ 2420.504527] Bluetooth: hci0: sending frame failed (-49) [ 2420.818950] Bluetooth: hci1: command 0x1001 tx timeout [ 2420.824378] Bluetooth: hci1: sending frame failed (-49) [ 2421.138984] Bluetooth: hci2: command 0x1001 tx timeout [ 2421.144396] Bluetooth: hci2: sending frame failed (-49) [ 2422.579100] Bluetooth: hci0: command 0x1009 tx timeout [ 2422.899089] Bluetooth: hci1: command 0x1009 tx timeout [ 2423.218974] Bluetooth: hci2: command 0x1009 tx timeout 03:08:54 executing program 0 (fault-call:3 fault-nth:55): perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 03:08:54 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xc0ed0000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:08:54 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x8800000000000000}}}, 0xb8}}, 0x0) 03:08:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xe33c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:08:54 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x5460, 0x0) 03:08:54 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x4020940d, 0x0) [ 2427.199613] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2427.212526] hfs: dir_umask requires a value [ 2427.216882] hfs: unable to parse mount options [ 2427.229369] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2427.237644] Bluetooth: hci0: Frame reassembly failed (-84) 03:08:54 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x9effffff00000000}}}, 0xb8}}, 0x0) [ 2427.253261] Bluetooth: hci1: Frame reassembly failed (-84) [ 2427.278332] FAULT_INJECTION: forcing a failure. [ 2427.278332] name failslab, interval 1, probability 0, space 0, times 0 [ 2427.322108] CPU: 1 PID: 25610 Comm: syz-executor.0 Not tainted 4.19.79 #0 [ 2427.329081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2427.329088] Call Trace: [ 2427.329110] dump_stack+0x172/0x1f0 [ 2427.329133] should_fail.cold+0xa/0x1b [ 2427.329152] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2427.329173] ? lock_downgrade+0x880/0x880 [ 2427.344910] __should_failslab+0x121/0x190 [ 2427.344928] should_failslab+0x9/0x14 [ 2427.349645] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2427.354005] kmem_cache_alloc+0x2ae/0x700 [ 2427.354021] ? lock_downgrade+0x880/0x880 [ 2427.354042] __kernfs_new_node+0xef/0x680 [ 2427.362401] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 2427.362418] ? wait_for_completion+0x440/0x440 [ 2427.362441] ? mutex_unlock+0xd/0x10 [ 2427.362457] ? kernfs_activate+0x192/0x1f0 [ 2427.374947] kernfs_new_node+0x99/0x130 [ 2427.374967] __kernfs_create_file+0x51/0x33b [ 2427.374987] sysfs_add_file_mode_ns+0x222/0x560 [ 2427.375013] internal_create_group+0x383/0xc30 [ 2427.405126] ? remove_files.isra.0+0x190/0x190 [ 2427.405142] ? kernfs_put+0x3c2/0x5d0 [ 2427.413506] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2427.436623] ? kernfs_create_link+0x1d2/0x250 [ 2427.441743] sysfs_create_groups+0x9b/0x141 [ 2427.446079] device_add+0x87e/0x1760 [ 2427.449809] ? get_device_parent.isra.0+0x570/0x570 [ 2427.454842] rfkill_register+0x1bf/0xb50 [ 2427.458919] hci_register_dev+0x385/0x880 [ 2427.463088] hci_uart_tty_ioctl+0x761/0xaf0 [ 2427.467424] tty_ioctl+0x8b5/0x1510 [ 2427.471058] ? hci_uart_init_work+0x140/0x140 [ 2427.475560] ? tty_vhangup+0x30/0x30 [ 2427.479290] ? mark_held_locks+0x100/0x100 [ 2427.483547] ? __fget+0x340/0x540 [ 2427.487015] ? __might_sleep+0x95/0x190 [ 2427.491001] ? tty_vhangup+0x30/0x30 [ 2427.494723] do_vfs_ioctl+0xd5f/0x1380 [ 2427.498617] ? selinux_file_ioctl+0x46f/0x5e0 [ 2427.503115] ? selinux_file_ioctl+0x125/0x5e0 [ 2427.507616] ? ioctl_preallocate+0x210/0x210 [ 2427.512037] ? selinux_file_mprotect+0x620/0x620 [ 2427.516810] ? iterate_fd+0x360/0x360 [ 2427.520621] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2427.526173] ? fput+0x128/0x1a0 [ 2427.529465] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2427.535006] ? security_file_ioctl+0x8d/0xc0 [ 2427.539568] ksys_ioctl+0xab/0xd0 [ 2427.543035] __x64_sys_ioctl+0x73/0xb0 [ 2427.546937] do_syscall_64+0xfd/0x620 [ 2427.550752] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2427.555947] RIP: 0033:0x459a59 03:08:54 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0xf0ffffff00000000}}}, 0xb8}}, 0x0) [ 2427.559147] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2427.578053] RSP: 002b:00007f13ec7e5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2427.585771] RAX: ffffffffffffffda RBX: 00007f13ec7e5c90 RCX: 0000000000459a59 [ 2427.593045] RDX: 0000000000000000 RSI: 00000000400455c8 RDI: 0000000000000004 [ 2427.600320] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2427.607592] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f13ec7e66d4 [ 2427.614878] R13: 00000000004c27a1 R14: 00000000004d61b0 R15: 0000000000000005 03:08:54 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xf6ffffff, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:08:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xe43c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:08:54 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000}}}, 0xb8}}, 0x0) [ 2427.630055] Bluetooth: hci2: Frame reassembly failed (-84) [ 2427.643987] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2427.699996] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2427.735608] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:08:55 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xe4ffffff, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2427.835606] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2429.299090] Bluetooth: hci0: command 0x1003 tx timeout [ 2429.299096] Bluetooth: hci1: command 0x1003 tx timeout [ 2429.300629] Bluetooth: hci1: sending frame failed (-49) [ 2429.304630] Bluetooth: hci0: sending frame failed (-49) [ 2429.698957] Bluetooth: hci2: command 0x1003 tx timeout [ 2429.704344] Bluetooth: hci2: sending frame failed (-49) [ 2431.379012] Bluetooth: hci0: command 0x1001 tx timeout [ 2431.379076] Bluetooth: hci1: command 0x1001 tx timeout [ 2431.384489] Bluetooth: hci0: sending frame failed (-49) [ 2431.398954] Bluetooth: hci1: sending frame failed (-49) [ 2431.779117] Bluetooth: hci2: command 0x1001 tx timeout [ 2431.784530] Bluetooth: hci2: sending frame failed (-49) [ 2433.459008] Bluetooth: hci1: command 0x1009 tx timeout [ 2433.464411] Bluetooth: hci0: command 0x1009 tx timeout [ 2433.859045] Bluetooth: hci2: command 0x1009 tx timeout 03:09:05 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xfcfdffff, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:09:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xe53c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:09:05 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x80045430, 0x0) 03:09:05 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000}}}, 0xb8}}, 0x0) 03:09:05 executing program 0 (fault-call:3 fault-nth:56): perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 03:09:05 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x40045431, 0x0) [ 2438.067304] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2438.084312] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2438.084318] Bluetooth: hci0: Frame reassembly failed (-84) [ 2438.111127] Bluetooth: hci1: Frame reassembly failed (-84) 03:09:05 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffff000}}}, 0xb8}}, 0x0) [ 2438.144510] FAULT_INJECTION: forcing a failure. [ 2438.144510] name failslab, interval 1, probability 0, space 0, times 0 [ 2438.192600] CPU: 1 PID: 25638 Comm: syz-executor.0 Not tainted 4.19.79 #0 [ 2438.199574] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2438.199580] Call Trace: [ 2438.199603] dump_stack+0x172/0x1f0 [ 2438.199626] should_fail.cold+0xa/0x1b [ 2438.199644] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2438.199659] ? lock_downgrade+0x880/0x880 [ 2438.199684] __should_failslab+0x121/0x190 [ 2438.199701] should_failslab+0x9/0x14 [ 2438.199714] kmem_cache_alloc+0x2ae/0x700 [ 2438.199726] ? lock_downgrade+0x880/0x880 [ 2438.199744] ? kasan_check_write+0x14/0x20 [ 2438.199763] __kernfs_new_node+0xef/0x680 [ 2438.199782] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 2438.199800] ? mutex_unlock+0xd/0x10 [ 2438.199813] ? kernfs_activate+0x192/0x1f0 [ 2438.199830] ? kernfs_add_one+0x131/0x4d0 [ 2438.240832] kernfs_new_node+0x99/0x130 [ 2438.240855] kernfs_create_dir_ns+0x52/0x160 [ 2438.281010] internal_create_group+0x1cb/0xc30 [ 2438.285605] ? internal_create_group+0x79a/0xc30 [ 2438.290381] ? remove_files.isra.0+0x190/0x190 [ 2438.294973] ? remove_files.isra.0+0x190/0x190 [ 2438.299911] ? kernfs_put+0x3c2/0x5d0 [ 2438.303726] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2438.309287] ? kernfs_create_link+0x1d2/0x250 [ 2438.313810] sysfs_create_group+0x20/0x30 [ 2438.317965] dpm_sysfs_add+0x26/0x210 [ 2438.317987] device_add+0xa47/0x1760 [ 2438.318012] ? get_device_parent.isra.0+0x570/0x570 [ 2438.318036] rfkill_register+0x1bf/0xb50 [ 2438.334619] hci_register_dev+0x385/0x880 [ 2438.334646] hci_uart_tty_ioctl+0x761/0xaf0 03:09:05 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xfdfdffff, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 2438.334664] tty_ioctl+0x8b5/0x1510 [ 2438.346824] ? hci_uart_init_work+0x140/0x140 [ 2438.351350] ? tty_vhangup+0x30/0x30 [ 2438.355075] ? mark_held_locks+0x100/0x100 [ 2438.359334] ? __fget+0x340/0x540 [ 2438.362802] ? __might_sleep+0x95/0x190 [ 2438.366781] ? tty_vhangup+0x30/0x30 [ 2438.370518] do_vfs_ioctl+0xd5f/0x1380 [ 2438.374419] ? selinux_file_ioctl+0x46f/0x5e0 [ 2438.378929] ? selinux_file_ioctl+0x125/0x5e0 [ 2438.384486] ? ioctl_preallocate+0x210/0x210 [ 2438.388908] ? selinux_file_mprotect+0x620/0x620 [ 2438.393684] ? iterate_fd+0x360/0x360 [ 2438.397509] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2438.403060] ? fput+0x128/0x1a0 [ 2438.406361] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2438.411909] ? security_file_ioctl+0x8d/0xc0 [ 2438.416329] ksys_ioctl+0xab/0xd0 [ 2438.419806] __x64_sys_ioctl+0x73/0xb0 [ 2438.423723] do_syscall_64+0xfd/0x620 [ 2438.427540] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2438.432738] RIP: 0033:0x459a59 [ 2438.435937] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2438.454859] RSP: 002b:00007f13ec7e5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2438.462590] RAX: ffffffffffffffda RBX: 00007f13ec7e5c90 RCX: 0000000000459a59 [ 2438.469878] RDX: 0000000000000000 RSI: 00000000400455c8 RDI: 0000000000000004 [ 2438.477244] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2438.484529] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f13ec7e66d4 03:09:05 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}}, 0xb8}}, 0x0) [ 2438.491807] R13: 00000000004c27a1 R14: 00000000004d61b0 R15: 0000000000000005 [ 2438.511817] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:09:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xe63c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2438.541901] Bluetooth: hci2: Frame reassembly failed (-84) [ 2438.558409] Bluetooth: hci2: Frame reassembly failed (-84) 03:09:05 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xfdffffff, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:09:05 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}}, 0xb8}}, 0x0) [ 2438.585992] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2438.592529] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:09:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xe73c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2438.675667] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2438.717485] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2440.099051] Bluetooth: hci0: command 0x1003 tx timeout [ 2440.104529] Bluetooth: hci0: sending frame failed (-49) [ 2440.178923] Bluetooth: hci1: command 0x1003 tx timeout [ 2440.184320] Bluetooth: hci1: sending frame failed (-49) [ 2440.579093] Bluetooth: hci2: command 0x1003 tx timeout [ 2440.584691] Bluetooth: hci2: sending frame failed (-49) [ 2442.178932] Bluetooth: hci0: command 0x1001 tx timeout [ 2442.186064] Bluetooth: hci0: sending frame failed (-49) [ 2442.259265] Bluetooth: hci1: command 0x1001 tx timeout [ 2442.264661] Bluetooth: hci1: sending frame failed (-49) [ 2442.659052] Bluetooth: hci2: command 0x1001 tx timeout [ 2442.664447] Bluetooth: hci2: sending frame failed (-49) [ 2444.258937] Bluetooth: hci0: command 0x1009 tx timeout [ 2444.339216] Bluetooth: hci1: command 0x1009 tx timeout [ 2444.739093] Bluetooth: hci2: command 0x1009 tx timeout 03:09:16 executing program 0 (fault-call:3 fault-nth:57): perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 03:09:16 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}}}, 0xb8}}, 0x0) 03:09:16 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xfe030000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:09:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xe83c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:09:16 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x40045436, 0x0) 03:09:16 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x80045432, 0x0) [ 2448.949790] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2448.967477] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2448.978181] Bluetooth: hci0: Frame reassembly failed (-84) [ 2448.989915] Bluetooth: hci1: Frame reassembly failed (-84) 03:09:16 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}}}, 0xb8}}, 0x0) [ 2449.018678] FAULT_INJECTION: forcing a failure. [ 2449.018678] name failslab, interval 1, probability 0, space 0, times 0 [ 2449.038815] CPU: 1 PID: 25672 Comm: syz-executor.0 Not tainted 4.19.79 #0 [ 2449.045789] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2449.055162] Call Trace: [ 2449.055186] dump_stack+0x172/0x1f0 [ 2449.055208] should_fail.cold+0xa/0x1b [ 2449.065292] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2449.070409] ? lock_downgrade+0x880/0x880 [ 2449.070434] __should_failslab+0x121/0x190 [ 2449.070451] should_failslab+0x9/0x14 [ 2449.070464] kmem_cache_alloc+0x2ae/0x700 [ 2449.070475] ? lock_downgrade+0x880/0x880 [ 2449.070492] ? kasan_check_write+0x14/0x20 [ 2449.078863] __kernfs_new_node+0xef/0x680 [ 2449.078881] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 2449.078901] ? mutex_unlock+0xd/0x10 [ 2449.078914] ? kernfs_activate+0x192/0x1f0 [ 2449.078932] ? kernfs_add_one+0x131/0x4d0 [ 2449.086865] kernfs_new_node+0x99/0x130 [ 2449.095212] kernfs_create_dir_ns+0x52/0x160 [ 2449.095237] internal_create_group+0x1cb/0xc30 [ 2449.104106] ? internal_create_group+0x79a/0xc30 [ 2449.104129] ? remove_files.isra.0+0x190/0x190 [ 2449.121016] ? remove_files.isra.0+0x190/0x190 [ 2449.129958] ? kernfs_put+0x3c2/0x5d0 [ 2449.129975] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2449.129989] ? kernfs_create_link+0x1d2/0x250 [ 2449.130010] sysfs_create_group+0x20/0x30 [ 2449.157941] dpm_sysfs_add+0x26/0x210 [ 2449.157960] device_add+0xa47/0x1760 [ 2449.169592] ? get_device_parent.isra.0+0x570/0x570 [ 2449.174619] rfkill_register+0x1bf/0xb50 [ 2449.178681] hci_register_dev+0x385/0x880 [ 2449.178706] hci_uart_tty_ioctl+0x761/0xaf0 [ 2449.187317] tty_ioctl+0x8b5/0x1510 [ 2449.190961] ? hci_uart_init_work+0x140/0x140 [ 2449.195491] ? tty_vhangup+0x30/0x30 [ 2449.199201] ? mark_held_locks+0x100/0x100 [ 2449.199228] ? __fget+0x340/0x540 [ 2449.199254] ? __might_sleep+0x95/0x190 [ 2449.210889] ? tty_vhangup+0x30/0x30 [ 2449.214607] do_vfs_ioctl+0xd5f/0x1380 [ 2449.214626] ? selinux_file_ioctl+0x46f/0x5e0 [ 2449.222978] ? selinux_file_ioctl+0x125/0x5e0 [ 2449.227480] ? ioctl_preallocate+0x210/0x210 [ 2449.231890] ? selinux_file_mprotect+0x620/0x620 [ 2449.231913] ? iterate_fd+0x360/0x360 [ 2449.240791] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2449.240806] ? fput+0x128/0x1a0 [ 2449.240827] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2449.240839] ? security_file_ioctl+0x8d/0xc0 [ 2449.240859] ksys_ioctl+0xab/0xd0 [ 2449.263015] __x64_sys_ioctl+0x73/0xb0 [ 2449.266904] do_syscall_64+0xfd/0x620 [ 2449.266925] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2449.275908] RIP: 0033:0x459a59 [ 2449.279114] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2449.298034] RSP: 002b:00007f13ec7e5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2449.305769] RAX: ffffffffffffffda RBX: 00007f13ec7e5c90 RCX: 0000000000459a59 [ 2449.313044] RDX: 0000000000000000 RSI: 00000000400455c8 RDI: 0000000000000004 03:09:16 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xffff1f00, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:09:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xe93c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2449.320326] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2449.327616] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f13ec7e66d4 [ 2449.334899] R13: 00000000004c27a1 R14: 00000000004d61b0 R15: 0000000000000005 03:09:16 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}}, 0xb8}}, 0x0) [ 2449.377444] Bluetooth: hci2: Frame reassembly failed (-84) [ 2449.393942] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:09:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xea3c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:09:16 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xfffffdfc, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 2449.440307] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2449.481281] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2450.979047] Bluetooth: hci0: command 0x1003 tx timeout [ 2450.984494] Bluetooth: hci0: sending frame failed (-49) [ 2451.058910] Bluetooth: hci1: command 0x1003 tx timeout [ 2451.064334] Bluetooth: hci1: sending frame failed (-49) [ 2451.378918] Bluetooth: hci2: command 0x1003 tx timeout [ 2451.385897] Bluetooth: hci2: sending frame failed (-49) [ 2453.058959] Bluetooth: hci0: command 0x1001 tx timeout [ 2453.064480] Bluetooth: hci0: sending frame failed (-49) [ 2453.138940] Bluetooth: hci1: command 0x1001 tx timeout [ 2453.144342] Bluetooth: hci1: sending frame failed (-49) [ 2453.458937] Bluetooth: hci2: command 0x1001 tx timeout [ 2453.464382] Bluetooth: hci2: sending frame failed (-49) [ 2455.138962] Bluetooth: hci0: command 0x1009 tx timeout [ 2455.218963] Bluetooth: hci1: command 0x1009 tx timeout [ 2455.538951] Bluetooth: hci2: command 0x1009 tx timeout 03:09:27 executing program 0 (fault-call:3 fault-nth:58): perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 03:09:27 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}}}, 0xb8}}, 0x0) 03:09:27 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xeb3c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:09:27 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xfffffdfd, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:09:27 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x80045438, 0x0) 03:09:27 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455c8, 0x0) [ 2459.817590] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2459.847890] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2459.858138] Bluetooth: hci1: Frame reassembly failed (-84) 03:09:27 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 2459.874892] Bluetooth: hci0: Frame reassembly failed (-84) [ 2459.919596] FAULT_INJECTION: forcing a failure. [ 2459.919596] name failslab, interval 1, probability 0, space 0, times 0 [ 2459.945010] CPU: 0 PID: 25703 Comm: syz-executor.0 Not tainted 4.19.79 #0 [ 2459.952115] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2459.961969] Call Trace: [ 2459.964769] dump_stack+0x172/0x1f0 [ 2459.968671] should_fail.cold+0xa/0x1b [ 2459.972704] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2459.978253] ? lock_downgrade+0x880/0x880 [ 2459.982667] __should_failslab+0x121/0x190 [ 2459.987815] should_failslab+0x9/0x14 [ 2459.991651] kmem_cache_alloc+0x2ae/0x700 [ 2459.995896] __kernfs_new_node+0xef/0x680 [ 2459.995922] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 2460.005558] ? lock_downgrade+0x880/0x880 [ 2460.005582] ? mutex_trylock+0x1e0/0x1e0 [ 2460.005609] kernfs_new_node+0x99/0x130 [ 2460.018240] __kernfs_create_file+0x51/0x33b [ 2460.022785] sysfs_add_file_mode_ns+0x222/0x560 [ 2460.027510] sysfs_merge_group+0x1a0/0x340 [ 2460.031783] ? sysfs_mount+0x1e0/0x1e0 [ 2460.035933] ? kernfs_put+0x3c2/0x5d0 [ 2460.039791] dpm_sysfs_add+0x164/0x210 [ 2460.043728] device_add+0xa47/0x1760 [ 2460.047490] ? get_device_parent.isra.0+0x570/0x570 [ 2460.052558] rfkill_register+0x1bf/0xb50 [ 2460.056666] hci_register_dev+0x385/0x880 [ 2460.061161] hci_uart_tty_ioctl+0x761/0xaf0 [ 2460.065614] tty_ioctl+0x8b5/0x1510 [ 2460.069277] ? hci_uart_init_work+0x140/0x140 [ 2460.073969] ? tty_vhangup+0x30/0x30 [ 2460.077711] ? mark_held_locks+0x100/0x100 [ 2460.082005] ? __fget+0x340/0x540 [ 2460.085505] ? __might_sleep+0x95/0x190 [ 2460.089544] ? tty_vhangup+0x30/0x30 [ 2460.093458] do_vfs_ioctl+0xd5f/0x1380 [ 2460.097518] ? selinux_file_ioctl+0x46f/0x5e0 [ 2460.102123] ? selinux_file_ioctl+0x125/0x5e0 [ 2460.106700] ? ioctl_preallocate+0x210/0x210 [ 2460.111226] ? selinux_file_mprotect+0x620/0x620 [ 2460.116207] ? iterate_fd+0x360/0x360 [ 2460.120037] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2460.125852] ? fput+0x128/0x1a0 [ 2460.129285] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2460.134849] ? security_file_ioctl+0x8d/0xc0 [ 2460.139297] ksys_ioctl+0xab/0xd0 [ 2460.142901] __x64_sys_ioctl+0x73/0xb0 [ 2460.146829] do_syscall_64+0xfd/0x620 [ 2460.150706] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2460.155923] RIP: 0033:0x459a59 [ 2460.159244] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2460.178680] RSP: 002b:00007f13ec7e5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2460.186617] RAX: ffffffffffffffda RBX: 00007f13ec7e5c90 RCX: 0000000000459a59 [ 2460.194116] RDX: 0000000000000000 RSI: 00000000400455c8 RDI: 0000000000000004 [ 2460.201508] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2460.209142] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f13ec7e66d4 03:09:27 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xec3c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:09:27 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xffffff7f, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 2460.216441] R13: 00000000004c27a1 R14: 00000000004d61b0 R15: 0000000000000005 [ 2460.239265] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2460.261603] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:09:27 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}}}, 0xb8}}, 0x0) 03:09:27 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xffffff8c, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 2460.299875] Bluetooth: hci2: Frame reassembly failed (-84) 03:09:27 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xed3c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2460.353496] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2460.416595] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2461.859091] Bluetooth: hci1: command 0x1003 tx timeout [ 2461.866487] Bluetooth: hci1: sending frame failed (-49) [ 2461.938958] Bluetooth: hci0: command 0x1003 tx timeout [ 2461.944453] Bluetooth: hci0: sending frame failed (-49) [ 2462.339182] Bluetooth: hci2: command 0x1003 tx timeout [ 2462.346213] Bluetooth: hci2: sending frame failed (-49) [ 2463.938927] Bluetooth: hci1: command 0x1001 tx timeout [ 2463.944324] Bluetooth: hci1: sending frame failed (-49) [ 2464.018963] Bluetooth: hci0: command 0x1001 tx timeout [ 2464.024350] Bluetooth: hci0: sending frame failed (-49) [ 2464.418915] Bluetooth: hci2: command 0x1001 tx timeout [ 2464.424323] Bluetooth: hci2: sending frame failed (-49) [ 2466.019032] Bluetooth: hci1: command 0x1009 tx timeout [ 2466.098950] Bluetooth: hci0: command 0x1009 tx timeout [ 2466.499046] Bluetooth: hci2: command 0x1009 tx timeout 03:09:37 executing program 0 (fault-call:3 fault-nth:59): perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 03:09:37 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf}}}, 0xb8}}, 0x0) 03:09:37 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xffffff97, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:09:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xee3c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:09:37 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x40049409, 0x0) 03:09:37 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x80045439, 0x0) [ 2470.715550] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2470.726677] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2470.738657] Bluetooth: hci1: Frame reassembly failed (-84) [ 2470.747356] Bluetooth: hci0: Frame reassembly failed (-84) [ 2470.753342] Bluetooth: hci0: Frame reassembly failed (-84) 03:09:38 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48}}}, 0xb8}}, 0x0) 03:09:38 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xfffffff6, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:09:38 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xef030000, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2470.829773] FAULT_INJECTION: forcing a failure. [ 2470.829773] name failslab, interval 1, probability 0, space 0, times 0 [ 2470.848186] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2470.874589] CPU: 1 PID: 25733 Comm: syz-executor.0 Not tainted 4.19.79 #0 [ 2470.881577] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2470.890995] Call Trace: [ 2470.893616] dump_stack+0x172/0x1f0 [ 2470.897266] should_fail.cold+0xa/0x1b [ 2470.901177] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2470.906299] ? lock_downgrade+0x880/0x880 [ 2470.910481] __should_failslab+0x121/0x190 [ 2470.914732] should_failslab+0x9/0x14 [ 2470.918545] kmem_cache_alloc+0x2ae/0x700 [ 2470.922706] ? lock_downgrade+0x880/0x880 [ 2470.926888] ? kasan_check_write+0x14/0x20 [ 2470.931151] __kernfs_new_node+0xef/0x680 [ 2470.935321] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 2470.940201] ? mutex_unlock+0xd/0x10 [ 2470.943924] ? kernfs_activate+0x192/0x1f0 [ 2470.948174] ? kernfs_add_one+0x131/0x4d0 [ 2470.952353] kernfs_new_node+0x99/0x130 [ 2470.956449] kernfs_create_dir_ns+0x52/0x160 [ 2470.960875] internal_create_group+0x1cb/0xc30 [ 2470.965566] ? internal_create_group+0x79a/0xc30 [ 2470.970346] ? remove_files.isra.0+0x190/0x190 [ 2470.975808] ? remove_files.isra.0+0x190/0x190 [ 2470.980398] ? kernfs_put+0x3c2/0x5d0 [ 2470.984211] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2470.989756] ? kernfs_create_link+0x1d2/0x250 [ 2470.994292] sysfs_create_group+0x20/0x30 [ 2470.998460] dpm_sysfs_add+0x26/0x210 [ 2471.002282] device_add+0xa47/0x1760 [ 2471.006018] ? get_device_parent.isra.0+0x570/0x570 [ 2471.011058] rfkill_register+0x1bf/0xb50 [ 2471.015225] hci_register_dev+0x385/0x880 [ 2471.019392] hci_uart_tty_ioctl+0x761/0xaf0 [ 2471.023729] tty_ioctl+0x8b5/0x1510 [ 2471.027368] ? hci_uart_init_work+0x140/0x140 [ 2471.031871] ? tty_vhangup+0x30/0x30 [ 2471.035589] ? mark_held_locks+0x100/0x100 [ 2471.039845] ? __fget+0x340/0x540 [ 2471.043317] ? __might_sleep+0x95/0x190 [ 2471.047300] ? tty_vhangup+0x30/0x30 [ 2471.051029] do_vfs_ioctl+0xd5f/0x1380 [ 2471.054929] ? selinux_file_ioctl+0x46f/0x5e0 [ 2471.059436] ? selinux_file_ioctl+0x125/0x5e0 [ 2471.063940] ? ioctl_preallocate+0x210/0x210 [ 2471.068360] ? selinux_file_mprotect+0x620/0x620 [ 2471.073144] ? iterate_fd+0x360/0x360 [ 2471.076961] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2471.082531] ? fput+0x128/0x1a0 [ 2471.085830] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2471.091379] ? security_file_ioctl+0x8d/0xc0 [ 2471.095805] ksys_ioctl+0xab/0xd0 [ 2471.099273] __x64_sys_ioctl+0x73/0xb0 [ 2471.103170] do_syscall_64+0xfd/0x620 [ 2471.106988] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2471.112180] RIP: 0033:0x459a59 03:09:38 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c}}}, 0xb8}}, 0x0) [ 2471.115382] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2471.134299] RSP: 002b:00007f13ec7e5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2471.142114] RAX: ffffffffffffffda RBX: 00007f13ec7e5c90 RCX: 0000000000459a59 [ 2471.149406] RDX: 0000000000000000 RSI: 00000000400455c8 RDI: 0000000000000004 [ 2471.149415] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2471.149423] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f13ec7e66d4 [ 2471.149431] R13: 00000000004c27a1 R14: 00000000004d61b0 R15: 0000000000000005 03:09:38 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xef3c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2471.182944] Bluetooth: hci2: Frame reassembly failed (-84) [ 2471.219898] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:09:38 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60}}}, 0xb8}}, 0x0) [ 2471.239789] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2471.312898] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2472.748940] Bluetooth: hci1: command 0x1003 tx timeout [ 2472.754345] Bluetooth: hci1: sending frame failed (-49) [ 2472.828918] Bluetooth: hci0: command 0x1003 tx timeout [ 2472.834329] Bluetooth: hci0: sending frame failed (-49) [ 2473.218981] Bluetooth: hci2: command 0x1003 tx timeout [ 2473.224523] Bluetooth: hci2: sending frame failed (-49) [ 2474.819083] Bluetooth: hci1: command 0x1001 tx timeout [ 2474.824589] Bluetooth: hci1: sending frame failed (-49) [ 2474.899097] Bluetooth: hci0: command 0x1001 tx timeout [ 2474.904559] Bluetooth: hci0: sending frame failed (-49) [ 2475.298969] Bluetooth: hci2: command 0x1001 tx timeout [ 2475.304378] Bluetooth: hci2: sending frame failed (-49) [ 2476.898938] Bluetooth: hci1: command 0x1009 tx timeout [ 2476.978914] Bluetooth: hci0: command 0x1009 tx timeout [ 2477.378912] Bluetooth: hci2: command 0x1009 tx timeout 03:09:48 executing program 0 (fault-call:3 fault-nth:60): perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 03:09:48 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xfffffffd, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:09:48 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xf0030000, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:09:48 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68}}}, 0xb8}}, 0x0) 03:09:48 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x80045440, 0x0) 03:09:48 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x40086602, 0x0) [ 2481.575298] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2481.594221] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2481.630960] FAULT_INJECTION: forcing a failure. [ 2481.630960] name failslab, interval 1, probability 0, space 0, times 0 [ 2481.642899] CPU: 1 PID: 25760 Comm: syz-executor.0 Not tainted 4.19.79 #0 [ 2481.649848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2481.659986] Call Trace: [ 2481.662593] dump_stack+0x172/0x1f0 [ 2481.666242] should_fail.cold+0xa/0x1b [ 2481.670148] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2481.676138] ? lock_downgrade+0x880/0x880 [ 2481.680318] __should_failslab+0x121/0x190 [ 2481.684572] should_failslab+0x9/0x14 [ 2481.688390] kmem_cache_alloc+0x2ae/0x700 [ 2481.692559] ? lock_downgrade+0x880/0x880 [ 2481.696722] ? kasan_check_read+0x11/0x20 [ 2481.700887] __kernfs_new_node+0xef/0x680 [ 2481.705507] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 2481.710282] ? wait_for_completion+0x440/0x440 [ 2481.714910] ? mutex_unlock+0xd/0x10 [ 2481.718639] ? kernfs_activate+0x192/0x1f0 [ 2481.722890] kernfs_new_node+0x99/0x130 [ 2481.726886] __kernfs_create_file+0x51/0x33b [ 2481.731314] sysfs_add_file_mode_ns+0x222/0x560 [ 2481.736007] sysfs_merge_group+0x1a0/0x340 [ 2481.740393] ? sysfs_mount+0x1e0/0x1e0 [ 2481.744297] ? kernfs_put+0x3c2/0x5d0 [ 2481.748133] dpm_sysfs_add+0x164/0x210 [ 2481.752047] device_add+0xa47/0x1760 [ 2481.755784] ? get_device_parent.isra.0+0x570/0x570 [ 2481.760830] rfkill_register+0x1bf/0xb50 [ 2481.764915] hci_register_dev+0x385/0x880 [ 2481.769087] hci_uart_tty_ioctl+0x761/0xaf0 [ 2481.773420] tty_ioctl+0x8b5/0x1510 [ 2481.777065] ? hci_uart_init_work+0x140/0x140 [ 2481.781569] ? tty_vhangup+0x30/0x30 [ 2481.785303] ? mark_held_locks+0x100/0x100 [ 2481.789556] ? __fget+0x340/0x540 [ 2481.793024] ? __might_sleep+0x95/0x190 [ 2481.797010] ? tty_vhangup+0x30/0x30 [ 2481.800735] do_vfs_ioctl+0xd5f/0x1380 [ 2481.804631] ? selinux_file_ioctl+0x46f/0x5e0 [ 2481.809135] ? selinux_file_ioctl+0x125/0x5e0 [ 2481.813640] ? ioctl_preallocate+0x210/0x210 [ 2481.818054] ? selinux_file_mprotect+0x620/0x620 [ 2481.822835] ? iterate_fd+0x360/0x360 [ 2481.826653] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2481.832203] ? fput+0x128/0x1a0 [ 2481.835501] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2481.841044] ? security_file_ioctl+0x8d/0xc0 [ 2481.845461] ksys_ioctl+0xab/0xd0 [ 2481.848935] __x64_sys_ioctl+0x73/0xb0 [ 2481.852833] do_syscall_64+0xfd/0x620 [ 2481.856646] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2481.861843] RIP: 0033:0x459a59 03:09:49 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c}}}, 0xb8}}, 0x0) 03:09:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xf03c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2481.865045] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2481.884658] RSP: 002b:00007f13ec7e5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2481.892388] RAX: ffffffffffffffda RBX: 00007f13ec7e5c90 RCX: 0000000000459a59 [ 2481.899808] RDX: 0000000000000000 RSI: 00000000400455c8 RDI: 0000000000000004 [ 2481.907876] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2481.915343] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f13ec7e66d4 [ 2481.922674] R13: 00000000004c27a1 R14: 00000000004d61b0 R15: 0000000000000005 [ 2481.955005] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2481.969019] Bluetooth: hci2: Frame reassembly failed (-84) 03:09:49 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x1000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:09:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xf0ffffff, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:09:49 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74}}}, 0xb8}}, 0x0) [ 2481.998170] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2482.077888] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2482.090463] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:09:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xf13c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2482.190364] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2483.619115] Bluetooth: hci1: command 0x1003 tx timeout [ 2483.624602] Bluetooth: hci0: command 0x1003 tx timeout [ 2483.624645] Bluetooth: hci1: sending frame failed (-49) [ 2483.638970] Bluetooth: hci0: sending frame failed (-49) [ 2484.018925] Bluetooth: hci2: command 0x1003 tx timeout [ 2484.025853] Bluetooth: hci2: sending frame failed (-49) [ 2485.698925] Bluetooth: hci0: command 0x1001 tx timeout [ 2485.704342] Bluetooth: hci0: sending frame failed (-49) [ 2485.710200] Bluetooth: hci1: command 0x1001 tx timeout [ 2485.716353] Bluetooth: hci1: sending frame failed (-49) [ 2486.098922] Bluetooth: hci2: command 0x1001 tx timeout [ 2486.104328] Bluetooth: hci2: sending frame failed (-49) [ 2487.778990] Bluetooth: hci1: command 0x1009 tx timeout [ 2487.784399] Bluetooth: hci0: command 0x1009 tx timeout [ 2488.179195] Bluetooth: hci2: command 0x1009 tx timeout 03:09:59 executing program 0 (fault-call:3 fault-nth:61): perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 03:09:59 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xedc000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:09:59 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a}}}, 0xb8}}, 0x0) 03:09:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xf23c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:09:59 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455c9, 0x0) 03:09:59 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x40087602, 0x0) [ 2492.484243] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2492.493872] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:09:59 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88}}}, 0xb8}}, 0x0) [ 2492.530968] Bluetooth: hci1: Frame reassembly failed (-84) [ 2492.538666] Bluetooth: hci0: Frame reassembly failed (-84) 03:09:59 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x4000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:09:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xf33c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2492.582657] FAULT_INJECTION: forcing a failure. [ 2492.582657] name failslab, interval 1, probability 0, space 0, times 0 [ 2492.619212] CPU: 0 PID: 25790 Comm: syz-executor.0 Not tainted 4.19.79 #0 [ 2492.626315] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2492.635697] Call Trace: [ 2492.638324] dump_stack+0x172/0x1f0 [ 2492.642003] should_fail.cold+0xa/0x1b [ 2492.645940] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2492.651074] ? lock_downgrade+0x880/0x880 [ 2492.655271] __should_failslab+0x121/0x190 [ 2492.657468] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2492.659532] should_failslab+0x9/0x14 [ 2492.659553] kmem_cache_alloc+0x2ae/0x700 [ 2492.659575] ? lock_downgrade+0x880/0x880 [ 2492.659604] __kernfs_new_node+0xef/0x680 [ 2492.659627] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 2492.675028] ? wait_for_completion+0x440/0x440 [ 2492.675068] ? mutex_unlock+0xd/0x10 [ 2492.675089] ? kernfs_activate+0x192/0x1f0 [ 2492.683500] kernfs_new_node+0x99/0x130 [ 2492.683531] __kernfs_create_file+0x51/0x33b [ 2492.683558] sysfs_add_file_mode_ns+0x222/0x560 [ 2492.683592] internal_create_group+0x383/0xc30 [ 2492.692943] ? remove_files.isra.0+0x190/0x190 [ 2492.692960] ? kernfs_put+0x3c2/0x5d0 [ 2492.692982] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2492.693000] ? kernfs_create_link+0x1d2/0x250 [ 2492.693046] sysfs_create_groups+0x9b/0x141 [ 2492.700997] device_add+0x87e/0x1760 [ 2492.701039] ? get_device_parent.isra.0+0x570/0x570 [ 2492.701076] rfkill_register+0x1bf/0xb50 [ 2492.701102] hci_register_dev+0x385/0x880 [ 2492.709491] hci_uart_tty_ioctl+0x761/0xaf0 [ 2492.709636] tty_ioctl+0x8b5/0x1510 [ 2492.709665] ? hci_uart_init_work+0x140/0x140 [ 2492.718951] ? tty_vhangup+0x30/0x30 [ 2492.718968] ? mark_held_locks+0x100/0x100 [ 2492.719010] ? __fget+0x340/0x540 [ 2492.719044] ? __might_sleep+0x95/0x190 [ 2492.719061] ? tty_vhangup+0x30/0x30 [ 2492.719088] do_vfs_ioctl+0xd5f/0x1380 [ 2492.727505] ? selinux_file_ioctl+0x46f/0x5e0 [ 2492.727523] ? selinux_file_ioctl+0x125/0x5e0 [ 2492.727546] ? ioctl_preallocate+0x210/0x210 [ 2492.727564] ? selinux_file_mprotect+0x620/0x620 [ 2492.727597] ? iterate_fd+0x360/0x360 [ 2492.727616] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2492.737638] ? fput+0x128/0x1a0 03:10:00 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0}}}, 0xb8}}, 0x0) [ 2492.737673] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2492.737691] ? security_file_ioctl+0x8d/0xc0 [ 2492.737717] ksys_ioctl+0xab/0xd0 [ 2492.737741] __x64_sys_ioctl+0x73/0xb0 [ 2492.745758] do_syscall_64+0xfd/0x620 [ 2492.745787] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2492.745803] RIP: 0033:0x459a59 [ 2492.745822] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2492.745831] RSP: 002b:00007f13ec7e5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2492.754895] RAX: ffffffffffffffda RBX: 00007f13ec7e5c90 RCX: 0000000000459a59 [ 2492.754906] RDX: 0000000000000000 RSI: 00000000400455c8 RDI: 0000000000000004 [ 2492.754917] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2492.754928] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f13ec7e66d4 [ 2492.754939] R13: 00000000004c27a1 R14: 00000000004d61b0 R15: 0000000000000005 [ 2492.755581] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:10:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xf43c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:10:00 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x6b6b6b00000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 2492.900476] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2492.943457] Bluetooth: hci2: Frame reassembly failed (-84) [ 2493.017162] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2494.588918] Bluetooth: hci0: command 0x1003 tx timeout [ 2494.594379] Bluetooth: hci1: command 0x1003 tx timeout [ 2494.594412] Bluetooth: hci0: sending frame failed (-49) [ 2494.600107] Bluetooth: hci1: sending frame failed (-49) [ 2494.978928] Bluetooth: hci2: command 0x1003 tx timeout [ 2494.984675] Bluetooth: hci2: sending frame failed (-49) [ 2496.659039] Bluetooth: hci0: command 0x1001 tx timeout [ 2496.664429] Bluetooth: hci0: sending frame failed (-49) [ 2496.669907] Bluetooth: hci1: command 0x1001 tx timeout [ 2496.675259] Bluetooth: hci1: sending frame failed (-49) [ 2497.058917] Bluetooth: hci2: command 0x1001 tx timeout [ 2497.064340] Bluetooth: hci2: sending frame failed (-49) [ 2498.739107] Bluetooth: hci1: command 0x1009 tx timeout [ 2498.744506] Bluetooth: hci0: command 0x1009 tx timeout [ 2499.138922] Bluetooth: hci2: command 0x1009 tx timeout 03:10:10 executing program 0 (fault-call:3 fault-nth:62): perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 03:10:10 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300}}}, 0xb8}}, 0x0) 03:10:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xf53c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:10:10 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x100000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:10:10 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x4020940d, 0x0) 03:10:10 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455cc, 0x0) [ 2503.349070] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2503.357903] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2503.375157] Bluetooth: hci1: Frame reassembly failed (-84) [ 2503.381426] Bluetooth: hci0: Frame reassembly failed (-84) [ 2503.387189] Bluetooth: hci1: Frame reassembly failed (-84) 03:10:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xf63c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2503.429754] FAULT_INJECTION: forcing a failure. [ 2503.429754] name failslab, interval 1, probability 0, space 0, times 0 03:10:10 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x200000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 2503.474943] CPU: 1 PID: 25820 Comm: syz-executor.0 Not tainted 4.19.79 #0 [ 2503.481921] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2503.491291] Call Trace: [ 2503.493909] dump_stack+0x172/0x1f0 [ 2503.497579] should_fail.cold+0xa/0x1b [ 2503.497600] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2503.506579] ? lock_downgrade+0x880/0x880 [ 2503.510745] __should_failslab+0x121/0x190 [ 2503.510768] should_failslab+0x9/0x14 [ 2503.510783] kmem_cache_alloc+0x2ae/0x700 03:10:10 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500}}}, 0xb8}}, 0x0) [ 2503.510796] ? lock_downgrade+0x880/0x880 [ 2503.510813] ? kasan_check_read+0x11/0x20 [ 2503.531182] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2503.531289] __kernfs_new_node+0xef/0x680 [ 2503.542873] ? kernfs_dop_revalidate+0x3c0/0x3c0 [ 2503.547739] ? wait_for_completion+0x440/0x440 [ 2503.552352] ? mutex_unlock+0xd/0x10 [ 2503.556078] ? kernfs_activate+0x192/0x1f0 [ 2503.560331] kernfs_new_node+0x99/0x130 [ 2503.564330] __kernfs_create_file+0x51/0x33b [ 2503.568762] sysfs_add_file_mode_ns+0x222/0x560 [ 2503.573456] sysfs_merge_group+0x1a0/0x340 [ 2503.577698] ? sysfs_mount+0x1e0/0x1e0 [ 2503.577713] ? kernfs_put+0x3c2/0x5d0 [ 2503.577740] dpm_sysfs_add+0x164/0x210 [ 2503.585417] device_add+0xa47/0x1760 [ 2503.585441] ? get_device_parent.isra.0+0x570/0x570 [ 2503.585465] rfkill_register+0x1bf/0xb50 [ 2503.598749] hci_register_dev+0x385/0x880 [ 2503.598776] hci_uart_tty_ioctl+0x761/0xaf0 [ 2503.611269] tty_ioctl+0x8b5/0x1510 [ 2503.614896] ? hci_uart_init_work+0x140/0x140 [ 2503.614913] ? tty_vhangup+0x30/0x30 03:10:10 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600}}}, 0xb8}}, 0x0) [ 2503.614925] ? mark_held_locks+0x100/0x100 [ 2503.614949] ? __fget+0x340/0x540 [ 2503.621013] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2503.623133] ? __might_sleep+0x95/0x190 [ 2503.623148] ? tty_vhangup+0x30/0x30 [ 2503.623167] do_vfs_ioctl+0xd5f/0x1380 [ 2503.647317] ? selinux_file_ioctl+0x46f/0x5e0 [ 2503.647331] ? selinux_file_ioctl+0x125/0x5e0 [ 2503.647349] ? ioctl_preallocate+0x210/0x210 [ 2503.647365] ? selinux_file_mprotect+0x620/0x620 [ 2503.669388] ? iterate_fd+0x360/0x360 [ 2503.669406] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2503.678810] ? fput+0x128/0x1a0 [ 2503.682103] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2503.687655] ? security_file_ioctl+0x8d/0xc0 [ 2503.687683] ksys_ioctl+0xab/0xd0 [ 2503.687703] __x64_sys_ioctl+0x73/0xb0 [ 2503.699430] do_syscall_64+0xfd/0x620 [ 2503.703248] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2503.708450] RIP: 0033:0x459a59 [ 2503.711658] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2503.712837] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2503.730657] RSP: 002b:00007f13ec7e5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2503.730673] RAX: ffffffffffffffda RBX: 00007f13ec7e5c90 RCX: 0000000000459a59 [ 2503.730680] RDX: 0000000000000000 RSI: 00000000400455c8 RDI: 0000000000000004 [ 2503.730688] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 03:10:11 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x300000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 2503.730696] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f13ec7e66d4 [ 2503.730704] R13: 00000000004c27a1 R14: 00000000004d61b0 R15: 0000000000000005 [ 2503.799517] Bluetooth: hci2: Frame reassembly failed (-84) 03:10:11 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700}}}, 0xb8}}, 0x0) [ 2503.900723] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2505.378981] Bluetooth: hci1: command 0x1003 tx timeout [ 2505.384423] Bluetooth: hci1: sending frame failed (-49) [ 2505.458927] Bluetooth: hci0: command 0x1003 tx timeout [ 2505.464470] Bluetooth: hci0: sending frame failed (-49) [ 2505.859254] Bluetooth: hci2: command 0x1003 tx timeout [ 2505.864821] Bluetooth: hci2: sending frame failed (-49) [ 2507.458918] Bluetooth: hci1: command 0x1001 tx timeout [ 2507.464334] Bluetooth: hci1: sending frame failed (-49) [ 2507.538954] Bluetooth: hci0: command 0x1001 tx timeout [ 2507.544391] Bluetooth: hci0: sending frame failed (-49) [ 2507.939193] Bluetooth: hci2: command 0x1001 tx timeout [ 2507.944594] Bluetooth: hci2: sending frame failed (-49) [ 2509.538914] Bluetooth: hci1: command 0x1009 tx timeout [ 2509.618919] Bluetooth: hci0: command 0x1009 tx timeout [ 2510.019403] Bluetooth: hci2: command 0x1009 tx timeout 03:10:21 executing program 0 (fault-call:3 fault-nth:63): perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 03:10:21 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xf73c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:10:21 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00}}}, 0xb8}}, 0x0) 03:10:21 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x400000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:10:21 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x80045430, 0x0) 03:10:21 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x80086601, 0x0) [ 2514.228599] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2514.238153] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2514.251276] Bluetooth: hci0: Frame reassembly failed (-84) [ 2514.257044] Bluetooth: hci1: Frame reassembly failed (-84) 03:10:21 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x500000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:10:21 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00}}}, 0xb8}}, 0x0) 03:10:21 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xf8030000, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2514.351072] FAULT_INJECTION: forcing a failure. [ 2514.351072] name failslab, interval 1, probability 0, space 0, times 0 [ 2514.390110] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2514.390168] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2514.418968] CPU: 0 PID: 25852 Comm: syz-executor.0 Not tainted 4.19.79 #0 [ 2514.425948] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2514.435323] Call Trace: [ 2514.437940] dump_stack+0x172/0x1f0 [ 2514.441633] should_fail.cold+0xa/0x1b [ 2514.445546] ? fault_create_debugfs_attr+0x1e0/0x1e0 03:10:21 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00}}}, 0xb8}}, 0x0) [ 2514.450660] ? lock_downgrade+0x880/0x880 [ 2514.450693] __should_failslab+0x121/0x190 [ 2514.450715] should_failslab+0x9/0x14 [ 2514.450728] __kmalloc+0x2e2/0x750 [ 2514.450750] ? rcu_read_lock_sched_held+0x110/0x130 [ 2514.471843] ? kobject_get_path+0xc4/0x1b0 [ 2514.476105] kobject_get_path+0xc4/0x1b0 [ 2514.480207] kobject_uevent_env+0x3ab/0x101d [ 2514.484663] kobject_uevent+0x20/0x26 [ 2514.488491] device_add+0xb3a/0x1760 [ 2514.492250] ? get_device_parent.isra.0+0x570/0x570 [ 2514.497307] rfkill_register+0x1bf/0xb50 [ 2514.501390] hci_register_dev+0x385/0x880 [ 2514.501425] hci_uart_tty_ioctl+0x761/0xaf0 [ 2514.509892] tty_ioctl+0x8b5/0x1510 [ 2514.513540] ? hci_uart_init_work+0x140/0x140 [ 2514.518069] ? tty_vhangup+0x30/0x30 [ 2514.521802] ? mark_held_locks+0x100/0x100 [ 2514.526070] ? __fget+0x340/0x540 [ 2514.526106] ? __might_sleep+0x95/0x190 [ 2514.526131] ? tty_vhangup+0x30/0x30 [ 2514.537277] do_vfs_ioctl+0xd5f/0x1380 [ 2514.541189] ? selinux_file_ioctl+0x46f/0x5e0 [ 2514.545705] ? selinux_file_ioctl+0x125/0x5e0 [ 2514.550335] ? ioctl_preallocate+0x210/0x210 [ 2514.554845] ? selinux_file_mprotect+0x620/0x620 [ 2514.554882] ? iterate_fd+0x360/0x360 [ 2514.554903] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2514.554921] ? fput+0x128/0x1a0 [ 2514.554948] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2514.577867] ? security_file_ioctl+0x8d/0xc0 [ 2514.582304] ksys_ioctl+0xab/0xd0 [ 2514.585791] __x64_sys_ioctl+0x73/0xb0 [ 2514.585818] do_syscall_64+0xfd/0x620 [ 2514.585846] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2514.598723] RIP: 0033:0x459a59 [ 2514.602032] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2514.621557] RSP: 002b:00007f13ec7e5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2514.621578] RAX: ffffffffffffffda RBX: 00007f13ec7e5c90 RCX: 0000000000459a59 [ 2514.621589] RDX: 0000000000000000 RSI: 00000000400455c8 RDI: 0000000000000004 [ 2514.621600] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2514.621611] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f13ec7e66d4 [ 2514.621621] R13: 00000000004c27a1 R14: 00000000004d61b0 R15: 0000000000000005 [ 2514.667542] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:10:22 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000}}}, 0xb8}}, 0x0) 03:10:22 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x600000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 2514.854161] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2515.013159] Bluetooth: hci2: Frame reassembly failed (-84) [ 2515.023723] Bluetooth: hci2: Frame reassembly failed (-84) [ 2516.259226] Bluetooth: hci1: command 0x1003 tx timeout [ 2516.266206] Bluetooth: hci1: sending frame failed (-49) [ 2516.271800] Bluetooth: hci0: command 0x1003 tx timeout [ 2516.282941] Bluetooth: hci0: sending frame failed (-49) [ 2517.058904] Bluetooth: hci2: command 0x1003 tx timeout [ 2517.064450] Bluetooth: hci2: sending frame failed (-49) [ 2518.339165] Bluetooth: hci0: command 0x1001 tx timeout [ 2518.344583] Bluetooth: hci0: sending frame failed (-49) [ 2518.350240] Bluetooth: hci1: command 0x1001 tx timeout [ 2518.355586] Bluetooth: hci1: sending frame failed (-49) [ 2519.138940] Bluetooth: hci2: command 0x1001 tx timeout [ 2519.144345] Bluetooth: hci2: sending frame failed (-49) [ 2520.419159] Bluetooth: hci1: command 0x1009 tx timeout [ 2520.424547] Bluetooth: hci0: command 0x1009 tx timeout [ 2521.218911] Bluetooth: hci2: command 0x1009 tx timeout 03:10:32 executing program 0 (fault-call:3 fault-nth:64): perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 03:10:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xf83c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:10:32 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}}}, 0xb8}}, 0x0) 03:10:32 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x700000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:10:32 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x80087601, 0x0) 03:10:32 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x80045432, 0x0) [ 2525.107999] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2525.127888] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2525.141602] Bluetooth: hci0: Frame reassembly failed (-84) [ 2525.147372] Bluetooth: hci1: Frame reassembly failed (-84) 03:10:32 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4800}}}, 0xb8}}, 0x0) [ 2525.186103] FAULT_INJECTION: forcing a failure. [ 2525.186103] name failslab, interval 1, probability 0, space 0, times 0 [ 2525.208985] CPU: 0 PID: 25881 Comm: syz-executor.0 Not tainted 4.19.79 #0 [ 2525.215979] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2525.225360] Call Trace: [ 2525.227977] dump_stack+0x172/0x1f0 [ 2525.231644] should_fail.cold+0xa/0x1b [ 2525.235561] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2525.240688] ? lock_downgrade+0x880/0x880 [ 2525.244886] __should_failslab+0x121/0x190 [ 2525.249149] should_failslab+0x9/0x14 [ 2525.252968] kmem_cache_alloc_node_trace+0x274/0x720 [ 2525.258121] ? __alloc_skb+0xd5/0x5f0 [ 2525.261967] __kmalloc_node_track_caller+0x3d/0x80 [ 2525.266919] __kmalloc_reserve.isra.0+0x40/0xf0 [ 2525.271615] __alloc_skb+0x10b/0x5f0 [ 2525.275352] ? skb_scrub_packet+0x490/0x490 [ 2525.279705] ? kasan_check_read+0x11/0x20 [ 2525.284582] alloc_uevent_skb+0x83/0x1e2 [ 2525.288670] kobject_uevent_env+0xaa3/0x101d [ 2525.293124] kobject_uevent+0x20/0x26 [ 2525.296949] device_add+0xb3a/0x1760 [ 2525.300701] ? get_device_parent.isra.0+0x570/0x570 [ 2525.305817] rfkill_register+0x1bf/0xb50 [ 2525.309909] hci_register_dev+0x385/0x880 [ 2525.314093] hci_uart_tty_ioctl+0x761/0xaf0 [ 2525.318443] tty_ioctl+0x8b5/0x1510 [ 2525.322092] ? hci_uart_init_work+0x140/0x140 [ 2525.326606] ? tty_vhangup+0x30/0x30 [ 2525.330361] ? mark_held_locks+0x100/0x100 [ 2525.334747] ? __fget+0x340/0x540 [ 2525.338238] ? __might_sleep+0x95/0x190 [ 2525.342228] ? tty_vhangup+0x30/0x30 [ 2525.345965] do_vfs_ioctl+0xd5f/0x1380 [ 2525.349872] ? selinux_file_ioctl+0x46f/0x5e0 [ 2525.355078] ? selinux_file_ioctl+0x125/0x5e0 [ 2525.359597] ? ioctl_preallocate+0x210/0x210 [ 2525.364027] ? selinux_file_mprotect+0x620/0x620 [ 2525.368817] ? iterate_fd+0x360/0x360 [ 2525.372639] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2525.378195] ? fput+0x128/0x1a0 [ 2525.381510] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2525.387063] ? security_file_ioctl+0x8d/0xc0 [ 2525.393323] ksys_ioctl+0xab/0xd0 [ 2525.396803] __x64_sys_ioctl+0x73/0xb0 [ 2525.400727] do_syscall_64+0xfd/0x620 [ 2525.404559] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2525.409765] RIP: 0033:0x459a59 [ 2525.412994] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 03:10:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xf93c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2525.431912] RSP: 002b:00007f13ec7e5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2525.439657] RAX: ffffffffffffffda RBX: 00007f13ec7e5c90 RCX: 0000000000459a59 [ 2525.446952] RDX: 0000000000000000 RSI: 00000000400455c8 RDI: 0000000000000004 [ 2525.454241] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2525.461526] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f13ec7e66d4 [ 2525.468810] R13: 00000000004c27a1 R14: 00000000004d61b0 R15: 0000000000000005 03:10:32 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x800000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 2525.507019] Bluetooth: hci2: Frame reassembly failed (-84) [ 2525.538804] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:10:32 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00}}}, 0xb8}}, 0x0) 03:10:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xfa3c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2525.570173] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2525.636590] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2525.657659] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:10:33 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000}}}, 0xb8}}, 0x0) [ 2525.755740] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2527.218980] Bluetooth: hci1: command 0x1003 tx timeout [ 2527.224506] Bluetooth: hci1: sending frame failed (-49) [ 2527.230400] Bluetooth: hci0: command 0x1003 tx timeout [ 2527.241512] Bluetooth: hci0: sending frame failed (-49) [ 2527.539163] Bluetooth: hci2: command 0x1003 tx timeout [ 2527.544779] Bluetooth: hci2: sending frame failed (-49) [ 2529.298936] Bluetooth: hci0: command 0x1001 tx timeout [ 2529.305797] Bluetooth: hci0: sending frame failed (-49) [ 2529.311634] Bluetooth: hci1: command 0x1001 tx timeout [ 2529.317077] Bluetooth: hci1: sending frame failed (-49) [ 2529.619181] Bluetooth: hci2: command 0x1001 tx timeout [ 2529.624575] Bluetooth: hci2: sending frame failed (-49) [ 2531.378964] Bluetooth: hci1: command 0x1009 tx timeout [ 2531.384374] Bluetooth: hci0: command 0x1009 tx timeout [ 2531.699148] Bluetooth: hci2: command 0x1009 tx timeout 03:10:43 executing program 0 (fault-call:3 fault-nth:65): perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 03:10:43 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x900000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:10:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xfb3c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:10:43 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6800}}}, 0xb8}}, 0x0) 03:10:43 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x80045438, 0x0) 03:10:43 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0xc0045878, 0x0) [ 2536.007952] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2536.017964] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2536.043428] Bluetooth: hci1: Frame reassembly failed (-84) [ 2536.050398] Bluetooth: hci0: Frame reassembly failed (-84) 03:10:43 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00}}}, 0xb8}}, 0x0) 03:10:43 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xa00000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:10:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xfc030000, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2536.110919] FAULT_INJECTION: forcing a failure. [ 2536.110919] name failslab, interval 1, probability 0, space 0, times 0 [ 2536.155496] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2536.158565] CPU: 1 PID: 25911 Comm: syz-executor.0 Not tainted 4.19.79 #0 [ 2536.171973] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2536.181362] Call Trace: [ 2536.181404] dump_stack+0x172/0x1f0 [ 2536.181426] should_fail.cold+0xa/0x1b [ 2536.181451] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2536.181483] ? lock_downgrade+0x880/0x880 [ 2536.181515] __should_failslab+0x121/0x190 [ 2536.205057] should_failslab+0x9/0x14 [ 2536.208879] __kmalloc+0x2e2/0x750 [ 2536.212460] ? rcu_read_lock_sched_held+0x110/0x130 [ 2536.217519] ? kobject_get_path+0xc4/0x1b0 [ 2536.221792] kobject_get_path+0xc4/0x1b0 [ 2536.225893] kobject_uevent_env+0x3ab/0x101d [ 2536.230432] kobject_uevent+0x20/0x26 [ 2536.234265] device_add+0xb3a/0x1760 [ 2536.238011] ? get_device_parent.isra.0+0x570/0x570 [ 2536.243050] rfkill_register+0x1bf/0xb50 [ 2536.247153] hci_register_dev+0x385/0x880 [ 2536.251343] hci_uart_tty_ioctl+0x761/0xaf0 [ 2536.255717] tty_ioctl+0x8b5/0x1510 [ 2536.259386] ? hci_uart_init_work+0x140/0x140 [ 2536.263913] ? tty_vhangup+0x30/0x30 [ 2536.267653] ? mark_held_locks+0x100/0x100 [ 2536.271910] ? __fget+0x340/0x540 [ 2536.275382] ? __might_sleep+0x95/0x190 [ 2536.279374] ? tty_vhangup+0x30/0x30 [ 2536.283097] do_vfs_ioctl+0xd5f/0x1380 [ 2536.287010] ? selinux_file_ioctl+0x46f/0x5e0 [ 2536.291534] ? selinux_file_ioctl+0x125/0x5e0 [ 2536.296059] ? ioctl_preallocate+0x210/0x210 [ 2536.300488] ? selinux_file_mprotect+0x620/0x620 [ 2536.305273] ? iterate_fd+0x360/0x360 [ 2536.309095] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2536.314655] ? fput+0x128/0x1a0 [ 2536.317960] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2536.323507] ? security_file_ioctl+0x8d/0xc0 [ 2536.327936] ksys_ioctl+0xab/0xd0 [ 2536.331416] __x64_sys_ioctl+0x73/0xb0 [ 2536.335328] do_syscall_64+0xfd/0x620 [ 2536.339152] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2536.344353] RIP: 0033:0x459a59 [ 2536.347565] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2536.366478] RSP: 002b:00007f13ec7e5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2536.374192] RAX: ffffffffffffffda RBX: 00007f13ec7e5c90 RCX: 0000000000459a59 [ 2536.381456] RDX: 0000000000000000 RSI: 00000000400455c8 RDI: 0000000000000004 [ 2536.388714] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2536.395985] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f13ec7e66d4 03:10:43 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7400}}}, 0xb8}}, 0x0) [ 2536.403264] R13: 00000000004c27a1 R14: 00000000004d61b0 R15: 0000000000000005 03:10:43 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x150e000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 2536.429812] Bluetooth: hci2: Frame reassembly failed (-84) 03:10:43 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00}}}, 0xb8}}, 0x0) [ 2536.588700] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2536.614031] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2536.697255] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2538.099174] Bluetooth: hci0: command 0x1003 tx timeout [ 2538.104731] Bluetooth: hci0: sending frame failed (-49) [ 2538.110323] Bluetooth: hci1: command 0x1003 tx timeout [ 2538.121522] Bluetooth: hci1: sending frame failed (-49) [ 2538.509084] Bluetooth: hci2: command 0x1003 tx timeout [ 2538.514485] Bluetooth: hci2: sending frame failed (-49) [ 2540.179158] Bluetooth: hci1: command 0x1001 tx timeout [ 2540.184564] Bluetooth: hci1: sending frame failed (-49) [ 2540.190075] Bluetooth: hci0: command 0x1001 tx timeout [ 2540.195448] Bluetooth: hci0: sending frame failed (-49) [ 2540.578971] Bluetooth: hci2: command 0x1001 tx timeout [ 2540.584360] Bluetooth: hci2: sending frame failed (-49) [ 2542.259021] Bluetooth: hci0: command 0x1009 tx timeout [ 2542.264569] Bluetooth: hci1: command 0x1009 tx timeout [ 2542.658995] Bluetooth: hci2: command 0x1009 tx timeout 03:10:54 executing program 0 (fault-call:3 fault-nth:66): perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 03:10:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xfc3c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:10:54 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x1f00000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:10:54 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8800}}}, 0xb8}}, 0x0) 03:10:54 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x80045439, 0x0) 03:10:54 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0xc0045878, 0x0) [ 2546.869133] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2546.881596] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:10:54 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf000}}}, 0xb8}}, 0x0) [ 2546.912150] Bluetooth: hci1: Frame reassembly failed (-84) [ 2546.919554] Bluetooth: hci1: Frame reassembly failed (-84) [ 2546.961071] FAULT_INJECTION: forcing a failure. [ 2546.961071] name failslab, interval 1, probability 0, space 0, times 0 [ 2546.979147] CPU: 0 PID: 25939 Comm: syz-executor.0 Not tainted 4.19.79 #0 [ 2546.986575] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2546.995456] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2546.996194] Call Trace: [ 2547.007767] dump_stack+0x172/0x1f0 03:10:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xfcffffff, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2547.011464] should_fail.cold+0xa/0x1b [ 2547.015567] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 2547.020800] ? lock_downgrade+0x880/0x880 [ 2547.025012] __should_failslab+0x121/0x190 [ 2547.029443] should_failslab+0x9/0x14 [ 2547.033550] kmem_cache_alloc+0x2ae/0x700 [ 2547.037872] ? refcount_add_not_zero_checked+0x240/0x240 [ 2547.043354] ? lock_downgrade+0x880/0x880 [ 2547.047555] skb_clone+0x156/0x3e0 [ 2547.051247] netlink_broadcast_filtered+0x86e/0xb20 [ 2547.056325] netlink_broadcast+0x3a/0x50 [ 2547.060432] kobject_uevent_env+0xad4/0x101d [ 2547.064897] kobject_uevent+0x20/0x26 [ 2547.068728] device_add+0xb3a/0x1760 [ 2547.072491] ? get_device_parent.isra.0+0x570/0x570 [ 2547.077564] rfkill_register+0x1bf/0xb50 [ 2547.081672] hci_register_dev+0x385/0x880 [ 2547.085877] hci_uart_tty_ioctl+0x761/0xaf0 [ 2547.090324] tty_ioctl+0x8b5/0x1510 [ 2547.093989] ? hci_uart_init_work+0x140/0x140 [ 2547.098517] ? tty_vhangup+0x30/0x30 [ 2547.102378] ? mark_held_locks+0x100/0x100 [ 2547.106764] ? __fget+0x340/0x540 [ 2547.111219] ? __might_sleep+0x95/0x190 [ 2547.115230] ? tty_vhangup+0x30/0x30 [ 2547.119143] do_vfs_ioctl+0xd5f/0x1380 [ 2547.123072] ? selinux_file_ioctl+0x46f/0x5e0 [ 2547.127600] ? selinux_file_ioctl+0x125/0x5e0 [ 2547.132388] ? ioctl_preallocate+0x210/0x210 [ 2547.136925] ? selinux_file_mprotect+0x620/0x620 [ 2547.141929] ? iterate_fd+0x360/0x360 [ 2547.145776] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 2547.151347] ? fput+0x128/0x1a0 [ 2547.154795] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 2547.160364] ? security_file_ioctl+0x8d/0xc0 [ 2547.164810] ksys_ioctl+0xab/0xd0 [ 2547.168479] __x64_sys_ioctl+0x73/0xb0 [ 2547.172399] do_syscall_64+0xfd/0x620 [ 2547.176249] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 2547.181465] RIP: 0033:0x459a59 [ 2547.184681] Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 2547.203758] RSP: 002b:00007f13ec7e5c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2547.211505] RAX: ffffffffffffffda RBX: 00007f13ec7e5c90 RCX: 0000000000459a59 [ 2547.218807] RDX: 0000000000000000 RSI: 00000000400455c8 RDI: 0000000000000004 [ 2547.226131] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 2547.233427] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f13ec7e66d4 [ 2547.240742] R13: 00000000004c27a1 R14: 00000000004d61b0 R15: 0000000000000005 [ 2547.253646] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:10:54 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x34000}}}, 0xb8}}, 0x0) 03:10:54 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x2000000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 2547.270941] Bluetooth: hci2: Frame reassembly failed (-84) 03:10:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xfd3c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2547.347685] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:10:54 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400300}}}, 0xb8}}, 0x0) [ 2547.398904] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2547.473524] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2548.898918] Bluetooth: hci0: command 0x1003 tx timeout [ 2548.904668] Bluetooth: hci0: sending frame failed (-49) [ 2548.978965] Bluetooth: hci1: command 0x1003 tx timeout [ 2548.984555] Bluetooth: hci1: sending frame failed (-49) [ 2549.299001] Bluetooth: hci2: command 0x1003 tx timeout [ 2549.304584] Bluetooth: hci2: sending frame failed (-49) [ 2550.979052] Bluetooth: hci0: command 0x1001 tx timeout [ 2550.986483] Bluetooth: hci0: sending frame failed (-49) [ 2551.059097] Bluetooth: hci1: command 0x1001 tx timeout [ 2551.064590] Bluetooth: hci1: sending frame failed (-49) [ 2551.378975] Bluetooth: hci2: command 0x1001 tx timeout [ 2551.384370] Bluetooth: hci2: sending frame failed (-49) [ 2553.058903] Bluetooth: hci0: command 0x1009 tx timeout [ 2553.138903] Bluetooth: hci1: command 0x1009 tx timeout [ 2553.458924] Bluetooth: hci2: command 0x1009 tx timeout 03:11:05 executing program 0 (fault-call:3 fault-nth:67): perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 03:11:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xfe030000, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:11:05 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x2200000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:11:05 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffff}}}, 0xb8}}, 0x0) 03:11:05 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x80045440, 0x0) 03:11:05 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0xc0189436, 0x0) [ 2557.741400] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2557.766126] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2557.786532] Bluetooth: hci0: Frame reassembly failed (-84) 03:11:05 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}}}, 0xb8}}, 0x0) 03:11:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xfe3c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:11:05 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x2c00000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 2557.872761] Bluetooth: hci2: Frame reassembly failed (-84) [ 2557.901038] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:11:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xfeff0000, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2557.942321] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:11:05 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}}}, 0xb8}}, 0x0) [ 2557.998309] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:11:05 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000}}}, 0xb8}}, 0x0) [ 2558.040389] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2558.110268] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2559.859038] Bluetooth: hci0: command 0x1003 tx timeout [ 2559.864434] Bluetooth: hci0: sending frame failed (-49) [ 2559.870229] Bluetooth: hci1: command 0x1003 tx timeout [ 2559.875597] Bluetooth: hci1: sending frame failed (-49) [ 2559.938922] Bluetooth: hci2: command 0x1003 tx timeout [ 2559.944312] Bluetooth: hci2: sending frame failed (-49) [ 2561.939013] Bluetooth: hci1: command 0x1001 tx timeout [ 2561.939052] Bluetooth: hci0: command 0x1001 tx timeout [ 2561.944413] Bluetooth: hci1: sending frame failed (-49) [ 2561.958961] Bluetooth: hci0: sending frame failed (-49) [ 2562.018999] Bluetooth: hci2: command 0x1001 tx timeout [ 2562.024402] Bluetooth: hci2: sending frame failed (-49) [ 2564.019004] Bluetooth: hci0: command 0x1009 tx timeout [ 2564.024398] Bluetooth: hci1: command 0x1009 tx timeout [ 2564.099100] Bluetooth: hci2: command 0x1009 tx timeout 03:11:15 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 03:11:15 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x3f00000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:11:15 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xfeffffff, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:11:15 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}}}, 0xb8}}, 0x0) 03:11:15 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0xc020660b, 0x0) 03:11:15 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455c9, 0x0) [ 2568.000179] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2568.017310] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:11:15 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xff030000, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:11:15 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000}}}, 0xb8}}, 0x0) [ 2568.050386] Bluetooth: hci0: Frame reassembly failed (-84) [ 2568.064500] Bluetooth: hci1: Frame reassembly failed (-84) [ 2568.071149] Bluetooth: hci1: Frame reassembly failed (-84) [ 2568.091762] Bluetooth: hci2: Frame reassembly failed (-84) 03:11:15 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x4000000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:11:15 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000}}}, 0xb8}}, 0x0) [ 2568.143402] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2568.162601] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:11:15 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xff0f0000, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:11:15 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x4800000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 2568.280601] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2568.291612] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2570.108991] Bluetooth: hci2: command 0x1003 tx timeout [ 2570.114614] Bluetooth: hci2: sending frame failed (-49) [ 2570.120539] Bluetooth: hci1: command 0x1003 tx timeout [ 2570.131924] Bluetooth: hci1: sending frame failed (-49) [ 2570.137605] Bluetooth: hci0: command 0x1003 tx timeout [ 2570.148219] Bluetooth: hci0: sending frame failed (-49) [ 2572.179021] Bluetooth: hci0: command 0x1001 tx timeout [ 2572.184681] Bluetooth: hci0: sending frame failed (-49) [ 2572.190451] Bluetooth: hci1: command 0x1001 tx timeout [ 2572.195795] Bluetooth: hci1: sending frame failed (-49) [ 2572.208882] Bluetooth: hci2: command 0x1001 tx timeout [ 2572.214251] Bluetooth: hci2: sending frame failed (-49) [ 2574.258940] Bluetooth: hci2: command 0x1009 tx timeout [ 2574.264336] Bluetooth: hci1: command 0x1009 tx timeout [ 2574.275952] Bluetooth: hci0: command 0x1009 tx timeout 03:11:25 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x2, 0x0) 03:11:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xff3c0100, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:11:25 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000}}}, 0xb8}}, 0x0) 03:11:25 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x4c00000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:11:25 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000), 0x0, 0x0) ioctl$VIDIOC_SUBDEV_G_CROP(r1, 0xc038563b, &(0x7f0000000000)={0x0, 0x0, {0x0, 0x8, 0x8, 0x1f}}) 03:11:25 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) [ 2578.256717] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2578.278146] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:11:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xff7f0000, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:11:25 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000}}}, 0xb8}}, 0x0) 03:11:25 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x6000000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 2578.438695] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2578.464931] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:11:25 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000}}}, 0xb8}}, 0x0) 03:11:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xffff1f00, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:11:25 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x4b47, 0x0) [ 2578.547119] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:11:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xffffa888, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:11:25 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x6800000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 2578.599064] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:11:25 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf000000}}}, 0xb8}}, 0x0) 03:11:26 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xfffff000, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2578.676729] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2578.737627] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2578.789754] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2580.338906] Bluetooth: hci0: command 0x1003 tx timeout [ 2580.338935] Bluetooth: hci1: command 0x1003 tx timeout [ 2580.351229] Bluetooth: hci0: sending frame failed (-49) [ 2580.362267] Bluetooth: hci1: sending frame failed (-49) [ 2582.418961] Bluetooth: hci1: command 0x1001 tx timeout [ 2582.424367] Bluetooth: hci1: sending frame failed (-49) [ 2582.430171] Bluetooth: hci0: command 0x1001 tx timeout [ 2582.443677] Bluetooth: hci0: sending frame failed (-49) [ 2584.498971] Bluetooth: hci0: command 0x1009 tx timeout [ 2584.504365] Bluetooth: hci1: command 0x1009 tx timeout 03:11:35 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455cc, 0x0) 03:11:35 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x4b49, 0x0) 03:11:35 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x6c00000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:11:35 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000}}}, 0xb8}}, 0x0) 03:11:35 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xffffff7f, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:11:35 executing program 2: pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0x400) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000140)) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x104000) vmsplice(r4, &(0x7f0000000000), 0x0, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f0000000240)='/dev/snd/midiC#D#\x00', 0xa6, 0x2) ioctl(r5, 0x2, &(0x7f0000000280)="86e45afa6cf16b767e3bdb0bd9e437ce204df08b36") ioctl$TCGETA(r2, 0x5405, &(0x7f0000000000)) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0xe0080, 0x0) r7 = socket(0x11, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r7, &(0x7f0000000140)={0x11, 0x0, r8, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) ioctl$BLKIOMIN(r1, 0x1278, &(0x7f0000000300)) setsockopt$packet_int(r7, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r7, &(0x7f0000000d00), 0x1c4, 0x0) setsockopt$netrom_NETROM_T4(r7, 0x103, 0x6, &(0x7f0000000200)=0x4, 0x4) ioctl$TIOCGSOFTCAR(r6, 0x5419, &(0x7f00000000c0)) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(0xffffffffffffffff, 0x400455c8, 0x0) r9 = syz_open_dev$vbi(&(0x7f0000000140)='/dev/vbi#\x00', 0x2, 0x2) ioctl$BLKZEROOUT(r9, 0x127f, &(0x7f0000000180)={0xfffffffffffffffe, 0x5}) r10 = openat$audio(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/audio\x00', 0x161040, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r11, &(0x7f00000001c0), 0xfffffef3) ioctl$PIO_CMAP(r11, 0x4b71, &(0x7f00000002c0)={0x1f, 0x5, 0x3, 0x1, 0x3, 0xffffffffffff4543}) ioctl$BINDER_THREAD_EXIT(r10, 0x40046208, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x800455ca, 0x0) [ 2588.493733] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2588.494656] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2588.520610] Bluetooth: hci0: Frame reassembly failed (-84) 03:11:35 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000}}}, 0xb8}}, 0x0) 03:11:35 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xffffff9e, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:11:35 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x7400000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 2588.633286] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2588.650789] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:11:36 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x5409, 0x0) 03:11:36 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000}}}, 0xb8}}, 0x0) 03:11:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xffffffc3, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2588.816880] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2588.846969] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2590.578917] Bluetooth: hci0: command 0x1003 tx timeout [ 2590.584387] Bluetooth: hci0: sending frame failed (-49) [ 2592.658975] Bluetooth: hci0: command 0x1001 tx timeout [ 2592.664360] Bluetooth: hci0: sending frame failed (-49) [ 2594.739009] Bluetooth: hci0: command 0x1009 tx timeout 03:11:45 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x80086601, 0x0) 03:11:45 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x7a00000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:11:45 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c000000}}}, 0xb8}}, 0x0) 03:11:45 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xffffffe4, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:11:45 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x540b, 0x0) 03:11:45 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x80f) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) [ 2598.692165] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2598.716293] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:11:46 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x64800, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:11:46 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xfffffff0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:11:46 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60000000}}}, 0xb8}}, 0x0) [ 2598.752457] Bluetooth: hci0: Frame reassembly failed (-84) 03:11:46 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x8cffffff00000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 2598.870892] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2598.878644] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:11:46 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x540c, 0x0) 03:11:46 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_dev$loop(&(0x7f00000001c0)='/dev/loop#\x00', 0x15f6, 0x400) ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40086607, &(0x7f0000000200)=0x413) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_GET_NETID(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x48004400}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, r2, 0x200, 0x70bd2a, 0x25dfdbfb, {}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x84}, 0x1) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) [ 2599.011767] Bluetooth: hci1: Frame reassembly failed (-84) [ 2600.819090] Bluetooth: hci0: command 0x1003 tx timeout [ 2600.824665] Bluetooth: hci0: sending frame failed (-49) [ 2601.059042] Bluetooth: hci1: command 0x1003 tx timeout [ 2601.064545] Bluetooth: hci1: sending frame failed (-49) [ 2602.899081] Bluetooth: hci0: command 0x1001 tx timeout [ 2602.904491] Bluetooth: hci0: sending frame failed (-49) [ 2603.139048] Bluetooth: hci1: command 0x1001 tx timeout [ 2603.145969] Bluetooth: hci1: sending frame failed (-49) [ 2604.979062] Bluetooth: hci0: command 0x1009 tx timeout [ 2605.219027] Bluetooth: hci1: command 0x1009 tx timeout 03:11:56 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x80087601, 0x0) 03:11:56 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68000000}}}, 0xb8}}, 0x0) 03:11:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xfffffffc, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:11:56 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x97ffffff00000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:11:56 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x540d, 0x0) 03:11:56 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c000000}}}, 0xb8}}, 0x0) [ 2608.935554] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2608.940911] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2609.026595] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:11:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xfffffffe, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:11:56 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xf6ffffff00000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:11:56 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74000000}}}, 0xb8}}, 0x0) 03:11:56 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a000000}}}, 0xb8}}, 0x0) [ 2609.133279] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2609.147921] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:11:56 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x540e, 0x0) [ 2609.264614] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:11:56 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xfcfdffff00000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 2611.138927] Bluetooth: hci0: command 0x1003 tx timeout [ 2611.144669] Bluetooth: hci0: sending frame failed (-49) [ 2613.218967] Bluetooth: hci0: command 0x1001 tx timeout [ 2613.224372] Bluetooth: hci0: sending frame failed (-49) [ 2615.298936] Bluetooth: hci0: command 0x1009 tx timeout 03:12:06 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88000000}}}, 0xb8}}, 0x0) 03:12:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xffffffff, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:12:06 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x540f, 0x0) 03:12:06 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0xc0045878, 0x0) 03:12:06 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xfdfdffff00000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:12:06 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x15) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f0000000080)=0x0) ptrace$setregs(0xd, r4, 0x1, &(0x7f0000000180)="a14317e2f42c2c20161e3d3021003888a52b9810e8df1153b37883be270c6519500031b453c89e2185da27df1c23e94c02768f02ed30c7e55dc500a8e335fccbb353722dd2bf93f5c8aacd493dff322859a9ce523678b178c25000c34a09e3b084525a70b440b868da") r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vga_arbiter\x00', 0x200000, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fanotify_mark(r5, 0x40, 0x20, r6, &(0x7f0000000280)='./file0\x00') ioctl$KDADDIO(r2, 0x400455c8, 0x1ff) fsetxattr$security_smack_entry(r0, &(0x7f0000000100)='security.SMACK64MMAP\x00', &(0x7f0000000200)=']vboxnet0}vboxnet0/{\xfdself\x00', 0x1a, 0x3) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) [ 2619.196713] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2619.218595] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:12:06 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9effffff}}}, 0xb8}}, 0x0) 03:12:06 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xfdffffff00000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:12:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:12:06 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffffff}}}, 0xb8}}, 0x0) [ 2619.355584] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2619.380053] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:12:06 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xfe03000000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:12:06 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x5410, 0x0) 03:12:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2619.474533] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:12:06 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff000}}}, 0xb8}}, 0x0) [ 2619.526047] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:12:06 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xffff1f0000000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 2619.623487] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2621.298953] Bluetooth: hci0: command 0x1003 tx timeout [ 2621.306082] Bluetooth: hci0: sending frame failed (-49) [ 2623.378964] Bluetooth: hci0: command 0x1001 tx timeout [ 2623.384375] Bluetooth: hci0: sending frame failed (-49) [ 2625.459017] Bluetooth: hci0: command 0x1009 tx timeout 03:12:16 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0xc0045878, 0x0) 03:12:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:12:16 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f}}}, 0xb8}}, 0x0) 03:12:16 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x5412, 0x0) 03:12:16 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xffffff7f00000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:12:16 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r2 = socket$inet(0x2, 0x4000000805, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) r4 = dup3(r2, r3, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r4, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r3, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x66, &(0x7f000059aff8)={r5}, &(0x7f000034f000)=0x8) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000180)={r5, 0x9}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={r6, @in6={{0xa, 0x4e24, 0x1f, @dev={0xfe, 0x80, [], 0x1f}, 0x2}}, 0x8000, 0x2, 0x10000, 0x2, 0x11}, &(0x7f00000002c0)=0x98) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) r7 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x10002, 0x100) ioctl$KDGKBDIACR(r7, 0x4b4a, &(0x7f0000000100)=""/101) [ 2629.421381] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2629.431533] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2629.453525] Bluetooth: hci0: Frame reassembly failed (-84) 03:12:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x4, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:12:16 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff9e}}}, 0xb8}}, 0x0) [ 2629.505314] Bluetooth: hci1: Frame reassembly failed (-84) [ 2629.515821] Bluetooth: hci1: Frame reassembly failed (-84) 03:12:16 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xffffffff00000000, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 2629.577169] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2629.615792] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:12:16 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x5413, 0x0) 03:12:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x5, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:12:16 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff0}}}, 0xb8}}, 0x0) [ 2629.704233] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2629.752541] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2631.458990] Bluetooth: hci0: command 0x1003 tx timeout [ 2631.467783] Bluetooth: hci0: sending frame failed (-49) [ 2631.539091] Bluetooth: hci1: command 0x1003 tx timeout [ 2631.544678] Bluetooth: hci1: sending frame failed (-49) [ 2633.538931] Bluetooth: hci0: command 0x1001 tx timeout [ 2633.544344] Bluetooth: hci0: sending frame failed (-49) [ 2633.619122] Bluetooth: hci1: command 0x1001 tx timeout [ 2633.624517] Bluetooth: hci1: sending frame failed (-49) [ 2635.618913] Bluetooth: hci0: command 0x1009 tx timeout [ 2635.699114] Bluetooth: hci1: command 0x1009 tx timeout 03:12:26 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x6, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:12:26 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:12:26 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40030000000000}}}, 0xb8}}, 0x0) 03:12:26 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0xc0189436, 0x0) 03:12:26 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x5414, 0x0) 03:12:27 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0xfb) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) ioctl$KDADDIO(r3, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) [ 2639.671917] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2639.672207] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2639.743552] Bluetooth: hci0: Frame reassembly failed (-84) [ 2639.749538] Bluetooth: hci0: Frame reassembly failed (-84) 03:12:27 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffffffffffff}}}, 0xb8}}, 0x0) 03:12:27 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:12:27 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'\nir_umask', 0x3d, 0x80000000}}]}) [ 2639.872484] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2639.881283] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:12:27 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x5415, 0x0) 03:12:27 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x8, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:12:27 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000}}}, 0xb8}}, 0x0) [ 2639.934121] hfs: unable to parse mount options [ 2639.978376] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:12:27 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'\"ir_umask', 0x3d, 0x80000000}}]}) 03:12:27 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x9, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2640.030057] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:12:27 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000}}}, 0xb8}}, 0x0) [ 2640.098399] hfs: unable to parse mount options [ 2640.099390] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2640.175267] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2641.778967] Bluetooth: hci0: command 0x1003 tx timeout [ 2641.785878] Bluetooth: hci0: sending frame failed (-49) [ 2643.858936] Bluetooth: hci0: command 0x1001 tx timeout [ 2643.864337] Bluetooth: hci0: sending frame failed (-49) [ 2645.938945] Bluetooth: hci0: command 0x1009 tx timeout 03:12:37 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0xc020660b, 0x0) 03:12:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xa, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:12:37 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'%ir_umask', 0x3d, 0x80000000}}]}) 03:12:37 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000}}}, 0xb8}}, 0x0) 03:12:37 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x5416, 0x0) 03:12:37 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x181041, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x8, 0x2000) sendmsg$IPVS_CMD_DEL_DEST(r1, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1080000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x9c, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x10001}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x23}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xf7}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x10000}, @IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}]}, 0x9c}, 0x1, 0x0, 0x0, 0x20004001}, 0x4) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) [ 2649.909162] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2649.917856] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2649.943910] Bluetooth: hci0: Frame reassembly failed (-84) 03:12:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xc, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2649.971612] hfs: unable to parse mount options 03:12:37 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000}}}, 0xb8}}, 0x0) 03:12:37 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={',ir_umask', 0x3d, 0x80000000}}]}) [ 2650.058033] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2650.092036] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:12:37 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xe, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:12:37 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x5418, 0x0) [ 2650.144652] hfs: unable to parse mount options 03:12:37 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000}}}, 0xb8}}, 0x0) [ 2650.182890] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2650.217646] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2652.018916] Bluetooth: hci1: command 0x1003 tx timeout [ 2652.018991] Bluetooth: hci0: command 0x1003 tx timeout [ 2652.024407] Bluetooth: hci1: sending frame failed (-49) [ 2652.038936] Bluetooth: hci0: sending frame failed (-49) [ 2654.099063] Bluetooth: hci0: command 0x1001 tx timeout [ 2654.104468] Bluetooth: hci0: sending frame failed (-49) [ 2654.110284] Bluetooth: hci1: command 0x1001 tx timeout [ 2654.115633] Bluetooth: hci1: sending frame failed (-49) [ 2656.179016] Bluetooth: hci1: command 0x1009 tx timeout [ 2656.184412] Bluetooth: hci0: command 0x1009 tx timeout 03:12:47 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x4) r2 = socket(0xa, 0x80000, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000080)={0x4, [0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000100)=0x14) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000140)={r4, @in6={{0xa, 0x4e21, 0x1, @local, 0x7}}, 0x1f, 0xd7, 0xd0e, 0x83, 0x4c}, &(0x7f0000000200)=0x98) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:12:47 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xf, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:12:47 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000}}}, 0xb8}}, 0x0) 03:12:47 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'.ir_umask', 0x3d, 0x80000000}}]}) 03:12:47 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x541b, 0x0) 03:12:47 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xe) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x100, 0x0) write$nbd(r1, &(0x7f0000000100)={0x67446698, 0x1, 0x1, 0x2, 0x3, "df8d20c350e51794e69242538cdbd0afd7aca45f7ff356426546caa1162677a260d60505b126f0b96d72790b7af6abe4f05f2242e5813dad54c45e6e0b7ac46fb6983c311684ae86e787bc2e2a7cc6c40eb2da38319569930c74fdd90b9b09be67fff644f67be32f67cb59bc60405b1c123bb7b80c7813a1f501b0ce88833924f74fa841531a6df19bb5ca4dd5d9114591"}, 0xa1) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) [ 2660.150378] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2660.167457] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2660.218006] hfs: unable to parse mount options 03:12:47 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000}}}, 0xb8}}, 0x0) 03:12:47 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x10, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2660.253129] Bluetooth: hci0: Frame reassembly failed (-84) 03:12:47 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x7, 0x2) r2 = socket$inet(0x2, 0x4000000805, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) r4 = dup3(r2, r3, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r4, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r3, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x66, &(0x7f000059aff8)={r5}, &(0x7f000034f000)=0x8) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000080)={r5, 0x3}, &(0x7f0000000100)=0x8) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:12:47 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'/ir_umask', 0x3d, 0x80000000}}]}) [ 2660.317036] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:12:47 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000}}}, 0xb8}}, 0x0) [ 2660.383096] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2660.410845] Bluetooth: hci1: Frame reassembly failed (-84) 03:12:47 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x541d, 0x0) [ 2660.439419] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2660.463171] hfs: unable to parse mount options [ 2662.258913] Bluetooth: hci0: command 0x1003 tx timeout [ 2662.264316] Bluetooth: hci0: sending frame failed (-49) [ 2662.428990] Bluetooth: hci1: command 0x1003 tx timeout [ 2662.434914] Bluetooth: hci1: sending frame failed (-49) [ 2664.338992] Bluetooth: hci0: command 0x1001 tx timeout [ 2664.346080] Bluetooth: hci0: sending frame failed (-49) [ 2664.499001] Bluetooth: hci1: command 0x1001 tx timeout [ 2664.504401] Bluetooth: hci1: sending frame failed (-49) [ 2666.418970] Bluetooth: hci0: command 0x1009 tx timeout [ 2666.578965] Bluetooth: hci1: command 0x1009 tx timeout 03:12:57 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x12, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:12:57 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000}}}, 0xb8}}, 0x0) 03:12:57 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'d\nr_umask', 0x3d, 0x80000000}}]}) 03:12:57 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x541f, 0x0) 03:12:57 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r1, 0xc0305615, &(0x7f0000000000)={0x0, {0x2549, 0x4}}) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) [ 2670.397888] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2670.402968] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:12:57 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00000000000000}}}, 0xb8}}, 0x0) 03:12:57 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x18, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2670.459312] hfs: unable to parse mount options [ 2670.495486] Bluetooth: hci0: Frame reassembly failed (-84) 03:12:57 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'d\"r_umask', 0x3d, 0x80000000}}]}) [ 2670.535992] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2670.545806] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2670.622234] hfs: unable to parse mount options 03:12:58 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x40000, 0x0) ioctl$DRM_IOCTL_RM_MAP(r1, 0x4028641b, &(0x7f0000000080)={0x0, 0xfffffffffffff000, 0x1, 0x11, &(0x7f0000ffb000/0x4000)=nil, 0x13b}) mount(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000140)='overlay\x00', 0x0, &(0x7f0000000240)=ANY=[]) getxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)=@known='trusted.overlay.origin\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:12:58 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000}}}, 0xb8}}, 0x0) 03:12:58 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x5420, 0x0) 03:12:58 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3c, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:12:58 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'d%r_umask', 0x3d, 0x80000000}}]}) [ 2671.021788] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2671.045314] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2671.070986] Bluetooth: hci1: Frame reassembly failed (-84) 03:12:58 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000}}}, 0xb8}}, 0x0) 03:12:58 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x48, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2671.092287] hfs: unable to parse mount options [ 2671.135831] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2671.150507] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:12:58 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4800000000000000}}}, 0xb8}}, 0x0) [ 2671.275282] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2671.286826] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2672.508901] Bluetooth: hci0: command 0x1003 tx timeout [ 2672.514302] Bluetooth: hci0: sending frame failed (-49) [ 2673.149151] Bluetooth: hci1: command 0x1003 tx timeout [ 2673.154715] Bluetooth: hci1: sending frame failed (-49) [ 2674.578904] Bluetooth: hci0: command 0x1001 tx timeout [ 2674.584311] Bluetooth: hci0: sending frame failed (-49) [ 2675.219113] Bluetooth: hci1: command 0x1001 tx timeout [ 2675.224514] Bluetooth: hci1: sending frame failed (-49) [ 2676.658896] Bluetooth: hci0: command 0x1009 tx timeout [ 2677.299108] Bluetooth: hci1: command 0x1009 tx timeout 03:13:07 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) ioctl$TIOCEXCL(r1, 0x540c) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(0xffffffffffffffff, 0x40485404, &(0x7f0000000200)={{0x0, 0x0, 0x7, 0x0, 0xbc77f78}, 0x1, 0x4}) r2 = ioctl$TIOCGPTPEER(r0, 0x5441, 0x6f9) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$sock_SIOCSIFBR(r2, 0x8941, &(0x7f0000000000)=@generic={0x1, 0x8}) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) ioctl$KDSKBSENT(r0, 0x4b49, &(0x7f0000000100)="8ea3649ebd29689dc983e53cc873498f04129f2e9b16fd26ec615aaf7420691287c2546c3951ca801378b4f9f784a63bdc09919db7652e6bf0f920a3ae7d5847cd8410e6a45b42ff865385f63ee340b3107f8fb39956e601e76d6cb0d2b772e28c7a107ce9780a804939fe1ddae448d85fb78fb8087a30bb7577b11077c60da4d9724686b88bd8ad9ff4ee9e490d9f3d3b036e5585bdb262e0ce18f1227b6c925972e00bd39e37ecb6132b545dd2011254d178ebd936b45d44efc9877ad98611e4f7a9abe095e60eb13b403a7e8ade4511e05d487ddf7caaeffdc73383114cc360367e169b03") 03:13:07 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00000000000000}}}, 0xb8}}, 0x0) 03:13:07 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'d,r_umask', 0x3d, 0x80000000}}]}) 03:13:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x4a, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2680.624269] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2680.633175] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2680.656043] hfs: unable to parse mount options 03:13:08 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000000000000}}}, 0xb8}}, 0x0) 03:13:08 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x5421, 0x0) 03:13:08 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x4c, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:13:08 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'di\n_umask', 0x3d, 0x80000000}}]}) 03:13:08 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) r1 = gettid() rt_sigqueueinfo(r1, 0x0, &(0x7f0000000080)={0x0, 0x0, 0xfffffffa}) perf_event_open(0x0, r1, 0xf, 0xffffffffffffffff, 0x10) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={r1, r2, 0x0, 0xa, &(0x7f0000000000)='/dev/ptmx\x00', 0xffffffffffffffff}, 0x30) r4 = gettid() rt_sigqueueinfo(r4, 0x0, &(0x7f0000000080)={0x0, 0x0, 0xfffffffa}) perf_event_open(0x0, r4, 0xf, 0xffffffffffffffff, 0x10) r5 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r5, &(0x7f0000000140)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r5, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r5, &(0x7f0000000d00), 0x1c4, 0x0) r7 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r7, &(0x7f0000000140)={0x11, 0x0, r8, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r7, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r7, &(0x7f0000000100), 0x941fa2410b76d2, 0xae4db4b7f27acd50) kcmp(r3, r4, 0x0, r5, r7) [ 2681.271666] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2681.294916] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2681.321958] Bluetooth: hci0: Frame reassembly failed (-84) [ 2681.336048] hfs: unable to parse mount options 03:13:08 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6800000000000000}}}, 0xb8}}, 0x0) 03:13:08 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x60, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:13:08 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'di\"_umask', 0x3d, 0x80000000}}]}) [ 2681.420825] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:13:08 executing program 4: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0xc4080, 0x0) ioctl$NBD_SET_SIZE_BLOCKS(r0, 0xab07, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x0) ioctl$TIOCSETD(r1, 0x400455cb, 0x0) 03:13:08 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x5422, 0x0) [ 2681.468657] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:13:08 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x68, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:13:08 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00000000000000}}}, 0xb8}}, 0x0) [ 2681.545946] hfs: unable to parse mount options [ 2681.566093] Bluetooth: hci1: Frame reassembly failed (-84) [ 2681.611879] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2681.638166] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:13:09 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'di%_umask', 0x3d, 0x80000000}}]}) 03:13:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x6c, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:13:09 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x5423, 0x0) 03:13:09 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7400000000000000}}}, 0xb8}}, 0x0) [ 2681.778666] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2681.786256] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2681.853320] hfs: unable to parse mount options [ 2683.378978] Bluetooth: hci0: command 0x1003 tx timeout [ 2683.384496] Bluetooth: hci0: sending frame failed (-49) [ 2683.619014] Bluetooth: hci1: command 0x1003 tx timeout [ 2683.624529] Bluetooth: hci1: sending frame failed (-49) [ 2685.458997] Bluetooth: hci0: command 0x1001 tx timeout [ 2685.464398] Bluetooth: hci0: sending frame failed (-49) [ 2685.699084] Bluetooth: hci1: command 0x1001 tx timeout [ 2685.704484] Bluetooth: hci1: sending frame failed (-49) [ 2687.538990] Bluetooth: hci0: command 0x1009 tx timeout [ 2687.779015] Bluetooth: hci1: command 0x1009 tx timeout 03:13:18 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='\x03\x00\x00\x00\x00\x9c\"\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:13:18 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00000000000000}}}, 0xb8}}, 0x0) 03:13:18 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x74, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:13:18 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x5424, 0x0) [ 2691.584903] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2691.595778] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:13:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7a, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:13:19 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'di,_umask', 0x3d, 0x80000000}}]}) 03:13:19 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8800000000000000}}}, 0xb8}}, 0x0) 03:13:19 executing program 2: sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x70, 0x0, 0x200, 0x7, 0x25dfdbfd, {}, [@TIPC_NLA_MON={0x44, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x421}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7a8c}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x80}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1abd8951}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7ff}]}, @TIPC_NLA_SOCK={0x18, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x21f}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x20008008}, 0x8040) r0 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r0, 0xc018620c, &(0x7f00000001c0)={0x3}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$KDSKBMETA(r2, 0x4b63, &(0x7f0000000200)=0xb1) ioprio_set$uid(0x3, 0xee01, 0x804) r3 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r3, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r3, &(0x7f0000000d00), 0x1c4, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)=@gettfilter={0x34, 0x2e, 0x6d31127534d7d8a5, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, {0x8, 0x1e}, {0x10, 0xfff1}, {0x7, 0xffe0}}, [{0x8}, {0x8, 0xb, 0xd187}]}, 0x34}, 0x1, 0x0, 0x0, 0x4004000}, 0x400) ioctl$KDADDIO(r1, 0x400455c8, 0x0) ioctl$TIOCSETD(r1, 0x800455ca, 0x0) 03:13:19 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x5425, 0x0) [ 2692.144603] audit: type=1400 audit(1571022799.424:84): avc: denied { set_context_mgr } for pid=28823 comm="syz-executor.2" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=binder permissive=1 [ 2692.145163] binder: 28823:28824 ioctl c018620c 200001c0 returned -22 [ 2692.182343] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:13:19 executing program 4: r0 = gettid() rt_sigqueueinfo(r0, 0x0, &(0x7f0000000080)={0x0, 0x0, 0xfffffffa}) perf_event_open(0x0, r0, 0xf, 0xffffffffffffffff, 0x10) sched_setattr(r0, &(0x7f00000001c0)={0x30, 0x5, 0x3, 0x4, 0xcecf, 0x6, 0x6, 0x10001}, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x0) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) getsockopt$inet_buf(r2, 0x0, 0x6f, &(0x7f0000000080)=""/63, &(0x7f0000000100)=0x3f) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = syz_open_dev$ndb(&(0x7f0000000200)='/dev/nbd#\x00', 0x0, 0x202001) ioctl$BLKPBSZGET(r5, 0x127b, &(0x7f0000000240)) write(r4, &(0x7f00000001c0), 0xfffffef3) ioctl$TCSBRK(r4, 0x5409, 0x99b) ioctl$TIOCSRS485(r4, 0x542f, &(0x7f0000000000)={0x1, 0x100, 0x7}) [ 2692.193834] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:13:19 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9effffff00000000}}}, 0xb8}}, 0x0) [ 2692.243203] Bluetooth: hci0: Frame reassembly failed (-84) [ 2692.253566] hfs: unable to parse mount options 03:13:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7e, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:13:19 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir\tumask', 0x3d, 0x80000000}}]}) 03:13:19 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x5427, 0x0) [ 2692.358164] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2692.383755] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2692.393735] Bluetooth: hci1: Frame reassembly failed (-84) 03:13:19 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffffff00000000}}}, 0xb8}}, 0x0) [ 2692.458716] hfs: unable to parse mount options 03:13:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x90, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2692.488408] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:13:19 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir\numask', 0x3d, 0x80000000}}]}) 03:13:19 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000}}}, 0xb8}}, 0x0) 03:13:19 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x5428, 0x0) [ 2692.562236] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2692.633897] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2692.663678] hfs: unable to parse mount options [ 2694.258922] Bluetooth: hci0: command 0x1003 tx timeout [ 2694.264324] Bluetooth: hci0: sending frame failed (-49) [ 2694.418944] Bluetooth: hci1: command 0x1003 tx timeout [ 2694.424453] Bluetooth: hci1: sending frame failed (-49) [ 2696.338919] Bluetooth: hci0: command 0x1001 tx timeout [ 2696.344327] Bluetooth: hci0: sending frame failed (-49) [ 2696.498956] Bluetooth: hci1: command 0x1001 tx timeout [ 2696.504693] Bluetooth: hci1: sending frame failed (-49) [ 2698.418954] Bluetooth: hci0: command 0x1009 tx timeout [ 2698.578937] Bluetooth: hci1: command 0x1009 tx timeout 03:13:30 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x400, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000080)) msgsnd(0x0, &(0x7f0000000100)={0x1, "58f243a0f218507e5c6cbcf3bbdc277e0b6f6bc1f095170e43f8ef8fdd15190745f07c4a19b64f787a32241d0fc7cfd6a9f3dce353e664ae6577e8a25ce5ff5765804252c07e"}, 0x4e, 0x1400) 03:13:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xa2, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:13:30 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000}}}, 0xb8}}, 0x0) 03:13:30 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir\"umask', 0x3d, 0x80000000}}]}) 03:13:30 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x5429, 0x0) 03:13:30 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0xda200, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r1, &(0x7f0000000d00), 0x1c4, 0x0) setsockopt$TIPC_MCAST_BROADCAST(r1, 0x10f, 0x85) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) pipe2$9p(&(0x7f0000000040), 0x0) [ 2703.062547] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2703.074821] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:13:30 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffff000}}}, 0xb8}}, 0x0) [ 2703.112816] hfs: unable to parse mount options [ 2703.128701] Bluetooth: hci0: Frame reassembly failed (-84) 03:13:30 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir%umask', 0x3d, 0x80000000}}]}) 03:13:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xdc, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2703.223526] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:13:30 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x5437, 0x0) 03:13:30 executing program 4: r0 = syz_open_dev$video4linux(&(0x7f00000006c0)='/dev/v4l-subdev#\x00', 0x9, 0x410202) ioctl$VIDIOC_ENUM_FREQ_BANDS(r0, 0xc0405665, &(0x7f0000000fc0)={0xffff, 0x5, 0xf8000000, 0x100, 0x2, 0x7, 0xe}) ioctl$SG_SET_COMMAND_Q(0xffffffffffffffff, 0x2271, &(0x7f0000001040)=0x1) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x0) ioctl$TIOCSETD(r1, 0x400455cb, 0x0) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) r4 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000001000)='/dev/dlm_plock\x00', 0x200401, 0x0) write$selinux_access(r4, &(0x7f0000001080)={'system_u:object_r:getty_exec_t:s0', 0x20, 'unconfined_u:system_r:insmod_t:s0-s0:c0.c1023', 0x20, 0x6}, 0x65) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) clock_gettime(0x0, &(0x7f0000000f00)={0x0, 0x0}) recvmmsg(r2, &(0x7f0000000e00)=[{{&(0x7f0000000100)=@un=@abs, 0x80, &(0x7f0000000000)=[{&(0x7f0000000180)=""/112, 0x70}, {&(0x7f0000000200)=""/157, 0x9d}], 0x2}, 0x2}, {{&(0x7f00000002c0)=@pptp={0x18, 0x2, {0x0, @multicast1}}, 0x80, &(0x7f0000000400)=[{&(0x7f0000000080)=""/60, 0x3c}, {&(0x7f0000000340)=""/190, 0xbe}], 0x2, &(0x7f0000000440)=""/126, 0x7e}, 0x9}, {{&(0x7f00000004c0)=@rc, 0x80, &(0x7f0000000800)=[{&(0x7f0000000540)=""/27, 0x1b}, {&(0x7f0000000580)=""/7, 0x7}, {&(0x7f00000005c0)=""/250, 0xfa}, {&(0x7f00000006c0)}, {&(0x7f0000000700)=""/76, 0x4c}, {&(0x7f0000000780)=""/73, 0x49}], 0x6, &(0x7f0000000880)=""/52, 0x34}, 0x6}, {{&(0x7f00000008c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000000c80)=[{&(0x7f0000000940)=""/130, 0x82}, {&(0x7f0000000a00)=""/95, 0x5f}, {&(0x7f0000000a80)=""/49, 0x31}, {&(0x7f0000000ac0)=""/246, 0xf6}, {&(0x7f0000000bc0)=""/156, 0x9c}], 0x5, &(0x7f0000000d00)=""/224, 0xe0}, 0x3ff}], 0x4, 0x40, &(0x7f0000000f40)={r5, r6+10000000}) setsockopt$bt_BT_VOICE(r7, 0x112, 0xb, &(0x7f0000000f80)=0x3, 0x2) 03:13:30 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}}, 0xb8}}, 0x0) [ 2703.269638] hfs: unable to parse mount options [ 2703.288955] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2703.386477] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2703.431301] Bluetooth: hci1: Frame reassembly failed (-84) [ 2705.138905] Bluetooth: hci0: command 0x1003 tx timeout [ 2705.144397] Bluetooth: hci0: sending frame failed (-49) [ 2705.459023] Bluetooth: hci1: command 0x1003 tx timeout [ 2705.464519] Bluetooth: hci1: sending frame failed (-49) [ 2707.218936] Bluetooth: hci0: command 0x1001 tx timeout [ 2707.224344] Bluetooth: hci0: sending frame failed (-49) [ 2707.538907] Bluetooth: hci1: command 0x1001 tx timeout [ 2707.544300] Bluetooth: hci1: sending frame failed (-49) [ 2709.298919] Bluetooth: hci0: command 0x1009 tx timeout [ 2709.618982] Bluetooth: hci1: command 0x1009 tx timeout 03:13:40 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) r1 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/attr/exec\x00', 0x2, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$VIDIOC_SUBDEV_S_CROP(r2, 0xc038563c, &(0x7f0000000080)={0x0, 0x0, {0x7fff, 0x100, 0x0, 0x25b}}) ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r1, 0xc0506617, &(0x7f0000000100)={{0x1, 0x0, @descriptor="1bfc9ee5267fd001"}, 0x30, [], "19f91d79598ea935b5641677a5105f509de4d01387f88535b49319cf4603a12d7ac2df28db0ff4f229c74e0c27d1c6d6"}) 03:13:40 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir,umask', 0x3d, 0x80000000}}]}) 03:13:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xf0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:13:40 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}}, 0xb8}}, 0x0) 03:13:40 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x5441, 0x0) [ 2713.261482] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2713.273602] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:13:40 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}}}, 0xb8}}, 0x0) [ 2713.314938] Bluetooth: hci0: Frame reassembly failed (-84) [ 2713.336390] hfs: unable to parse mount options 03:13:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x184, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:13:40 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}}}, 0xb8}}, 0x0) [ 2713.391658] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:13:40 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dircumask', 0x3d, 0x80000000}}]}) 03:13:40 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x5450, 0x0) [ 2713.469158] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2713.482505] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2713.545094] hfs: unable to parse mount options 03:13:41 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1ce, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:13:41 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}}, 0xb8}}, 0x0) [ 2713.944361] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2713.952058] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2715.379042] Bluetooth: hci0: command 0x1003 tx timeout [ 2715.384444] Bluetooth: hci0: sending frame failed (-49) [ 2717.459020] Bluetooth: hci0: command 0x1001 tx timeout [ 2717.464424] Bluetooth: hci0: sending frame failed (-49) [ 2719.539019] Bluetooth: hci0: command 0x1009 tx timeout 03:13:50 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x648900, 0x0) ioctl$sock_rose_SIOCDELRT(r1, 0x890c, &(0x7f0000000100)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x7, @default, @rose={'rose', 0x0}, 0x3, [@null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @bcast]}) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:13:50 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_\nmask', 0x3d, 0x80000000}}]}) 03:13:50 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x5451, 0x0) 03:13:50 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x60b9e7fcd53ea83e, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000080)=0x408013) connect$bt_sco(0xffffffffffffffff, &(0x7f0000000040)={0x1f, {0x0, 0xb1, 0xf4, 0xd1, 0x5, 0x97}}, 0x8) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) ioctl$UI_SET_PROPBIT(r3, 0x4004556e, 0x7) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:13:50 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}}}, 0xb8}}, 0x0) 03:13:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1d1, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2723.510011] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2723.518630] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2723.560752] hfs: unable to parse mount options 03:13:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x254, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:13:50 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 2723.585231] Bluetooth: hci0: Frame reassembly failed (-84) 03:13:50 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_\"mask', 0x3d, 0x80000000}}]}) [ 2723.642578] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2723.687082] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:13:51 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x5452, 0x0) 03:13:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x300, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:13:51 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}}}, 0xb8}}, 0x0) [ 2723.728508] hfs: unable to parse mount options [ 2723.798014] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2723.815081] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2725.619028] Bluetooth: hci0: command 0x1003 tx timeout [ 2725.626281] Bluetooth: hci0: sending frame failed (-49) [ 2727.698998] Bluetooth: hci0: command 0x1001 tx timeout [ 2727.704741] Bluetooth: hci0: sending frame failed (-49) [ 2729.778959] Bluetooth: hci0: command 0x1009 tx timeout 03:14:01 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf}}}, 0xb8}}, 0x0) 03:14:01 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_#mask', 0x3d, 0x80000000}}]}) 03:14:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x372, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:14:01 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x545d, 0x0) 03:14:01 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) prctl$PR_MCE_KILL_GET(0x22) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r1, &(0x7f0000000d00), 0x1c4, 0x0) r3 = socket$inet(0x2, 0x4000000805, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) r5 = dup3(r3, r4, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) r6 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r6, &(0x7f0000000140)={0x11, 0x0, r7, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r6, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r6, &(0x7f0000000d00), 0x1c4, 0x0) connect$bt_rfcomm(r6, &(0x7f0000000000)={0x1f, {0x80, 0x80, 0x3, 0x3, 0x4, 0xf9}, 0x3}, 0xa) sendto$inet(r5, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r4, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f00000001c0)=ANY=[@ANYBLOB="02000000789814b9aa915cb18472836c3cdab87c3e738164a5c825c60efc79ea2d14968e1e09e74f636fd99452484e277f9908001fcbef216d6bd3628b2d6b9da11dba3cd922aa7c6bc805aa159be5a29bf121414ae93f948825ce7a", @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r5, 0x84, 0x66, &(0x7f000059aff8)={r8}, &(0x7f000034f000)=0x8) setsockopt$inet_sctp_SCTP_SET_PEER_PRIMARY_ADDR(r1, 0x84, 0x5, &(0x7f0000000100)={r8, @in6={{0xa, 0x4e20, 0x3, @empty, 0x3f}}}, 0x84) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:14:01 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x4) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) r3 = socket$inet(0x2, 0x4000000805, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) r5 = dup3(r3, r4, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r5, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r4, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r5, 0x84, 0x66, &(0x7f000059aff8)={r6}, &(0x7f000034f000)=0x8) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000000)={r6}, &(0x7f00000001c0)=0x8) r7 = syz_open_dev$binderN(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, 0x0) ioctl$BINDER_THREAD_EXIT(r7, 0x40046208, 0x0) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r1, &(0x7f0000000d00), 0x1c4, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x41, &(0x7f0000000200)=ANY=[@ANYBLOB="726177000000000000000000000000c84107667fbb8c4000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000abc094e0ae898838c29cbd3dd53f41874484ef1d87fffe76c36ccf4757f3c1664f64235f58a88ee2595d3fff9cc05f7973"], 0x48) sendmsg$IPVS_CMD_DEL_DAEMON(r5, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x4c, 0x0, 0x0, 0x70bd2b, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xffff}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x1}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x1}, 0xdf531fa8ffb34fbe) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) [ 2733.757921] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2733.763037] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2733.775069] hfs: unable to parse mount options [ 2733.796925] Bluetooth: hci0: Frame reassembly failed (-84) 03:14:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3ba, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:14:01 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_%mask', 0x3d, 0x80000000}}]}) [ 2733.846863] Bluetooth: hci1: Frame reassembly failed (-84) 03:14:01 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48}}}, 0xb8}}, 0x0) [ 2733.970796] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2733.971830] hfs: unable to parse mount options 03:14:01 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x5460, 0x0) [ 2734.029483] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:14:01 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c}}}, 0xb8}}, 0x0) 03:14:01 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_*mask', 0x3d, 0x80000000}}]}) 03:14:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3ef, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2734.164797] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2734.182865] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2734.225077] hfs: unable to parse mount options 03:14:01 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60}}}, 0xb8}}, 0x0) 03:14:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3f0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:14:01 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_+mask', 0x3d, 0x80000000}}]}) [ 2734.331243] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2734.334880] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2734.405938] hfs: unable to parse mount options [ 2735.858956] Bluetooth: hci1: command 0x1003 tx timeout [ 2735.865984] Bluetooth: hci1: sending frame failed (-49) [ 2735.872255] Bluetooth: hci0: command 0x1003 tx timeout [ 2735.883280] Bluetooth: hci0: sending frame failed (-49) [ 2737.939022] Bluetooth: hci0: command 0x1001 tx timeout [ 2737.944427] Bluetooth: hci0: sending frame failed (-49) [ 2737.950244] Bluetooth: hci1: command 0x1001 tx timeout [ 2737.955604] Bluetooth: hci1: sending frame failed (-49) [ 2740.018926] Bluetooth: hci1: command 0x1009 tx timeout [ 2740.024320] Bluetooth: hci0: command 0x1009 tx timeout 03:14:11 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68}}}, 0xb8}}, 0x0) 03:14:11 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x40045431, 0x0) 03:14:11 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3f8, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:14:11 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_,mask', 0x3d, 0x80000000}}]}) 03:14:11 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x18020, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r1, 0xc1205531, &(0x7f0000000280)={0xfffffffe, 0x3, 0x1, 0x8, [], [], [], 0x81, 0x7d, 0x0, 0x4, "7b6933a32ce6096d09fccb57c8d26a73"}) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r2 = gettid() rt_sigqueueinfo(r2, 0x0, &(0x7f0000000080)={0x0, 0x0, 0xfffffffa}) r3 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r3, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x10, 0x6, @dev={[], 0x16}}, 0xfffffffffffffdac) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r5, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r6, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000140)=0x1, r7, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r5, &(0x7f00000001c0)={0x14, 0x88, 0xfa00, {r7, 0x30, 0x0, @in={0x2, 0x4e22, @loopback}}}, 0x90) sendmmsg(r3, &(0x7f0000000d00), 0x1c4, 0x0) fcntl$getownex(r3, 0x10, &(0x7f0000000000)) perf_event_open(0x0, 0x0, 0xa, 0xffffffffffffffff, 0x0) ptrace$getsig(0x4202, r2, 0x2, &(0x7f0000000100)) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:14:11 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x2000, 0x0) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x2, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TCSETSF(r4, 0x5404, &(0x7f0000000240)={0x1, 0xffff, 0x80, 0x33ef, 0x14, 0x7, 0x4, 0x3f, 0x1, 0x10000000, 0x8, 0x7}) write(r3, &(0x7f00000001c0), 0xfffffef3) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f00000001c0)={0x8, &(0x7f0000000180)=[{}, {}, {}, {}, {0x0}, {}, {}, {}]}) ioctl$DRM_IOCTL_SWITCH_CTX(0xffffffffffffffff, 0x40086424, &(0x7f0000000200)={r5, 0x2}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, &(0x7f00000001c0), 0xfffffef3) ioctl$TIOCGSID(r6, 0x5429, &(0x7f0000000100)=0x0) write$FUSE_LK(r2, &(0x7f0000000140)={0x28, 0xfffffffffffffff5, 0x4, {{0x4, 0x0, 0x2, r7}}}, 0x28) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r1, 0x54a3) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) [ 2744.139315] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2744.148308] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:14:11 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c}}}, 0xb8}}, 0x0) [ 2744.180788] hfs: unable to parse mount options [ 2744.194709] Bluetooth: hci0: Frame reassembly failed (-84) 03:14:11 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3fc, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:14:11 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_-mask', 0x3d, 0x80000000}}]}) [ 2744.281143] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2744.321027] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:14:11 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74}}}, 0xb8}}, 0x0) 03:14:11 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x40045436, 0x0) [ 2744.371135] hfs: unable to parse mount options 03:14:11 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3fe, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:14:11 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a}}}, 0xb8}}, 0x0) 03:14:11 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_.mask', 0x3d, 0x80000000}}]}) [ 2744.422986] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2744.481851] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:14:11 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88}}}, 0xb8}}, 0x0) [ 2744.522534] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2744.556202] hfs: unable to parse mount options 03:14:11 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x500, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2744.597767] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2744.644426] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:14:12 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455cb, 0x0) [ 2746.258968] Bluetooth: hci0: command 0x1003 tx timeout [ 2746.264386] Bluetooth: hci0: sending frame failed (-49) [ 2748.338919] Bluetooth: hci0: command 0x1001 tx timeout [ 2748.344310] Bluetooth: hci0: sending frame failed (-49) [ 2750.418951] Bluetooth: hci0: command 0x1009 tx timeout 03:14:22 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x3a01d49341892956, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:14:22 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0}}}, 0xb8}}, 0x0) 03:14:22 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_0mask', 0x3d, 0x80000000}}]}) 03:14:22 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x400000, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x1080, 0x0) ioctl$CAPI_GET_FLAGS(r1, 0x80044323, &(0x7f0000000080)) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:14:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x600, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:14:22 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x40049409, 0x0) 03:14:22 executing program 2: write$P9_RRENAMEAT(0xffffffffffffffff, &(0x7f00000001c0)={0x7, 0x4b, 0x1}, 0x7) r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x5, 0x492000) ioctl$TUNGETIFF(r0, 0x800454d2, &(0x7f0000000080)) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x0) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) fsetxattr$trusted_overlay_opaque(r2, &(0x7f0000000100)='trusted.overlay.opaque\x00', &(0x7f0000000140)='y\x00', 0x2, 0x9b5d861a20e70265) ioctl$TIOCSETD(r1, 0x800455ca, 0x0) [ 2754.865430] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2754.877919] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:14:22 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x2, 0x3255d6ff80eca877) ioctl$PIO_UNIMAP(r1, 0x4b67, &(0x7f0000000100)={0x4, &(0x7f0000000080)=[{0x8d18, 0x97}, {0x2, 0x5}, {0x8d, 0x24}, {0xa1c8, 0xfffc}]}) 03:14:22 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300}}}, 0xb8}}, 0x0) [ 2754.929931] hfs: unable to parse mount options [ 2754.976498] Bluetooth: hci0: Frame reassembly failed (-84) 03:14:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x700, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2755.035841] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:14:22 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_Xmask', 0x3d, 0x80000000}}]}) 03:14:22 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500}}}, 0xb8}}, 0x0) 03:14:22 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x40086602, 0x0) [ 2755.111524] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:14:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x900, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2755.176114] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2755.208497] hfs: unable to parse mount options 03:14:22 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600}}}, 0xb8}}, 0x0) [ 2755.250725] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:14:22 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_cmask', 0x3d, 0x80000000}}]}) 03:14:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xa00, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2755.313127] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:14:22 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x40087602, 0x0) [ 2755.374166] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2755.414702] hfs: unable to parse mount options [ 2756.979025] Bluetooth: hci0: command 0x1003 tx timeout [ 2756.984541] Bluetooth: hci0: sending frame failed (-49) [ 2757.138929] Bluetooth: hci1: command 0x1003 tx timeout [ 2757.144361] Bluetooth: hci1: sending frame failed (-49) [ 2759.059075] Bluetooth: hci0: command 0x1001 tx timeout [ 2759.064482] Bluetooth: hci0: sending frame failed (-49) [ 2759.218968] Bluetooth: hci1: command 0x1001 tx timeout [ 2759.224379] Bluetooth: hci1: sending frame failed (-49) [ 2761.139021] Bluetooth: hci0: command 0x1009 tx timeout [ 2761.298954] Bluetooth: hci1: command 0x1009 tx timeout 03:14:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xc00, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2765.139286] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:14:33 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f0000000000)={0x48000000, 0x9, 0x23}) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:14:33 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x4020940d, 0x0) 03:14:33 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700}}}, 0xb8}}, 0x0) 03:14:33 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_dmask', 0x3d, 0x80000000}}]}) 03:14:33 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x200, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) ioctl$TIOCMGET(0xffffffffffffffff, 0x5415, &(0x7f0000000000)) ioctl$VHOST_VSOCK_SET_GUEST_CID(0xffffffffffffffff, 0x4008af60, &(0x7f0000000100)={@reserved}) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vsock\x00', 0x200100, 0x0) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000002440)={r4, &(0x7f0000002300)="fd763f88e31a3e7aa6408b285648c21f54c59843c3d1c96979af8a261c4d0e983e9ffdaae8f99ec551a99846a3eb93f6", &(0x7f0000002340)=""/225}, 0x20) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) r5 = syz_open_dev$amidi(&(0x7f0000002280)='/dev/amidi#\x00', 0x3f, 0x4b4242) ioctl$TIOCGPGRP(r5, 0x540f, &(0x7f00000022c0)) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r7, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$KVM_SET_NESTED_STATE(r7, 0x4080aebf, &(0x7f0000000200)={0x2, 0x0, 0x2080, {0x0, 0x0, 0x3}, [], "444e6397219ad76ec311ea5d2528fc4b9dcb694b4c6700f0d0403da9c15b44bea393ccdb722b6eca1b83a98e4f8f76e90882fa8c39e5abc11951179813ec9a359bfcae434bd9bb86d4aa8b862268f7d3502c00ebb58bcbf5f7e71c81b03d7d2348effa4630f9a14e705946f0f12747d669ee445c251ac1c9cb461a91f9cf057cf6c55ca52edfd4bde4b2d07c66408f926977c0d1f15da60514f1c61f8b1c1cd0a1c108307ecfeb14f1e8df1b52d9132fa5b739bbdcf6bfea39a823afea6a4796b1ab71003e373d0f039239f22bb3af59f860e8a0432002d83c28daf9fea9868eac05f1ad382847d46f9fd825641c96de1c9374e0dbedefe55ff7ff9e5e25eb750027dce384978f33271dc0ddf04286b18ce47b43d35aea8b06d4464f6891fe861d7eea78adbe32f73c928546492565b4d555d1c1fd3585ed47e99762ff5d97fc46c6c9b7a1280844c7727c38d09eff2545ff46e4447e978147864530823b4415129612fc58a786352b8c75a8c6e25fb17d3cf0bd7f05863edd70346574f76a432ac739008d30cdc3a771b8462e4dc0627da1f25fc0daecb82e8d09e6366a2caba7219eeaa5be04d5b8fa45d67ea47e898a914ba841b4f9fb0d8b7a9fdb76247645a9f51853d73420f67b2645648817edd6d77f410efe5fe79a5bf8685a791293b40994877017157b246d918f5db2f92ed22a3da294eed7c82edcb8125cc33087d0f9b9bd09dc00ffa86c1342c4639819ed52f84d202edb3a78f66fb836325b93fd407a94d12184041852c211bdd1d4b6660397ca52baa10f03919de32fa84c45d9cbd4f03fbe7407a36b9e58fc4930489f414592fa86a02efc57ef4d71bd564373a997677f1bec5b9231e36a587f87e1e17be15e6358985775693536030aa102444a1762e8edcfa2c286ff83f5ebe072c6245373e538f1e615be0acb33c8835c5e2ce53d397b61c062ba142b4f2d3e7cd7a70c537670b3fbbdd57cf513fbc7c77984d87ba1e2036955547c6cc6234d8d6489061a3315a00066110c20146a040db2327dad21e2bb43996ad85fa8e90b7b0a74db85e4171d2a6cea8d1cac79829befda5bbc717f02c9b00df70beb6ff2d63f09b596b3c8c739a8cb1cfeac0cfa49c45e5336845d3ddfccb1e99b6ce68b54f3e6e0bdb4d3fac02df24cc0ba435f80bb57b1cff3998e11aedcb70200c58768d84eacafdd2ea4d3fea30afc7ee8bf306f7c25ca2a89bac74cbd35e08ff86ee328eeed6bc269a7f32fd9814bfb5606a45fcbf48e1d9650d5e9faaf7f5c68bf7657160b15986ddb178b59e9fee18ce7273890dbf59bee7db95991f7da6932edc95ba41129bcd0fca847a8ea976793435013e9a365fbfca5df87337d42d872ac45036a4157812821e0da89baf163306677549d89944b00d948711e573b6ed5cc82afa5913d880d9bead1a3500ec9d495b29ca85f8044e9ecd624b2c00bc02b030d2c3a839c706b7b10552badd28110e5387f3422096de8e9bdb5cf108086c4f9d02143a06234e345d73bc41a43147e79405e886d51d5ca4f1e2ebe82aa72b47232abf9f945bdcb61bced67ee13c6314d5862920bb58cde2e4c4012e5cf601701ac8368ca45f806c333bebb756c12eb8b6b23a283be8c466ebf46f1eb3e1cd00d6ca7f7964648bea5546687dede27a8ae99422c074ad30c757f8329b2e54811d487697d23d67c3c1c7a1148df6997bf766173f30c9045a82c8fda2a124316ee7525ccf54806bd93531b48bd6a804d7975f18f1bcc2a4551cae367da0dafdc44a32c9ca8106fcd3ce6ee067bea8a03f2312bae95e2cab9e9cefda5e5cfa03c08516c5aa9fcd6f0f8e4aaaba1a8d30788f27c9204b6257f73d5d165d19773f5cf9d49c1854f561e0ee850cfc2ef25eb8ad2ac039ef1c145f027df421323c22d20f984b5390d5268f2f4bb09bbda2e24f54f620d06b56bc4c09411cae572da83b9078c611828bf7e5317d6175c1092db5a60c60ad79f4fa336e590e4a757e1529e3f7f510460389287079bb192b2a5827c51c9c458c689e0d7d054311e8adea4af1187e7efdce57878e073228d2631cd074244048e484d5f3603683746296e6106a39e50605fcefaed9c5c695c760e991c93d5f1c183659c0e683d16f83dc6e90df0cd089a3165972168563d50d8ef3cc46bdbbd779dac5d4af64080fe5654bdf1bb8dd0c0bf9e9bb59215a5907c363380596456fe0ef7d396d76cdd29e48046b4cef5e6d45c374da154b05b1fc2faa45c46f2e74a199a56f8565a6e26fd5efbb80d825195dc7acee0dbf8839322ed97c2d3962d15b9523b55c8196ec9c79b5927027c9c90a225d740d1e93d77b8f4ea68f186c1842196a76811cca528dc9657d52a820aaa39d432e90d2054feea6b5fccde9d07be553502e1a63559333d2459f4aefcc2be9e84544194bdbc1f32500ff1077419f3a568c3a7c42085085d8648ceb3c6acced440532369c224acb23c59ec72c641d31fec1568ade34e549a93dea7893acc8707cc244263cfc5f4d6656f98a633f90fe405710ca0eb80f0352000104bd459e04d19e97ac407886067ee1433532f81dd500547c8456d40b8d39325a9a525599f04cc8a27b1202947aa31fabba65e11b3fea1881885bb8a68cf9f3f4789e29bf8bae7d73de75dd659b101502ce3bc17345f95639ddd80dd52335ff5e92e2d3f29ebaa4a1fff74bb169dcf244ca4948053b62299ac1136bbd4ebaec388b2b30c11da40a48fb8e08e954ec82129822e20fb6c7ec559c8503478c1178b595093d71410bd28f79daff134626119a956bb02772a6244e9535ea32efab50a167d698c42b223bcdb7edb7c969b39e1a995be9d4c1d777638b34e697b8e05da996cc3caa20bb1731c045f7600fa1d0f30704d939211e8a4f49794ed4fd37a14801f8e22d5f55d7d5180c379a621032743555063a12dad50ede2fb4eb2cec9f4b7d2a48fe0ab4bf2e324afc9b6c76db0b87e97e7dd05a1daf265c718670e933eeb89aef9421896c3f16ec30c62570b63aa22465a39a51731ce7d675b2cad6ff30cbab47cd6d2fb4bf6b38311598867df4e4e852b4e20be40228bdd9d9f97e484f2418b68dd8b03c4ed5c6c567ecf8f0a097b9afe26ab3139fbea27078cf349802fabd4c3fd753a5ea0524ce3576659d95ff07da890674b12f1110b79b9cfbc881b25f34ca59d01a316d290d65b22e51efb9d3fedaed8598bcea82304592df20e0c2b9f69d72050618459084d54e7eed1b93673821fd70e9319515d93b3245412be2c320c3117652a38b253b420a0e36c1bf53981c83eb805417206ccd62d6ad1db09021f37e281d0baaf06a801ee28b6667d1478aeccc0b49fc772036349a61439f34a1eefaa29e43ec22abcefcc7d2ce51e82bedd478aa264dceeb44283581caf7f7c27a8538e91f6d606c8c31bc1a2473b3b91cddb1ac49163f33ce4edad118574a824301aabe5f242b52447d0919f2a51523e667f141c49a9e6d5251d0ed694ec1792b80d836f2058c080b98d447564ebc2082292d9d83c202f9e17b65b42088c30a7933ab16b1265cc221688f3082cb0a64702c836aeb44c8d65c109e56ed1afa950c8ef7de944af37b952214e1b913a4c9ad556e5aa2ad58e810e6c7348224c0d8893dd000630c84392f5143efd697a2ea936945c4e7d975682aed5aafae985817c33ebfb93831cee9c670f0f13679aa74e3dae58ba840818823706c9c1222a48b684603fddb8fe3d72fe8059d6848786dd30d74e1e7cd2b07a8f6ae0fe4b734158b33bc4dc23275695d545ab9b71ffe21d5555a37b74f224b8968c0f7975ebcb1b3d18cefee8402caa03529d668f1c5b8629d2f59d4bb95b1c33db0f7c29d94a9557fc42058b0cb5492d3081b9f9db475037d03e51ed88b3ed2e28805030186899db1eded08bc03189267f95aa908db87ec7527bd4f6ef036bbafa0de64ab71883d2068c240a21a30c345114efe96badd0fcfa2878d36bb7c3ac9ba17ec665fd491010b486fc76b8e5e76746d238a0f59eefdfeff1173c42fd61b29c5a225dc6d447383772210e6eb1a494f3a697297330558c77c93ba72047ca591e1b3e06047e6f8d0fdd148d566c6925d882f895ac678e92f3592f1691f09752921702b793b8f5950187d1d086d01a72d6fcf385f509976c41054e2af42dc33f1786a5731e19ffd6265e2a7b9a25a7bf4276f68a6379e8fdcc6ec55b4490f3a966d659da3b4b3053b7336075754be9b007f59bab9828dce29fa6e279c0f8cc854c30387502efa3c5623527f3507608efcbc78c6ba93575f5e26f337ffd1676d4901a1f38b2e99872386d17ac144a3c4b9a37379df67f02e723d5cdf1f6c8294328a8db01fd65dd7f6a48d094eb7050f0110569896e20dceae9f1a62c14d09b43aa4e5f684789d9a14a0156e45f588655bac90ac8a4c99c7de6ecbfaf732fbb8902c455417a3c1fd275bc79726073681874af568aa0dad455383ab2a20e64d8dc6dfbcf061e40448e98242272a88704d54ffc913161ca4d51e47f1e275235a5c46dc081750128f592ffc4223dc65b3dd2527e214cc25bc85891ab6743fed22c718164a13e41e7d927db856d02ce42114d80eb5ee0b86b227f72330510f005b5c9af5369dc044c63a0bfc3ce380f963d7721be2f1a9357454741d7274cace702186841b35787e64e44f3cbaf60290068133b1f367bbfdbbc8e10832772c947264cc8c31181324e7c44ecaee2833b23f9aafc2184235134361cd157d184811a99d141411dd2234a3fbaba74b2d8b63b4f30ee3adc17e70fdb547541f159501953933c0481234c77d028a2f00d62bba881cf79ec2f02127636484b492730360c0e0a973b1554d3b1eb89db34b06b87f6cc1eafa69bc4a50d1f347fb060646f0a39a12f71595805a80285c3068e8dd9f6c9996a04e9f4a556b56c5c3b6c438490b45bee918426cb31e9d836a539bdb067f705f47af94da6d07acd810a9bfff26594a46482a2f199ad01240743048ce00a788bc6a3d85ee59bb8a5a60eedc265d2d654fec7324e34922e6ca56c52c27254a6458f5fcb17d16fe41bb2b926f3f01caacfea94fa71c6ef2f73c170f99dbdb2f82e42646fa9a90e301bebce27a37c07a946da34968612f5fa9851f84a21fb8a0a6599cdacc708983f222aedf3afef2d10e04b0d738e01808114c28ced05a48c65edcb74a278a24f5ef3fe70e2042be5eba97855ed2d68eff6a1911cdd13a187fd1f0f00c58474b09bd47b8261c43c223a766d0e0fe34e7eae6936d694bfbcf65ff46b393afd21a225e87183b601bc9480cb5ebf466330c5292a28d5aeccb6eda9290b441b25019f872112e947472288446500c381188eeb5e13f1a37c4386f73be3a0f6b303bce6fee6a4266b56c185cfe54c4818da87da2db869c94bb41da2a429d22014f4a9fcebbf180daf50949ec528a9309e0dffab97bfa01fbbf43501692aba4875b2dde96fa1a7c781e9a2737ca782ab4073f60daff0dfb906363ab97fcb040a4f29de583c3c707845f709fea273a64d2434ad57dc33edd94d1db058414b008188326abd0e9298eaffb74ccbd92db1dcf6d4c61e934aa1e1f31d28258fe8cafc783e629e0cc7f862a05f2d3a583e612dd3e8ceb46a55492d5b18ff8c5328b04a26f6f229d324ab2730e4d910899cf8ec5c8775f1cbc7d97fe571aa3e64f9b78ec258da670d74745005e4d9c5f741652199efd6ec296256c254ce3eeea7f30c9b882625ad20dec35207ec4dc0996b55f94eb9abbe6bc2ec32b3444c8a1f3ae9353cbe30", "f4d60dcf45d2fe93ba5647df2693d5226451ca5fb88ca3baa2a37e45dd797818c93c1eae5ac9a5cead5c3a0e60de0e76e4ab5461f41aff424a5a0a260faeb356fecc7b6c09110d7d92365884bc0dc5e2a8c23bb74baf4331d27264f6a392728fec13cd3d3a5a272be0faf34f229a30d0029187bd6944f91b922186a0e3f73a7f19c9857025d16b6a1d61838a345d375ec043849ce937a0f20c0ef4db810ed694433ddc4a45106c9e3624d92777733e96b1982cd5713efe54109a65ffd6d3e5c938bb84115696e7dd4ea5bb2a48d0089e905163a66bd6e507412aa50d9f72c1a4e4b78691f1786415021b7fd6a5d41756b55712c4e2adb404a490f6705cd1a6dd46a23470d9cd567dfa30996d835967705fa2a2c3bdeffc09d7d67b487fadb4e70bac99ece8fdf1a47d24bb0c303c8c6abc467fa5a696ad46c46160f6f45fc4b29c500115e7c3ff4b8b633592013d671d204980990ead3adf9da62b0280a8ccddef5813cf5611d8ec62718063a13b5113aea808033fa485e17355add038923bd798837b2931e6ec7bc7d2947cae93e719382000bf29a49c70756c8b61e37099a7d7053a8d9a8caa473f3142a2325e41c36e905a8ca2865b6c1fbf5743e48505d680b15079a04a6caf31066f2b1d691e86ab2bd9ac37e67eb2dac6e41ec95598000131b191e1c4154634151274c209c70bd13fcf861d44a1155f2812710078f9c27ee53bebd46c49adf101176b6227997f5d2c14deae3ec60d0cbc8974d591cedbc165877b89b430612b70c55235a9100aa9607ad8db90f1fd40064ae1b9501b50bcc332cd653f01033f131b0bb46022b1e450944ea006fde980c72165ce48c75bf32d19c56b0d40f536e486529556ca312fbab7cc5bfacb7b8fe0b65ddd19541b4fcd5663cde572333eae640daf47082083ece56f44302937d6d2f9a32b61eae5e5b48c09d036212fa7cef1486fa853426a12bd863dddbe7db9a427e634a5ed2ed73cce94e7cab13b66130e79de14560868076eb9be9a66fed0b7a6532358e9374f309bfe7da2519b135d51187b00b3584385cd9ac982b7215429f09482989e0a48ae8a159689e2d839384f89e53e0faa5baabaad29d3c059485601ed3f47f1d13be13d6b74961b15b3c7e6d144dd2f5f2d240cf2526ebb728bd17e64c4f74df4c230f16b513fa5f319bfddefb5d0a7d0a7ce88157a1a44a593368377dd5b3e685318c06e1bf684f7191a35a4bf36b926fe95f0d6b5671718cbb22d06004a3dd5ddc8a7a0c94d9e499f4bece6996a831061cf72fdf97b2b37949ea4596d73f9a5708402cc32437bb49a0b64fae0927e0a2e664d9bb70b16bfd6d3d172f03b85439a7ee1139815ca20ee3907c82286b89cd6e03f0e386dab259114e4470b19ecef8ce3319fa0aa152ed1653454e60a7121574fefc5a21a13c6089fbf358814a88b5e7e12682773c9f75297cc22f2c35c0d9ba33b2d9bf2f50297907c330feb158f5bab235bf79682f160b7821f575ecd9cfd148e7452f248f5dc97e5b026ddde3190deb6eeb768b4f0879e45406e8c021f3492b70eaff254041b2b30dd68ae9225b6e3ba5d81c4c736a7aaa2e69e77db9c9468f76eace20490b4a28e0a358e127a8c85117a8ae5c94289900462af1055e73558a08230ba4ade50e92ca637b4ba3fd3949cd83cfa7e6a4ab0a959b98f24ddf505d2a3d3302dfc7cbb713343a8ee7137472cb9a8f8004da45c2567c8bb6db4fd524a3c0d64915a01a497e5e176a107692d440df3aba1e9d3f522938e143a6fdc725375d0c9e1ec00ca095fb6d0f057d6e459c0fcc449bb94f9e72edddc56139d1b055046e5f1839b797e01c8e0f233496a3823f74d2e5c15a50a5a4866f47d96ca65e2f55e9453a9070aa57740961dcc99130b17a38e5c532eaf60b0da3622b65e797f706e89091a7733c7d90c964bcebea74e9792ca8e3d6ab5161c7759edcf7091e330421e0f8ca997e12d8f48167dd1d36b04c7f8b7589b74d3e865ed3f9f987864e84657541308f5c95afd04181827c4f1c2d6ae649e2dd9e177de85620e5ca917f281a011a0ce2787b4f8f778f6b573ee9958284616b1603169fdceec07271de121bf11cbffd26225b105914b7da5f21489acae30a5ed8b304f658603d7dc2a3d881fe23587784e8f0787baaaf4df3f86b94b7e7bf865c5eaf234da1fbd237f10cb12841f8e656bd76a631ff0917f2e9d651006dfbca341a087807cc81488787091a272bf70faed167434558061c86a058c0b8c66b9dd5cf1b0e862ee6dbc5eb6262b6a96fb13633875596594a1c9c7a0f33965dca0e79a258b351932ee09eb43408c94621fb99ec5013107b599f3cb8879b3347fc70fc8ef3ffb2c462b0c46255e4dbdd44e3d4b9bb1c6967e1e55862fcc9d37dff3594963555c1c38aad03574e417dbc990cf0b42900a033b46c8b92bdcbab748bb42b4c6fe8f948be1ed241fd09de8dce9a5bc95bf7b775a7218a2a8c7ea019b5c0334123506ecc6a41e2822cfd48afe1ad294c2e509a55a9773b4673806892de531d1081f2c65afb0c78212b6e647fa376a980992e0a61167eadd2709cc5f297cb3cc3392d8181d42dbbc3c02f66b0784548823162988e6f558966c1c328c46b5928e7b2aaea431f3b43d3acf6ef78d30c33d12c1a03f38d2c67d5a7b6fe6ff8fe2424014cc6c02afa6190d85e4bc00561ee862067e69639c262de2906fe8aa072a14e62bf5af9e7ffed5c0e70e07dd86d2b43f2fd619f8df3e175ec9eca91102fd9efc75e7e84ddd97d4f69e55a6525626212270eca7ebf7521ecc06afa6183446e528baeaf8d3abd7acea6dfac944f15324e25647a6125db45929e7c85440775e79a4fbadbb17f3ea7c8aef1e3f15a351cc8f0f3a1e05ee680feaf87d39282cf4b30ba16a6cb4b6418ba7e8d8172afc0db9860016a55b6523b51b6adf2d5eac979b020661cdad3985cbffe61a985ffbded97e38232495c235f046e8b02711f40f85d7899c2c5fc320961e8bff6714bf04229503e5599811323bf6854deaf0f3f6ad2f479cbffd5c51d7496dff8e7465fabaaca433bdfd82de447f1e8cc479a497bf70e383467dec1597be85032f59a4f440881b80761166ea0362cc7474c0bbe2c3642791c486b53ef53d893382a52566351455da7b8a17a437c73004324739f14cac588a1e95f5e2965f599a11c5d2d30be659c19f91c77760269da1799153b94264de828dd11ea4dab876a59da27ec3f92a6a922bd96c791a492726fd336eedb422eb2c73c9d523dcf402d347caf738364415a4a6b27c706c6761a021d36db1d3b71595a286498a4385b853bc1703682d5b7d7dbc3fc6db2d92e9e8b5f46230f00f8525eac8b3eb58bf1b73af41e389d26ae12ef6c3d37887ce24142d4d46910c41c16895095f9345f2ddcd47215a8bff4010edae26e73978e015cd280b28322d4d85bc5000d93e1b4676899348cd2cbbd5996b6a3cd68281b3f0114ae4eb32706b36bfb269c6a324d2d0c302a583f8f5850567ca964d329970ad6f32128767a749e0c1dd2b3031b2bdacec0488662154522ac1edbbbc22c526ce424519f0e6ba36dc095f1f8f9d384735a47f006308f8723af77b6d103603a3a420b7a0a01dbf6e1153e009714170b99fce7854598f10240e92176a1cf3f0e2a3a8ec7c10dd60f12f0e785189295ada622be41227919429febba7003aa3b32b4e0d9434757d0c29083894af2a43661cb129fd59462fbf0049a42bd830c3d6513c549bdb36979473d54de2ad045f1f70a73c3f295bff170d5866c4fa2c14aeafd10a2bf3b9f58d05a1dd9ae8abb3385ffbae2c24e901b06670a9521335c98403f69e9a885852044471c6cb2d5c6ca00cb2582609e90ec873509058c39c019aaa1fbab4f59c31283c21c46426e8257b066f3ce4970c42144b7d9ebf5f0a74b0d0497065a920259237d6713fd9d053e04a29fd9be90e306fd5b7531ac509930004bba9653ae3276d2003fe7e30ab05738cd727c5dc06d63214498ddef7ada809a1bdd116b146a63c68ae2c280c4cb253497db56ebe4f1bc3b9b2ce9f40c9ea50f87bdcbc38cb69f572ab8b8dc6a5155b2ad1ebb013f76ea777bb34120129458c8d43af5c6c46fb52aa2cbc6e00fc0db7d825831e93136ddbaa187b005f1d71c78010c80facdb2eb72ca3fbed0d85709a67038d222f5ce6500b835d1d61c4d9452247b0a38f54da10358c5b7106ff8d889f76a5e07d112abde572688a9ea5e43ac421e0a56c9af64f8adbe599b857e1f3787867dc0e809b713829d0eb4c60600691d498470cc93a8f9908ce9e989e25ba275addb833d5dbfa2ca340ae155b5106d05c73e2871c7e9ca6956abce0692e66d0c8be4fe933d8ac7287cd95cc63447521fc0a394d43ad1f13d626b90e295f66b58dc2597dd39bf9672a9ce7e42e11d9228bc2ce5ea50952a0c312ed2fdd0131859cfbdd2041c4dc306927f89efca8b9004a888b5030b7ddb9cb9c3d83439afe2b5cbb04b6fc561f603d43278af4ecef5b8111ff2f70735e0ab890cd8a88784b2aacf5da363e6f57b6e84afc27b0399ce97597c197ac680f5944180d47a42af6f74b4509e9bf13db5adab734a2c9d5dec5f412811614a69d933355158efdc454e1006009006cb104a7f1a0e0c6cd0590c483a35a95040ea11216c4b896ff98c0014000bc310d7aa100425ae2d3622229b1c5f5651086da206cf26e6d0b81fb5eb928827dcb95e5f1ed36ee2e58e204d9868b7cb3eb1a5b15ce36ecf47df2df4be45de0a1468f57f99db19686c383d930b025f36b7aa265d2cfd96a75b8370e5c021f26acdc8f15df09f3ded8f7c2de06ed2f0235c047aee4e02fe857a4a3703590270f65922662cc2647a994ea2c4c3bbbfc726d4a5c39bfce8c664f743d47356d10efd04e4a342d11d958d09774d970c706682ea6a033e103427610a13d0c636dd525aab90654e0cb8d561a378d31b839a7a8b14fe411be071748b830af81ae044813a69583f050b60e33b43300c54565a9100de52f24dea7a3dead6536676d9452a5d2b77c541a257033267c6f45bb07b2e38f110b1eb02e5bb461e161ebc2a057a572763b43bf93d47c0d13efbcc07f99ceef17c2e46fcdd2cfa68539d57c51ed688a34878b943e9f213954def871207da4ed6b801ef1016b4f2f24e93e018a8dde2741559d91760f877fd0093edfb87602adc95b2cbc7474b0bf412629aeceab7feb6999f4206cadc4b4bbe91891319a615da93f4676a24d00b8bd4a9302c97d56ef40e555a0e96b744a7e861669c12fde4e76589cd4f123c787ae99a65e0dc2e4896f6b7c644b2a3b140d4af60caef66076db70e30eac67cada5dd18b5c14f4ab5eaea60471fc4b3ed3ad1c9fdc2f1548421608e1fb0946dcbd3dab4beff15b84474b5487dac7f29f065e9fd351e22b143c7f1f8cad5e3d7e7bcaa6663c074cbccc4e24e6788ae590562ab740b0b6b2d8bc871cd9d6f3e8ea0b0bd7449dc0e0a3cf5bc9c68c606db396738bca9afff548fd8e43289eab0357b838ed9efab12039d5fbe6221e345c4e23914713efc77ff3eead1b760a84e57d9201cb68f8083bf4ce42ae4d19f362a209a146ffaf3a4a5f6a05c5aec35759a241a69b35fdee123ca8ec0139e42738d4c33b977b4327bce8d092a6b8257a53e02c828de21989e7dcbbde8c37a6c8cffbbe4a8c9f948e0ff8a4d11d505d933482dfb87d7f8634bd5cf39d3e3c0a5556fcb506a90c46598761f6bbe765d3fd629ab210f4520cec1fe6978c4b36f2d461177431"}) ioctl$RNDGETENTCNT(r6, 0x80045200, &(0x7f00000001c0)) connect$bt_sco(r2, &(0x7f0000000180)={0x1f, {0x3f, 0x6, 0x3, 0x1, 0x40, 0x4}}, 0x8) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$TIOCGPTPEER(r0, 0x5441, 0x2) write$P9_RLERRORu(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="170078d70224000a002f6465762f70746d780006000000"], 0x17) 03:14:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xe00, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2765.742843] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2765.764772] hfs: unable to parse mount options [ 2765.774565] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2765.792152] Bluetooth: hci0: Frame reassembly failed (-84) 03:14:33 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00}}}, 0xb8}}, 0x0) 03:14:33 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_imask', 0x3d, 0x80000000}}]}) [ 2765.841884] Bluetooth: hci1: Frame reassembly failed (-84) 03:14:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xe15, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:14:33 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00}}}, 0xb8}}, 0x0) [ 2765.927588] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2765.963814] hfs: unable to parse mount options 03:14:33 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x80045430, 0x0) [ 2765.988306] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2766.027963] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:14:33 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_lmask', 0x3d, 0x80000000}}]}) [ 2766.138251] hfs: unable to parse mount options [ 2767.859086] Bluetooth: hci1: command 0x1003 tx timeout [ 2767.866677] Bluetooth: hci1: sending frame failed (-49) [ 2767.872906] Bluetooth: hci0: command 0x1003 tx timeout [ 2767.884005] Bluetooth: hci0: sending frame failed (-49) [ 2769.939159] Bluetooth: hci0: command 0x1001 tx timeout [ 2769.944876] Bluetooth: hci0: sending frame failed (-49) [ 2769.951151] Bluetooth: hci1: command 0x1001 tx timeout [ 2769.956627] Bluetooth: hci1: sending frame failed (-49) [ 2772.019066] Bluetooth: hci1: command 0x1009 tx timeout [ 2772.024504] Bluetooth: hci0: command 0x1009 tx timeout 03:14:43 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/yev/ptmx ', 0x2204c0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x40000, 0x10) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f0000000080)={0x9, &(0x7f0000000100)=[{0x8, 0x1, 0x20, 0x2}, {0x2e, 0x0, 0x6, 0xffff}, {0xfff, 0x1f, 0x8c, 0xff}, {0x5, 0x8c, 0x4, 0x4}, {0x3, 0x1, 0x7, 0x5}, {0x6, 0xcc, 0x13, 0x7}, {0x810, 0x1f, 0x9, 0xf95d}, {0x55, 0x19, 0x1, 0x5}, {0x101, 0x1, 0x1, 0x7f}]}, 0x10) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:14:43 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00}}}, 0xb8}}, 0x0) 03:14:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xf00, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:14:43 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_omask', 0x3d, 0x80000000}}]}) 03:14:43 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x80045432, 0x0) 03:14:43 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) r4 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r4, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r4, &(0x7f0000000d00), 0x1c4, 0x0) r6 = socket$inet(0x2, 0x4000000805, 0x0) r7 = socket$inet_sctp(0x2, 0x5, 0x84) r8 = dup3(r6, r7, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r8, &(0x7f0000000240)="92ab9c7b2774556d82ca54aa7f475aa206e7eb8109", 0x15, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0xb) sendto$inet(r7, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f000025e000)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r8, 0x84, 0x66, &(0x7f000059aff8)={r9}, &(0x7f000034f000)=0x8) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r4, 0x84, 0x71, &(0x7f0000000100)={r9, 0xffffffff}, &(0x7f0000000200)=0x8) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) write(r2, &(0x7f0000000180)="42cd339d0fd734a528dac1c00103bcc6bb6a362b49de79ab797d3f59aa1941a28b8b1c1435d9ab4a2bb0e04dfe84dd98bbe192df86db5809cfcccf1dd48aac81c355ffb26cca", 0x618cc60d) ioctl$TCSETSF(r1, 0x5404, &(0x7f0000000000)={0x8ba4, 0x6, 0x0, 0x2, 0xe, 0x6, 0x0, 0x9b, 0x1, 0xffff, 0x80000001, 0x1000}) rt_sigreturn() ioctl$TIOCSETD(r0, 0x800455ca, 0x0) [ 2776.004411] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2776.009379] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:14:43 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000}}}, 0xb8}}, 0x0) 03:14:43 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x2) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) ioctl$KDSKBLED(r0, 0x4b65, 0x4) [ 2776.072818] hfs: unable to parse mount options [ 2776.090688] Bluetooth: hci0: Frame reassembly failed (-84) 03:14:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1200, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:14:43 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_pmask', 0x3d, 0x80000000}}]}) [ 2776.170762] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:14:43 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x80045438, 0x0) 03:14:43 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00}}}, 0xb8}}, 0x0) [ 2776.237248] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2776.293819] hfs: unable to parse mount options 03:14:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x150e, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:14:43 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_smask', 0x3d, 0x80000000}}]}) 03:14:43 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4800}}}, 0xb8}}, 0x0) [ 2776.347406] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2776.368467] Bluetooth: Invalid header checksum [ 2776.373515] Bluetooth: Invalid header checksum [ 2776.419204] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2776.454502] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2776.470069] Bluetooth: Invalid header checksum 03:14:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1800, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:14:43 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x80045439, 0x0) [ 2776.500677] hfs: unable to parse mount options [ 2776.551590] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2776.586383] Bluetooth: Invalid header checksum [ 2776.689223] Bluetooth: Invalid header checksum [ 2776.809133] Bluetooth: Invalid header checksum [ 2776.919263] Bluetooth: Invalid header checksum [ 2778.098983] Bluetooth: hci0: command 0x1003 tx timeout [ 2778.104385] Bluetooth: hci0: sending frame failed (-49) [ 2780.178985] Bluetooth: hci0: command 0x1001 tx timeout [ 2780.184394] Bluetooth: hci0: sending frame failed (-49) [ 2782.258995] Bluetooth: hci0: command 0x1009 tx timeout 03:14:53 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_xmask', 0x3d, 0x80000000}}]}) 03:14:53 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00}}}, 0xb8}}, 0x0) 03:14:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1f00, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:14:53 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x80045440, 0x0) 03:14:53 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0xe) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) [ 2786.225880] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2786.242715] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2786.253777] hfs: unable to parse mount options 03:14:53 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000}}}, 0xb8}}, 0x0) 03:14:53 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x13) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) ioctl$TIOCNOTTY(r0, 0x5422) 03:14:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:14:53 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_u\nask', 0x3d, 0x80000000}}]}) [ 2786.367464] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:14:53 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x800455c9, 0x0) 03:14:53 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6800}}}, 0xb8}}, 0x0) [ 2786.450231] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:14:53 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x70000, 0x0) ioctl$EVIOCGPROP(r1, 0x80404509, &(0x7f0000000100)=""/102) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) r4 = fcntl$dupfd(r0, 0x406, r2) ioctl$TIOCLINUX7(r4, 0x541c, &(0x7f0000000080)) [ 2786.527114] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:14:53 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00}}}, 0xb8}}, 0x0) [ 2786.587564] Bluetooth: hci0: Frame reassembly failed (-84) [ 2786.594530] hfs: unable to parse mount options 03:14:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3c00, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:14:54 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_u\"ask', 0x3d, 0x80000000}}]}) [ 2786.694334] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:14:54 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7400}}}, 0xb8}}, 0x0) 03:14:54 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x800455ca, 0x0) [ 2786.739016] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:14:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3f00, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2786.837726] hfs: unable to parse mount options [ 2786.841241] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:14:54 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00}}}, 0xb8}}, 0x0) 03:14:54 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_u%ask', 0x3d, 0x80000000}}]}) [ 2786.963527] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2786.970893] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:14:54 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8800}}}, 0xb8}}, 0x0) 03:14:54 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x800455cc, 0x0) 03:14:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x4000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2787.050982] hfs: unable to parse mount options [ 2787.121502] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2787.145143] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2788.659091] Bluetooth: hci0: command 0x1003 tx timeout [ 2788.664495] Bluetooth: hci0: sending frame failed (-49) [ 2790.739067] Bluetooth: hci0: command 0x1001 tx timeout [ 2790.744605] Bluetooth: hci0: sending frame failed (-49) [ 2792.819022] Bluetooth: hci0: command 0x1009 tx timeout 03:15:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x4087, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:15:04 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_u,ask', 0x3d, 0x80000000}}]}) 03:15:04 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf000}}}, 0xb8}}, 0x0) 03:15:04 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x80086601, 0x0) 03:15:04 executing program 4: r0 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r0, &(0x7f0000000140)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r0, &(0x7f0000000d00), 0x1c4, 0x0) accept4$packet(r0, 0x0, &(0x7f0000000180), 0xc00) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptix\x00', 0x8a800, 0x0) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000080)=0x0) sched_setparam(r3, &(0x7f0000000100)=0x1) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0x8) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(r4, 0xc040564b, &(0x7f0000000140)={0x1, 0x0, 0x1004, 0x7, 0x2, {0x2, 0x200}, 0x1}) ioctl$TIOCSETD(r2, 0x400455cb, 0x0) semctl$GETZCNT(0xffffffffffffffff, 0x4, 0xf, &(0x7f0000000140)) 03:15:04 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x469, 0x20040) ioctl$KVM_SET_LAPIC(r1, 0x4400ae8f, &(0x7f0000000100)={"5199edc0c8e79dfb70b027803477cb0f9b4c9122834b2aa2f4cfd91b37f567d3042091cc16f97743094115d8b1ec26ec022109531d0d7dcfa20a769f3fe2adf3e4d2909dd74528324ae75b1ffa996c0d071d44a71bd020242f1672459c797740d9273dd3df3ae9032a8a4ee46fd25bf0cb6f372033ff3825084174aed56aa7f41b112f786eb1799a55dda5cae38ca5f50a2ffc86167b6bfa16ac08a6958d4d11b89f1b095961cbccef9420f323ef5c549bc018869e2be3f923e10da08987905df783292a826e13aabc3cfb99ee6a889c42f9895dd69bda2eb4ac0078d08e0768161512d37cc6aa7c7861d311030dd757987e65d25aa03c07e93dfe4d4ae45189f12ecb4858d9fbcef5daa7187ece7c173b6513af2856e760159ed3d4f81a2a6613b87c914eb11d07fa9f9930d0082cc6532eac1556c30531735aef37f41447f26a4a7b057700b065f64d1eae6ded6ad2e0faec4e47777b61117a5157ef3eb4673bafc22efd9f23663a0d6d256e737ab4193671654b6633ef80a61140c45c37e5ec8a76e6ec8f850c3af3d2db81b6a8ec3216cfa1dd599486c40801913a56d39cbca18fd29e1258c95edd4d25abcc2eaacf865139cdf62ec902a81f2b5e791ef155d58eae1757055f3faf0beb3c62967e9a6b07ab23b516c6e922789f329026da8f1f39c788e4638743b07ede5069b183dc15fd3eb89fa51c45bce2236af12fbcc04841a5ebe49433e9929fb01ebaf51ab132a700a6506ba76b70021c6deb5047b9424cff30af2acb44aff37d533f756af83117cd493545f6b9b8622d5533adad89e7b941bd3ccb7a2dabba71433bec93a6bfbb253d41b0bc91d909a30d8382bb6ccebab436e473eb1239fa85cebb4e50b3ccd14579284118351428a41ad6467fd5ab02885fc3a93d31957ec22deb493a07f6dd94f3695e2817b19312be2fa98dbfc3b4a7e6068bdf6d1f27fc2ba763dbb90048aaa2be3688dfd022e99f220d08d20d5a3173b7fa5853508c8efdba69e9608df6c1ae507c0ea1b35ee056e456b28fcae4765d9c4f6ca48eec5c2cd786310a8ba54f43f4de79334b56136c9d7b6923f71e57a0836b94b065af0512c746cb7cd9cedfd1cfdeb714f7332838af17ed9edb5d296fbafa28e4660af086f587934043a0239b0bdede784428c40c5aa88b7f0b049494f3b1bd588cca653b2d8a452ceeb914e2f943b5b82bf8055594c5ddc1710814fe3910a69738f187718a9abe21807de30b1d44888ae60df2a0f8216109305d1ff7962f3cb7ce44f8ac469c9aad81c1584b65f41d9720cc73d775deb38582fc5594a4cf5575365f00ff28028a88ab11fb1f61689c59be76173ae00e9e8a7c2e4649c52470954cf6915d1ad7273e4372a697a7a67aff649151eb359f5674d673e251335db702738fdf97fed189c85f6bc1cff1231374a52026b2ff7442"}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x1) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r2 = add_key(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)='@', 0x1, 0xfffffffffffffffb) request_key(&(0x7f0000000180)='id_resolver\x00', &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000200)='proc\x00', r2) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000540)={0x0, 0x80000, r4}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r3, 0xc00c642e, &(0x7f0000000580)={r5}) r6 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000500)={'syz', 0x1}, 0x0, 0x0, r2) keyctl$setperm(0x5, r6, 0x6020100) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) [ 2797.095393] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2797.114539] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:15:04 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x34000}}}, 0xb8}}, 0x0) [ 2797.166874] hfs: unable to parse mount options 03:15:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x4800, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:15:04 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_um\nsk', 0x3d, 0x80000000}}]}) [ 2797.265363] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:15:04 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x80087601, 0x0) 03:15:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x4a00, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2797.306182] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2797.318384] hfs: unable to parse mount options 03:15:04 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400300}}}, 0xb8}}, 0x0) 03:15:04 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_um\"sk', 0x3d, 0x80000000}}]}) [ 2797.424731] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2797.451631] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:15:04 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffff}}}, 0xb8}}, 0x0) [ 2797.487414] hfs: unable to parse mount options 03:15:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x4c00, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:15:04 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_um%sk', 0x3d, 0x80000000}}]}) [ 2797.598046] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2797.625936] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2797.637440] hfs: unable to parse mount options 03:15:05 executing program 4: r0 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r0, &(0x7f0000000140)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r0, &(0x7f0000000d00), 0x1c4, 0x0) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000000)=0x7fff, 0x4) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-control\x00', 0x1, 0x0) write$9p(r3, &(0x7f0000000000)="0600000000000000c9b9000f050000002a1ff7adf576f3790f68bc2c197cbf8d63735a09ab8383afd2de1a5587fe067fde18fa64249e1dabdd9514480a16f3733d18f833b3aacfcf04f7b0bdd78687423a6bff51b9f9218a249e3d00"/104, 0xb3) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x0) ioctl$TIOCSETD(r2, 0x400455cb, 0x0) 03:15:05 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0xc0045878, 0x0) 03:15:05 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}}}, 0xb8}}, 0x0) 03:15:05 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_um,sk', 0x3d, 0x80000000}}]}) 03:15:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x5402, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2798.044345] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2798.060521] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2798.070994] hfs: unable to parse mount options 03:15:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x5865, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:15:05 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}}}, 0xb8}}, 0x0) 03:15:05 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_uma\nk', 0x3d, 0x80000000}}]}) [ 2798.171610] Bluetooth: hci0: Frame reassembly failed (-84) 03:15:05 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0xc0045878, 0x0) [ 2798.240769] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2798.244945] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:15:05 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000}}}, 0xb8}}, 0x0) 03:15:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x6000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2798.324357] hfs: unable to parse mount options 03:15:05 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_uma\"k', 0x3d, 0x80000000}}]}) [ 2798.383839] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2798.411970] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2798.529212] hfs: unable to parse mount options [ 2800.178910] Bluetooth: hci0: command 0x1003 tx timeout [ 2800.189064] Bluetooth: hci0: sending frame failed (-49) [ 2802.258931] Bluetooth: hci0: command 0x1001 tx timeout [ 2802.264333] Bluetooth: hci0: sending frame failed (-49) [ 2804.338989] Bluetooth: hci0: command 0x1009 tx timeout 03:15:15 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x6558, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:15:15 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}}}, 0xb8}}, 0x0) 03:15:15 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0xc0189436, 0x0) 03:15:15 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_uma#k', 0x3d, 0x80000000}}]}) 03:15:15 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) ioctl$sock_inet_tcp_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, &(0x7f0000000000)) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffffff, 0xc0206434, &(0x7f0000000080)={0x1f, 0x0, 0x0, 0x5e0000000}) ioctl$DRM_IOCTL_AGP_BIND(r1, 0x40106436, &(0x7f0000000100)={r2, 0x4}) [ 2808.645441] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2808.651845] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2808.665070] Bluetooth: hci0: Frame reassembly failed (-84) 03:15:16 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000}}}, 0xb8}}, 0x0) 03:15:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x6800, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2808.702588] hfs: unable to parse mount options 03:15:16 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_uma%k', 0x3d, 0x80000000}}]}) 03:15:16 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0xc) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) bind$llc(r1, &(0x7f0000000080)={0x1a, 0x0, 0x6, 0x8, 0x1, 0x75, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, 0x10) [ 2808.776691] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:15:16 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000}}}, 0xb8}}, 0x0) 03:15:16 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0xc020660b, 0x0) 03:15:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x6c00, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2808.852708] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2808.877320] Bluetooth: hci1: Frame reassembly failed (-84) [ 2808.897388] hfs: unable to parse mount options [ 2808.956369] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2808.975340] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:15:16 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_uma*k', 0x3d, 0x80000000}}]}) 03:15:16 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000}}}, 0xb8}}, 0x0) 03:15:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7203, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2809.103926] hfs: unable to parse mount options [ 2809.104797] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:15:16 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_uma+k', 0x3d, 0x80000000}}]}) [ 2809.154735] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2809.241226] hfs: unable to parse mount options [ 2810.739039] Bluetooth: hci0: command 0x1003 tx timeout [ 2810.746541] Bluetooth: hci0: sending frame failed (-49) [ 2810.899423] Bluetooth: hci1: command 0x1003 tx timeout [ 2810.905353] Bluetooth: hci1: sending frame failed (-49) [ 2812.818925] Bluetooth: hci0: command 0x1001 tx timeout [ 2812.824347] Bluetooth: hci0: sending frame failed (-49) [ 2812.979027] Bluetooth: hci1: command 0x1001 tx timeout [ 2812.984432] Bluetooth: hci1: sending frame failed (-49) [ 2814.898922] Bluetooth: hci0: command 0x1009 tx timeout [ 2815.059035] Bluetooth: hci1: command 0x1009 tx timeout 03:15:26 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000100)='/dev/adsp#\x00', 0x100000040080, 0x40000) ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000080)=0x1) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:15:26 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) 03:15:26 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7400, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:15:26 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000}}}, 0xb8}}, 0x0) [ 2818.857966] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2818.867183] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2818.910280] Bluetooth: hci0: Frame reassembly failed (-84) 03:15:26 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:15:26 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_uma,k', 0x3d, 0x80000000}}]}) 03:15:26 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000}}}, 0xb8}}, 0x0) 03:15:26 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7a00, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:15:26 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x3) 03:15:26 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf000000}}}, 0xb8}}, 0x0) [ 2819.502471] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2819.517742] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2819.535457] hfs: unable to parse mount options 03:15:26 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_uma-k', 0x3d, 0x80000000}}]}) [ 2819.626533] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:15:26 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7e00, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2819.720123] hfs: unable to parse mount options [ 2819.734115] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2820.988924] Bluetooth: hci0: command 0x1003 tx timeout [ 2820.994333] Bluetooth: hci0: sending frame failed (-49) [ 2823.058911] Bluetooth: hci0: command 0x1001 tx timeout [ 2823.064309] Bluetooth: hci0: sending frame failed (-49) [ 2825.139005] Bluetooth: hci0: command 0x1009 tx timeout 03:15:36 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x60a80, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:15:36 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000}}}, 0xb8}}, 0x0) 03:15:36 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x4) 03:15:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x8100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:15:36 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_uma.k', 0x3d, 0x80000000}}]}) 03:15:36 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x82640, 0x0) setsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f0000000080)={@broadcast, @empty}, 0xc) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) r3 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r3, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f00000001c0), 0xfffffef3) ioctl$KVM_S390_UCAS_MAP(r5, 0x4018ae50, &(0x7f00000001c0)={0x2, 0x6, 0x3ff}) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TIOCMIWAIT(r6, 0x545c, 0x0) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r3, &(0x7f0000000d00), 0x1c4, 0x0) getsockopt$inet_sctp_SCTP_MAXSEG(r3, 0x84, 0xd, &(0x7f0000000100)=@assoc_value={0x0, 0x1}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000180)={r7, 0x5, 0x9, 0x8, 0xdca5, 0x7}, 0x14) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) r8 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r8, &(0x7f0000000140)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r8, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r8, &(0x7f0000000d00), 0x1c4, 0x0) r10 = accept$inet(r8, 0x0, &(0x7f0000000200)) getpeername(r10, &(0x7f0000000240)=@l2, &(0x7f00000002c0)=0x80) [ 2829.106863] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2829.117173] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2829.136333] hfs: unable to parse mount options [ 2829.149460] Bluetooth: hci0: Frame reassembly failed (-84) 03:15:36 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000}}}, 0xb8}}, 0x0) [ 2829.164405] Bluetooth: hci1: Frame reassembly failed (-84) 03:15:36 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_uma0k', 0x3d, 0x80000000}}]}) 03:15:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x8401, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2829.243225] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:15:36 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000}}}, 0xb8}}, 0x0) [ 2829.295018] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2829.332113] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:15:36 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c000000}}}, 0xb8}}, 0x0) 03:15:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x9000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2829.385066] hfs: unable to parse mount options [ 2829.408112] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2829.426320] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2831.219071] Bluetooth: hci0: command 0x1003 tx timeout [ 2831.219142] Bluetooth: hci2: command 0x1003 tx timeout [ 2831.231265] Bluetooth: hci0: sending frame failed (-49) [ 2831.242433] Bluetooth: hci2: sending frame failed (-49) [ 2831.247985] Bluetooth: hci1: command 0x1003 tx timeout [ 2831.259035] Bluetooth: hci1: sending frame failed (-49) [ 2833.299125] Bluetooth: hci1: command 0x1001 tx timeout [ 2833.304622] Bluetooth: hci1: sending frame failed (-49) [ 2833.310403] Bluetooth: hci2: command 0x1001 tx timeout [ 2833.315754] Bluetooth: hci2: sending frame failed (-49) [ 2833.328966] Bluetooth: hci0: command 0x1001 tx timeout [ 2833.334364] Bluetooth: hci0: sending frame failed (-49) [ 2835.379132] Bluetooth: hci0: command 0x1009 tx timeout [ 2835.384584] Bluetooth: hci2: command 0x1009 tx timeout [ 2835.397926] Bluetooth: hci1: command 0x1009 tx timeout 03:15:46 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umaXk', 0x3d, 0x80000000}}]}) 03:15:46 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60000000}}}, 0xb8}}, 0x0) 03:15:46 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xa200, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:15:46 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x5) 03:15:46 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r3 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r3, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r3, &(0x7f0000000d00), 0x1c4, 0x0) setsockopt$RDS_CONG_MONITOR(r3, 0x114, 0x6, &(0x7f0000000180), 0x4) bind$bt_rfcomm(r2, &(0x7f00000001c0)={0x1f, {0xf8, 0x1, 0x1, 0x80, 0x80, 0x1f}, 0x5}, 0xa) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000080)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_DESTROY_ID(r1, &(0x7f0000000140)={0x1, 0x10, 0xfa00, {&(0x7f0000000000), r5}}, 0x18) 03:15:46 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) [ 2839.370831] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2839.378292] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:15:46 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xba03, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:15:46 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68000000}}}, 0xb8}}, 0x0) [ 2839.449489] Bluetooth: hci0: Frame reassembly failed (-84) [ 2839.467806] hfs: unable to parse mount options [ 2839.488652] Bluetooth: hci1: Frame reassembly failed (-84) 03:15:46 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umack', 0x3d, 0x80000000}}]}) [ 2839.510742] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2839.548494] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:15:46 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xce01, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:15:46 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c000000}}}, 0xb8}}, 0x0) [ 2839.650864] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2839.688424] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:15:47 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x6) 03:15:47 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74000000}}}, 0xb8}}, 0x0) 03:15:47 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xd101, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2839.704136] hfs: unable to parse mount options [ 2839.746087] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:15:47 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xdc00, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:15:47 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umadk', 0x3d, 0x80000000}}]}) [ 2839.802082] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2839.856817] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2839.911933] hfs: unable to parse mount options [ 2841.458909] Bluetooth: hci0: command 0x1003 tx timeout [ 2841.464310] Bluetooth: hci0: sending frame failed (-49) [ 2841.548933] Bluetooth: hci1: command 0x1003 tx timeout [ 2841.554387] Bluetooth: hci1: sending frame failed (-49) [ 2843.538930] Bluetooth: hci0: command 0x1001 tx timeout [ 2843.544351] Bluetooth: hci0: sending frame failed (-49) [ 2843.618951] Bluetooth: hci1: command 0x1001 tx timeout [ 2843.624371] Bluetooth: hci1: sending frame failed (-49) [ 2845.618990] Bluetooth: hci0: command 0x1009 tx timeout [ 2845.699072] Bluetooth: hci1: command 0x1009 tx timeout 03:15:56 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x4, 0x400000) ioctl$RTC_PIE_OFF(r1, 0x7006) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:15:56 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a000000}}}, 0xb8}}, 0x0) 03:15:56 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umaik', 0x3d, 0x80000000}}]}) 03:15:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xef03, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:15:56 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x7) 03:15:56 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) [ 2849.626313] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2849.636041] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2849.660148] Bluetooth: hci0: Frame reassembly failed (-84) 03:15:57 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88000000}}}, 0xb8}}, 0x0) [ 2849.696825] hfs: unable to parse mount options 03:15:57 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xf000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:15:57 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umalk', 0x3d, 0x80000000}}]}) [ 2849.788834] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:15:57 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9effffff}}}, 0xb8}}, 0x0) 03:15:57 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0xb) [ 2849.846833] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:15:57 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xf003, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2849.904966] hfs: unable to parse mount options [ 2849.906857] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2849.967250] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2851.698993] Bluetooth: hci1: command 0x1003 tx timeout [ 2851.704529] Bluetooth: hci1: sending frame failed (-49) [ 2851.710418] Bluetooth: hci0: command 0x1003 tx timeout [ 2851.721438] Bluetooth: hci0: sending frame failed (-49) [ 2853.779042] Bluetooth: hci0: command 0x1001 tx timeout [ 2853.785665] Bluetooth: hci0: sending frame failed (-49) [ 2853.791751] Bluetooth: hci1: command 0x1001 tx timeout [ 2853.797126] Bluetooth: hci1: sending frame failed (-49) [ 2855.859012] Bluetooth: hci1: command 0x1009 tx timeout [ 2855.864599] Bluetooth: hci0: command 0x1009 tx timeout 03:16:07 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_trie\x00') preadv(r0, &(0x7f0000000080)=[{&(0x7f00000002c0)=""/169, 0xa9}], 0x1, 0x2) r1 = syz_open_dev$vivid(&(0x7f0000000000)='/dev/video#\x00', 0x2, 0x2) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r1, 0x4020565b, &(0x7f0000000080)={0x5, 0xdf, 0x2}) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r2, 0x80045400, &(0x7f0000000100)) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r3, 0x400455c8, 0x0) ioctl$TIOCSETD(r3, 0x800455ca, 0x0) 03:16:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xf803, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:16:07 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffffff}}}, 0xb8}}, 0x0) 03:16:07 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umaok', 0x3d, 0x80000000}}]}) 03:16:07 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x10) 03:16:07 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffd) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) [ 2859.838542] hfs: unable to parse mount options [ 2859.849523] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2859.872030] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:16:07 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umapk', 0x3d, 0x80000000}}]}) 03:16:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xfc03, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:16:07 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff000}}}, 0xb8}}, 0x0) [ 2859.926837] Bluetooth: hci0: Frame reassembly failed (-84) [ 2859.938406] Bluetooth: hci1: Frame reassembly failed (-84) [ 2859.949500] Bluetooth: hci1: Frame reassembly failed (-84) 03:16:07 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f}}}, 0xb8}}, 0x0) [ 2859.998505] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2860.011336] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2860.021589] hfs: unable to parse mount options 03:16:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xfe03, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:16:07 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umauk', 0x3d, 0x80000000}}]}) [ 2860.125504] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2860.144630] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2860.214692] hfs: unable to parse mount options [ 2861.938938] Bluetooth: hci1: command 0x1003 tx timeout [ 2861.944344] Bluetooth: hci1: sending frame failed (-49) [ 2861.950037] Bluetooth: hci0: command 0x1003 tx timeout [ 2861.955407] Bluetooth: hci0: sending frame failed (-49) [ 2864.018980] Bluetooth: hci0: command 0x1001 tx timeout [ 2864.024392] Bluetooth: hci0: sending frame failed (-49) [ 2864.030197] Bluetooth: hci1: command 0x1001 tx timeout [ 2864.035543] Bluetooth: hci1: sending frame failed (-49) [ 2866.098984] Bluetooth: hci1: command 0x1009 tx timeout [ 2866.104379] Bluetooth: hci0: command 0x1009 tx timeout 03:16:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xfeff, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:16:17 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x48) 03:16:17 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff9e}}}, 0xb8}}, 0x0) 03:16:17 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umaxk', 0x3d, 0x80000000}}]}) 03:16:17 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x20080, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r1, &(0x7f0000000d00), 0x1c4, 0x0) setsockopt$TIPC_SRC_DROPPABLE(r1, 0x10f, 0x80, &(0x7f0000000000)=0x1, 0x4) 03:16:17 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x44000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000000440)={@initdev, @empty, 0x0}, &(0x7f0000000480)=0xc) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', r2}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r1, &(0x7f0000000d00), 0x1c4, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000200)=0x0) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000240)=r4) r5 = syz_open_dev$admmidi(&(0x7f00000000c0)='/dev/admmidi#\x00', 0x1000, 0x8000) getsockopt$IPT_SO_GET_ENTRIES(r5, 0x0, 0x41, &(0x7f0000000100)={'security\x00', 0x93, "5a9601a5b8bc13947994af340967664573a8868e390bafd63d6a70413257c68a74f62715883db76a76be82d5907b82d503da4280e1840e15a5a37b26975af4714f7ad9a533b5269fc0eb328b4df32482c5de49c00190910569e0af770c86a8243bbfdafa2b3eec944857a81552dd9ab48ecf0c76c5824aa07f8a6cf12e9014814d3875c34cfbc4e1761addfcd931f1cc40d2f5"}, &(0x7f00000001c0)=0xb7) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) r6 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cachefiles\x00', 0x8000, 0x0) ioctl$TUNSETNOCSUM(r6, 0x400454c8, 0x0) [ 2870.089154] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2870.102815] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:16:17 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff0}}}, 0xb8}}, 0x0) [ 2870.140738] Bluetooth: hci0: Frame reassembly failed (-84) [ 2870.170961] hfs: unable to parse mount options 03:16:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xff03, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:16:17 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umas\n', 0x3d, 0x80000000}}]}) [ 2870.258064] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:16:17 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x4c) 03:16:17 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40030000000000}}}, 0xb8}}, 0x0) 03:16:17 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r1, &(0x7f0000000d00), 0x1c4, 0x0) r3 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r3, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r3, &(0x7f0000000d00), 0x1c4, 0x0) r5 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r5, &(0x7f0000000140)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r5, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r5, &(0x7f0000000d00), 0x1c4, 0x0) r7 = dup(r5) ioctl$KVM_SET_XCRS(r7, 0x4188aea7, &(0x7f0000000100)={0x7, 0x8000, [{0x7}, {0x2, 0x0, 0x2}, {0x1, 0x0, 0x7}, {0xe7, 0x0, 0x20}, {0x7, 0x0, 0x7fff}, {0x7}, {0x9}]}) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) [ 2870.329493] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2870.342216] hfs: unable to parse mount options 03:16:17 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umas\"', 0x3d, 0x80000000}}]}) [ 2870.397743] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:16:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xff0f, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:16:17 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffffffffffff}}}, 0xb8}}, 0x0) [ 2870.451670] Bluetooth: hci1: Frame reassembly failed (-84) [ 2870.527515] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2870.538244] hfs: unable to parse mount options 03:16:17 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x68) [ 2870.592737] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2872.178930] Bluetooth: hci0: command 0x1003 tx timeout [ 2872.184446] Bluetooth: hci0: sending frame failed (-49) [ 2872.498969] Bluetooth: hci1: command 0x1003 tx timeout [ 2872.504475] Bluetooth: hci1: sending frame failed (-49) [ 2874.258946] Bluetooth: hci0: command 0x1001 tx timeout [ 2874.264363] Bluetooth: hci0: sending frame failed (-49) [ 2874.578985] Bluetooth: hci1: command 0x1001 tx timeout [ 2874.584417] Bluetooth: hci1: sending frame failed (-49) [ 2876.338953] Bluetooth: hci0: command 0x1009 tx timeout [ 2876.658974] Bluetooth: hci1: command 0x1009 tx timeout 03:16:27 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000}}}, 0xb8}}, 0x0) 03:16:27 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umas%', 0x3d, 0x80000000}}]}) 03:16:27 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xff7f, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:16:27 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x6c) 03:16:27 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) ioctl$TIOCGPTLCK(r1, 0x80045439, &(0x7f0000000100)) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) ioctl$PIO_UNIMAP(r3, 0x4b67, &(0x7f0000000080)={0x7, &(0x7f0000000000)=[{0x4}, {0x6d8b, 0x6}, {0x3, 0xff}, {0x4, 0x20}, {0x6, 0x2}, {0x101, 0xffff}, {0x8, 0x200}]}) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) [ 2880.323774] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2880.335324] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:16:27 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000}}}, 0xb8}}, 0x0) [ 2880.376151] hfs: unable to parse mount options 03:16:27 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xfffe, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2880.467265] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2880.487283] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:16:28 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/[t\xc0\x1d\x00', 0x3a5c3de63b06b35f, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:16:28 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umas,', 0x3d, 0x80000000}}]}) 03:16:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cb2, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:16:28 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000}}}, 0xb8}}, 0x0) 03:16:28 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x74) [ 2881.068080] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2881.069115] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:16:28 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000}}}, 0xb8}}, 0x0) 03:16:28 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x443040, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x800, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$KIOCSOUND(r1, 0x4b2f, 0x100000000) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TIOCEXCL(r2, 0x540c) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000080)=@req={0x9, 0x73ed, 0x5}, 0x10) [ 2881.127647] hfs: unable to parse mount options 03:16:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cb3, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:16:28 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x100080, 0x0) ioctl$KDADDIO(r1, 0x400455c8, 0xffffffffffffffeb) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) r4 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vfio/vfio\x00', 0x1, 0x0) splice(r2, &(0x7f0000000080), r4, &(0x7f0000000140), 0x9, 0x2) 03:16:28 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x22, 0x80000000}}]}) [ 2881.220561] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:16:28 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000}}}, 0xb8}}, 0x0) [ 2881.266668] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:16:28 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x7a) 03:16:28 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000}}}, 0xb8}}, 0x0) [ 2881.332654] hfs: unable to parse mount options [ 2881.335283] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:16:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cb4, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:16:28 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x25, 0x80000000}}]}) 03:16:28 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) [ 2881.432840] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:16:28 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000}}}, 0xb8}}, 0x0) [ 2881.487147] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:16:28 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x300) [ 2881.552309] Bluetooth: hci0: Frame reassembly failed (-84) [ 2881.570493] hfs: unable to parse mount options [ 2881.601574] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:16:29 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x3) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:16:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cb5, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:16:29 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000}}}, 0xb8}}, 0x0) 03:16:29 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x2c, 0x80000000}}]}) 03:16:29 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x500) [ 2882.146730] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2882.159290] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2882.181534] hfs: unable to parse mount options 03:16:29 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000}}}, 0xb8}}, 0x0) 03:16:29 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r1, &(0x7f0000000d00), 0x1c4, 0x0) poll(&(0x7f0000000000)=[{r1, 0x10}, {r0, 0x8090}], 0x2, 0x1) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:16:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cb6, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:16:29 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x40000}}]}) [ 2882.297244] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2882.358354] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2882.408552] hfs: can't find a HFS filesystem on dev loop3 [ 2882.416330] Bluetooth: hci1: Frame reassembly failed (-84) [ 2882.422568] Bluetooth: hci1: Frame reassembly failed (-84) [ 2883.628990] Bluetooth: hci0: command 0x1003 tx timeout [ 2883.634399] Bluetooth: hci0: sending frame failed (-49) [ 2884.418906] Bluetooth: hci1: command 0x1003 tx timeout [ 2884.424303] Bluetooth: hci1: sending frame failed (-49) [ 2885.708928] Bluetooth: hci0: command 0x1001 tx timeout [ 2885.714336] Bluetooth: hci0: sending frame failed (-49) [ 2886.498923] Bluetooth: hci1: command 0x1001 tx timeout [ 2886.505875] Bluetooth: hci1: sending frame failed (-49) [ 2887.779024] Bluetooth: hci0: command 0x1009 tx timeout [ 2888.578997] Bluetooth: hci1: command 0x1009 tx timeout 03:16:39 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) fcntl$setstatus(r0, 0x4, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:16:39 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x600) 03:16:39 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00000000000000}}}, 0xb8}}, 0x0) 03:16:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cb7, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:16:39 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x44000000}}]}) [ 2891.842214] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2891.848601] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:16:39 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000}}}, 0xb8}}, 0x0) [ 2891.897462] Bluetooth: hci0: Frame reassembly failed (-84) [ 2891.908818] Bluetooth: hci0: Frame reassembly failed (-84) [ 2891.933799] hfs: can't find a HFS filesystem on dev loop3 03:16:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cb8, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2891.966437] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:16:39 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000002}}]}) 03:16:39 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000}}}, 0xb8}}, 0x0) [ 2892.016242] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2892.104435] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2892.117452] hfs: dir_umask requires a value [ 2892.122013] hfs: unable to parse mount options 03:16:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cb9, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:16:39 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x700) 03:16:39 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4800000000000000}}}, 0xb8}}, 0x0) [ 2892.502334] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2892.515712] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2893.938973] Bluetooth: hci0: command 0x1003 tx timeout [ 2893.944449] Bluetooth: hci0: sending frame failed (-49) [ 2896.019014] Bluetooth: hci0: command 0x1001 tx timeout [ 2896.024448] Bluetooth: hci0: sending frame failed (-49) [ 2898.098961] Bluetooth: hci0: command 0x1009 tx timeout 03:16:49 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000080)) ioctl$KDENABIO(r0, 0x4b36) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:16:49 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000003}}]}) 03:16:49 executing program 2: r0 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r0, &(0x7f0000000140)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) getsockopt$nfc_llcp(r0, 0x118, 0x0, &(0x7f0000000200)=""/35, 0x23) sendmmsg(r0, &(0x7f0000000d00), 0x1c4, 0x0) r2 = dup(r0) ioctl$EVIOCGABS3F(r2, 0x8018457f, &(0x7f0000000100)=""/196) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0x1b) r4 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x80, 0x0) ioctl$TIOCMGET(r4, 0x5415, &(0x7f0000000080)) ioctl$KDADDIO(r3, 0x400455c8, 0x0) fcntl$setflags(r3, 0x2, 0x1) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f00000001c0), 0xfffffef3) ioctl$TIOCVHANGUP(r5, 0x5437, 0x0) ioctl$TIOCSETD(r3, 0x800455ca, 0x0) 03:16:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cba, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:16:49 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00000000000000}}}, 0xb8}}, 0x0) 03:16:49 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0xb00) [ 2902.051004] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2902.066126] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:16:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cbb, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:16:49 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000000000000}}}, 0xb8}}, 0x0) [ 2902.108186] hfs: dir_umask requires a value [ 2902.123306] hfs: unable to parse mount options [ 2902.143241] Bluetooth: hci0: Frame reassembly failed (-84) [ 2902.197686] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2902.223687] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:16:49 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000004}}]}) 03:16:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cbc, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:16:49 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6800000000000000}}}, 0xb8}}, 0x0) 03:16:49 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0xe15) [ 2902.364939] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2902.373675] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2902.419381] hfs: dir_umask requires a value [ 2902.428418] hfs: unable to parse mount options [ 2904.178996] Bluetooth: hci0: command 0x1003 tx timeout [ 2904.184487] Bluetooth: hci0: sending frame failed (-49) [ 2906.259032] Bluetooth: hci0: command 0x1001 tx timeout [ 2906.264455] Bluetooth: hci0: sending frame failed (-49) [ 2908.339015] Bluetooth: hci0: command 0x1009 tx timeout 03:16:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cbd, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:16:59 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00000000000000}}}, 0xb8}}, 0x0) 03:16:59 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000005}}]}) 03:16:59 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x150e) 03:16:59 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) r1 = socket$key(0xf, 0x3, 0x2) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) connect$rose(r2, &(0x7f0000000000)=@short={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, 0x1, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}}, 0x1c) recvfrom(r1, &(0x7f0000000100)=""/100, 0x64, 0x0, &(0x7f0000000180)=@rc={0x1f, {0xc, 0x7, 0x3f, 0xfe, 0x3, 0x6}, 0x5}, 0x80) ioctl$TIOCNOTTY(r0, 0x5422) [ 2912.333763] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2912.335096] hfs: dir_umask requires a value [ 2912.342032] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:16:59 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7400000000000000}}}, 0xb8}}, 0x0) 03:16:59 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xc) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TCSETX(r1, 0x5433, &(0x7f0000000400)={0xa74, 0x1, [0x7, 0xb160, 0x400, 0x3, 0x200], 0x51}) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, &(0x7f00000001c0)) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) accept$netrom(r2, &(0x7f0000000100)={{0x3, @default}, [@remote, @bcast, @default, @null, @bcast, @bcast, @remote, @rose]}, &(0x7f0000000000)=0x48) r4 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r4, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) r6 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r6, &(0x7f0000000140)={0x11, 0x0, r7, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r6, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r6, &(0x7f0000000d00), 0x1c4, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000580)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x5c77b3deb9c073da}, 0xc, &(0x7f0000000540)={&(0x7f0000000480)=@deltaction={0x94, 0x31, 0xb8a9457f1021cb23, 0x70bd26, 0x25dfdbfc, {}, [@TCA_ACT_TAB={0x24, 0x1, [{0x10, 0x18, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}, {0x10, 0x1e, @TCA_ACT_INDEX={0x8, 0x3, 0xf6440000}}]}, @TCA_ACT_TAB={0x38, 0x1, [{0x14, 0xf, @TCA_ACT_KIND={0xc, 0x1, 'police\x00'}}, {0x10, 0x12, @TCA_ACT_INDEX={0x8, 0x3, 0xfffffffb}}, {0x10, 0x8, @TCA_ACT_INDEX={0x8, 0x3, 0x6406}}]}, @TCA_ACT_TAB={0x24, 0x1, [{0x10, 0x1d, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}, {0x10, 0x9, @TCA_ACT_INDEX={0x8, 0x3, 0x6}}]}]}, 0x94}, 0x1, 0x0, 0x0, 0xc080}, 0x680c4) sendmmsg(r4, &(0x7f0000000d00), 0x1c4, 0x0) r8 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000240)='/dev/vsock\x00', 0x200000, 0x0) r9 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_NODE_ADDR(r8, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x24, r9, 0x400, 0x70bd27, 0x25dfdbff, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0x4}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x24040804}, 0x20010) sendmsg$TIPC_CMD_SHOW_STATS(r4, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x1c, r9, 0x100, 0x70bd28, 0x25dfdbfd, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x28000000}, 0x20008011) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) r10 = openat$full(0xffffffffffffff9c, &(0x7f0000000200)='/dev/full\x00', 0x800000, 0x0) ioctl$EVIOCGUNIQ(r10, 0x80404508, &(0x7f0000000240)=""/75) [ 2912.378170] hfs: unable to parse mount options 03:16:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cbe, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2912.404947] Bluetooth: hci0: Frame reassembly failed (-84) [ 2912.415170] Bluetooth: hci0: Frame reassembly failed (-84) 03:16:59 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000006}}]}) [ 2912.475901] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2912.509712] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:16:59 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00000000000000}}}, 0xb8}}, 0x0) 03:16:59 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1f00) [ 2912.616199] hfs: dir_umask requires a value 03:16:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cbf, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2912.650936] hfs: unable to parse mount options [ 2912.654674] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:17:00 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8800000000000000}}}, 0xb8}}, 0x0) [ 2912.701588] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:17:00 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000007}}]}) 03:17:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cc0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2912.768039] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:17:00 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9effffff00000000}}}, 0xb8}}, 0x0) [ 2912.877239] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2912.889463] hfs: dir_umask requires a value [ 2912.896290] hfs: unable to parse mount options [ 2912.923454] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2914.414516] audit: type=1400 audit(1571023021.694:85): avc: denied { map } for pid=2533 comm="sh" path="/bin/dash" dev="sda1" ino=1473 scontext=system_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1 [ 2914.437262] Bluetooth: hci0: command 0x1003 tx timeout [ 2914.442812] Bluetooth: hci0: sending frame failed (-49) [ 2916.499070] Bluetooth: hci0: command 0x1001 tx timeout [ 2916.505767] Bluetooth: hci0: sending frame failed (-49) [ 2918.579195] Bluetooth: hci0: command 0x1009 tx timeout 03:17:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cc1, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:17:09 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2000) 03:17:09 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffffff00000000}}}, 0xb8}}, 0x0) 03:17:09 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000008}}]}) 03:17:09 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x200000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:17:09 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r1, &(0x7f0000000d00), 0x1c4, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000280012000c000100766574680000000018000200fd0001000000000023c0306554362dddcb892ef8051404bde5bf296e3c566a03d724f7ead1ef33adfdbe08b8c5236b93b9797b4409f6e370d1515d2e1fa63259e6d4bd05772981", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x48}}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x300, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r6, 0x5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0x14}]}, 0x28}}, 0x0) bind$packet(r1, &(0x7f0000000000)={0x11, 0x5, r6, 0x1, 0x9, 0x6, @dev={[], 0x2a}}, 0x14) ioctl(r1, 0x7fff, &(0x7f0000000100)="5e0f288fc90cb36013d1e792a8b682dce681835c4db1761a76aa8cf8d3f4e6e7349ca426d4879c0a0c3f05917e78587b2a6a9c38041ee8be526c4c6732e52b1753fd3249744352b9313d0b95664658035dae50a4dbd0070bbd7608a4eb6cb66f83c97d246c5089af77f8511cdad28dbf7664d177a734448e1fc365fa6d5937c1ec9e7d99c1eb4f1554d53fbdea30bbc4be1b8e3340775853029d5e76423b9e3522cddb4dbd1527ef04f2bd77a9086e00b9") [ 2922.640822] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2922.651838] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:17:10 executing program 4: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB="9feb010018000000000000007701000077010000040000000500000003000004090000000e00000400000003000000080000000100000003000000001000000b00000003000006040000000600000001010000090000000000000000000000000100000c00000000000008000000000b00000000000002050000000200000008000084080000000500000001000000030000000600000004000000020000000b00000003000000010100000f00000004000000a041ffff0c000000040000000700f0ff0200000002000000080000000f00000003000000040000000a00000000000000ff0f000008000000090000060400000008000000010000000100000000020000030000000500000004000000050000000d0000003b39ffff0c000000050000000f0000000400000006000000060000000300000007000000100000000200000f030000000300000006000000000000000100000001040000060000009e7479000000000300000d0000000003000000020000000700000002000000030000000100000000005f6100"], &(0x7f0000000340)=""/239, 0x194, 0xef, 0x6}, 0x20) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) ioctl$PIO_UNIMAPCLR(r1, 0x4b68, &(0x7f0000000000)={0x6, 0x610, 0x1}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:17:10 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000}}}, 0xb8}}, 0x0) [ 2922.694074] Bluetooth: hci0: Frame reassembly failed (-84) [ 2922.703741] Bluetooth: hci0: Frame reassembly failed (-84) 03:17:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cc2, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2922.777200] hfs: dir_umask requires a value [ 2922.779104] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.2'. [ 2922.797469] hfs: unable to parse mount options [ 2922.805466] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:17:10 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000}}}, 0xb8}}, 0x0) 03:17:10 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x3f00) [ 2922.886405] IPv6: ADDRCONF(NETDEV_UP): veth11: link is not ready [ 2922.913099] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2922.937176] batman_adv: batadv0: Adding interface: veth11 [ 2922.947031] batman_adv: batadv0: The MTU of interface veth11 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. 03:17:10 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffff000}}}, 0xb8}}, 0x0) [ 2922.986117] batman_adv: batadv0: Interface activated: veth11 [ 2922.998307] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:17:10 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000009}}]}) 03:17:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cc3, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2923.043906] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:17:10 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x2}}}, 0xb8}}, 0x0) [ 2923.146843] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:17:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cc4, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:17:10 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x4000) [ 2923.195003] hfs: dir_umask requires a value [ 2923.204546] hfs: unable to parse mount options [ 2923.216351] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2923.314518] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2924.739058] Bluetooth: hci0: command 0x1003 tx timeout [ 2924.744529] Bluetooth: hci0: sending frame failed (-49) [ 2926.818986] Bluetooth: hci0: command 0x1001 tx timeout [ 2926.824394] Bluetooth: hci0: sending frame failed (-49) [ 2928.899004] Bluetooth: hci0: command 0x1009 tx timeout 03:17:20 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000100)={0x0, @in={{0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, 0x84) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:17:20 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x3}}}, 0xb8}}, 0x0) 03:17:20 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x8000000a}}]}) 03:17:20 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x4087) 03:17:20 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cc5, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:17:20 executing program 4: pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r0, &(0x7f0000000100)="07408de9cdac15036dc229be9c93ad8e159173488fae8210cdbdff1676006a50a5b7a8beb558fefe134f9b7baf66843ded67f078e9d4860a2c3c5896e764eef960210d8ff82ec2d830820ed43b57caa2be1e41286b746a5900ec2569a07134e95103297d2ee266afd267e688fdb4f5ad8adc1e5f8a0fe0ce2892266fa9c8001c893f2070bcf76d82d388a0221a61a81eaf55da25b6910b54fd8326f39c843c1e8fc729611eb6444d2e24ce8794a29cdfefca443c112f738bc5506dfe636b14acb85afdae602e7a16fcd2ea633de22d86d4136a44743707c75b478118dcf05778cc175889783be50271c8dd913e31393fde4707e72f21f6c8be8396512574a8c33743c76d2d754678d701c40d077e356580a0cb034101e7884ae8bc140946c0c681ac642acc546b6a2957ec88032355dc9d2acfc95b0c6a91d7ca4f6d76ddb1992a454bcd377ba794e60c9919ce635053de169e807a4ff4e3f190f8755149741d28dbaa2a7bcb596228d1c6214ef4516654691bf4cf8f9216b9fee05aef3eb5e4189d3c5c80c40e4257025c9462aa4cdd828b4b97889d09716544757e5da44411ef3edd690a7c3b281cc50f6dab9603f9f91c2dcc0905057b40ec9b1c7d72ce3b354010fade6c187415389d5ce4563ca6cecfa62f5078537de4ea2c6b251a410297f5cd3099c272aed632bf889a730c87f2699354fec0958fd6797dd40ce673b23aad87eaf6190ba6182d69ac5bb089701d9f7f3c0a6aa27813a6a2f39330e320372dee88d3f2122251f123cf05cd3895cf76f1cbc3e6fc833e27b12a6162c4f5c106de30f3e3d64f0ab41ac15656859b7ea19d59d1b6233d76f5021047640158946c006c2c8f5361a61a4f9408ffd789af9c233ad8fddc272028e73c21b845f61dfc27d04dcd8da66654798fc1747ca24c0915253007ce3b7faf9943f950a3acfe901a44c54a7539f37418b0d62746022f306648de74d63b15412fb0dee08054fc22995bae70b5d7e2267599d1721f5918549f9a0abe3b40073ca74724e472c6e6ef406327befb2606850c46cdce38f057721b84c2a5167032fc265c0cd6929c4e1bcbb10a430ec4b3a4001177a8c5627d7ee9981a69a5d1f7852bcc176f5d42ca1a4ee06a84809f4afd09dfd6c1b7b733a27263c0dbb96d6ad30900bf5c4504ad28006906a8e86e4b1cb9f05b9aa1a33cc8ee0e51eaab95d3a1064036fe19bcdf450ecacf172efa3e3b020a8f7cc981f8606f426d14179d49632e58dbc8c6593613c6f08f4467057f0cb0eb607695e221edc682ddb75e6570b5c2f06c720da6e897d64da0d79bb54819c967a749a482c39d119493ba2e67caece96afa4a456fdeda5be21437d7ff0cdb637da43046d4be171768ea41876ed6c28165d8865738f755b0205f1901934263d109f171c1f5513286c8003130616a7b046aeb11df282e34dc2500fdce3236416ad1f310cf8bb87ce8d4b610be4eb14fc17d8446e4fba38d79c70532debb0994e2102354162b11714a9e59be02658976692ffa17c34fad00d20c2533898fa0295ba473cce3386e407cfe2a9c38bfe7c9f1c5d6ce4ddb50c3b3e4285d90c3c33d4d62f1c06f365c5f811934729041a1e12f963b729c01afe7e942348037698e6d333326135e95cf27df8ad68bc8a62d3036114d246c56e9001dba65b406691a8b761846f10e8b4785f1a703c41512aa4b2a11cca8a238eec40a3e24e61bd5811a81f26ad2d4f50c011434dff05ff727f4188435ea2764d1e6e8643678e7edc3505243d95429a4410d7ae1272e548143dca7cb5a951ec0866b764b13766b24d5832cda9131140f59957dba9ad738e37365f249b27365cbae51d796456ce8a17527e892f0a4a0fd4f422783854172e5f7b1db07f5951afc1a52d5725d55e408ea96bd36fd33071bc1c88595b23ba4bb8cc786687a056832533af187423860eb63e7db686d9c31ca5a3a5ccd4dcd2f8849ef0a65d14e023a51aa3fec9db411da3fabc10557f22ad0a3224aaa1eeeeea13c986df3906c180cbdcf91e533bff914c2e62192abefc8a81fd70e6fa4114ada0a20cbad175faeedd05650c0bf32bf544dad55b98d962a9a995e0678523b846538b0725cbb302b0a08d2f2a37847f5de03d7df78fbcacc48529769c61b95dd58a28640beb6e6fb113c175a1bb9c3e39d9a0c444e15fe17e15e97000a0542dd3510bfee2625d7a1f2e9b47792f271d645bfd7e29779f84724e3c5bac1d8ccdbbf64f68cc01848dd97520063869c87d4b549c9bbcd78b78b6b2ea01ad5a38db64f84ef00a848dd5b36509dee8592806edafdf7997978499120ae3c0fa8970187123a25655faf5297d557d30162ff2b89391c2bff2db9e77914ab9c4998aaa01a9b51a9dbbb1c1b41d7d1762f70dda77e8fcb983ce1bf74a4874c3acebb816b7fe0ddb3abf761f8cb186cd2bb37cd35d40d175783bd6d86960a4c516f84324f7360357c43902c2a97da8282a03bf88aa513d26be498701ac6fa32e85dc92e41ed220f3ae92d9d6721b6487051cf7a22fef7e3199e86b0c47142972dbf5edfced58ee8c41e10f7b73706a669d524f121175f4f91b159f9f9ccadf4fde857825168fd39d85b1881a05d180acb2af03ac0b99e0fb63a661541ed1ea5cde18ab5f1081791f0941562967711d6a5ec2e4c0eb18bd3b0c992da5cecb4cccd58885ccb64e23fef404becde15407286d2541480a2fc3923b756034f4fe6177f5687a3711180eaf832f4c3d3e49466800ea6ed8fa905310fe0d9ee233603a0560be1ac81630a565100b6e628a6f7c13dc111f4e257e2c8b81c199493c32552c99f0905fcbd1dfd22bd540b70c0e8b58b3d0c39442ab30cf6819b8356fb3bfdcd2dbe29e62be1ab405f7404882684cac3cd90882855b00930cc941d6510418e57dff6e0c5fc0918afc6b6e65fb14298e7ee7e909f22223c3e7eaca62151d164ace1285f7686500fc2ee6c892404d580e6a1619f78306bd5195057e24ee9afb07491458617185b255074f04c10532936ffe99a4d988fa224d53ea9147978d6a8d6b0f2702a43c24bc2d7ef697c4fd66944604afa331023b92287ba443402f9062c48ab20f03f06f3c6e3d09fe0e6a2e67b06f30e78275a4aa6c5abab4e3e12358156b134a4de2df432b828b64a5a86a18fdc9e621a5c6101efcb790078495533d0e659127bf491082d18cb6b2b681af9542b9f348e36da49fc4f763c85846c84fe24e8ad53df7b5de7b29db6c52eccb12c3d0a66a775f779e7211ee8a81072be997e4ffb08083364b4282e8de87e7c134a8fad2cb5d314609b6c343c7d6afe93076b21ce04ff589f7fcfaad63dfcd45405e7dab2048959bcf35b5e86501f36bdddafcfa28c9b40a6be47eebf0404321f02440c67840ffc75c3d725b4be53ea57f65ec9692327786642e636604b801e407dfaa113888a9353fc1bd0e8362944d3519be29c62304afc153a085ba14d0dc4301d826bd98f4ebc2d2cf8118cff8c6fc805bbe51790b84adebb2741235f15b821b0a3bfe630b2debec49285a3ff2654f9173869c7fc9b51423bb75716b8bbdb0625fad9b4772eb5bf841b1aba12809a50dccf10460f20d27cf112492019ebed93a512775659118b3dc1a1c1edc9cf22bd0ee98ccab2cc487a9e08478ea0d1b080aa723152ead1eb80cdbcc1500ed146b35394aaead3d0361df078a4fd651f8ad114a565f8b70c4e211b5200d278f9a181c411c1dee6349a1b675fe7add4e9f98b6d38f8f83da47173536454cf45928afff925d2648e28ac3b7abe846600ebd14675ee688b4663b6e4ee8c57b21ce4cb21a55a179ad899554269a5f5ec0baa2a74b33b5bcdce06634d6c1d574451fd825675a39a8435b49f311d780964b6368c5863535475b9b48e8987d0a1bafa07ec681420ce03a87b74b6ad2e0ed579686bb443116b79ebb5bdd8fc7fec5a0fbee824b245eb19bb6af4988f23fc015cf9fba144eb4837a059c797279c6188334f6c4444dab656834d43436577ec1c746a5efe5b7103e82cb4bc13f39f8090e4d4a296dabcee26e4f2fe034c38e82a6b072572538823e0c41ccd86942cfd2869ea1eaebac1f8457414f401bed2182f9e2a26de8c2ab837d5601cbb3a4f08f71f938278da6940002ba1599aa1e04dd24c59dd19ac25daa578efc4186fb63bee6494f33c6743f268e3e5e3858fc5ca548671eab3fc585fa1f4958db1a0eff51423c987da4455c7f60d74c4ab3b2c215c7770ffc663dd28a980aa787656d1375c4e0d2cea21cc767bed20f774bfe81b21d93a85e70927a95897fc779087966438194dba0797e0749cc3e7cbf7e157203967d4ee05a61d1f7a6778972091a1b0fc8eccc1015c2902d8f0eb3782bf69c0c09deb701ce704c0e608610c08d6eb1beb42c8647637c43800847df6f7cb4bb6394cc0dbc791b471655599b2831f67f3faaa0658014264ce32019698be99dd4d1714577dc4c1311752570052b5a380bfe1fec1e735c819f56a031edabbc481dea9c9cf142deb0bbc2bd21722265663315ca4930d30ae570fad76af0cb49113b3a10eef6608e1cd3caa743206fed89097434d28f2aec4bd3646d58eb0f510889dcafd1c54f5133c4d059b7fe7181090fb66ef0170f9eb3541b6d12ce6f234db3838482054a1d88958bcdfa305e600179a3806a45c2b4121c282f1ed3ee0357c8270e344c26d42f3ad43a227343714389c7137e92b64a940a1542f06a9b4999b0566321a252454b19ebb8d7f74bf526023bac88953843db50869617d18ba36e4c09454ae7da888a33e23b64156f377b8a5c5f734e48d0d7ccd2cd0493242a61c6850f3a6a79cec8a9b6e8cc82ec05bfa668066809bc29e77879b9f9b43b72d8f9c334c5dc043a6cb02211ec032ce5a4412c37e6b65eee9d932a01ed11b6e5f3e8d9d64c90560b8d238d3ca4336a1e18f3c1d8c2c9e20cada13b1bf6934c5d1f1bf366d74067ed97df40ba6f24aeb44197fbc5e80952e5f533d79a6f41989f85e6348c0cc1b1d1ec5dbbaa5964555a96fc99dcc3c5cbbe4caf13ba2c22994accb6b21a9f0585883a1c2b7177e9edfd02a90a6396b1e06c20ae9bbb767d37063369413e237b08f41d1ea22ffa77c0086d1f754745e0446f0ca2d8cdc85f334a86e82fcf44d705dace70d9f66d90d9f509b1dd9e10eb51588fc40010b8139374a98f10d9ae63a8bab2cf734a5676ac4e35719f61cb4a704c5ef628c59c34bed291bbb036bd79d83c75f5e90fdaca319a2487adffcb0d3f707dfcc869f15b8fe19107d5e835933f7a25b3f873ad0543ad5533838a3bccb47c48704396a6201cf7f2ea6507509f15f52e22c6ab1111ed74591d2bef755a9ce97cee7f82981ae0e6c23c2498c72ae803a1b7f0f90c81b6fec2aba07dbcdfcc9742d735169b24ad6695c11d78c33443e892175666ea9c10224440eb9499c9f1c15b9e89845c873af676df58ec28d603143100f853a9f7fe3005f9d841452309bc58388bc4ee59ab1dbbf093f74c800ddd048870c2fe26bf44c43a789a15079b27f6f69ff8ca5ba431bd30b011da37bf708353fe3293fb94e70e60a29f7c54ae3cb4d81263b4e1c045fe8be4b1141d9fbb564abf00bce839e4e4dd5838dbe5cdb39cfc9c00e1566dafe62dccf8d7a585b9b460382c8f5082fb6bed6759368e740736f880fd16c13fb573ea32cdf4a58b8d160f6900298235ccae5ae0dd110cc8fd7d97dcc05f4c94c66e2c51e1bb798509a99f006b95c4f08527fe640b4f261985a6dbb9de1ab377bae7ac71fd1e0"}, 0x20) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x0) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, &(0x7f0000001180)) syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x50000000000000, 0x4000) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) getsockname(r2, &(0x7f0000001180)=@can, &(0x7f0000001200)=0x80) pipe(&(0x7f0000001380)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$VIDIOC_QUERYCAP(r4, 0x80685600, &(0x7f0000001100)) ioctl$TIOCSETD(r1, 0x400455cb, 0x0) [ 2932.827587] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2932.839785] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:17:20 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x4}}}, 0xb8}}, 0x0) 03:17:20 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cc6, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2932.879898] Bluetooth: hci0: Frame reassembly failed (-84) [ 2932.893078] Bluetooth: hci1: Frame reassembly failed (-84) [ 2932.907767] hfs: dir_umask requires a value [ 2932.919244] hfs: unable to parse mount options 03:17:20 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000022}}]}) [ 2933.004184] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2933.004478] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:17:20 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x4800) 03:17:20 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x5}}}, 0xb8}}, 0x0) 03:17:20 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cc7, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2933.141454] hfs: dir_umask requires a value [ 2933.149030] hfs: unable to parse mount options [ 2933.150371] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2933.176753] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2934.898910] Bluetooth: hci1: command 0x1003 tx timeout [ 2934.898956] Bluetooth: hci0: command 0x1003 tx timeout [ 2934.909696] Bluetooth: hci1: sending frame failed (-49) [ 2934.921129] Bluetooth: hci0: sending frame failed (-49) [ 2936.978980] Bluetooth: hci0: command 0x1001 tx timeout [ 2936.984392] Bluetooth: hci0: sending frame failed (-49) [ 2936.990299] Bluetooth: hci1: command 0x1001 tx timeout [ 2936.995826] Bluetooth: hci1: sending frame failed (-49) [ 2939.059017] Bluetooth: hci1: command 0x1009 tx timeout [ 2939.064414] Bluetooth: hci0: command 0x1009 tx timeout 03:17:30 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/mls\x00', 0x0, 0x0) ioctl$KDGKBSENT(r1, 0x4b48, &(0x7f0000000080)={0x73, 0x1}) 03:17:30 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x6}}}, 0xb8}}, 0x0) 03:17:30 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x8000002c}}]}) 03:17:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cc8, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:17:30 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x4c00) 03:17:30 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/f\x00\x00\x00\x80\x00', 0x148180, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) [ 2943.027993] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2943.032494] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2943.080871] Bluetooth: hci0: Frame reassembly failed (-84) [ 2943.115255] hfs: dir_umask requires a value 03:17:30 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) creat(&(0x7f0000000000)='./file0\x00', 0x80) 03:17:30 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x7}}}, 0xb8}}, 0x0) 03:17:30 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cc9, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2943.137128] hfs: unable to parse mount options 03:17:30 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000048}}]}) [ 2943.220759] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2943.233295] Bluetooth: hci1: Frame reassembly failed (-84) [ 2943.243904] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:17:30 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x6800) 03:17:30 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xa}}}, 0xb8}}, 0x0) [ 2943.346019] hfs: dir_umask requires a value [ 2943.356018] hfs: unable to parse mount options [ 2943.369143] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2945.139007] Bluetooth: hci0: command 0x1003 tx timeout [ 2945.144513] Bluetooth: hci0: sending frame failed (-49) [ 2945.298987] Bluetooth: hci1: command 0x1003 tx timeout [ 2945.304493] Bluetooth: hci1: sending frame failed (-49) [ 2947.219001] Bluetooth: hci0: command 0x1001 tx timeout [ 2947.224424] Bluetooth: hci0: sending frame failed (-49) [ 2947.378982] Bluetooth: hci1: command 0x1001 tx timeout [ 2947.384400] Bluetooth: hci1: sending frame failed (-49) [ 2949.298985] Bluetooth: hci0: command 0x1009 tx timeout [ 2949.458950] Bluetooth: hci1: command 0x1009 tx timeout 03:17:40 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xe}}}, 0xb8}}, 0x0) 03:17:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cca, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:17:40 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x8000004c}}]}) 03:17:40 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x6c00) 03:17:40 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r2, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000140)=0x1, r3, 0x0, 0x1, 0x4}}, 0x20) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) write$RDMA_USER_CM_CMD_MIGRATE_ID(r1, &(0x7f0000000080)={0x12, 0x10, 0xfa00, {&(0x7f0000000000), r3, r4}}, 0x18) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) [ 2953.260017] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2953.279749] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:17:40 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xf}}}, 0xb8}}, 0x0) [ 2953.342620] hfs: dir_umask requires a value [ 2953.347143] hfs: unable to parse mount options [ 2953.394842] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2953.453889] Bluetooth: hci0: Frame reassembly failed (-84) 03:17:41 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = gettid() rt_sigqueueinfo(r1, 0x0, &(0x7f0000000080)={0x0, 0x0, 0xfffffffa}) perf_event_open(0x0, r1, 0xf, 0xffffffffffffffff, 0x10) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r1, 0x3f, &(0x7f0000000100)=""/253) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:17:41 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13ccb, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:17:41 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x48}}}, 0xb8}}, 0x0) 03:17:41 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000060}}]}) 03:17:41 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x7400) 03:17:41 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x4c}}}, 0xb8}}, 0x0) [ 2953.892554] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2953.916520] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2953.972281] hfs: dir_umask requires a value [ 2953.975219] Bluetooth: hci1: Frame reassembly failed (-84) [ 2953.985123] hfs: unable to parse mount options 03:17:41 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13ccc, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2954.029929] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:17:41 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000068}}]}) 03:17:41 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x60}}}, 0xb8}}, 0x0) [ 2954.085500] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:17:41 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x7a00) [ 2954.200496] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2954.222633] hfs: dir_umask requires a value [ 2954.238308] hfs: unable to parse mount options [ 2955.458918] Bluetooth: hci0: command 0x1003 tx timeout [ 2955.464435] Bluetooth: hci0: sending frame failed (-49) [ 2956.019183] Bluetooth: hci1: command 0x1003 tx timeout [ 2956.026315] Bluetooth: hci1: sending frame failed (-49) [ 2957.539105] Bluetooth: hci0: command 0x1001 tx timeout [ 2957.544524] Bluetooth: hci0: sending frame failed (-49) [ 2958.099150] Bluetooth: hci1: command 0x1001 tx timeout [ 2958.104562] Bluetooth: hci1: sending frame failed (-49) [ 2959.619104] Bluetooth: hci0: command 0x1009 tx timeout [ 2960.179138] Bluetooth: hci1: command 0x1009 tx timeout 03:17:50 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x68}}}, 0xb8}}, 0x0) 03:17:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13ccd, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2963.515192] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2963.525606] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:17:51 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x800, 0x404102) ioctl$TIOCMGET(r1, 0x5415, &(0x7f0000000080)) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pivot_root(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='./file0\x00') ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:17:51 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x8000006c}}]}) 03:17:51 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x33672) 03:17:51 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/d\xba\x00\x00\x00tmx\x00', 0x100, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) r1 = shmget$private(0x0, 0x4000, 0x6b1, &(0x7f0000ffb000/0x4000)=nil) shmat(r1, &(0x7f0000ffa000/0x3000)=nil, 0x3000) 03:17:51 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x6c}}}, 0xb8}}, 0x0) 03:17:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cce, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2964.132378] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2964.160724] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:17:51 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x74}}}, 0xb8}}, 0x0) 03:17:51 executing program 2: bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)={&(0x7f00000000c0)='./file0\x00', 0x0, 0x10}, 0x10) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x409142, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x10000000000001f2, 0x0) ioctl$TIOCGDEV(r1, 0x80045432, &(0x7f0000000080)) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000180)=0x4) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20ncci\x00', 0x1, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f00000001c0)={'yam0\x00', @link_local}) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:17:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13ccf, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2964.193801] Bluetooth: hci0: Frame reassembly failed (-84) [ 2964.226200] hfs: dir_umask requires a value [ 2964.234233] hfs: unable to parse mount options 03:17:51 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000074}}]}) [ 2964.285297] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2964.311456] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:17:51 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x7a}}}, 0xb8}}, 0x0) 03:17:51 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x33673) [ 2964.428264] hfs: dir_umask requires a value [ 2964.442134] hfs: unable to parse mount options [ 2964.449842] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2966.258984] Bluetooth: hci0: command 0x1003 tx timeout [ 2966.264567] Bluetooth: hci0: sending frame failed (-49) [ 2968.338909] Bluetooth: hci0: command 0x1001 tx timeout [ 2968.344320] Bluetooth: hci0: sending frame failed (-49) [ 2970.419001] Bluetooth: hci0: command 0x1009 tx timeout 03:18:01 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000003c00)='/proc/sys/net/ipv4/vs/conn_reuse_mode\x00', 0x2, 0x0) r2 = socket$inet(0x2, 0x4000000805, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) r4 = dup3(r2, r3, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r4, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r3, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r4, 0x84, 0x66, &(0x7f000059aff8)={r5}, &(0x7f000034f000)=0x8) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000003c40)={r5, 0x8001, 0x9}, &(0x7f0000003c80)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000003cc0)={r6, 0x99, "3c103d7d76cb57a02d37da133a38c0a096554852496eb2a545edf4cbebd2f5127985318bd8a1fea72542d9fd951230d136c46423141db13e4805e4bbcc372594e3b2250424572340a3603ee9e2a7266ee503c0d6f4fab5ead4f1186a398744c03654654dc7cf8af17b92e3a19e70573ddf9727fd261cb7432edaadf5c43d2c146f735a03ee7e8e9e884038702adc67b8ec104d21b796ea007e"}, &(0x7f0000003d80)=0xa1) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000140)={0xffffffffffffffff}) ioctl$FIONREAD(0xffffffffffffffff, 0x541b, &(0x7f0000000080)) vmsplice(r7, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) epoll_pwait(r7, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}], 0x6, 0x0, &(0x7f0000000000)={0x7}, 0x8) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) 03:18:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cd0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:18:01 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x10) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) ftruncate(r2, 0x0) ioctl$sock_inet_SIOCRTMSG(r2, 0x890d, &(0x7f0000000180)={0x0, {0x2, 0x4e22, @remote}, {0x2, 0x4e23, @local}, {0x2, 0x4e20, @empty}, 0xd0, 0x0, 0x0, 0x0, 0xeae4, &(0x7f0000000000)='veth0_to_team\x00', 0x2, 0x2, 0xc99}) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:18:01 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x88}}}, 0xb8}}, 0x0) 03:18:01 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x8000007a}}]}) 03:18:01 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x33674) [ 2974.395191] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2974.412271] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2974.421845] hfs: dir_umask requires a value [ 2974.435284] hfs: unable to parse mount options 03:18:01 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xf0}}}, 0xb8}}, 0x0) 03:18:01 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000300}}]}) 03:18:01 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cd1, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2974.540072] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:18:01 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x300}}}, 0xb8}}, 0x0) [ 2974.581244] Bluetooth: hci0: Frame reassembly failed (-84) 03:18:01 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x33675) [ 2974.634726] hfs: dir_umask requires a value [ 2974.635859] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2974.661156] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2974.672341] hfs: unable to parse mount options 03:18:02 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x500}}}, 0xb8}}, 0x0) [ 2974.787586] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2976.658907] Bluetooth: hci0: command 0x1003 tx timeout [ 2976.665754] Bluetooth: hci0: sending frame failed (-49) [ 2978.739063] Bluetooth: hci0: command 0x1001 tx timeout [ 2978.744564] Bluetooth: hci0: sending frame failed (-49) [ 2980.818962] Bluetooth: hci0: command 0x1009 tx timeout 03:18:12 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f0000000000)) 03:18:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cd2, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:18:12 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x800003fe}}]}) 03:18:12 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x33676) 03:18:12 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x600}}}, 0xb8}}, 0x0) 03:18:12 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x10) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) [ 2985.266477] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2985.278572] hfs: dir_umask requires a value [ 2985.291195] hfs: unable to parse mount options [ 2985.297473] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:18:12 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x700}}}, 0xb8}}, 0x0) 03:18:12 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$VT_GETMODE(r1, 0x5601, &(0x7f0000000000)) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) [ 2985.335408] Bluetooth: hci0: Frame reassembly failed (-84) 03:18:12 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000500}}]}) 03:18:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cd3, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2985.453600] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2985.467703] Bluetooth: hci1: Frame reassembly failed (-84) 03:18:12 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xa00}}}, 0xb8}}, 0x0) 03:18:12 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x33677) [ 2985.546877] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2985.560944] hfs: dir_umask requires a value [ 2985.562556] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2985.565301] hfs: unable to parse mount options [ 2987.379020] Bluetooth: hci0: command 0x1003 tx timeout [ 2987.384538] Bluetooth: hci0: sending frame failed (-49) [ 2987.539006] Bluetooth: hci1: command 0x1003 tx timeout [ 2987.544512] Bluetooth: hci1: sending frame failed (-49) [ 2989.459086] Bluetooth: hci0: command 0x1001 tx timeout [ 2989.464550] Bluetooth: hci0: sending frame failed (-49) [ 2989.618970] Bluetooth: hci1: command 0x1001 tx timeout [ 2989.624381] Bluetooth: hci1: sending frame failed (-49) [ 2991.539079] Bluetooth: hci0: command 0x1009 tx timeout [ 2991.699002] Bluetooth: hci1: command 0x1009 tx timeout 03:18:22 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x3) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = gettid() rt_sigqueueinfo(r1, 0x0, &(0x7f0000000080)={0x0, 0x0, 0xfffffffa}) socket$rds(0x15, 0x5, 0x0) perf_event_open(0x0, r1, 0xf, 0xffffffffffffffff, 0x10) getpriority(0x0, r1) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:18:22 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xe00}}}, 0xb8}}, 0x0) 03:18:22 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000600}}]}) 03:18:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cd4, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:18:22 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x33678) [ 2995.499143] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2995.512036] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:18:22 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xf00}}}, 0xb8}}, 0x0) [ 2995.581944] hfs: dir_umask requires a value [ 2995.586340] hfs: unable to parse mount options 03:18:22 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x2000, 0x0) ioctl$sock_ax25_SIOCADDRT(r1, 0x890b, &(0x7f0000000100)={@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, 0x2, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) [ 2995.658386] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:18:23 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000700}}]}) 03:18:23 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cd5, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:18:23 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x2000}}}, 0xb8}}, 0x0) 03:18:23 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x33679) 03:18:23 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) pipe(&(0x7f0000000080)) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x5, 0x200) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) fsetxattr$security_smack_transmute(0xffffffffffffffff, &(0x7f0000000200)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000240)='TRUE', 0x4, 0x2) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) ioctl$TIOCLINUX3(0xffffffffffffffff, 0x541c, &(0x7f00000004c0)) setsockopt$RDS_FREE_MR(r2, 0x114, 0x3, &(0x7f0000000100)={{0x6, 0xcd}, 0x20}, 0x10) ioctl$SCSI_IOCTL_DOORUNLOCK(r1, 0x5381) ioctl$SG_NEXT_CMD_LEN(0xffffffffffffffff, 0x2283, &(0x7f00000001c0)=0x51) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000480)={r4, 0xc0, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=0x8001, 0x0, 0x0, 0x0, &(0x7f00000002c0)={0x2, 0x2}, 0x0, 0x0, &(0x7f0000000300)={0x5, 0x5, 0xff, 0x1}, &(0x7f0000000340)=0x5268, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=0xffffffff80000001}}, 0x10) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f00000001c0), 0xfffffef3) ioctl$TUNSETVNETLE(r5, 0x400454dc, &(0x7f0000000500)) [ 2996.140132] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2996.166198] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:18:23 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) syz_open_dev$usbfs(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x1131, 0x2) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) r4 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r4, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r4, &(0x7f0000000d00), 0x1c4, 0x0) sendmsg$rds(r4, &(0x7f00000039c0)={&(0x7f0000000240)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x12}}, 0x10, &(0x7f00000015c0)=[{&(0x7f0000000280)=""/131, 0x83}, {&(0x7f0000000340)=""/123, 0x7b}, {&(0x7f00000003c0)=""/42, 0x2a}, {&(0x7f00000004c0)=""/4096, 0x1000}, {&(0x7f00000014c0)=""/188, 0xbc}, {&(0x7f0000001580)=""/62, 0x3e}], 0x6, &(0x7f0000003840)=[@cswp={0x58, 0x114, 0x7, {{0x81, 0xb5}, &(0x7f0000001640)=0x7ff, &(0x7f0000001680)=0x2, 0x4fc, 0x3, 0x2, 0x5, 0x2, 0x1e15}}, @cswp={0x58, 0x114, 0x7, {{0x800, 0x80000000}, &(0x7f00000016c0)=0xe4, &(0x7f0000001700)=0xffff, 0x7fffffff, 0x1, 0x2, 0x2, 0x2, 0x200000000000000}}, @fadd={0x58, 0x114, 0x6, {{0x3e03, 0x8}, &(0x7f0000001740)=0x6, &(0x7f0000001780)=0x3, 0x80000001, 0x5, 0x5, 0x1ff, 0x4, 0x7}}, @rdma_map={0x30, 0x114, 0x3, {{&(0x7f00000017c0)=""/4096, 0x1000}, &(0x7f00000027c0), 0x68}}, @rdma_dest={0x18, 0x114, 0x2, {0xde, 0x80}}, @rdma_map={0x30, 0x114, 0x3, {{&(0x7f0000002800)=""/4096, 0x1000}, &(0x7f0000003800), 0x34}}], 0x180, 0x10}, 0x40040) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000100)={0x0, @remote, @initdev}, &(0x7f00000001c0)=0xc) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r9, @ANYBLOB="0000000000000000280012000c000100766574680000000018000200fd0001000000000023c0306554362dddcb892ef8051404bde5bf296e3c566a03d724f7ead1ef33adfdbe08b8c5236b93b9797b4409f6e370d1515d2e1fa63259e6d4bd05772981", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x48}}, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x300, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r9, 0x5}, [@IFLA_PROTO_DOWN={0x8, 0xa, 0x14}]}, 0x28}}, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x14, &(0x7f0000000200)={@ipv4={[], [], @remote}}, 0x14) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r10, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r1, 0x107, 0x8, &(0x7f0000000180)=0x24, 0x4) sendmmsg(r1, &(0x7f0000000d00), 0x1c4, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e23, 0xe39, @ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x83}, @in={0x2, 0x4e22, @local}], 0x3c) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:18:23 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x3f00}}}, 0xb8}}, 0x0) [ 2996.228023] hfs: dir_umask requires a value [ 2996.241830] hfs: unable to parse mount options 03:18:23 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cd6, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 2996.269814] Bluetooth: hci0: Frame reassembly failed (-84) 03:18:23 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000900}}]}) [ 2996.319262] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2996.351673] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:18:23 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x4800}}}, 0xb8}}, 0x0) [ 2996.410946] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2996.432536] IPv6: ADDRCONF(NETDEV_UP): veth19: link is not ready [ 2996.440915] batman_adv: batadv0: Adding interface: veth19 [ 2996.441135] hfs: dir_umask requires a value 03:18:23 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x3367a) [ 2996.446575] batman_adv: batadv0: The MTU of interface veth19 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 2996.480898] batman_adv: batadv0: Interface activated: veth19 [ 2996.488100] hfs: unable to parse mount options 03:18:23 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cd7, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:18:23 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x4c00}}}, 0xb8}}, 0x0) [ 2996.510974] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2996.558525] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2996.608435] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:18:23 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cd8, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:18:23 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000a00}}]}) 03:18:24 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x6000}}}, 0xb8}}, 0x0) [ 2996.755753] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 2996.757826] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 2996.782967] hfs: dir_umask requires a value [ 2996.801368] hfs: unable to parse mount options [ 2998.338952] Bluetooth: hci0: command 0x1003 tx timeout [ 2998.344454] Bluetooth: hci0: sending frame failed (-49) [ 3000.418964] Bluetooth: hci0: command 0x1001 tx timeout [ 3000.425603] Bluetooth: hci0: sending frame failed (-49) [ 3002.498988] Bluetooth: hci0: command 0x1009 tx timeout 03:18:33 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$KDSIGACCEPT(r0, 0x4b4e, 0x3e) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r1, &(0x7f0000000d00), 0x1c4, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000000), 0x4) 03:18:33 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x3367b) 03:18:33 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x208100, 0x0) r3 = syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x3, 0x2000) ioctl$VT_OPENQRY(r3, 0x5600, &(0x7f00000001c0)) sendmmsg(r1, &(0x7f0000000d00), 0x1c4, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0xa, &(0x7f0000000000)=0x7, 0x4) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) ioctl$DRM_IOCTL_AGP_ACQUIRE(r4, 0x6430) ioctl$KDADDIO(r4, 0x400455c8, 0x3) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:18:33 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x6800}}}, 0xb8}}, 0x0) 03:18:33 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000e15}}]}) 03:18:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cd9, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3006.435635] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3006.445772] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:18:33 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x6c00}}}, 0xb8}}, 0x0) [ 3006.479847] hfs: dir_umask requires a value [ 3006.491630] Bluetooth: hci0: Frame reassembly failed (-84) [ 3006.492608] hfs: unable to parse mount options [ 3006.497557] Bluetooth: hci0: Frame reassembly failed (-84) 03:18:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cda, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:18:33 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x8000150e}}]}) 03:18:33 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x7400}}}, 0xb8}}, 0x0) 03:18:33 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x3367c) [ 3006.624605] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3006.644249] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:18:34 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cdb, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3006.721688] hfs: dir_umask requires a value [ 3006.726056] hfs: unable to parse mount options [ 3006.756020] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3006.779606] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3008.499056] Bluetooth: hci0: command 0x1003 tx timeout [ 3008.506235] Bluetooth: hci0: sending frame failed (-49) [ 3010.579050] Bluetooth: hci0: command 0x1001 tx timeout [ 3010.584452] Bluetooth: hci0: sending frame failed (-49) [ 3012.659069] Bluetooth: hci0: command 0x1009 tx timeout 03:18:43 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) prctl$PR_MCE_KILL(0x21, 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) ioctl$KDSKBMODE(r1, 0x4b45, &(0x7f0000000000)=0x7) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000380)={0x2, 0x0, [{0x3004, 0xd5, &(0x7f0000000180)=""/213}, {0x100000, 0xc2, &(0x7f0000000280)=""/194}]}) syz_open_dev$rtc(&(0x7f0000000080)='/dev/rtc#\x00', 0x1, 0x1) 03:18:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cdc, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:18:43 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x7a00}}}, 0xb8}}, 0x0) 03:18:43 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80001f00}}]}) 03:18:43 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x3367d) 03:18:43 executing program 4: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='tmpfs\x00', 0x0, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r1) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000500)={{{@in6=@local, @in6}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000000600)=0xe8) r2 = syz_open_dev$media(&(0x7f00000008c0)='/dev/media#\x00', 0x8, 0x2) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000b00)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@dev}}, &(0x7f0000000c00)=0xffffffc5) syz_mount_image$ext4(&(0x7f0000000100)='eXt3\x00', &(0x7f0000000140)='./file0\x00', 0x1, 0x4, &(0x7f0000000340)=[{&(0x7f0000000180)="b8680449", 0x4, 0x32f1}, {&(0x7f0000000200)="16f60b1b49c4a1d31543ca22cd41490f299fd65cb00ca92cc7ee5011b9f1576bfa3eaeba95bab30e456ff14b8f4078d90a832d3017c2363700620aeef96542af42feaf0beeeaa23e91abc77b2f43bf9592fe03088764492145426b067b36059ca2b758ba374eee66db7b3275cba9ca6476998807d80edd87ab3fc20bb9ad483533b45b68246bcd164bdf34b5848d32e6d04411484be3a556fcdcc28608bb754d89ec25b1b0affa0cbaad31cb90f42017c09b9d5a0cdaed3f4d79d3d31c6fcb6b1f06ab85faac6f8f5022491c11902818e6c105adc11518308f91b91fcf1df00a64ea7857bf0f3590b5ba0f580cdc3d19f0a9c3e6e6059d20e710", 0xfa, 0xad0}, {&(0x7f0000000400)="3aaba717510ed9b4e15def4980f3c37536517f7c0915e761f727f26d2a906b0f2bd4ae2acad61f54c6e49f4edd244c51001eb71466eed9d331ab6c06b9c11106696f243346e3edbb937c67f00569577d4ab73859e191d252108861fbeb2159ed5dd68af999299e3e3bca7a0921e9ca34fdb82bbb9bc3e86da867a6f7113a43f8afe6430c8d433a62ec056f1490344c0463515889d0230e20bddb13ec99e62f60f9b5157c3f3742335a4b77025be11433acbfd4d7f3abc2b133751cb9c04f3b1d0c113c446929ef601b9bbbfae9", 0xcd, 0x4}, {&(0x7f00000001c0)="f3bf466b305d279449f850d416238194a3b7276ab03053", 0x17, 0x2a9}], 0x40000, &(0x7f0000000780)={[], [{@obj_role={'obj_role', 0x3d, 'bdev'}}, {@audit='audit'}, {@smackfsfloor={'smackfsfloor', 0x3d, '*'}}, {@smackfsroot={'smackfsroot', 0x3d, ':&vboxnet0-vboxnet0keyring'}}, {@hash='hash'}, {@smackfsroot={'smackfsroot', 0x3d, 'tmpfs\x00'}}, {@euid_eq={'euid', 0x3d, r3}}, {@obj_type={'obj_type', 0x3d, '/dev/ptmx\x00'}}]}) umount2(&(0x7f0000000080)='./file0/../file0/file0\x00', 0x0) lsetxattr$security_ima(&(0x7f0000000300)='./file0/../file0/file0\x00', &(0x7f00000003c0)='security.ima\x00', &(0x7f0000000840)=@sha1={0x1, "54003aaa1e6ad59fff3b9d9f68f2f96a48c47f44"}, 0x15, 0x2) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r4, 0x400455c8, 0x0) ioctl$TIOCSETD(r4, 0x400455cb, 0x0) [ 3016.673803] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3016.676986] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3016.704034] Bluetooth: hci0: Frame reassembly failed (-84) 03:18:44 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x8800}}}, 0xb8}}, 0x0) 03:18:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cdd, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3016.721594] Bluetooth: hci1: Frame reassembly failed (-84) [ 3016.735452] hfs: dir_umask requires a value [ 3016.746451] hfs: unable to parse mount options 03:18:44 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80002000}}]}) [ 3016.830768] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3016.841937] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:18:44 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x3367e) 03:18:44 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xf000}}}, 0xb8}}, 0x0) [ 3016.923412] hfs: dir_umask requires a value [ 3016.939865] hfs: unable to parse mount options 03:18:44 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cde, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3016.964284] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3016.996626] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3018.738915] Bluetooth: hci1: command 0x1003 tx timeout [ 3018.738951] Bluetooth: hci0: command 0x1003 tx timeout [ 3018.744310] Bluetooth: hci1: sending frame failed (-49) [ 3018.755300] Bluetooth: hci0: sending frame failed (-49) [ 3020.818956] Bluetooth: hci0: command 0x1001 tx timeout [ 3020.825882] Bluetooth: hci0: sending frame failed (-49) [ 3020.831507] Bluetooth: hci1: command 0x1001 tx timeout [ 3020.836852] Bluetooth: hci1: sending frame failed (-49) [ 3022.898920] Bluetooth: hci1: command 0x1009 tx timeout [ 3022.904305] Bluetooth: hci0: command 0x1009 tx timeout 03:18:54 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhost-vsock\x00', 0x2, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x7, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x1aa) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) getsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f00000001c0)=0x1, &(0x7f0000000200)=0x4) ioctl$TIOCSETD(0xffffffffffffffff, 0x800455ca, 0x0) flock(0xffffffffffffffff, 0x4) get_mempolicy(&(0x7f0000000100), &(0x7f0000000180), 0x6, &(0x7f0000ffd000/0x1000)=nil, 0x0) 03:18:54 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$inet6_dccp_buf(r1, 0x21, 0x1cd, &(0x7f0000000080)=""/50, &(0x7f0000000100)=0x32) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r1, 0x400455cb, 0x0) 03:18:54 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x34000}}}, 0xb8}}, 0x0) 03:18:54 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80002200}}]}) 03:18:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cdf, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:18:54 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x3367f) [ 3026.903560] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3026.923487] hfs: dir_umask requires a value [ 3026.925233] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3026.942768] hfs: unable to parse mount options 03:18:54 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000140)={0x0, &(0x7f0000000100)}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x80000) ioctl$DRM_IOCTL_SG_FREE(r2, 0x40106439, &(0x7f0000000080)={0x2f}) [ 3026.952249] Bluetooth: hci0: Frame reassembly failed (-84) 03:18:54 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x400300}}}, 0xb8}}, 0x0) 03:18:54 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80002c00}}]}) 03:18:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13ce0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3027.049742] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:18:54 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xf0ffff}}}, 0xb8}}, 0x0) 03:18:54 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x33680) [ 3027.112231] Bluetooth: hci1: Frame reassembly failed (-84) [ 3027.135282] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3027.144822] hfs: dir_umask requires a value [ 3027.167719] hfs: unable to parse mount options [ 3027.174054] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3028.978905] Bluetooth: hci0: command 0x1003 tx timeout [ 3028.984351] Bluetooth: hci0: sending frame failed (-49) [ 3029.138949] Bluetooth: hci1: command 0x1003 tx timeout [ 3029.144484] Bluetooth: hci1: sending frame failed (-49) [ 3031.058986] Bluetooth: hci0: command 0x1001 tx timeout [ 3031.065716] Bluetooth: hci0: sending frame failed (-49) [ 3031.219005] Bluetooth: hci1: command 0x1001 tx timeout [ 3031.224449] Bluetooth: hci1: sending frame failed (-49) [ 3033.138974] Bluetooth: hci0: command 0x1009 tx timeout [ 3033.298929] Bluetooth: hci1: command 0x1009 tx timeout 03:19:04 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x1000000}}}, 0xb8}}, 0x0) 03:19:04 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13ce1, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:19:04 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80003f00}}]}) 03:19:04 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x33681) 03:19:04 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) pipe2(&(0x7f0000000000), 0x8c000) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x80000, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/mls\x00', 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x800455ca, 0x0) [ 3037.207250] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3037.208816] hfs: dir_umask requires a value [ 3037.217119] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:19:04 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x2000000}}}, 0xb8}}, 0x0) [ 3037.247574] Bluetooth: hci0: Frame reassembly failed (-84) [ 3037.254147] hfs: unable to parse mount options [ 3037.340568] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:19:05 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$MON_IOCX_GET(r1, 0x40189206, &(0x7f0000000180)={&(0x7f0000000080), &(0x7f0000000100)=""/94, 0x5e}) 03:19:05 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80004000}}]}) 03:19:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13ce2, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:19:05 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x33682) 03:19:05 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x3000000}}}, 0xb8}}, 0x0) [ 3037.742191] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3037.762227] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:19:05 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x4000000}}}, 0xb8}}, 0x0) 03:19:05 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13ce3, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3037.819428] hfs: dir_umask requires a value [ 3037.836841] Bluetooth: hci1: sending frame failed (-49) [ 3037.842170] hfs: unable to parse mount options 03:19:05 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80004800}}]}) 03:19:05 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x33683) [ 3037.967687] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3037.975652] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:19:05 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x5000000}}}, 0xb8}}, 0x0) [ 3038.057592] hfs: dir_umask requires a value [ 3038.062968] hfs: unable to parse mount options [ 3038.174067] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3039.298909] Bluetooth: hci0: command 0x1003 tx timeout [ 3039.304315] Bluetooth: hci0: sending frame failed (-49) [ 3039.859021] Bluetooth: hci1: command 0x1003 tx timeout [ 3039.864568] Bluetooth: hci1: sending frame failed (-49) [ 3041.378955] Bluetooth: hci0: command 0x1001 tx timeout [ 3041.384377] Bluetooth: hci0: sending frame failed (-49) [ 3041.938942] Bluetooth: hci1: command 0x1001 tx timeout [ 3041.944877] Bluetooth: hci1: sending frame failed (-49) [ 3043.458961] Bluetooth: hci0: command 0x1009 tx timeout [ 3044.018934] Bluetooth: hci1: command 0x1009 tx timeout 03:19:14 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x20, 0x4040) ioctl$GIO_UNISCRNMAP(r2, 0x4b69, &(0x7f0000000180)=""/255) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:19:14 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80004c00}}]}) [ 3047.345877] hfs: dir_umask requires a value [ 3047.355470] Bluetooth: hci0: Frame reassembly failed (-84) [ 3047.355517] hfs: unable to parse mount options 03:19:15 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x33684) 03:19:15 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13ce4, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:19:15 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x6000000}}}, 0xb8}}, 0x0) 03:19:15 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80006000}}]}) 03:19:15 executing program 4: r0 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r0, &(0x7f0000000140)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r0, &(0x7f0000000d00), 0x1c4, 0x0) setsockopt$netrom_NETROM_N2(r0, 0x103, 0x3, &(0x7f0000000080)=0x3, 0x4) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x0) ioctl$TIOCSETD(r2, 0x400455cb, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) ioctl$TIOCMSET(r3, 0x5418, &(0x7f0000000000)=0x8001) [ 3047.988406] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3047.996109] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:19:15 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13ce5, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3048.047761] hfs: dir_umask requires a value 03:19:15 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x7000000}}}, 0xb8}}, 0x0) [ 3048.077236] hfs: unable to parse mount options [ 3048.108732] Bluetooth: hci1: Frame reassembly failed (-84) [ 3048.134353] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:19:15 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80006800}}]}) [ 3048.175402] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:19:15 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13ce6, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:19:15 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x33685) [ 3048.278394] hfs: dir_umask requires a value [ 3048.282387] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3048.313035] hfs: unable to parse mount options [ 3049.378911] Bluetooth: hci0: command 0x1003 tx timeout [ 3049.384432] Bluetooth: hci0: sending frame failed (-49) [ 3050.179131] Bluetooth: hci1: command 0x1003 tx timeout [ 3050.184681] Bluetooth: hci1: sending frame failed (-49) [ 3051.459017] Bluetooth: hci0: command 0x1001 tx timeout [ 3051.464431] Bluetooth: hci0: sending frame failed (-49) [ 3052.259128] Bluetooth: hci1: command 0x1001 tx timeout [ 3052.264530] Bluetooth: hci1: sending frame failed (-49) [ 3053.538989] Bluetooth: hci0: command 0x1009 tx timeout [ 3054.339110] Bluetooth: hci1: command 0x1009 tx timeout 03:19:24 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13ce7, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:19:24 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xa000000}}}, 0xb8}}, 0x0) 03:19:24 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80006c00}}]}) 03:19:24 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x33686) 03:19:24 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x12) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r1, &(0x7f0000000d00), 0x1c4, 0x0) r3 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r3, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r3, &(0x7f0000000d00), 0x1c4, 0x0) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x20040, 0x0) r5 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r5, &(0x7f0000000140)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r5, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r5, &(0x7f0000000d00), 0x1c4, 0x0) r7 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r7, &(0x7f0000000140)={0x11, 0x0, r8, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r7, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r7, &(0x7f0000000d00), 0x1c4, 0x0) r9 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r9, &(0x7f0000000140)={0x11, 0x0, r10, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r9, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r9, &(0x7f0000000d00), 0x1c4, 0x0) r11 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r11, &(0x7f0000000140)={0x11, 0x0, r12, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r11, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r11, &(0x7f0000000d00), 0x1c4, 0x0) r13 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r13, &(0x7f0000000140)={0x11, 0x0, r14, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r13, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r13, &(0x7f0000000d00), 0x1c4, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x5) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) [ 3057.578675] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3057.594069] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:19:24 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xe000000}}}, 0xb8}}, 0x0) [ 3057.650275] hfs: dir_umask requires a value [ 3057.654827] hfs: unable to parse mount options [ 3057.751157] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:19:25 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80007400}}]}) 03:19:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13ce8, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:19:25 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x33687) 03:19:25 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xf000000}}}, 0xb8}}, 0x0) 03:19:25 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) ioctl$TIOCGISO7816(r1, 0x80285442, &(0x7f0000000000)) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) [ 3058.214996] hfs: dir_umask requires a value [ 3058.227318] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3058.241192] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3058.244403] hfs: unable to parse mount options 03:19:25 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x20000000}}}, 0xb8}}, 0x0) [ 3058.287202] Bluetooth: hci0: sending frame failed (-49) 03:19:25 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80007a00}}]}) 03:19:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13ce9, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3058.367736] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:19:25 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x3f000000}}}, 0xb8}}, 0x0) 03:19:25 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x33688) [ 3058.458053] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3058.513223] hfs: dir_umask requires a value [ 3058.517595] hfs: unable to parse mount options [ 3058.531682] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:19:25 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0x20f) ioctl$KDADDIO(r0, 0x400455c8, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r3 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r3, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r3, &(0x7f0000000d00), 0x1c4, 0x0) fallocate(r3, 0x44, 0xa3e1, 0xff) ioctl$PIO_FONT(r2, 0x4b61, &(0x7f0000000000)="76225d468c1814b23e189edb3e20652e75957f3057b52f2387b8be3d2308498648238ab01ec1d7dabf47362e852bedfc2ba2") pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r5, &(0x7f00000001c0), 0xfffffef3) ioctl$SCSI_IOCTL_SEND_COMMAND(r5, 0x1, &(0x7f0000000080)={0x2, 0x188e, 0x20, "8093"}) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:19:25 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cea, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:19:25 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x48000000}}}, 0xb8}}, 0x0) 03:19:25 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x8000fe03}}]}) [ 3058.678616] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3058.692961] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:19:26 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x4c000000}}}, 0xb8}}, 0x0) 03:19:26 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x33689) [ 3058.751328] hfs: dir_umask requires a value [ 3058.755859] hfs: unable to parse mount options [ 3058.821825] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3060.338940] Bluetooth: hci0: command 0x1003 tx timeout [ 3060.344432] Bluetooth: hci0: sending frame failed (-49) [ 3062.418955] Bluetooth: hci0: command 0x1001 tx timeout [ 3062.424368] Bluetooth: hci0: sending frame failed (-49) [ 3064.498982] Bluetooth: hci0: command 0x1009 tx timeout 03:19:35 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}, 0x22}]}) 03:19:35 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13ceb, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:19:35 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x60000000}}}, 0xb8}}, 0x0) 03:19:35 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x3368a) 03:19:35 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$VT_ACTIVATE(0xffffffffffffffff, 0x5606, 0x40) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:19:35 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) write$P9_RCREATE(r2, &(0x7f0000000080)={0x18, 0x73, 0x2, {{0x43, 0x4, 0x7}, 0x80000000}}, 0x18) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x12) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) [ 3068.471723] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3068.488661] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3068.503823] hfs: unable to parse mount options [ 3068.507667] Bluetooth: hci0: Frame reassembly failed (-84) 03:19:35 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x68000000}}}, 0xb8}}, 0x0) 03:19:35 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}, 0x2f}]}) 03:19:35 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cec, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3068.600660] Bluetooth: hci1: Frame reassembly failed (-84) [ 3068.623795] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3068.644388] hfs: unable to parse mount options 03:19:36 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x6c000000}}}, 0xb8}}, 0x0) 03:19:36 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}, 0x32}]}) [ 3068.704694] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:19:36 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x3368b) 03:19:36 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x74000000}}}, 0xb8}}, 0x0) 03:19:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13ced, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3068.764645] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3068.836636] hfs: dir_umask requires a value [ 3068.837046] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3068.848421] hfs: unable to parse mount options [ 3068.856444] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:19:36 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x7a000000}}}, 0xb8}}, 0x0) 03:19:36 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cee, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3068.963853] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3068.991665] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3070.579011] Bluetooth: hci0: command 0x1003 tx timeout [ 3070.588218] Bluetooth: hci0: sending frame failed (-49) [ 3070.659061] Bluetooth: hci1: command 0x1003 tx timeout [ 3070.664458] Bluetooth: hci1: sending frame failed (-49) [ 3072.659006] Bluetooth: hci0: command 0x1001 tx timeout [ 3072.664417] Bluetooth: hci0: sending frame failed (-49) [ 3072.739052] Bluetooth: hci1: command 0x1001 tx timeout [ 3072.744480] Bluetooth: hci1: sending frame failed (-49) [ 3074.739091] Bluetooth: hci0: command 0x1009 tx timeout [ 3074.819043] Bluetooth: hci1: command 0x1009 tx timeout 03:19:45 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) ioctl$VT_RESIZE(r1, 0x5609, &(0x7f0000000000)={0x7f, 0xa9b4, 0x41}) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:19:45 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:19:45 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cef, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:19:45 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x3368c) 03:19:45 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x88000000}}}, 0xb8}}, 0x0) 03:19:45 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$KDSETLED(r1, 0x4b32, 0x38) syncfs(r0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) [ 3078.720578] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3078.737757] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:19:46 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x9effffff}}}, 0xb8}}, 0x0) 03:19:46 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cf0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3078.786795] Bluetooth: hci0: Frame reassembly failed (-84) [ 3078.797537] hfs: dir_umask requires a value [ 3078.802791] hfs: unable to parse mount options [ 3078.847785] Bluetooth: hci1: Frame reassembly failed (-84) [ 3078.883363] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:19:46 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}], [], 0x2}) 03:19:46 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xf0ffffff}}}, 0xb8}}, 0x0) [ 3078.894893] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:19:46 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x3368d) 03:19:46 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cf1, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3078.981246] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3078.998718] hfs: dir_umask requires a value [ 3079.009180] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3079.018208] hfs: unable to parse mount options [ 3080.819205] Bluetooth: hci0: command 0x1003 tx timeout [ 3080.827968] Bluetooth: hci0: sending frame failed (-49) [ 3080.898979] Bluetooth: hci1: command 0x1003 tx timeout [ 3080.904497] Bluetooth: hci1: sending frame failed (-49) [ 3082.899180] Bluetooth: hci0: command 0x1001 tx timeout [ 3082.904573] Bluetooth: hci0: sending frame failed (-49) [ 3082.978994] Bluetooth: hci1: command 0x1001 tx timeout [ 3082.984919] Bluetooth: hci1: sending frame failed (-49) [ 3084.979193] Bluetooth: hci0: command 0x1009 tx timeout [ 3085.058957] Bluetooth: hci1: command 0x1009 tx timeout 03:19:56 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x206a80, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000000)=0x5) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$BLKFLSBUF(r2, 0x1261, &(0x7f0000002700)=0x1d) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) recvmmsg(r1, &(0x7f0000002640)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000180)=""/180, 0xb4}, {&(0x7f0000000240)=""/190, 0xbe}, {&(0x7f0000000300)=""/4096, 0x1000}], 0x3, &(0x7f0000001300)=""/84, 0x54}, 0x3}, {{&(0x7f0000001380)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x80, &(0x7f0000001600)=[{&(0x7f0000001400)=""/125, 0x7d}, {&(0x7f0000000100)=""/31, 0x1f}, {&(0x7f0000001480)=""/88, 0x58}, {&(0x7f0000001500)=""/241, 0xf1}], 0x4, &(0x7f0000001640)=""/4096, 0x1000}, 0x5}], 0x2, 0x20, &(0x7f00000026c0)={0x0, 0x1c9c380}) 03:19:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cf2, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:19:56 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xfffff000}}}, 0xb8}}, 0x0) 03:19:56 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}], [], 0x3}) 03:19:56 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1fffff) [ 3088.963207] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3088.980528] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:19:56 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000140)={0xffffffffffffffff}) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) r4 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x20, 0x6, @random="f648e869a026"}, 0x14) setsockopt$packet_int(r4, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r4, &(0x7f0000000d00), 0x1c4, 0x0) getsockopt$bt_l2cap_L2CAP_LM(r4, 0x6, 0x3, &(0x7f0000001500), &(0x7f0000001540)=0x4) bind$packet(r2, &(0x7f0000000140)={0x11, 0x19, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) vmsplice(r2, &(0x7f00000011c0)=[{&(0x7f0000001100)="cefb27b8d276fe8a90f33f8ec8e0673700752c01ccf01a57515c9895787422cff56e9e4e150abcaf8bb88ad1f707aa119957fc631c2d81352e6ee390fcf42f5ca7320a", 0x43}], 0x1, 0x0) ioctl$GIO_SCRNMAP(r1, 0x4b40, &(0x7f0000000100)=""/4096) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r7 = syz_open_dev$amidi(&(0x7f0000001180)='/dev/amidi#\x00', 0x6, 0x400000) r8 = syz_open_dev$binderN(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r8, 0x40046207, 0x0) r9 = mmap$binder(&(0x7f0000a00000/0x600000)=nil, 0x600000, 0x1, 0x11, r8, 0x0) ioctl$BINDER_WRITE_READ(r7, 0xc0306201, &(0x7f00000014c0)={0x20, 0x0, &(0x7f0000001380)=[@acquire, @free_buffer={0x40086303, r9}, @decrefs={0x40046307, 0x1}, @exit_looper], 0xe7, 0x0, &(0x7f00000013c0)="f9f450a52d5a245ebc5a54f5af74cca79f0dcbeb501622e245ab7d93a02ae1418a04170a7cab84737878b9731ce08080251c8480c4518a7ad7a23f27b893ddadc6ecc769b15b02f37ab0c2ffd5a88be1c48e36c00d843a815dae50fc9f2e332b415b1e3eb8cd6e8e64cccb778c9b4856b549e35f556383240795c3ebfd85decb7ab3dc303c4b8b485e622f5689993fd84f77a95ba564f72d6bce587882f473ae47473f86d549cf44cf0520f9b7beee76131ffdf966327ec8c6348a067bdbf81bddf95ae107ccc6099a594d4b94813acfdd4fd13ca933412b079bd87bc0495623c8133770db73c1"}) ioctl$KDADDIO(r0, 0x400455c8, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r10, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r11 = socket(0x1, 0x4, 0x8) r12 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r12, &(0x7f0000000140)={0x11, 0x0, r13, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r12, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r12, &(0x7f0000000d00), 0x1c4, 0x0) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r11, &(0x7f0000000140)={0x11, 0x0, r14, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r11, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r11, &(0x7f0000000d00), 0x1c4, 0x0) r15 = socket$inet(0x2, 0x4000000805, 0x0) r16 = socket$inet_sctp(0x2, 0x5, 0x84) r17 = dup3(r15, r16, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r16, 0x84, 0x64, &(0x7f0000001280)=[@in6={0xa, 0x4e22, 0x4, @loopback, 0x400005}], 0x1c) sendto$inet(r17, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r16, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r16, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f000059aff8)={r18}, &(0x7f000034f000)=0x8) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r11, 0x84, 0x13, &(0x7f0000001200)={r18, 0x8}, &(0x7f0000001240)=0x8) ioctl$TIOCSBRK(r10, 0x5427) dup(r8) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:19:56 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xffffff7f}}}, 0xb8}}, 0x0) 03:19:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cf3, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3089.037411] hfs: dir_umask requires a value [ 3089.050851] hfs: unable to parse mount options 03:19:56 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}], [], 0x4}) [ 3089.132299] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3089.162732] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:19:56 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x6b6b6b) 03:19:56 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xffffff9e}}}, 0xb8}}, 0x0) [ 3089.218190] audit: type=1400 audit(1571023196.494:86): avc: denied { map } for pid=6922 comm="syz-executor.4" path="/dev/binder4" dev="devtmpfs" ino=16840 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:device_t:s0 tclass=chr_file permissive=1 [ 3089.255548] Bluetooth: hci0: sending frame failed (-49) [ 3089.263760] hfs: dir_umask requires a value 03:19:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cf4, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3089.288161] hfs: unable to parse mount options [ 3089.313382] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3089.354598] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:19:57 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) r1 = eventfd2(0x1000, 0x399261359455a7d3) read$eventfd(r1, &(0x7f0000000000), 0x8) 03:19:57 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xfffffff0}}}, 0xb8}}, 0x0) 03:19:57 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}], [], 0x5}) 03:19:57 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cf5, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:19:57 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1000000) [ 3089.850742] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3089.868388] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3089.921254] Bluetooth: hci1: Frame reassembly failed (-84) [ 3089.927319] Bluetooth: hci1: Frame reassembly failed (-84) [ 3089.936257] hfs: dir_umask requires a value [ 3089.946295] hfs: unable to parse mount options [ 3091.298940] Bluetooth: hci0: command 0x1003 tx timeout [ 3091.305822] Bluetooth: hci0: sending frame failed (-49) [ 3091.938900] Bluetooth: hci1: command 0x1003 tx timeout [ 3091.944502] Bluetooth: hci1: sending frame failed (-49) [ 3093.378926] Bluetooth: hci0: command 0x1001 tx timeout [ 3093.384317] Bluetooth: hci0: sending frame failed (-49) [ 3094.018917] Bluetooth: hci1: command 0x1001 tx timeout [ 3094.024322] Bluetooth: hci1: sending frame failed (-49) [ 3095.458936] Bluetooth: hci0: command 0x1009 tx timeout [ 3096.098913] Bluetooth: hci1: command 0x1009 tx timeout 03:20:07 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000000)={0x2, 0x1000, 0x3, 0xfff, 0x18, 0x1, 0x0, 0x20, 0xa5, 0x4, 0x9, 0x7fff}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:20:07 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x40030000000000}}}, 0xb8}}, 0x0) 03:20:07 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}], [], 0x6}) 03:20:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cf6, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:20:07 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x2000000) [ 3099.950399] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3099.977344] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3099.991770] Bluetooth: hci0: Frame reassembly failed (-84) 03:20:07 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xf0ffffffffffff}}}, 0xb8}}, 0x0) 03:20:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cf7, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3100.023119] hfs: dir_umask requires a value [ 3100.027482] hfs: unable to parse mount options [ 3100.108652] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3100.125134] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:20:07 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x3000000) 03:20:07 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}], [], 0x7}) 03:20:07 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x100000000000000}}}, 0xb8}}, 0x0) 03:20:07 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cf8, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:20:07 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r1) r2 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r3) setresuid(r1, r3, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r4, 0x400455c8, 0x0) [ 3100.470369] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3100.480221] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3100.526161] Bluetooth: hci1: Frame reassembly failed (-84) [ 3100.538649] hfs: dir_umask requires a value [ 3100.555828] hfs: unable to parse mount options [ 3102.018963] Bluetooth: hci0: command 0x1003 tx timeout [ 3102.027210] Bluetooth: hci0: sending frame failed (-49) [ 3102.578991] Bluetooth: hci1: command 0x1003 tx timeout [ 3102.584497] Bluetooth: hci1: sending frame failed (-49) [ 3104.098959] Bluetooth: hci0: command 0x1001 tx timeout [ 3104.104352] Bluetooth: hci0: sending frame failed (-49) [ 3104.659015] Bluetooth: hci1: command 0x1001 tx timeout [ 3104.664425] Bluetooth: hci1: sending frame failed (-49) [ 3106.178998] Bluetooth: hci0: command 0x1009 tx timeout [ 3106.739021] Bluetooth: hci1: command 0x1009 tx timeout 03:20:17 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) syz_open_pts(r0, 0x882) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$TCSETAW(r1, 0x5407, &(0x7f0000000080)={0x3f, 0x7c16, 0x7ff, 0x3, 0x12, 0x3, 0x3, 0x1, 0x4, 0x7}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) ioctl$GIO_UNISCRNMAP(r2, 0x4b69, &(0x7f0000000100)=""/36) ioctl$KDADDIO(r0, 0x400455c8, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000180)=@assoc_value, &(0x7f00000001c0)=0x8) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:20:17 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x200000000000000}}}, 0xb8}}, 0x0) 03:20:17 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}], [], 0x8}) 03:20:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cf9, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:20:17 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x4000000) [ 3110.061567] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3110.073296] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3110.117383] hfs: dir_umask requires a value 03:20:17 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x300000000000000}}}, 0xb8}}, 0x0) 03:20:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cfa, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3110.139522] hfs: unable to parse mount options [ 3110.178119] Bluetooth: hci0: Frame reassembly failed (-84) [ 3110.195972] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:20:17 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}], [], 0x9}) 03:20:17 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x400000000000000}}}, 0xb8}}, 0x0) [ 3110.232656] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:20:17 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x5000000) 03:20:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cfb, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3110.311298] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3110.326202] hfs: dir_umask requires a value [ 3110.335586] hfs: unable to parse mount options [ 3110.427838] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:20:17 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}], [], 0xa}) [ 3110.693744] hfs: dir_umask requires a value [ 3110.698103] hfs: unable to parse mount options [ 3112.188911] Bluetooth: hci0: command 0x1003 tx timeout [ 3112.195279] Bluetooth: hci0: sending frame failed (-49) [ 3114.258930] Bluetooth: hci0: command 0x1001 tx timeout [ 3114.264324] Bluetooth: hci0: sending frame failed (-49) [ 3116.339029] Bluetooth: hci0: command 0x1009 tx timeout 03:20:27 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cfc, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:20:27 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x500000000000000}}}, 0xb8}}, 0x0) 03:20:27 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x6000000) 03:20:27 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptKx\x00', 0x200040, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) write(r2, &(0x7f0000000240), 0x0) ioctl$KDGKBLED(r1, 0x4b64, &(0x7f0000000200)) lsetxattr$security_smack_entry(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='security.SMACK64MMAP\x00', &(0x7f0000000140)='\x00', 0x1, 0x2) utimes(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={{}, {0x77359400}}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x1b) ioctl$KDADDIO(r0, 0x400455c8, 0x0) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000000)) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) syz_init_net_socket$llc(0x1a, 0x1, 0x0) 03:20:27 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}], [], 0x22}) 03:20:27 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x20000, 0x0) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) r4 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r6, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r6, 0xc1205531, &(0x7f00000001c0)={0x8, 0x0, 0x7, 0x401, [], [], [], 0x3, 0x80000000, 0xa38, 0xfffffffb, "4d05fda883b23fab4f2f991e33e84d0e"}) setsockopt$packet_int(r4, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r4, &(0x7f0000000d00), 0x1c4, 0x0) r7 = socket$inet(0x2, 0x4000000805, 0x0) r8 = socket$inet_sctp(0x2, 0x5, 0x84) r9 = dup3(r7, r8, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r8, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r10, &(0x7f00000001c0), 0xfffffef3) ioctl$VIDIOC_ENUMAUDOUT(r10, 0xc0345642, &(0x7f0000000300)={0x7, "fca59b8c080b1d0c259306efcb5642b904b9c50639fc8409f3f866ca1e54459b", 0x2}) sendto$inet(r9, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r8, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r8, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r9, 0x84, 0x66, &(0x7f000059aff8)={r11}, &(0x7f000034f000)=0x8) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r4, 0x84, 0x76, &(0x7f0000000100)={r11, 0x3}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp6_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f0000000180)={r12, 0x80000000, 0x0, 0x6da}, 0x10) ioctl$TIOCSISO7816(r1, 0xc0285443, &(0x7f0000000080)={0x401, 0x9a, 0xad, 0x26d, 0x1ff}) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) [ 3120.326219] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3120.326246] hfs: dir_umask requires a value [ 3120.347582] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3120.374148] hfs: unable to parse mount options 03:20:27 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x600000000000000}}}, 0xb8}}, 0x0) 03:20:27 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}], [], 0x2c}) 03:20:27 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x7000000) 03:20:27 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cfd, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:20:27 executing program 2: openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cuse\x00', 0x2, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x1, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x200, 0x20000) ioctl$FIGETBSZ(r1, 0x2, &(0x7f0000000000)) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) [ 3120.543247] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3120.574232] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:20:27 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x700000000000000}}}, 0xb8}}, 0x0) [ 3120.640430] Bluetooth: hci0: Frame reassembly failed (-84) [ 3120.650166] hfs: dir_umask requires a value [ 3120.657252] Bluetooth: hci1: Frame reassembly failed (-84) [ 3120.663556] hfs: unable to parse mount options [ 3120.664050] Bluetooth: hci1: Frame reassembly failed (-84) 03:20:28 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}], [], 0x48}) 03:20:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cfe, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3120.706479] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:20:28 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0xb000000) 03:20:28 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xa00000000000000}}}, 0xb8}}, 0x0) [ 3120.796888] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3120.809753] hfs: dir_umask requires a value [ 3120.828282] hfs: unable to parse mount options 03:20:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13cff, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3120.893314] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3120.977458] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3122.658905] Bluetooth: hci1: command 0x1003 tx timeout [ 3122.659016] Bluetooth: hci0: command 0x1003 tx timeout [ 3122.665377] Bluetooth: hci1: sending frame failed (-49) [ 3122.675385] Bluetooth: hci0: sending frame failed (-49) [ 3124.738946] Bluetooth: hci0: command 0x1001 tx timeout [ 3124.745640] Bluetooth: hci0: sending frame failed (-49) [ 3124.751410] Bluetooth: hci1: command 0x1001 tx timeout [ 3124.756766] Bluetooth: hci1: sending frame failed (-49) [ 3126.818952] Bluetooth: hci1: command 0x1009 tx timeout [ 3126.824350] Bluetooth: hci0: command 0x1009 tx timeout 03:20:38 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = semget$private(0x0, 0x4, 0x13) semctl$SETALL(r1, 0x0, 0x11, &(0x7f0000000000)=[0x0, 0x80, 0x81, 0x6, 0x1ca0, 0x1, 0x6, 0x1, 0x8001, 0x8001]) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:20:38 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xe00000000000000}}}, 0xb8}}, 0x0) 03:20:38 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}], [], 0x4c}) 03:20:38 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d00, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:20:38 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev\xe5\x850\x9ax\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x3c1102, 0x0) write$FUSE_DIRENT(r1, &(0x7f0000000100)={0x98, 0x0, 0x6, [{0x4, 0x80000000, 0xa, 0xfffffffb, '/dev/ptmx\x00'}, {0x2, 0x1, 0x1, 0xffff, '\xdb'}, {0x1, 0x401, 0xa, 0x7c1f82af, '/dev/ptmx\x00'}, {0x3, 0x9, 0x0, 0x5}]}, 0x98) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:20:38 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x10000000) [ 3131.296205] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3131.302598] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:20:38 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xf00000000000000}}}, 0xb8}}, 0x0) [ 3131.345868] Bluetooth: hci0: Frame reassembly failed (-84) [ 3131.374654] hfs: dir_umask requires a value 03:20:38 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000080)=0x4862) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f00000001c0)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@mcast2}}, &(0x7f00000002c0)=0xe8) r5 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) lsetxattr$system_posix_acl(&(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000280)={{}, {}, [], {}, [{0x8, 0x2, r6}, {0x8, 0x0, r6}], {0x10, 0x6}}, 0x34, 0x0) r7 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r7, &(0x7f0000000140)={0x11, 0x0, r8, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r7, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r7, &(0x7f0000000d00), 0x1c4, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r7, 0x29, 0x22, &(0x7f0000000300)={{{@in6=@remote, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6}}, &(0x7f0000000400)=0xe8) mount$fuseblk(&(0x7f0000000100)='/dev/loop0\x00', &(0x7f0000000140)='\x00', &(0x7f0000000180)='fuseblk\x00', 0x40, &(0x7f0000000440)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x1000}, 0x2c, {'user_id', 0x3d, r4}, 0x2c, {'group_id', 0x3d, r6}, 0x2c, {[{@blksize={'blksize'}}, {@allow_other='allow_other'}, {@allow_other='allow_other'}, {@allow_other='allow_other'}], [{@obj_type={'obj_type', 0x3d, '/dev/ptmx\x00'}}, {@dont_measure='dont_measure'}, {@obj_role={'obj_role', 0x3d, ']'}}, {@uid_eq={'uid', 0x3d, r9}}, {@smackfstransmute={'smackfstransmute', 0x3d, '/dev/ptmx\x00'}}, {@obj_type={'obj_type', 0x3d, 'selfmime_typecpuseteth0'}}]}}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0xffffffde, 0x207fff, 0x1, 0xb8d3, 0x11, 0xff, 0x6, 0x80, 0x7, 0x1, 0xb, 0x997}) 03:20:38 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d01, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3131.414072] hfs: unable to parse mount options [ 3131.427448] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:20:38 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x2000000000000000}}}, 0xb8}}, 0x0) 03:20:38 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x150e0000) 03:20:38 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}], [], 0x60}) [ 3131.480105] Bluetooth: hci1: Frame reassembly failed (-84) [ 3131.504600] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3131.557362] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3131.616480] hfs: dir_umask requires a value [ 3131.621395] hfs: unable to parse mount options [ 3133.379099] Bluetooth: hci0: command 0x1003 tx timeout [ 3133.384623] Bluetooth: hci0: sending frame failed (-49) [ 3133.538951] Bluetooth: hci1: command 0x1003 tx timeout [ 3133.544462] Bluetooth: hci1: sending frame failed (-49) [ 3135.459082] Bluetooth: hci0: command 0x1001 tx timeout [ 3135.464494] Bluetooth: hci0: sending frame failed (-49) [ 3135.618977] Bluetooth: hci1: command 0x1001 tx timeout [ 3135.624467] Bluetooth: hci1: sending frame failed (-49) [ 3137.539106] Bluetooth: hci0: command 0x1009 tx timeout [ 3137.698947] Bluetooth: hci1: command 0x1009 tx timeout 03:20:48 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x3f00000000000000}}}, 0xb8}}, 0x0) 03:20:48 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d02, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:20:48 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}], [], 0x68}) 03:20:48 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1f000000) 03:20:48 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x0, 0x0) syz_open_pts(r1, 0x200000) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TIOCPKT(r2, 0x5420, &(0x7f00000001c0)=0x3f) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) setsockopt$inet_sctp_SCTP_AUTO_ASCONF(r3, 0x84, 0x1e, &(0x7f0000000200)=0xb5, 0x4) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) r4 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r4, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r4, &(0x7f0000000d00), 0x1c4, 0x0) recvfrom$unix(r4, &(0x7f0000000080), 0x0, 0x10002, &(0x7f0000000100)=@file={0x0, './file0\x00'}, 0x6e) [ 3141.412807] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3141.431763] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3141.447899] hfs: dir_umask requires a value 03:20:48 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x4800000000000000}}}, 0xb8}}, 0x0) 03:20:48 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d03, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3141.464609] hfs: unable to parse mount options [ 3141.526358] Bluetooth: hci0: Frame reassembly failed (-84) [ 3141.550932] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3141.562348] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:20:49 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/pt^\x89\x00', 0x40000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCGSERIAL(0xffffffffffffffff, 0x541e, &(0x7f0000001100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=""/4093}) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:20:49 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}], [], 0x6c}) 03:20:49 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x4c00000000000000}}}, 0xb8}}, 0x0) 03:20:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d04, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:20:49 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x20000000) [ 3142.142331] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3142.150778] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:20:49 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x6000000000000000}}}, 0xb8}}, 0x0) 03:20:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d05, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:20:49 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) syz_open_pts(r1, 0x101000) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) [ 3142.209675] hfs: dir_umask requires a value [ 3142.228286] hfs: unable to parse mount options 03:20:49 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}], [], 0x74}) [ 3142.299252] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3142.307049] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3142.388095] hfs: dir_umask requires a value [ 3142.391024] Bluetooth: hci1: Frame reassembly failed (-84) [ 3142.398436] Bluetooth: hci1: Frame reassembly failed (-84) [ 3142.399009] hfs: unable to parse mount options [ 3143.538987] Bluetooth: hci0: command 0x1003 tx timeout [ 3143.544506] Bluetooth: hci0: sending frame failed (-49) [ 3144.419058] Bluetooth: hci1: command 0x1003 tx timeout [ 3144.424581] Bluetooth: hci1: sending frame failed (-49) [ 3145.618967] Bluetooth: hci0: command 0x1001 tx timeout [ 3145.624395] Bluetooth: hci0: sending frame failed (-49) [ 3146.499051] Bluetooth: hci1: command 0x1001 tx timeout [ 3146.506039] Bluetooth: hci1: sending frame failed (-49) [ 3147.698966] Bluetooth: hci0: command 0x1009 tx timeout [ 3148.579055] Bluetooth: hci1: command 0x1009 tx timeout 03:20:58 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) mq_open(&(0x7f0000000000)='wlan0!selinux)\x00', 0x40, 0x180, &(0x7f0000000080)={0x101, 0x9, 0x81, 0xff77, 0x7f, 0x4a0, 0x2, 0x7}) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio\x00', 0x8c1, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f0000000340)={0xffff, 0x1736, &(0x7f0000000140)="9f092fd5b64fdb44562ae3302f9fb1a771cbc9d6f7570592180f556654be15c3db476ab91f20fe6855b3ed946b6dce6551baaf4798a46bd1de8975c6e0ecacba936ee03b349ee2b28bbd12d8b93fc06dcc5c7adc7c33f6c978859a39de2b0fef35c1082acc3d2da623770b944308e8772502de79b2e64db104ed1e31c31d367c85087fe80103c1df0b3968af19845ef3a85d7de7d567a623a4436330d42e8b6808f0ec101acab4fec1ed06e26529da7a45df81ca5d6353a80047e1128a664db16df45275ddd41ab41567cd5f8dd2bb6f8a636e161ee1863ab84759e34253220fa9fe63ce95c7", &(0x7f0000000240)="e8fb89647eafa62436f3d01d6b561d3d32d04d4480021c8fefe4e72b45b2d1b2b38c1b120792f18b1c523c0164affd74b5d2b91a5b1634127c058d356b25307d716a7fc3248926d42c828fcf320c8d4854e3b099fb27d916e9face8831377487e38eeca9b4dbc306a91e4b5c27580ee562f652d58cef5296c98357ad0886c2bb255abd1a7682382a8ad5b244153a544227ab1ab557dc5afa319517f66d2c6d3ffd248d73a3dd73e09a2cb6ce97bec0f24a10fe290dc66b4df2e21aaafef18de63cc86640d5ab41378593aca60dd2656b6d59eb542677f5ffa1ca06de93a9708f872d489b0aa8602cf5ed0815cc6c3c43caace4a0", 0xe6, 0xf4}) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:20:58 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x3f000000) 03:20:58 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x6800000000000000}}}, 0xb8}}, 0x0) 03:20:58 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d06, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:20:58 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}], [], 0x7a}) [ 3151.698099] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3151.729396] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:20:59 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x6c00000000000000}}}, 0xb8}}, 0x0) 03:20:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d07, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3151.752522] Bluetooth: hci0: Frame reassembly failed (-84) [ 3151.776655] hfs: dir_umask requires a value [ 3151.793902] hfs: unable to parse mount options 03:20:59 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}], [], 0xff}) [ 3151.850499] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:20:59 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x40000000) 03:20:59 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x7400000000000000}}}, 0xb8}}, 0x0) [ 3151.910018] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3151.958706] hfs: dir_umask requires a value [ 3151.978003] hfs: unable to parse mount options [ 3151.983682] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:21:00 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x40002, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:21:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d08, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3152.930380] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3152.954819] Bluetooth: hci1: Frame reassembly failed (-84) [ 3153.788972] Bluetooth: hci0: command 0x1003 tx timeout [ 3153.794814] Bluetooth: hci0: sending frame failed (-49) [ 3154.978994] Bluetooth: hci1: command 0x1003 tx timeout [ 3154.986040] Bluetooth: hci1: sending frame failed (-49) [ 3155.859032] Bluetooth: hci0: command 0x1001 tx timeout [ 3155.864521] Bluetooth: hci0: sending frame failed (-49) [ 3157.058992] Bluetooth: hci1: command 0x1001 tx timeout [ 3157.064406] Bluetooth: hci1: sending frame failed (-49) [ 3157.939070] Bluetooth: hci0: command 0x1009 tx timeout [ 3159.138987] Bluetooth: hci1: command 0x1009 tx timeout 03:21:09 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = socket(0x20000000000001c, 0x2, 0x6) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r1, &(0x7f0000000d00), 0x1c4, 0x0) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000001c0)='erspan0\x00', 0x10) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r1, 0x84, 0x15, &(0x7f0000000000)={0x8}, 0x1) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ptmx\x00', 0x400000, 0x0) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) ioctl$KVM_SET_SIGNAL_MASK(r3, 0x4004ae8b, &(0x7f0000000200)=ANY=[@ANYBLOB="e200000064b3d46d267e28d0021309ac0df802bc12759cfa85990e90a116f289ea546be93206dc9593d75473a29e1d5870f92ef4dcf4fb50fca0fc7b95963f43303b177582909859e52c3b0506091d3c1dda49305eb33275c4502093884928ab22ef2ae2ae63b8e3bf6f941720bf88cef80902e0e1375c6c28451c4e53d5686beb7d14c759c5a1def8ac61e4bb02d09c74fa8508c741ee509dacfdec6447a3824012c277ae07edd0fd8ec18b419f1bcc5a1ee36ae4d1cb80056cde3ffb0faafe0d02f1c236cadb0000000091767dcafb9a24c5f590863085a27227ba6c1938778e8e6fa60000"]) 03:21:09 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x7a00000000000000}}}, 0xb8}}, 0x0) 03:21:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d09, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:21:09 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x48000000) 03:21:09 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) mknod(&(0x7f0000000080)='./file0\x00', 0x80, 0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="303030303230303030303030303030150000000000000070bd17a98fcc101a00000000"]) r2 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x2, 0x2) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r4) mount$9p_unix(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='9p\x00', 0x2000, &(0x7f0000000200)={'trans=unix,', {[{@access_user='access=user'}, {@noextend='noextend'}, {@msize={'msize'}}, {@debug={'debug'}}], [{@fsname={'fsname', 0x3d, '/dev/vbi#\x00'}}, {@euid_eq={'euid', 0x3d, r4}}]}}) [ 3161.909121] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3161.925950] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:21:09 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x8800000000000000}}}, 0xb8}}, 0x0) 03:21:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d0a, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3161.985502] hfs: unable to parse mount options [ 3161.993230] Bluetooth: hci0: Frame reassembly failed (-84) 03:21:09 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r2, 0x891c, &(0x7f0000000000)={'bond_slave_0\x00', {0x2, 0x4e23, @local}}) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x10, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:21:09 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x9effffff00000000}}}, 0xb8}}, 0x0) [ 3162.046422] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3162.084451] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:21:09 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x4c000000) [ 3162.173879] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3162.199918] hfs: dir_umask requires a value [ 3162.204600] hfs: unable to parse mount options [ 3162.307375] hfs: dir_umask requires a value [ 3162.326720] hfs: unable to parse mount options 03:21:10 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x10001, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:21:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d0b, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3163.167028] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3164.019187] Bluetooth: hci0: command 0x1003 tx timeout [ 3164.029209] Bluetooth: hci0: sending frame failed (-49) [ 3166.099087] Bluetooth: hci0: command 0x1001 tx timeout [ 3166.104493] Bluetooth: hci0: sending frame failed (-49) [ 3168.179095] Bluetooth: hci0: command 0x1009 tx timeout 03:21:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d0c, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:21:19 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xf0ffffff00000000}}}, 0xb8}}, 0x0) 03:21:19 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r2, 0xc040564a, &(0x7f0000000000)={0x8, 0x0, 0x4006, 0x1, 0x0, 0x2, 0x7, 0x1}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getpeername$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000180)=0x14) syz_mount_image$hfs(&(0x7f0000000080)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x21003, &(0x7f0000000640)=ANY=[@ANYBLOB='di000000020000000000,\x00'/35]) 03:21:19 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x68000000) 03:21:19 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x400000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:21:19 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r3, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r3, &(0x7f0000000d00), 0x1c4, 0x0) write(r1, &(0x7f00000005c0)="b1b3acff2b6d07ee609832bb01d6c96233374db58846bfeabfd3fa10b1f9351fb3d0af4ed2366a71d4e7bdcf74c8e455b8658e997c24de9c7f27660bd7f45ae7635c91726757183c1f12d331b1c05ccf703d4f90176ffe58f649d845be8526d0dd16606628d78243222333ca729a2242ebf875f8657f3b46ee422fa49fc38545075b8323aa7e77b477963343128d3f84ebe4399500"/163, 0x8b6aa1f36e35bbd7) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r5, &(0x7f0000000240)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000140)=0x1, r6, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_DISCONNECT(r2, &(0x7f0000000200)={0xa, 0x4, 0xfa00, {r6}}, 0xc) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r7, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r1, &(0x7f0000000d00), 0x0, 0x40000) r8 = dup2(r0, r1) ioctl$EXT4_IOC_GROUP_ADD(r8, 0x40286608, &(0x7f0000000000)={0x40000000, 0x4, 0x9, 0xfffffffffffffff7, 0x3, 0x5}) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r9, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$GIO_UNISCRNMAP(r9, 0x4b69, &(0x7f00000002c0)=""/162) r10 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r10, &(0x7f0000000140)={0x11, 0x0, r11, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r10, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r10, &(0x7f0000000d00), 0x1c4, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r12, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) epoll_ctl$EPOLL_CTL_MOD(r12, 0x3, r10, &(0x7f0000000280)={0x40000000}) setsockopt$IP_VS_SO_SET_ADDDEST(r10, 0x0, 0x487, &(0x7f0000000100)={{0x2, @remote, 0x4e22, 0x3, 'nq\x00', 0x3a, 0x33f4194c, 0x37}, {@local, 0x4e22, 0x10000, 0x78, 0xd11, 0x40}}, 0x44) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/validatetrans\x00', 0x1, 0x0) mq_unlink(&(0x7f00000001c0)='[$\x00') [ 3172.160478] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3172.182028] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:21:19 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xffffff7f00000000}}}, 0xb8}}, 0x0) 03:21:19 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$PIO_UNIMAPCLR(r1, 0x4b68, &(0x7f0000000000)={0xf0f, 0x3, 0x8}) 03:21:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d0d, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:21:19 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x6b6b6b00) [ 3172.313768] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3172.325568] Bluetooth: hci0: Frame reassembly failed (-84) 03:21:19 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xffffffff00000000}}}, 0xb8}}, 0x0) [ 3172.379815] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:21:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d0e, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:21:19 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0xfffffffffffff000}}}, 0xb8}}, 0x0) [ 3172.438978] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3172.497877] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:21:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d0f, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3172.560730] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3172.627526] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:21:20 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x1) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="6469725f756d61736b3d30303030303030303030303032303030303030303030302c000663785980bc3a3a6ecf372c75301a580fd9c65e5cd3a8b3314ea12efb3d209194ab4ef2dcd1f33b7e6b7b0a0f30b8fa6da15113e9e7fab3982f0fef8b42bd161c36c3e956866048072858a7a8016592d13debe471e1137d5c3488d7b538ec7692c7a072a3bf3b9afe6ce1dc83d0fe2836218dff9a71ec1589df22c500"/175]) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) fsync(0xffffffffffffffff) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f0000000280)={{0x6800, 0x4, 0x9, 0x0, 0x4, 0x1f, 0x8, 0x81, 0xa3, 0x81, 0xdc, 0x1}, {0x87800, 0x2000, 0x9, 0x5, 0x0, 0xaf, 0x5, 0x0, 0x81, 0x1, 0x0, 0x1}, {0x4000, 0xf000, 0x0, 0x7, 0x7f, 0x1, 0xb, 0x3f, 0x81, 0x8, 0x8, 0xb8}, {0x0, 0x2000, 0xd, 0x1, 0x7, 0x1, 0x2, 0x5, 0x7f, 0x5, 0x7f, 0x7f}, {0x0, 0xf000, 0xe, 0x5, 0x3f, 0xff, 0x40, 0x2, 0x6a, 0x29, 0x6, 0x2}, {0x3000, 0x106000, 0xd, 0x3f, 0x81, 0x5, 0x0, 0x1, 0x5, 0x7, 0x1, 0x40}, {0x1, 0x6000, 0xe, 0x1, 0x1, 0x0, 0x0, 0xd8, 0xff, 0x5, 0x7, 0x7f}, {0x4, 0xa001, 0xe, 0xe3, 0x6, 0x7f, 0x0, 0x7, 0x1f, 0x20, 0x6, 0x81}, {0x5000}, {0x2000, 0x12000}, 0x40000020, 0x0, 0x0, 0x10400, 0xb, 0x200, 0x2, [0xff, 0xfffffffffffff000, 0x3]}) r4 = syz_open_dev$sndpcmp(&(0x7f0000000080)='/dd/pcmC#D#p\x00', 0x80, 0x42040) r5 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r5, &(0x7f0000000140)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r5, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r5, &(0x7f0000000d00), 0x1c4, 0x0) getsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0x7, &(0x7f00000003c0), &(0x7f0000000400)=0x4) write$nbd(r4, &(0x7f0000000180)={0x67446698, 0x1, 0x2, 0x4, 0x4, "e064b2dc1423e42d5b779353733eb0ee06cc0a38da3368be1514a2d01e709f5930fe8f8f608a0ef71de5"}, 0x3a) ioctl$KVM_S390_VCPU_FAULT(r2, 0x4008ae52, &(0x7f0000000000)=0x4) 03:21:20 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x2}}}, 0xb8}}, 0x0) 03:21:20 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x6c000000) [ 3173.060761] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3173.129858] hfs: dir_umask requires a value [ 3173.134235] hfs: unable to parse mount options 03:21:20 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/Xevmx\x00\xd8(\x00', 0xd080c1, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:21:20 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d10, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3173.342341] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3174.339057] Bluetooth: hci0: command 0x1003 tx timeout [ 3174.344652] Bluetooth: hci0: sending frame failed (-49) [ 3176.418906] Bluetooth: hci0: command 0x1001 tx timeout [ 3176.424319] Bluetooth: hci0: sending frame failed (-49) [ 3178.499040] Bluetooth: hci0: command 0x1009 tx timeout 03:21:29 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x6, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xa088058ea43e4904}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, r2, 0x800, 0xfffffffd, 0x25dfdbfd, {{}, 0x0, 0x5, 0x0, {0x14, 0x19, {0x2, 0x80000000, 0x101, 0x5}}}, [""]}, 0x30}, 0x1, 0x0, 0x0, 0x48000}, 0x1) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x400, 0x0) ioctl$TIOCCONS(r3, 0x541d) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$USBDEVFS_CLAIMINTERFACE(r4, 0x8004550f, &(0x7f0000000240)=0xfff) 03:21:29 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x72360300) 03:21:29 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x3}}}, 0xb8}}, 0x0) 03:21:29 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x3ff, 0x400) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000080)={0x6, [0x7, 0xa7, 0x4, 0x5, 0x6, 0x6]}, 0x10) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) ioctl$TCSBRK(r0, 0x5409, 0x9) 03:21:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d11, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:21:29 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="64693030303030303030303032303030303010fffffffff442b7e78995fd6c80fa6be7a0832fa4bf002c9838bb2e3e1d824487dfedabb89c08563310b000ddbf17a830ab5be25f45c93e73f2a7729d990b652ebb280f53422ce5cd2228d2b6b993d31c468f8cc192d4a52cde40c6bc1d76ccb6b7a2b3240a081807eb9e1e3c38174606f718104b1ccd0b540b527f494005f522071a74489867ba6dbb2b790c4de10d676777410d30582617f42181412ad1317cdb8a0c6da782d8020092cf8378e1ad33a7ed811ac688901a257eb952f25bebbfcbed02e29c525daeb9309c0cd78ace79c59bc1cb40a859184354952abae0672f7a8366e62d37685aa0f52bf3d150234ace0fd1f9fbbab1e46757e0a6c01095bda2a297d933946baaf94aeab129bddbe61399e5fe2f2913b111fffba1e4e3b761f991cfea59d6b4bc3c"]) ioctl$VIDIOC_G_SLICED_VBI_CAP(0xffffffffffffffff, 0xc0745645, &(0x7f0000000140)={0xfff, [0x2, 0x0, 0x6, 0xffff, 0x4, 0x8000, 0x6, 0x3, 0x0, 0x81, 0x1, 0x3f, 0x7, 0x9, 0x1, 0x800, 0x3, 0x81, 0x0, 0x8, 0x34, 0x81, 0x401, 0x7, 0x100, 0x3, 0x8000, 0x9, 0xff80, 0x1de5, 0xff, 0x6, 0x3ff, 0xfff8, 0xc, 0x8eb5, 0xff, 0x6, 0x9, 0x7d8, 0x20, 0x2, 0x1, 0xee60, 0x6, 0x8, 0x7f, 0x8], 0x2}) [ 3182.391932] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3182.401867] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:21:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d12, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:21:29 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x4}}}, 0xb8}}, 0x0) [ 3182.457463] Bluetooth: hci1: Frame reassembly failed (-84) [ 3182.471514] hfs: unable to parse mount options 03:21:29 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) r3 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r3, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r3, &(0x7f0000000d00), 0x1c4, 0x0) r5 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r5, &(0x7f0000000140)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r5, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r5, &(0x7f0000000d00), 0x1c4, 0x0) r7 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r7, &(0x7f0000000140)={0x11, 0x0, r8, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r7, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r7, &(0x7f0000000d00), 0x1c4, 0x0) r9 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r9, &(0x7f0000000140)={0x11, 0x0, r10, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r9, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r9, &(0x7f0000000d00), 0x1c4, 0x0) r11 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r11, &(0x7f0000000140)={0x11, 0x0, r12, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r11, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r11, &(0x7f0000000d00), 0x1c4, 0x0) r13 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r13, &(0x7f0000000140)={0x11, 0x0, r14, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r13, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r13, &(0x7f0000000d00), 0x1c4, 0x0) ppoll(&(0x7f0000000140)=[{r3, 0x4480}, {r5, 0x1}, {r7, 0x2}, {r0, 0x8107}, {r9, 0x8014}, {r11, 0x1000}, {0xffffffffffffffff, 0x62}, {r13, 0x100}, {r1, 0x6}, {0xffffffffffffffff, 0x200}], 0xa, &(0x7f0000000000)={0x0, 0x1c9c380}, &(0x7f0000000080)={0x818}, 0x8) [ 3182.548556] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3182.579583] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:21:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d13, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:21:29 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x73360300) 03:21:29 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x5}}}, 0xb8}}, 0x0) [ 3182.637525] hfs: dir_umask requires a value [ 3182.673385] hfs: unable to parse mount options [ 3182.698395] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3182.716080] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3183.185140] hfs: dir_umask requires a value [ 3183.198911] hfs: unable to parse mount options [ 3184.498929] Bluetooth: hci1: command 0x1003 tx timeout [ 3184.504448] Bluetooth: hci1: sending frame failed (-49) [ 3184.510429] Bluetooth: hci0: command 0x1003 tx timeout [ 3184.521448] Bluetooth: hci0: sending frame failed (-49) [ 3186.578938] Bluetooth: hci0: command 0x1001 tx timeout [ 3186.584363] Bluetooth: hci0: sending frame failed (-49) [ 3186.590161] Bluetooth: hci1: command 0x1001 tx timeout [ 3186.595507] Bluetooth: hci1: sending frame failed (-49) [ 3188.658955] Bluetooth: hci1: command 0x1009 tx timeout [ 3188.664493] Bluetooth: hci0: command 0x1009 tx timeout 03:21:39 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x402, 0x0) setsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f0000000080)=0x8c6c477558c0bc3e, 0x4) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:21:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d14, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:21:39 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x6}}}, 0xb8}}, 0x0) 03:21:39 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x74000000) 03:21:39 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) 03:21:39 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r1, &(0x7f0000000d00), 0x1c4, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000580)={0xf0, r3, 0x0, 0x0, 0x25dfdbfe, {}, [@TIPC_NLA_BEARER={0x8c, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'nlmon0\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {0x14, 0x2, @in={0x2, 0x4e21, @empty}}}}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'bcsf0\x00'}}]}, @TIPC_NLA_SOCK={0x4}, @TIPC_NLA_MON={0x2c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4e94}, @TIPC_NLA_MON_REF={0x8}]}, @TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_ADDR={0x8}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x93}, @TIPC_NLA_MON_REF={0x8}]}]}, 0xf0}, 0x1, 0x0, 0x0, 0x10}, 0x40000) sendmsg$TIPC_NL_MON_PEER_GET(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000240)={0x10c, r3, 0x200, 0x70bd26, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0xa8, 0x5, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x200}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xbf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x401}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x87}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}]}, @TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x4}]}, @TIPC_NLA_LINK={0x10, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_MTU={0x8}]}]}, @TIPC_NLA_SOCK={0x34, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x93}, @TIPC_NLA_SOCK_REF={0x8}]}]}, 0x10c}, 0x1, 0x0, 0x0, 0x4}, 0x18044) sendmsg$TIPC_NL_NET_GET(r1, &(0x7f0000000400)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x2e8, r3, 0x100, 0x70bd25, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0xd0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0xca3e, @ipv4={[], [], @local}, 0xffff}}, {0x14, 0x2, @in={0x2, 0x4e20, @empty}}}}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1f}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf8a8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x27}}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x800, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x8001}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xfffffffa}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3000000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}]}, @TIPC_NLA_NET={0x44, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x2}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x1200}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfffffffc}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x101}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x80000000}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x5}]}, @TIPC_NLA_LINK={0xb8, 0x4, [@TIPC_NLA_LINK_PROP={0x4c, 0x7, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffff801}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}]}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_NET={0x3c, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x5}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfffffffb}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x2}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x8001}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x3}]}, @TIPC_NLA_SOCK={0x18, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8000}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3d}]}, @TIPC_NLA_MON={0x34, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xf7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xfffffffe}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x40}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3ff}]}, @TIPC_NLA_NET={0x14, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x4}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}]}, @TIPC_NLA_NET={0x14, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x5}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}]}, @TIPC_NLA_BEARER={0x3c, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x7, @ipv4={[], [], @loopback}, 0x1780}}, {0x14, 0x2, @in={0x2, 0x4e24, @empty}}}}]}]}, 0x2e8}}, 0x0) [ 3192.621809] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3192.630467] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:21:40 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x7}}}, 0xb8}}, 0x0) [ 3192.701218] Bluetooth: hci0: Frame reassembly failed (-84) [ 3192.710639] Bluetooth: hci1: Frame reassembly failed (-84) 03:21:40 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) r1 = gettid() rt_sigqueueinfo(r1, 0x0, &(0x7f0000000080)={0x0, 0x0, 0xfffffffa}) perf_event_open(0x0, r1, 0xf, 0xffffffffffffffff, 0x10) perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x8, 0x81, 0x8, 0x1, 0x0, 0x200001000, 0x21800, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x2, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1ff, 0x1, @perf_bp={&(0x7f0000000000), 0xd}, 0x813, 0x5533, 0x2, 0x2, 0xa0000000, 0x6, 0x3}, r1, 0xf, 0xffffffffffffffff, 0x3) syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x3, 0x2) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x6) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:21:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d15, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3192.788920] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:21:40 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xa}}}, 0xb8}}, 0x0) 03:21:40 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x74360300) [ 3192.848762] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3192.876520] hfs: dir_umask requires a value [ 3192.885741] hfs: unable to parse mount options 03:21:40 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d16, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3192.924132] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3192.951681] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3193.621934] hfs: dir_umask requires a value [ 3193.626307] hfs: unable to parse mount options [ 3194.738935] Bluetooth: hci1: command 0x1003 tx timeout [ 3194.739093] Bluetooth: hci0: command 0x1003 tx timeout [ 3194.744937] Bluetooth: hci1: sending frame failed (-49) [ 3194.759013] Bluetooth: hci0: sending frame failed (-49) [ 3196.819263] Bluetooth: hci0: command 0x1001 tx timeout [ 3196.824661] Bluetooth: hci0: sending frame failed (-49) [ 3196.830115] Bluetooth: hci1: command 0x1001 tx timeout [ 3196.835468] Bluetooth: hci1: sending frame failed (-49) [ 3198.899191] Bluetooth: hci1: command 0x1009 tx timeout [ 3198.904767] Bluetooth: hci0: command 0x1009 tx timeout 03:21:50 executing program 4: pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000280)="ca9b9f79e72b020883847ff7cdce049501f97fa46cfb22341c1d9833deec5844175f1f6d924d70f35b7a938c47cfee31122db4abd2cde6cad5dcd45c81c274a0ab840d627deeae343fd38b0300b168d7f56c0d7f5341960925a047b6286a48cb693015e4c455d4e893c76b66a63fbdbc03a3a78dfd0ff227fd246d5ab34b4ec946db1e43641668b6167540c36967c79d9d4da5d10b35738796a7c32cdb87aec0c8b06129cfc8f8a58c694191233f3b4f8f16e90000000000000000000000000000008a6f11e1aba92aa716fcae0ba653e65272e6a8a3ba23d4b0a829c46352f7d55df80d50c043421234370d336cc00cebc035fcb145ab63ae997a", 0xfffffffffffffe1d}], 0x1, 0x8) ioctl$KVM_SET_CPUID2(r0, 0x4008ae90, &(0x7f0000000100)={0x2, 0x0, [{0xc0000001, 0x9, 0x2, 0x7, 0x7fff, 0x1, 0x6}, {0x1352f2a53530b3ce, 0x80000001, 0x0, 0xfffface3, 0x8, 0x4, 0xffff}]}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x0) ioctl$TIOCSETD(r1, 0x400455cb, 0x0) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x7, &(0x7f0000000180)=0x0) io_submit(r3, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) io_destroy(r3) 03:21:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d17, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:21:50 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xe}}}, 0xb8}}, 0x0) 03:21:50 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x75360300) 03:21:50 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101000, 0x0) ioctl$VHOST_GET_VRING_BASE(r2, 0xc008af12, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r3, 0x84, 0x12, &(0x7f0000000280)=0x5, 0x4) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB='dir_umask=00000000000,\x00'/35]) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) r5 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r5, &(0x7f0000000140)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r5, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r5, &(0x7f0000000d00), 0x1c4, 0x0) epoll_ctl$EPOLL_CTL_DEL(r4, 0x2, r5) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r5, 0x84, 0x1e, &(0x7f00000001c0), &(0x7f0000000200)=0x4) 03:21:50 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000080)={&(0x7f0000000000)='./file0\x00', r1}, 0x10) [ 3202.886090] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3202.895826] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:21:50 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xf}}}, 0xb8}}, 0x0) 03:21:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d18, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3202.955804] hfs: can't find a HFS filesystem on dev loop3 [ 3202.990505] Bluetooth: hci1: Frame reassembly failed (-84) [ 3202.997586] Bluetooth: hci0: Frame reassembly failed (-84) [ 3203.060253] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:21:50 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x76360300) 03:21:50 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x48}}}, 0xb8}}, 0x0) [ 3203.112333] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:21:50 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d19, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3203.235788] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3203.273879] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:21:50 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x4c}}}, 0xb8}}, 0x0) [ 3203.397011] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3205.058924] Bluetooth: hci0: command 0x1003 tx timeout [ 3205.065417] Bluetooth: hci0: sending frame failed (-49) [ 3205.070903] Bluetooth: hci1: command 0x1003 tx timeout [ 3205.076249] Bluetooth: hci1: sending frame failed (-49) [ 3207.138988] Bluetooth: hci1: command 0x1001 tx timeout [ 3207.144403] Bluetooth: hci1: sending frame failed (-49) [ 3207.150048] Bluetooth: hci0: command 0x1001 tx timeout [ 3207.155399] Bluetooth: hci0: sending frame failed (-49) [ 3209.219061] Bluetooth: hci0: command 0x1009 tx timeout [ 3209.224462] Bluetooth: hci1: command 0x1009 tx timeout 03:22:00 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x80000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$KDSKBSENT(r1, 0x4b49, &(0x7f0000000100)="1a64d856b0978903d4c9628a5aa9294eaf7b9367e4c87a29daff1995b7ec3e05fd86e408abcec47bca8d1f1da350bd5f3a2ee7a64d7bbf57be64fc8f8317107009ba7c3c3c7de0c98112523432d9d480bdb18d3a3b17087a6f2b2559f46ad7eb3e603398b104f14ac154115ae37ba7958d4326cd73df32650774822fe13a4280774a8481890d06fd8f18ac4b3089019c89fd0dbcc6b3fdb81240d24b3a7196f7149bdebc57f0b7ffa5d45e25d8e093561cc127438a01e4e59e98c924b511b63c07017d327ac79227ad03a3c1c3ebdcc8") 03:22:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d1a, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:22:00 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x77360300) 03:22:00 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x60}}}, 0xb8}}, 0x0) 03:22:00 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xb) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:22:00 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) write$FUSE_GETXATTR(0xffffffffffffffff, &(0x7f00000001c0)={0x18, 0x0, 0x8}, 0x18) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/mISDNtimer\x00', 0x60004, 0x0) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) getsockopt$inet_dccp_buf(r2, 0x21, 0xd, &(0x7f0000000140)=""/86, &(0x7f0000000000)=0x56) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB='dir_um!sk=00000000000020000200000,\x00']) [ 3213.111175] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3213.128364] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:22:00 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x68}}}, 0xb8}}, 0x0) 03:22:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d1b, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3213.217613] hfs: unable to parse mount options [ 3213.277451] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3213.306724] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:22:00 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x6c}}}, 0xb8}}, 0x0) 03:22:00 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x78360300) 03:22:00 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) listen(r0, 0x40) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:22:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d1c, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3213.425640] hfs: dir_umask requires a value [ 3213.430448] hfs: unable to parse mount options [ 3213.445295] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3213.478349] hfs: dir_umask requires a value [ 3213.500191] hfs: unable to parse mount options [ 3213.506883] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3215.458915] Bluetooth: hci0: command 0x1003 tx timeout [ 3215.464314] Bluetooth: hci0: sending frame failed (-49) [ 3217.538997] Bluetooth: hci0: command 0x1001 tx timeout [ 3217.544934] Bluetooth: hci0: sending frame failed (-49) [ 3219.619001] Bluetooth: hci0: command 0x1009 tx timeout 03:22:11 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x1, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000080)=0x1) 03:22:11 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x74}}}, 0xb8}}, 0x0) 03:22:11 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d1d, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:22:11 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) r4 = socket(0x200000000000011, 0x4000000000080002, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r5, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TIOCSTI(r5, 0x5412, 0x8000000000007) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r4, &(0x7f0000000140)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) r7 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r7, &(0x7f0000000140)={0x11, 0x0, r8, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r7, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r7, &(0x7f0000000d00), 0x1c4, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r7, 0x10e, 0x2, &(0x7f00000001c0)=0x13, 0x4) setsockopt$packet_int(r4, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r4, &(0x7f0000000d00), 0x1c4, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000000)={'vcan0\x00', r3}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x10) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) r10 = fcntl$dupfd(0xffffffffffffffff, 0x605, 0xffffffffffffffff) sendfile(r2, r10, 0x0, 0x3) r11 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r11, &(0x7f0000000140)={0x11, 0x0, r12, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r11, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r11, &(0x7f0000000d00), 0x1c4, 0x0) bind$x25(r11, &(0x7f0000000200)={0x9, @null=' \x00'}, 0x12) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="037970653da7cf1adf2c66696c655f756d61736b3d30303030303030303030303031373737373737373737372c63726561746f723d15ae59862c756d61736b3d30313737373737373737373737373737373737373736372c63726561746f723df51972c62c636f6465706167653d63706861727365743d69736f383835392d31d0ac5aec97e21e3b3d3078303030303030303030303030303030382c706072743d3078303030303030303030303030303030342c00bb8d5dabda2f981691993e29e486e6402b6e1f016b6a0bfcb8a2496156af91164918836f4fbc0adeb5e1e30149c593fc8277c537dd483a21ef13619e61c8d701e70b82124cf4b46904e9a718e3eeae8ad395d7d70db60fb3335b4c01491bdd28e2a4c62a459a7a00000000000000"]) 03:22:11 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x79360300) 03:22:11 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$rxrpc(0x21, 0x2, 0x2) r2 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='hugetlb.2MB.e_in_bytes\x00\x00\x00\x00\x00', 0x275a, 0x0) r5 = creat(&(0x7f0000000180)='./file0\x00', 0x0) ioctl$TIOCSWINSZ(r4, 0x5414, &(0x7f0000000300)={0x5, 0x7fff, 0x1, 0x8001}) write$P9_RCLUNK(r5, &(0x7f0000000000)={0x7}, 0x22b) fallocate(r5, 0x0, 0x0, 0x2000402) fallocate(r4, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r4, 0xc028660f, &(0x7f0000000040)={0x0, r5, 0x0, 0x8, 0x12}) sendto$llc(r4, &(0x7f0000000080)="d616251647ff0c527b4542cc907a56e002f213c5e5cf79076bfa9c5df87f8b17388cd380058bcadede5f0f8f47b19cd2ed6a9f8683475cdb3f07daa27f6374b47ed8f926fc85", 0x46, 0x8000, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x6, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x61, 0x10, 0xa4}}, &(0x7f0000003ff6)='G\x00', 0x0, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, [], r3, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffc4b}, 0x48) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r5, 0x4020565b, &(0x7f0000000140)={0x8001007, 0x801000, 0x64849905ead3c746}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'hwsim0\x00', r3}) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000240)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cipher_null\x00'}, 0x58) accept4(r6, 0x0, 0x0, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r7, &(0x7f0000000340)={0x13, 0x65, 0xffff, 0x8001, 0x6, '9P2000'}, 0x13) r8 = dup(r7) write$FUSE_BMAP(r8, &(0x7f0000000000)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r8, &(0x7f00000000c0)={0x14c}, 0x137) openat(r8, &(0x7f00000002c0)='./file0\x00', 0x1f5600, 0x20) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) [ 3223.987114] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3224.010273] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:22:11 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x7a}}}, 0xb8}}, 0x0) 03:22:11 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d1e, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3224.088491] Bluetooth: hci0: Frame reassembly failed (-84) [ 3224.094517] Bluetooth: hci0: Frame reassembly failed (-84) [ 3224.125811] Bluetooth: hci1: Frame reassembly failed (-84) [ 3224.169630] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:22:11 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x7a000000) [ 3224.218725] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:22:11 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x88}}}, 0xb8}}, 0x0) [ 3224.295575] hfs: unable to parse mount options 03:22:11 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d1f, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:22:11 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xf0}}}, 0xb8}}, 0x0) [ 3224.319345] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3224.377903] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3224.379928] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3224.992738] hfs: unable to parse mount options [ 3226.098973] Bluetooth: hci0: command 0x1003 tx timeout [ 3226.104480] Bluetooth: hci0: sending frame failed (-49) [ 3226.178978] Bluetooth: hci1: command 0x1003 tx timeout [ 3226.184506] Bluetooth: hci1: sending frame failed (-49) [ 3228.178935] Bluetooth: hci0: command 0x1001 tx timeout [ 3228.184335] Bluetooth: hci0: sending frame failed (-49) [ 3228.259036] Bluetooth: hci1: command 0x1001 tx timeout [ 3228.264433] Bluetooth: hci1: sending frame failed (-49) [ 3230.258966] Bluetooth: hci0: command 0x1009 tx timeout [ 3230.339275] Bluetooth: hci1: command 0x1009 tx timeout 03:22:21 executing program 4: pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x44000) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc4c85513, &(0x7f0000000100)={{0xa, 0x6, 0x0, 0x4, 'syz1\x00', 0xd295}, 0x1, [0x48000, 0x1, 0x7ff, 0x0, 0x5, 0x7, 0x7, 0x7, 0x0, 0x2, 0x226, 0x3ff, 0x4, 0x7fff, 0x800, 0x0, 0x7, 0x81, 0xff, 0x63ff, 0x1, 0x4, 0x5, 0xf122, 0x400, 0xb9, 0x0, 0x3, 0x2, 0x2, 0x7fffffff, 0xc6, 0x80000001, 0x81, 0x3ff, 0x4, 0x3, 0xf, 0x3, 0x4, 0x100000000, 0x7, 0x7fffffff, 0x5, 0xff, 0x1f, 0x4, 0x7fffffff, 0x64, 0x401, 0xffffffff, 0x100000001, 0x70, 0x0, 0x3, 0x7, 0x9, 0x100000001, 0x4, 0x1, 0x5, 0x90e5, 0x2, 0xbd7, 0x9, 0x3, 0x101, 0x2, 0x100000000, 0xe, 0xce, 0x4, 0x93, 0xf6, 0x2, 0x8, 0x8001, 0x463e5729, 0x0, 0x8, 0x2, 0xc1, 0x3, 0x80000001, 0x1, 0x7, 0x5, 0xfffffffffffffffb, 0x3f5, 0x8001, 0x1, 0x8000, 0x2fd499ab, 0x6720, 0x10000, 0x8001, 0x0, 0x3, 0x7fffffff, 0x5d7, 0x9, 0xffff, 0x3f, 0x0, 0x1, 0xfff, 0x100000000, 0x1d, 0x0, 0x8001, 0xffff, 0x2, 0x2, 0xe, 0xfffffffffffffff8, 0x200, 0x3, 0x1, 0x0, 0x4, 0xfffffffffffffff9, 0x6, 0x6, 0x7, 0x30, 0x0, 0x7f, 0x5]}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x0) 03:22:21 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d20, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:22:21 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x300}}}, 0xb8}}, 0x0) 03:22:21 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x7a360300) 03:22:21 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="6469725f7530303030303030303030333030302980c6eee1efb8d09085ea6762303030303030302c0000000000000000"]) 03:22:21 executing program 2: r0 = socket$inet(0x2, 0x4000000805, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) r2 = dup3(r0, r1, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000280)='cpuacct.usage_percpu_user\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f00000002c0)=[@in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}], 0x223) sendto$inet(r2, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r0, &(0x7f00000001c0)="fd8b5188ec3f37bc928cdaab95172673a40ee47a6bdc1e5c26e03a207e542439e6cea7aede8590b4a455e013", 0x2c, 0x40081, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000200)=ANY=[@ANYBLOB="02000000c6717bd88f987aea85e8906455e2236ca327781f77f2435c54b93bb78ccee1db8b60b3ad1c46a7342e2dc17652f9c0bbdef5f34116980e435af609a479c0f2bce768f9a57ee5423ca8aaa62e", @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f000059aff8)={r4}, &(0x7f000034f000)=0x8) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000000100)={r4, @in={{0x2, 0x4e20, @empty}}}, 0x84) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r5, 0x400455c8, 0x0) ioctl$TIOCSETD(r5, 0x800455ca, 0x0) r6 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x200000, 0x0) ioctl$PIO_CMAP(r6, 0x4b71, &(0x7f0000000080)={0x30000000000, 0x1, 0x7f, 0xffffffffffffffff, 0x8, 0x278}) [ 3234.242542] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3234.261081] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:22:21 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x500}}}, 0xb8}}, 0x0) [ 3234.312788] hfs: unable to parse mount options 03:22:21 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d21, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:22:21 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 3234.387320] Bluetooth: hci1: sending frame failed (-49) [ 3234.441853] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3234.450006] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:22:21 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x7b360300) [ 3234.520128] hfs: dir_umask requires a value 03:22:21 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x600}}}, 0xb8}}, 0x0) [ 3234.547283] hfs: unable to parse mount options 03:22:21 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d22, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3234.625049] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3234.653447] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3236.419162] Bluetooth: hci1: command 0x1003 tx timeout [ 3236.424656] Bluetooth: hci1: sending frame failed (-49) [ 3236.430389] Bluetooth: hci0: command 0x1003 tx timeout [ 3236.441370] Bluetooth: hci0: sending frame failed (-49) [ 3238.499096] Bluetooth: hci0: command 0x1001 tx timeout [ 3238.504502] Bluetooth: hci0: sending frame failed (-49) [ 3238.510432] Bluetooth: hci1: command 0x1001 tx timeout [ 3238.515792] Bluetooth: hci1: sending frame failed (-49) [ 3240.579171] Bluetooth: hci1: command 0x1009 tx timeout [ 3240.584560] Bluetooth: hci0: command 0x1009 tx timeout 03:22:31 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0x1e) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x400000, 0x0) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f00000004c0)=0x5) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000000480)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000500)=ANY=[@ANYBLOB="cc020000", @ANYRES16=r2, @ANYBLOB="00032cbd7000ffdbdf250c0000001c01010008000300fbffffff5400020008000100810000000000000000040000080003003f0a0000080001000100000008000300000018000800030005000000080004000900000008000200ef0800000800010006000000080001000e000000100001006574683a6c61706230000000100001007564703a73797a310000000038000400200001000a004e2400000001fe8000000000000000000000000000aa000000001400020002004e200000000000000000000000001c00020008000400ffff0000080002000080000008000300d3000000100001007564703a73797a300000000038000400200001000a00694e5f5c76824e2180000001fe800000000000000000000000000029090000001400020002004e24000000000000000000000000380001003400020008000300170c000008000300ec0000000800020000000000080001001300000008000200c2067531080001000a0000009c0004000c00010073797a300000000014000700080003000100008008000100110000004400070008000400000000000800030001010000080002000500000008000300f548604a080001000c0000000800010017000000080002000000000008000200000200003400070008000300060000000800040005000000080004000500000008000400a90000000800040004000000080001001900000034000700080002008000000008000200000000000c000300020000000000000008000100010000000c00030045000000000000003000020008000200fdffffff08000200000000000800020080000000080001000500000008000100fdffffff04000400100002000400040008000100ffffffff5400090008000200050000000800010001000000080001008100000008000100020000000800010001040000080002000900000008000100dd0000000800010008000000080001000400000008000100ffffffff"], 0x2cc}, 0x1, 0x0, 0x0, 0x40}, 0x24000808) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:22:31 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) openat$btrfs_control(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/btrfs-control\x00', 0x400, 0x0) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="6469725f756d61736b3d303030303032303030303030303030302c00eea1b78aae5c4b095144e86b1cc4e700c31b995f6bcd0b60bae4d0059a0cd037e8ff8b3358cdfbdf2000eab928783fefb6a971ccbc17d9479b4daa67c2b892fbb0a4b9c9fea4dd23edc7662fb652d0fc4138474e3ebb2301c2b1c694"]) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000180)='/dev/loop-control\x00', 0x202, 0x0) getsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, &(0x7f0000000080), &(0x7f0000000140)=0xb) 03:22:31 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x700}}}, 0xb8}}, 0x0) 03:22:31 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d23, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:22:31 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x7c360300) 03:22:31 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x80000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000240)={0x2, &(0x7f00000000c0)=[{}, {}]}) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x1ff, 0x58601b5cb39df016) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, &(0x7f0000000100)="bc0988cd4550c8b45105a2bcd6419be7538df3e9a409ce6d11a93be5024d2c22d7d529ce2967782cdbba22e8cbd60fa630928d1bada57ae0fd708ec5dcce464c1a98ff82c06dbf016c078fa8d41b61a82d185dd687459d94bb7f9047199aa3ce55fe7f2a17a6fe3df66946cf60a85629527fc3c2f9ac0f20e4d8ddc144e62b72edd125f343f0f38cfc2be027c2483a933c192ee623b980f32f4393d668de8c37298d8b26256030ba28f1c36657091e93ab9e96504cfc6aac9f61bbd40b11102f491def49d796be807c39f080e01582d0cdb5c7e9e41c7b418c5d3a7149424c"}, 0xe6) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) [ 3244.465235] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3244.474695] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:22:31 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x404800, 0x0) ioctl$TUNSETTXFILTER(r1, 0x400454d1, &(0x7f0000000080)={0x1, 0x1, [@random="cd364f08129c"]}) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) renameat2(r2, &(0x7f0000000100)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x2) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) [ 3244.539495] hfs: dir_umask requires a value [ 3244.550036] hfs: unable to parse mount options 03:22:31 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xa00}}}, 0xb8}}, 0x0) 03:22:31 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d24, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3244.644175] hfs: dir_umask requires a value [ 3244.648545] hfs: unable to parse mount options [ 3244.662379] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3244.679129] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:22:32 executing program 3: r0 = dup(0xffffffffffffffff) r1 = memfd_create(&(0x7f0000000000)='-md5sumvmnet0\x00', 0x4) lseek(r1, 0x0, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:22:32 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x7d360300) [ 3244.709909] Bluetooth: hci1: Frame reassembly failed (-84) 03:22:32 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xe00}}}, 0xb8}}, 0x0) 03:22:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d25, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3244.816529] hfs: dir_umask requires a value [ 3244.823768] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3244.844430] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3244.855540] hfs: unable to parse mount options 03:22:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d26, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:22:32 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xf00}}}, 0xb8}}, 0x0) 03:22:32 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x7e360300) [ 3244.937055] hfs: dir_umask requires a value [ 3244.942693] hfs: unable to parse mount options [ 3244.958227] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3244.982385] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:22:32 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="6469725fb634e406e4de18a3642030303030302c0000"]) [ 3245.088145] hfs: unable to parse mount options [ 3246.588909] Bluetooth: hci0: command 0x1003 tx timeout [ 3246.595352] Bluetooth: hci0: sending frame failed (-49) [ 3246.739158] Bluetooth: hci1: command 0x1003 tx timeout [ 3246.744703] Bluetooth: hci1: sending frame failed (-49) [ 3248.659002] Bluetooth: hci0: command 0x1001 tx timeout [ 3248.664403] Bluetooth: hci0: sending frame failed (-49) [ 3248.819226] Bluetooth: hci1: command 0x1001 tx timeout [ 3248.824658] Bluetooth: hci1: sending frame failed (-49) [ 3250.739005] Bluetooth: hci0: command 0x1009 tx timeout [ 3250.899123] Bluetooth: hci1: command 0x1009 tx timeout 03:22:41 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x2000}}}, 0xb8}}, 0x0) [ 3254.703999] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:22:42 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x3f00}}}, 0xb8}}, 0x0) 03:22:42 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r1, &(0x7f0000000d00), 0x1c4, 0x0) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/dlm-monitor\x00', 0x8000, 0x0) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000400)) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(r4, &(0x7f0000000300)={0x0, 0x232, &(0x7f00000002c0)={&(0x7f00000001c0)={0x20, r5, 0x105, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0xc}]}, 0x20}}, 0x0) sendmsg$IPVS_CMD_GET_DEST(r1, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x8000001}, 0xc, &(0x7f0000000300)={&(0x7f0000000200)={0xd0, r5, 0x10, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}]}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x70}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x7a}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8}, @IPVS_CMD_ATTR_SERVICE={0x34, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@loopback}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x5}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@remote}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_SERVICE={0x48, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x1, 0x1}}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x44, 0x1}}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x1}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x1d}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@dev={0xfe, 0x80, [], 0x10}}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x10001}]}, 0xd0}, 0x1, 0x0, 0x0, 0x90}, 0x4004) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) setxattr$security_selinux(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='security.selinux\x00', &(0x7f0000000180)='system_u:object_r:syslogd_initrc_exec_t:s0\x00', 0x2b, 0x3) write(r7, &(0x7f00000001c0), 0xfffffef3) ioctl$VIDIOC_ENUMAUDIO(r7, 0xc0345641, &(0x7f0000000000)={0x4, "98a371de43720940fdbb5f448761545b312818733c3ef25583bf992d8db60158", 0x0, 0x1}) accept4$inet(r6, 0x0, &(0x7f0000000380), 0x80000) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:22:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d27, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:22:42 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0xfffffffffffffffd) syz_open_dev$video(&(0x7f0000000000)='/dev/video#\x00', 0x4, 0x800) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:22:42 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x7f360300) 03:22:42 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r1, &(0x7f0000000d00), 0x1c4, 0x0) ioctl$sock_inet_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000000)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x2000, 0x0) r4 = socket$inet(0x2, 0x4000000805, 0x0) r5 = socket$inet_sctp(0x2, 0x5, 0x84) r6 = dup3(r4, r5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r6, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r5, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r6, 0x84, 0x66, &(0x7f000059aff8)={r7}, &(0x7f000034f000)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f00000001c0)={0x7, 0x300, 0xffffffff, 0x8001, r7}, &(0x7f0000000200)=0x10) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000240)={r8, 0x80000001}, 0xc) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) [ 3255.370117] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3255.380301] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3255.408124] Bluetooth: hci0: Frame reassembly failed (-84) [ 3255.416292] hfs: dir_umask requires a value [ 3255.434556] hfs: unable to parse mount options [ 3255.449493] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 03:22:42 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x4800}}}, 0xb8}}, 0x0) 03:22:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d28, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:22:42 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x10001, 0x80) setsockopt$inet6_tcp_buf(r2, 0x6, 0xb, &(0x7f0000000140)="f0605689befaf056b15b29cb46b1135e9a752d975d4d94f9ada12a9ac0f3fa6a8ed0b5b8f54b92892e20953b79362d94e9f09c701c83a82f148732c5f881e4b6056a3f818fbcd13754d07d04e32ae7144a6507513638796003ebb76dc17f41a4b26ca887ccf283f8b147d4dd50f584bc9e8e84c0c7", 0x75) 03:22:42 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x80360300) [ 3255.584766] Bluetooth: hci1: Frame reassembly failed (-84) [ 3255.606423] Bluetooth: hci1: Frame reassembly failed (-84) [ 3255.607494] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3255.622495] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:22:42 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x4c00}}}, 0xb8}}, 0x0) 03:22:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d29, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:22:43 executing program 3: openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000340)='/dev/dlm-control\x00', 0x8000, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) setsockopt$IP_VS_SO_SET_TIMEOUT(r1, 0x0, 0x48a, &(0x7f0000000380)={0x1, 0xfce8, 0xfffffff8}, 0xc) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) recvfrom$packet(r2, &(0x7f0000000180)=""/243, 0xf3, 0x40002000, 0x0, 0x0) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="6469725f756d61736b3d30303030303030303030302c0000000000000000000000000094920c6bb4955b9b75bf3c37c1dbe387b3f45db5268233b59f2c1126ad144ff92b6e373a0da1cf054917cb516d121dcbb1ab61340dd78c455c6038e1c314864fb86792e2a195ab58acb3379bb81bfee016269048f4ce1f2177ac8676b5b81f326bcf17c0653ded25b4a9f68dcab432a6dd1027ce86"]) lsetxattr$security_capability(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='security.capability\x00', &(0x7f0000000140)=@v1={0x1000000, [{0x7, 0x4}]}, 0xc, 0x1) [ 3255.729957] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3255.744037] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3255.852940] hfs: can't find a HFS filesystem on dev loop3 [ 3257.458923] Bluetooth: hci0: command 0x1003 tx timeout [ 3257.464329] Bluetooth: hci0: sending frame failed (-49) [ 3257.629049] Bluetooth: hci1: command 0x1003 tx timeout [ 3257.634545] Bluetooth: hci1: sending frame failed (-49) [ 3259.538967] Bluetooth: hci0: command 0x1001 tx timeout [ 3259.544378] Bluetooth: hci0: sending frame failed (-49) [ 3259.699148] Bluetooth: hci1: command 0x1001 tx timeout [ 3259.704569] Bluetooth: hci1: sending frame failed (-49) [ 3261.619019] Bluetooth: hci0: command 0x1009 tx timeout [ 3261.779142] Bluetooth: hci1: command 0x1009 tx timeout 03:22:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d2a, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:22:53 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x6000}}}, 0xb8}}, 0x0) 03:22:53 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x81360300) 03:22:53 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x10000, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_GET_NETID(r0, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r1, 0x1, 0x70bd26, 0x25dfdbfd, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x0) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x240005, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r2, 0x80045400, &(0x7f0000000040)) pipe(&(0x7f0000000140)={0xffffffffffffffff}) bpf$OBJ_PIN_PROG(0x6, &(0x7f00000002c0)={&(0x7f0000000280)='./file1\x00', r3}, 0x10) r4 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="64303030303030303032303030303030303830302c00bc11ff15692d5e4b74353cc34a2c7c7aac47b55af183e2405b8ca2b2f707742984ceea1bc75161b34515ec16e5c613b915fe"]) 03:22:53 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/d\x00v/ptmx\x00', 0x400040, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x40, 0x0) ioctl$KDADDIO(r1, 0x400455c8, 0x1) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) r2 = socket$pptp(0x18, 0x1, 0x2) r3 = dup3(0xffffffffffffffff, r2, 0x0) ioctl$TUNSETSNDBUF(r3, 0x400454d4, &(0x7f0000000000)=0x327b) ioctl$TCSETS2(0xffffffffffffffff, 0x402c542b, &(0x7f0000000100)={0x5, 0x5b3, 0x7, 0x10000, 0x6, "c08b445f13b3892c6ba7064d63df86513d6c2c", 0x8, 0x1ff}) [ 3266.268038] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3266.285434] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3266.299372] hfs: unable to parse mount options 03:22:53 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x6800}}}, 0xb8}}, 0x0) 03:22:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d2b, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:22:53 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$EVIOCGNAME(r1, 0x80404506, &(0x7f0000000140)=""/177) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:22:53 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000001300)='/proc/capi/capi20ncci\x00', 0x400000, 0x0) accept4$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000002a80)=0x14, 0x9ef7869ee7141bf5) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000002ac0)='/selinux/status\x00', 0x0, 0x0) r3 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r3, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) r5 = getpid() ptrace$getregset(0x4204, r5, 0x4, &(0x7f0000000300)={&(0x7f00000002c0)=""/60, 0x3c}) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) r6 = syz_open_dev$vcsn(&(0x7f0000000340)='/dev/vcs#\x00', 0x8, 0x4002) setsockopt$bt_rfcomm_RFCOMM_LM(r6, 0x12, 0x3, &(0x7f0000000380)=0x44, 0x4) sendmmsg(r3, &(0x7f0000000d00), 0x1c4, 0x0) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f0000000000)={0x0, 0x2efa}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r3, 0x84, 0x6d, &(0x7f0000000100)={r7, 0xd0, "0eebe4a7ffeef1fd6a0b063bb0dd50a54071df0e9a703bd8bd4c07e998c872110984208038f59900b2cbfd75e11576437537a88612b3addce2d972af4c3b6ca3571cef64ee2fabddc9cf5105e65ac5d4a0bd66860e6bce19b1e673128493c9cb0bd786454d4f7111c8a1891b491787120c2e17ce70af372252b67f9bde477da43536ca8193cb4d94985b0c63cf29af29222298ad17c4eb3d62bca9e5bfaf05b26ef360aba9d113de442fdc9e34d6883bc5a53d64c62b6816de0b8108c65948bba8653e91d4ca47f89db68e2f026254c4"}, &(0x7f0000000200)=0xd8) bind$xdp(r1, &(0x7f0000002b00)={0x2c, 0x284a41e92641f92d, r2, 0x1a, r1}, 0xfffffffffffffef8) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r8, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r8, 0xc0105303, &(0x7f0000000240)={0x3f, 0x3, 0x5}) [ 3266.459355] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3266.474916] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:22:53 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x82360300) 03:22:53 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d2c, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:22:53 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x6c00}}}, 0xb8}}, 0x0) [ 3266.541081] hfs: dir_umask requires a value [ 3266.547727] hfs: unable to parse mount options [ 3266.626267] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3266.639671] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3266.648574] hfs: dir_umask requires a value [ 3266.657573] hfs: unable to parse mount options 03:22:54 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x7400}}}, 0xb8}}, 0x0) 03:22:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d2d, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:22:54 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x400000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$KVM_GET_EMULATED_CPUID(r2, 0xc008ae09, &(0x7f0000000140)=""/232) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) r3 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r3, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) r5 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r5, &(0x7f0000000140)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r5, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r5, &(0x7f0000000d00), 0x1c4, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) r10 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r10, &(0x7f0000000140)={0x11, 0x0, r11, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r10, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r10, &(0x7f0000000d00), 0x1c4, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(r10, 0x114, 0x7, &(0x7f0000000900)={@alg={0x26, 'hash\x00', 0x0, 0x0, 'cmac-aes-neon\x00'}, {&(0x7f00000004c0)=""/247, 0xf7}, &(0x7f0000000280), 0x44}, 0xa0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r12, @ANYBLOB="0000000000000000280012000c000100766574680000000018000200fd0001000000000023c0306554362dddcb892ef8051404bde5bf296e3c566a03d724f7ead1ef33adfdbe08b8c5236b93b9797b4409f6e370d1515d2e1fa63259e6d4bd05772981", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x48}}, 0x0) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x300, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="280000001000010800"/20, @ANYRES32=r12, @ANYBLOB='\x00'], 0x28}}, 0x0) bind$packet(r5, &(0x7f0000000240)={0x11, 0xf49af7b18eeb448a, r12, 0x1, 0xcf, 0x6, @broadcast}, 0x14) sendmmsg(r3, &(0x7f0000000d00), 0x1c4, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000300)={{{@in=@loopback, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@mcast2}}, &(0x7f0000000400)=0xe8) sendmsg$nl_xfrm(r2, &(0x7f0000000480)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0xe0000903}, 0xc, &(0x7f0000000440)={&(0x7f0000000680)=@flushpolicy={0x250, 0x1d, 0x2, 0x70bd27, 0x25dfdbff, "", [@migrate={0x88, 0x11, [{@in=@local, @in, 0x32, 0x4, 0x0, 0x0, 0x2, 0x2}, {@in6=@local, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x3c, 0x4, 0x0, 0x3504, 0xa, 0x2}, {@in=@empty, @in=@remote, 0xff, 0x1, 0x0, 0x0, 0x2, 0x2}]}, @algo_auth_trunc={0x9c, 0x14, {{'sha384\x00'}, 0x268, 0x100, "a3cd3ce70384c1891330754427c44fddf4b1a76a66c666fff0cc26e7372a9b4c521fcae92b759febb30b9a0303ad31190c72d803cc6f535bc4e572d49465d33d8a93ad5c67dc90fa612d2df42f"}}, @offload={0xc, 0x1c, {r13, 0x1}}, @algo_auth_trunc={0xec, 0x14, {{'sha256-ni\x00'}, 0x4f0, 0x180, "1ad0c44fae9eacae4d11e9963b4998827fa1cf71c20f2d321697a08f0fc6c4e602068739c0a9801e700714e5fd34ab585c5609e8239230a1bf4db4d5dd5af4a69d04823276ea4ec9e0b296c08ea7bcc8a61fe3621494f3b03e5286a87b1cef856bf69ec348372403922e66b470e82457b3cd256de6c984b37c4b19bd042f5a34a3fb513f1f5c6403dee27abc37528b8fea6527b7efdb43723f96b3943fe1"}}, @lastused={0xc}, @output_mark={0x8}, @replay_val={0x10, 0xa, {0x70bd2c, 0x70bd2b, 0x4}}]}, 0x250}, 0x1, 0x0, 0x0, 0x60000801}, 0x0) [ 3266.777956] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:22:54 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x83360300) [ 3266.865836] hfs: dir_umask requires a value [ 3266.866836] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3266.880164] hfs: unable to parse mount options 03:22:54 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x7a00}}}, 0xb8}}, 0x0) 03:22:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d2e, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3267.000956] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:22:54 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x8800}}}, 0xb8}}, 0x0) [ 3267.047056] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. 03:22:54 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x84360300) [ 3267.134485] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3267.167204] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3267.207959] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. 03:22:54 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x40000f) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) ioctl$VIDIOC_S_AUDIO(r1, 0x40345622, &(0x7f0000000080)={0x6, "32fe57a10a5a42287922d2d25ab21377a4d90cfaed6565b2b7b9ce9f25567268", 0x2}) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x2000, 0x0) ioctl$UI_END_FF_UPLOAD(r2, 0x406855c9, &(0x7f0000000100)={0x1, 0xf01b, {0x93c5441ebf0094c1, 0x4, 0x1, {0xf0, 0x7ff}, {0x1, 0x9bc}, @ramp={0x1, 0x20, {0x5, 0x5, 0x3, 0x2e71}}}, {0x52, 0x3, 0x40, {0x8, 0xe7d}, {0x2, 0xffe0}, @const={0x1, {0x1, 0xff7f, 0x3, 0xfff}}}}) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:22:54 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xf000}}}, 0xb8}}, 0x0) 03:22:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d2f, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:22:54 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x85360300) [ 3267.440220] hfs: dir_umask requires a value [ 3267.450532] hfs: unable to parse mount options [ 3267.496249] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3267.499553] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:22:54 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d30, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3267.553019] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. 03:22:54 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x34000}}}, 0xb8}}, 0x0) 03:22:55 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x400000, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000200)={0x0, 0xffff, 0x6, &(0x7f0000000080)=0x420}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = shmget$private(0x0, 0x1000, 0x1000, &(0x7f0000fff000/0x1000)=nil) shmctl$IPC_INFO(r3, 0x3, &(0x7f0000000140)=""/173) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f00000001c0), 0xfffffef3) ioctl$RTC_IRQP_READ(r4, 0x8008700b, &(0x7f0000000240)) 03:22:55 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x400300}}}, 0xb8}}, 0x0) [ 3267.685432] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:22:55 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x86360300) 03:22:55 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d31, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:22:55 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xf0ffff}}}, 0xb8}}, 0x0) [ 3267.801182] hfs: dir_umask requires a value [ 3267.805559] hfs: unable to parse mount options [ 3267.890304] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:22:55 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x1000000}}}, 0xb8}}, 0x0) 03:22:55 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x2000000}}}, 0xb8}}, 0x0) 03:22:55 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x87360300) 03:22:55 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d32, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:22:55 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x3000000}}}, 0xb8}}, 0x0) 03:22:55 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) syz_open_pts(r1, 0x101080) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) [ 3268.449633] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:22:55 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d33, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:22:55 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x4000000}}}, 0xb8}}, 0x0) [ 3268.603597] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3268.618422] Bluetooth: hci0: Frame reassembly failed (-84) 03:22:55 executing program 3: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x4000, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00') sendmsg$IPVS_CMD_DEL_SERVICE(r0, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80921485}, 0xc, &(0x7f00000002c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="05000000d08e10405ca57fd534d6d321e8fa99ea54d05575e46c807d0299f1815d5179de881602a5d6fffb78fdc9ead78b1551254d849074e1d1dd8b0f38be44ff466af129033d5cf66a47de06774b19acaefca7d71c4d01d3dda1d936a7c85115bf1f65dbb5c8d8202fdd2edd90dea6dd2a249feb2941939fbfb5045d6a60b618bea73bb995b885ce55394482933ee7f49e4d9ca85aa83be2f44374e5fa287e717991ef975635", @ANYRES16=r1, @ANYBLOB="020028bd7000fddbdf25030000002c00020008000500ff7f00000800040007000000080006000500000008000e004e22000008000900080000000800050007000000"], 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r2) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x2001000, &(0x7f0000000500)=ANY=[@ANYBLOB="6469725f756d61736b3d30300000000000000047a52f1da21fdafa18f82ad4499508d9beec9e3b5ccb5dfe73c5949e274d76c8a6f24ef51fe47e3a243d3a7c1e1988678c9d33c280c5b9331845fb65fe1feb1b7a117b0e751d6b56d687b1ff2d797799a458d3a111c905f15aad4b56c77c7bf505576508ae30f99bcf7ca976f72a533acf949fc1bb904497f7372be24d8c27595a4b9ee4ca385ac51bd2b91022f4ae4e39cf93f1306c78f2ae07d31b3578e03ef581087331ccb0ed850c484f088047eed0949433453eaf2b08b83b3f7c3e9e0dc01f59da5a62bdc7f7633241fb8b093fd226e3d35d0fa7ab50a5a18ab7778b7b6515432d27486ef08c1c40af20dd734ed1c1f39e06805861adb1f9eb12609f72748ab75fee1d73ac"]) 03:22:56 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x87400000) 03:22:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d34, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:22:56 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x5000000}}}, 0xb8}}, 0x0) 03:22:56 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r0) ioctl$sock_SIOCBRADDBR(r1, 0x89a0, &(0x7f0000000000)='ip_vti0\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000140)=@urb_type_iso={0x0, {0x4, 0x1}, 0x80000000, 0xd0999503af49216f, &(0x7f0000000080)="32fb5a50ae2463aa2607cc508ed2c447de6a608cebe765f70997e6e3a8", 0x1d, 0x100, 0x1, 0x37, 0x0, 0x9, 0xffffffffffffffff, [{0x4, 0x2, 0x80}, {0x2, 0xfff, 0x7}, {0x9, 0x7ff, 0x3f}, {0x8, 0x0, 0x80}, {0x56, 0x8001, 0x2}, {0x2, 0x7, 0x81}, {0x1f, 0x66d, 0x759}, {0x101, 0x6, 0x9}, {0x7, 0x7, 0x800}, {0x5, 0x7, 0x5}, {0x40, 0x7f, 0x8}, {0x8, 0xffffffff, 0x7}, {0x2, 0x695, 0x2}, {0x3, 0x8, 0x2}, {0x2, 0xbe, 0x3}, {0x9, 0x9, 0xefdd}, {0x7, 0x40, 0x3ff}, {0x8, 0x6, 0xbda}, {0x1f9, 0x6, 0xc546}, {0x9, 0x3, 0x6}, {0x1, 0x37, 0x3}, {0x7f, 0x100}, {0x5, 0x8653, 0xbcd}, {0x1, 0x1f, 0x95b3}, {0x0, 0x200, 0x4}, {0x6, 0xc70, 0x5}, {0x40, 0xfffffffc, 0x1a7}, {0x3, 0x1, 0x7}, {0xb88, 0xfffffffa, 0x818d}, {0x200, 0x20, 0x5}, {0x8, 0x5, 0x3f}, {0x3, 0x2, 0x529}, {0x5, 0x8000, 0x6}, {0x7, 0x7fff, 0x73}, {0xfffffffa, 0x3, 0xffffff67}, {0x5, 0x7, 0x7}, {0x350b, 0x7, 0x10001}, {0x3, 0x20, 0x6}, {0xffff, 0x40, 0x9}, {0xf3, 0xffffffc0, 0x9}, {0x8, 0x0, 0x4}, {0x20, 0x8, 0x1}, {0x6, 0x7, 0x9}, {0x33, 0x63, 0x729e}, {0x8, 0x4, 0x863f}, {0x5, 0x3f, 0x80}, {0x1, 0x10001, 0x7ff}, {0x6, 0x2, 0x3f}, {0x8, 0x6}, {0x9, 0x7, 0x6}, {0x7, 0x2, 0x8001}, {0x0, 0x3f, 0xfffffffa}, {0x401, 0x89b, 0x7ff}, {0x2, 0x1000000, 0x609}, {0xfff, 0x8, 0x65}]}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x400000000001, 0x0) close(r3) r4 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000cf6fe4)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) connect$inet6(r4, &(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r5 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x200004) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r3, 0x84, 0x7b, &(0x7f0000000100)={0x0, 0x2}, 0x8) mount$9p_fd(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, &(0x7f0000000740)={'trans=fd,', {'rfdno'}, 0x2c, {'wfdno'}}) sendfile(r3, r5, 0x0, 0x80001d00c0d0) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000040), 0x0) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:22:56 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x6000000}}}, 0xb8}}, 0x0) 03:22:56 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x20000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:22:56 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x7000000}}}, 0xb8}}, 0x0) 03:22:56 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x88360300) [ 3269.103077] hfs: dir_umask requires a value [ 3269.158805] hfs: unable to parse mount options [ 3269.290511] audit: type=1800 audit(1571023376.574:87): pid=12257 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed comm="syz-executor.3" name="bus" dev="sda1" ino=16804 res=0 [ 3270.664556] Bluetooth: hci0: command 0x1003 tx timeout [ 3270.671209] Bluetooth: hci0: sending frame failed (-49) [ 3272.749060] Bluetooth: hci0: command 0x1001 tx timeout [ 3272.754466] Bluetooth: hci0: sending frame failed (-49) [ 3274.819175] Bluetooth: hci0: command 0x1009 tx timeout [ 3279.021674] validate_nla: 2 callbacks suppressed [ 3279.021684] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3279.034607] nla_parse: 10 callbacks suppressed [ 3279.034618] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3279.115127] hfs: unable to parse mount options [ 3279.171994] hfs: unable to parse mount options [ 3279.211850] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3279.212206] Bluetooth: hci0: Frame reassembly failed (-84) [ 3279.257715] Bluetooth: hci0: Frame reassembly failed (-84) [ 3279.275684] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3279.339717] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3279.377554] hfs: dir_umask requires a value [ 3279.391356] hfs: unable to parse mount options [ 3279.475840] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:23:06 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xa000000}}}, 0xb8}}, 0x0) 03:23:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x40000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:23:06 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x89360300) 03:23:06 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) lsetxattr$system_posix_acl(&(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000280)={{}, {}, [], {}, [{0x8, 0x2, r3}, {0x8, 0x0, r3}], {0x10, 0x6}}, 0x34, 0x0) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)={[{@iocharset={'iocharset', 0x3d, 'ascii'}}], [{@smackfstransmute={'smackfstransmute', 0x3d, 'dir_umask'}}]}) 03:23:06 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qtmx\x00', 0x400200, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x640002, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000080)={0x0, 0x0, r2}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r1, 0xc00c642e, &(0x7f0000000100)={r3, 0x100000}) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) 03:23:06 executing program 2: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x7, &(0x7f0000000180)=0x0) io_submit(r1, 0x732, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x80000000000000, 0x1, 0x0, r0, &(0x7f0000000000), 0x377140be6b5ef4c7}]) io_pgetevents(r1, 0x0, 0x3, &(0x7f0000000740)=[{}, {}, {}], &(0x7f00000007c0)={0x77359400}, &(0x7f0000000840)={&(0x7f0000000800)={0x2}, 0x8}) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f0000000680)='/dev/mixer\x00', 0x4000, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r2, 0x400455c8, 0x0) r3 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r3, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r3, &(0x7f0000000d00), 0x1c4, 0x0) vmsplice(r3, &(0x7f0000000600)=[{&(0x7f0000000100)="8ed556949351ba3c61b54c304bb8ca20b4555a38a9ab3bb09c829b8e22a86378e68ae25222c4a43329f91b3b0da317aab2bd7508a2b7a2c7871763d433e2260c781b11850757e1e67beb", 0x4a}, {&(0x7f0000000180)="b630bc183539a97f5b304a0d478737631364f72201f69849c7603ad83d4a1773c42863aadf2956abbc5d63caa0f1291adb66afee53f721a09fe520f423690683473a8f9df2c78a21f4b92bdfc6b5de6d75a2c76410d3d339e32a39c5957d376652526adedb1d8e9a56a752926b05022018e7f514e2f6e11a75e6e31b930e89047ab56357f4fad455c49232d80461e74942118384a6107ff5fca91e06492cf2793ce0ba71c67872608864beb1c5b063e394880e9d7733f03564ea1d9afcdabacbb824897c52ae4ecd31c2052c0ec037d294cb7525ed34c381e40bcd615635fe654475", 0xe2}, {&(0x7f0000000280)="acde9f6c5bd847d4dff09c613ea35f5c48b07fd6b3622e60e5df4c94aacbc54a4a505743844e6ec4dbf7d828be305f26d603df9671ca6f2de04ca4aec47d84e06e71c09d8868f74d833cf58da18e70dc2f827ab44b7bb6a4ee02b0c5de798d5338706c52351828a0f3d66e9dcbbae3a06ef4921634bc6143228ba456d1096671df55206b9e69e4fb00d64bf6ba1f6b5a985b7c36cd50c047167322ceb74b043e0da997fbe792e3053408aaaaf49015222ac45afcc57742c0aa32a54ce93fe08627700ce63708b55dbb1930ff4bcf1defe6dd57", 0xd3}, {&(0x7f0000000380)="e42f69feac0e215eff8ba35d2a2006fc6bfb3c433f2fb8c2cdc8edef6ae7007cee4ff8dc921e0671aa35d46bbccb89a1b7f7ea6090691738e1c4e9b161d9309cd62ac48c2ae8318a0783fd10caa002af05dbfea05a86df38a01cdedda21280e603bbf427b0a2487385ba5e80af1b470e4c0abc03f50826aa086633903664d1b161128991df0c38534ce6e4d2391c", 0x8e}, {&(0x7f0000000440)="1a7821e4d6d157949ed940c74d38b0044723d58c9e5ae3f01c4aee50c2604203e97b859f084df30a5c0a281c80a577a72f12739b745965fe94b04417d99997f1b170304e887ea59ffc60ae497d1bdbb54d0cb84fe5399282dcac4cb91327a43df89f17a748134e4fb45961543720fc9e3295216c826a29ab3b7d8133fe8786fae932891693033540f56dbed31004228f7984", 0x92}, {&(0x7f0000000500)="920fb6c89c43b4fd19d8814f36421ea4a18a18bab4c96865ea8feae4ea639c702388ff59374a39c697e262878ea720b2f6ce013b733375b5be9dace096c9597f0f5c8b4e6bac0f6417acf4c4f2c7bc7b186e61ba7ee064bae9a864820921476aecf67db545d3fd913d1886410225f31eb097b0949663a9ed7faa3378f9c5b68ea197a1deef31834c9ca774e03ffbfe4acfba09c7202a84c18cd070e43520346385d2d478cecac6a5e89cc42b6b08013c02c9422e172bf96355503bdfb320f62d010bf9d76ccd007e96437ca9247b561b9f1d32f1d13e62eed089e85f84436d78517abf2f0979ccf3a005f79e09e11727a1d5844397", 0xf5}], 0x6, 0x1) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r5, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) symlinkat(&(0x7f00000006c0)='./file0\x00', r5, &(0x7f0000000700)='./file0\x00') pipe(&(0x7f0000000000)) ioctl$TIOCSETD(r2, 0x800455ca, 0x0) 03:23:06 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xe000000}}}, 0xb8}}, 0x0) 03:23:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1fffff, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:23:06 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) r3 = socket$inet(0x2, 0x4000000805, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) r5 = dup3(r3, r4, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r5, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r4, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f000025e000)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES32=0x0, @ANYRES32=0x0], &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r5, 0x84, 0x66, &(0x7f000059aff8)={r6}, &(0x7f000034f000)=0x8) setsockopt$inet_sctp_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f0000000080)={r6, 0x1, 0x6a4, 0x81}, 0x10) 03:23:06 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x8a360300) 03:23:06 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xf000000}}}, 0xb8}}, 0x0) 03:23:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x200000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:23:06 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x20000000}}}, 0xb8}}, 0x0) 03:23:06 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:23:06 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x8b360300) [ 3279.549768] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3279.571185] hfs: dir_umask requires a value [ 3279.580090] hfs: unable to parse mount options 03:23:06 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x3f000000}}}, 0xb8}}, 0x0) [ 3279.675287] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3279.721290] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:23:07 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x908302, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r1, &(0x7f0000000d00), 0x1c4, 0x0) r3 = accept$unix(r1, &(0x7f00000000c0), &(0x7f0000000000)=0x6e) fcntl$F_GET_FILE_RW_HINT(r3, 0x40d, &(0x7f0000000140)) [ 3279.926059] Bluetooth: hci1: Frame reassembly failed (-84) [ 3281.218943] Bluetooth: hci0: command 0x1003 tx timeout [ 3281.224478] Bluetooth: hci0: sending frame failed (-49) [ 3281.939011] Bluetooth: hci1: command 0x1003 tx timeout [ 3281.945304] Bluetooth: hci1: sending frame failed (-49) [ 3283.298973] Bluetooth: hci0: command 0x1001 tx timeout [ 3283.304450] Bluetooth: hci0: sending frame failed (-49) [ 3284.019020] Bluetooth: hci1: command 0x1001 tx timeout [ 3284.024444] Bluetooth: hci1: sending frame failed (-49) [ 3285.378929] Bluetooth: hci0: command 0x1009 tx timeout [ 3286.098945] Bluetooth: hci1: command 0x1009 tx timeout 03:23:16 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) vmsplice(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000000)=0xf) ioctl$KDSKBSENT(r0, 0x4b49, 0xffffffffffffffff) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001280)='/dev/autofs\x00', 0x80a00, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(r1, 0x29, 0x41, &(0x7f00000012c0)={'nat\x00', 0xe, "54e91f18b2515c94d12b85894177"}, &(0x7f0000001300)=0x32) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r2 = socket(0x3, 0x802, 0x3f) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000001240)={0x2, 0x1, 0x48, 0x401, 0x3, 0x80, 0xea, 0x40, 0x6, 0x5d, 0x9, 0x7f}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) connect$inet6(r2, &(0x7f0000000040)={0xa, 0x4e21, 0x7fb, @remote, 0x80000000}, 0x1a) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) r4 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r4, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r4, &(0x7f0000000d00), 0x1c4, 0x0) getsockopt$netlink(r4, 0x10e, 0xa, &(0x7f0000000200)=""/4096, &(0x7f0000001200)=0x1000) munlockall() ioctl$FS_IOC_GETFSLABEL(r2, 0x81009431, &(0x7f0000000100)) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:23:16 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xf0ffff, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:23:16 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r3, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r3, &(0x7f0000000d00), 0x1c4, 0x0) connect$unix(r3, &(0x7f0000000180)=@file={0x1, './file0\x00'}, 0x6e) write(r2, &(0x7f00000001c0), 0xfffffef3) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x80000000) 03:23:16 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x48000000}}}, 0xb8}}, 0x0) 03:23:16 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x8c360300) [ 3289.569918] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3289.571577] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:23:16 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x4c000000}}}, 0xb8}}, 0x0) [ 3289.641075] hfs: dir_umask requires a value [ 3289.645551] hfs: unable to parse mount options 03:23:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1000000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3289.728186] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:23:17 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x8d360300) 03:23:17 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x60000000}}}, 0xb8}}, 0x0) [ 3289.789218] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:23:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x13d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:23:17 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$KDADDIO(r1, 0x400455c8, 0x6) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) [ 3289.918102] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3289.947451] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:23:17 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0xe4ffffff) 03:23:17 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x68000000}}}, 0xb8}}, 0x0) 03:23:17 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x2000000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:23:17 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r0 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r0, &(0x7f0000000140)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r0, &(0x7f0000000d00), 0x1c4, 0x0) r2 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="6469725f756d61736b3d30303030303030303030303032303030303030303030302c00e845999834c0a2de00195c62ccf719f9f1440f2cc31babd8bb305574daf35dcc505799dceb82763187fc00972e05e2d735028f471a6eaa47c20b7823aacdc9a2fe79f4ad5bf0c288b030ebf4e7996cb9a7f09b2ccaf02ec0235098bc6ab37f2d3cf62b350245074ff264264a38e356a2acef80f79a829d161a35a3c7db87716efe11b7cad30a4c8ac4f5bf981cf3936cf2e8"]) 03:23:17 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DEL(r1, 0x0, 0x484, &(0x7f0000000000)={0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x0, 'lblc\x00', 0x9, 0x8, 0x5}, 0x2c) r2 = dup3(r1, 0xffffffffffffffff, 0x40000) r3 = socket$inet(0x2, 0x4000000805, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) r5 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r5, &(0x7f0000000140)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r5, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r5, &(0x7f0000000d00), 0x1c4, 0x0) r7 = socket$inet(0x2, 0x4000000805, 0x0) r8 = socket$inet_sctp(0x2, 0x5, 0x84) r9 = dup3(r7, r8, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r8, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r9, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r8, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r8, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r9, 0x84, 0x66, &(0x7f000059aff8)={r10}, &(0x7f000034f000)=0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r5, 0x84, 0x75, &(0x7f0000001180)={r10, 0x8}, 0x8) r11 = dup3(r3, r4, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000d6cff0)=[@in={0x2, 0x4e20, @loopback}], 0x10) sendto$inet(r11, &(0x7f0000fa3fff)='\t', 0x1, 0x0, &(0x7f00006f7000)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) sendto$inet(r4, &(0x7f00003cef9f)='7', 0x1, 0x0, &(0x7f0000618000)={0x2, 0x4e20, @loopback}, 0x10) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r4, 0x84, 0x1d, &(0x7f000025e000)={0x2, [0x0, 0x0]}, &(0x7f0000a8a000)=0xc) getegid() getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r11, 0x84, 0x66, &(0x7f000059aff8)={r13}, &(0x7f000034f000)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f0000000100)={r12, 0x1000, "52c82ba52788d1e63d64a5476e5842489d66fdd52b27cc2770d79740d6ff8479686741b5623612c8c569077233a107549396c5d22d2b6234a91ed83ebc5a1d9c452a2ed4e33ce25e928e625fc08b9531af0cdc14cbb1386b678b1cbeda3b597b2730808004eafdb19f78538811e70a1d770ee4fd6b94140cc16b0c4d611516d079f5d7bb6ab07e056f52235b7d3b9735bdbeb65a30a33e2d0377c5052b1c8d74517928a6be085e538a9e81990f48a9f3d1a16b47e8b71dfb2b29cd0cc6b136740174f32ae11f9842598b351a2b6dc28c2d6db5c1d13764a6ada1d694b692fba7aa6ce9ff863a271004f94923ca3114a593255cac59d85387be6d3f2ebcffdd663d41563d28f53b3c50c7df586e263a24cd7c574dda9c2703989c5fd2e2c40b0bb8f32d42770f2fabafb297dbcb5740e363ec28762becd4f702f7b3164416f49372c07645f3202224d4087b1a47811ae11c4b6c21ad98a5915e4c9ceaa3504a13182039acc489959afa433cb8a4c30791778cbec47943fea9db305b52adf61ec1e65d00fd1091ecd55ee8b9f072c86b66a8e1e61566a5b5b251c6c15a36ef4063b83b4366d47a0a196ee8565df05a7d8be55d0389f314375424c2a71af7482816f284f51f1b8bd00e8f02dc4059488c858ea364b5a92c3e56127bdb0c8dc64ce73170b3c977ede18672648a5d2b11bb99d7e5ae5b0191ebac9751dc0e5d103e85b647580d00aa45456c133a902586eb9f6cc3dc548ac6a0a164fe72ea8f928ce687754591e465528265ce25314c2f7bdf853a6ecce0667f1ba0e40a3005d42a80243928928e506cf6f0944b2bf687c892191d0108c1985abcb0fc5c7caddada6da948f094aa7f7fe2f603930a43e598e77a15f565d490b10671928312b7283d6ff8b94220fb8b0bc412e2a28ef3b44bb258ac2f2d2872c595f43626764b9065b091d7b6ca5248044840b32581e6cb21f06f94500e170ce672a48ba7319949d6a4bb66de0773f1c6d7cd784bb9010266a024d78260b32f97917a9c4f3d556f19057a665fcf652831aea835d6584725fb09a6e8cae46db61be4fe376ab679b8850d13008c6c635fe4764a18eaeb5606031027218e40c51da6706f391f01415cfbed1360eebe732208f92c9a189d58511fb9533d3616c9490b00243b63dbc448d7254b6f3af40607778314e908d4611a79bea680e6816be1d72b6330c2072ad3ee05d4705a29fdfcd4ab839054cba3e8ffa7e90195cb30d282177f55d576cf4ff151dba7586d74043b60b9086d4e6af70ca05b202f6e0dcf830dbbc6f9e7a4e848bd73cef2224e4a969a9e6f516ef7657181fbfef96462f7d96294dc9ec8d130df3910a9411498ada7e0b5e1434bf5a0da4d31792a574a729aa10729caf8b020c34cfd24d492f1a005f679338cc206c1d6c1e6607bc5741bdb837469900c488888b445e94f9f5e77cf89cd55955a11f7436a6a178a7f819bb40938f233e2347f1df6951c41aacc952c35724b7a794acee18990781598ebb2781b7407a7a564a439512a0607ae04abd07e65ae988eed7fe2af0bf9cb3b86f1b30ed4f1f765e5a0a02f05ff8ee62cb027443e9ec0e88e16725bc8b1c5e4f09e9e39a9f57ae45e2fce871d2e937a308354e8e5a58622a54b2e768c497338d3f41fdc45c3397222957830da84b3bebe7ac674a107f1ef6e6d7b62db74d6b3baa8064796faecff49d2d21bc9ec93a3e3e1d9cf6628e7e2ae6a18594e060e16a449b4197338f4fb74320fd306749925e35537ac84a9b7beadfbd31cf92d52fc05b736f92da0a9d8526b7268999d2ace0e78641b379aeb76d86978f84995f867ac45e9741574862ea4e79cffd0491efe714772828184ac35e49a1f42cd187df5d96427a6d1c289cfe863d35ceff0477bc11c6021504b60efcb60addf3af5ea74641f90ceb6cf651247728cf5af97662f9b6b68fe26bfdd4e6ce9b1c75194405303d221967d5e9f0244890386bbb7703907f898cad4c193d2367de921c553455cc43c83782349804a6b7d707ae6c63d7a404a7734c54d989a8d9c531fb1c0061f9f96a52aa4640f1cc35c724fd2369dd4b08f548ad7ebc68fe7497abc1c5fb7c47666f859253b9fb6319fbcf301a773831ae0a96e22e0875ef380d26bf436e3a7f56663f3737d915ca7f5b946eaeb4fa0479c51d4697e0fa13ec4ec6e6692018dc5e8dbf9f7d562bda7b7a289a28ba9901553269f5559bf7bcf7f35cd79fba069710be97aab4c7c5c55a8e61d67a1ab6f95de5aa1d95e848f91bf25babc6bb6bc969c9fd48be158a8775414f3c8899449ec34a95d234c2977098bddf70d3a17e7ca5074a1f05aa211cd89df47e4923e0ce92f0893e2f7d7ead0261294ffd04f5beb80130dd27c67f7766fcf1327cc02490794bbe927bcd76dc94d2c7c74b202c46cf3584c26bcb27e3b2dcb581e40a632d0c7dae4c8654c9d3336b73b01981b8e734fc9fd8051cf24bfb5d197eaafdae847ca4edefeab5e45016016483c74df47773abcee325b53aaf36bb1adefa8f4a221bbda05fb656d00c9225894bac19f0a494ee3e8cf557d597411dfb65afa36e56f9fb84121dfb81128bf11f18fb0a14ed9c96d99d74a5433addf523c42122084bfa8b86d24630a2a5828c4e04ab99eb027cbd887428336d7fa0327be57e739c435fbb7d76e76583012f04c5e88c0f0408ed6a9bed2aa7bce5fa58aad402c38892e3dd3f5259c8f86abedcbac5f6188187011d6d9566cc7c04da4820285464b10774ca26458336b3358244e090912406668976272b88dce1fe05643dc14dae19d2fd4f17f0c030b1f67ecf41ded5f94aa05f15d58436867912637bd72f371d122870b199dbf132405a2a8d696eb2f0b9e24cb4372287ff6c9c272dbfd0e7aef1f92ef6f813ccaf6e046478b636df5c79439c6e67f690a81315c3c722bcb5895509a9dd8bbd395e564a3eecdfb1512beac4c68f8dd7dc195eab0e4b312980334bc2e83378f795ea847b4804a477226b916ea239c2bebb5bfb220126fafcc9a5ae54d789f41065225749be7718e515975ffad10f4afacd133ffe8b57aeee932510594b475fe1792254a4d947303a8e195a99418b77e42a1f9e42f920b334e0ad11df7cbb3af38dafc5880725e3f6e3b03e2ac17212d46b0dbe3876c1717929d5c2c9b11f586bee204d7aabd4e50162bc1abeea375e2d9ae14d9a84634d9b02c6b7eda0d8540501b5238b739ccbc4342ccbda39b18ec19260b9b7571bcfe62ed781333e0b46b2effedc016eeee50af113e5b13eb3b953eee48310d12a0aaa31428975b13abafe4b5a8b567147873c3e6e6089f639b580da2baa4197486b7aaf0fa06779b47f689dc06974ac72cf087784babf7ea726aeacc099cb3662d3aef67c8dbd2c528979159b589d478a729706ba4a33331616e9783ab99867b9dcc89883fe59e6552168e65e35cbff9a6099f8b802acf014d4c496cc6d3299fd0b616c96555524d86dbe24dcc510df47255ececbbf8e9cf53f5336fb1f75ca731b526a80038dd64ee90a39ee1eed4d3cba0d883deeb0244d0c83139b0637d356b8e7c4eb4f0e9c1999a7f6934bfc674f3933b3844dc8fb0e7dbac17dba0dc393c51038f5344094500701f855963bfc47ac611a254e1aa96526df9fd1fcd165acb022a90ae6e30056b4798490eb01e02308d0937bf2d89b96cef174c46cfec25876be494096e13b9015a6c31a85c4def0a71e7b68f1fd1bb0d6f757fa5c80926c43b6a7698de9a666cae34e1ac4fe33fc99b30b7fb01a1b84491a2128a12c646a3728205bc3e410cec34047ce74e885376b3de47358b4d9643d0d7234f9440720c3f0dd348aeae0790c7abf1b47a5474e643dcd0df4f78ef797291a2ffec637ca33eef47d108718811594758e44ddecd36820f9ca7ad49d2139b62d79dc9a34ec2b5d22a89739f7743e85a5684fdf8f039146f12f84909a040db3c784d6451d2a8419d0c553ca842601fb6a9705b123a78ab8d0671005c2b724621fb68e1d0d6dc0d636dcfeff3a01c104ffdd4c98a64aae12eec3c9d11a5e745f5ac22b7f652dbe0b975b5993b0ff9bc0a6a84fe09b8e1caaeb152ac092ca51b8178cc1ece0aee6c5e5fc9c20086273b6f623fbcb7f876734da9d2abcad6fcaa9d7d13ba6283e96daf594e57154d6729474bc8f2263eba6658690e5ba2dc65fad7bf2101c20e0a21a4d94dac26958cccacddba9a5b6d6293b8587f3f9920717b94b58e67e181afd6aaa4abb215a0860acb462bd3640aa513aa94eb0539d2f7a8dcf3f16ac87c99c00a4e8146139ce8a20145335cc34a58614152545875edc48c54202aae9dc9a650ddd5674a978f7c222808ca5a58c427942d59043e0cfb38938f68a0cc0343f09f548d3f4f654bbb16e402e93cb49b76b4904258d134c3684d4a006152fff6f3272fe3dd255fab4067ae2a6ce92ceae61618fe51454a22eaa6d4e60a6137450ae45901f55bf1099dc5a0dbdb8ce249d0ff0fb341745852f320388e30551682fba104fc1702b0351d94f4ab2e31bc9211f3a56e86d810813c7f758e1ab417aea99efb61d72215a337d12b801c6ef1cd80f1d733f91f683404024b51a6c4c020a9cd0a503719a606cfa65c410572a6aa1cdf8da6a54d6a5a32291d5659f21a077d281966d22c122606fc24c4427abd3f3078073fdacfdc576cbfc650d974cfcf8965358901036005b5707e089b7e22840c8321bd24e03910020dc428f52dd7fc0216dcff6175c71d5480eb73b57e993ac6ff3cfc3b892178e61dee81cb8c8b775149de1ab5f84978abc3a4cffd5a43380a6339282ce6c69f867ddffc8fbdbbd42b84236e3bf988aa42a14f44421d9bb0f197ebcb015187644fbec009bcac63be56346ddea334147563431e0d58babac164298d409929a8987b1341176224849873cb685b08c2e70a3e47eafa8c236df979574f4d0de04ebbbfb849f89eea79df3adf51a1f6f9a68f7074658b0e5ebc3694f677ddfb01efa2b16c2470fb67f59018cc38dcfdbb9bd2837974e5488030d46dd59127c275097720debb45c60589c860d45155ec01656923189d81ea35e1316342beb4c99a24d18149250c707d00d15ab727cc703a81c01bcd54f0fb59387d0fadaac7059b47bfc53173dddd7efb33fad04dbd424f25091be76322de8ed6e3d9929b33732ae50d0400e4ce7d9b23ea89e838a173c37642c2af86a957e882e36858dd27ad47f5c03ed109ef1046608c4f45242a1a669c437a33c0aa457147da73e776c5b0d7f77cc3ae44806058b1ade9930c6b66f8d4e9002a3ead008e0e6aaf8cc9baa052e5d2b0122df45bc46977ded25945a9ffeaeb805f932585803349de499292154f4c9ab0a80395e125e1b7d798f28fe0ac360d36a51852a2b7fa0684bd3abfb40e3dd852f9078e9a602eda7368376849d71940494c5ed8b4b7d20aba38074b7555356a6c6f6a4345aa558bff6e92f5ce6fa0f378de8a2a7e17281cb1e75dcd1ada95b3ea3823ade21660b6a528137df417c14ebce9f6b5589bbd2bab0210288d1ea691c9e1383c96ad5e60490e1c9c37d3309a7d8309804d9f1f306daaa65d82add4785087d87bd72ee484fa45573e9c75644a402a45be6eaa81268b8c4160b33cdf836069b58c36d0e8992352012cbdf94fa33f687d42daa390bb1023bc39512c985b66df26cd6bbc633aeed2fb04b428fd277300566f11f7745a0fc99e5b97306439aa416850d1e83f8a7e4b2835c729c4afdeceb65b509be745e165d88cb88845b22178bc7b7726506dd2ed"}, &(0x7f0000001140)=0x1008) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000080)={r14}, 0xffffffffffffff80) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) [ 3290.587453] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3290.603724] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3290.669280] Bluetooth: hci0: Frame reassembly failed (-84) [ 3290.679623] IPVS: set_ctl: invalid protocol: 0 172.30.0.5:20002 03:23:18 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x6c000000}}}, 0xb8}}, 0x0) 03:23:18 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x23d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3290.711071] hfs: dir_umask requires a value [ 3290.715548] hfs: unable to parse mount options [ 3290.790101] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3290.810149] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3290.827615] hfs: dir_umask requires a value 03:23:18 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0xfdfdffff) [ 3290.844472] hfs: unable to parse mount options 03:23:18 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) ioctl$KDGKBMETA(r0, 0x4b62, &(0x7f0000000000)) 03:23:18 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x74000000}}}, 0xb8}}, 0x0) 03:23:18 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x3000000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:23:18 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000000)={0x0, 0x20}, &(0x7f0000000080)=0x8) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 3290.965227] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3290.988292] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3291.015314] Bluetooth: hci1: sending frame failed (-49) 03:23:18 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x7a000000}}}, 0xb8}}, 0x0) 03:23:18 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x33d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:23:18 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0xffff1f00) 03:23:18 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x88000000}}}, 0xb8}}, 0x0) [ 3291.114648] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3291.117386] hfs: dir_umask requires a value [ 3291.131058] hfs: unable to parse mount options [ 3291.141111] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3291.257989] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3291.280229] hfs: dir_umask requires a value [ 3291.285972] hfs: unable to parse mount options [ 3292.739044] Bluetooth: hci0: command 0x1003 tx timeout [ 3292.744588] Bluetooth: hci0: sending frame failed (-49) [ 3293.058957] Bluetooth: hci1: command 0x1003 tx timeout [ 3293.064484] Bluetooth: hci1: sending frame failed (-49) [ 3294.818954] Bluetooth: hci0: command 0x1001 tx timeout [ 3294.826570] Bluetooth: hci0: sending frame failed (-49) [ 3295.138976] Bluetooth: hci1: command 0x1001 tx timeout [ 3295.144401] Bluetooth: hci1: sending frame failed (-49) [ 3296.899011] Bluetooth: hci0: command 0x1009 tx timeout [ 3297.218963] Bluetooth: hci1: command 0x1009 tx timeout 03:23:28 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0xfffffdfd) 03:23:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x4000000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:23:28 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x9effffff}}}, 0xb8}}, 0x0) 03:23:28 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r1, &(0x7f0000000d00), 0x1c4, 0x0) pwrite64(r1, &(0x7f0000000140)="edaf47b4aff1d47d3326dde0e331678036a37c81b932af3172338fa4fc6a9aa4784c4cd52623bd4f76fe08888f3c07e856ac8a56afd600639df40692554807d24efef2c06894e58f13576b78a3afab6d94745bc7c9ca2e30a9251f0aa67430a842bade924a7493bc80d9b97995ddb1bfabb90d8a7b77e588ab4f0ae98d40e7a68cb46363266dc5d192ea6e6767b3ab9f283b7419fdfdbcda565ee79afd92fca3b5276c8a90c19b55c04af30493180faad89baa87c801bb8d90b8f78406be5dedf85562", 0xc3, 0x0) r3 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 3300.849300] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3300.863752] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3300.943990] hfs: dir_umask requires a value [ 3300.948374] hfs: unable to parse mount options 03:23:28 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x408080, 0x0) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000100)='fou\x00') sendmsg$FOU_CMD_DEL(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x2c, r2, 0x400, 0x70bd27, 0x25dfdbfe, {}, [@FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_TYPE={0x8}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @loopback}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000040}, 0x40) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) 03:23:28 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xf0ffffff}}}, 0xb8}}, 0x0) 03:23:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x43d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:23:28 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0xffffff7f) 03:23:28 executing program 3: prctl$PR_GET_TSC(0x19, &(0x7f0000000080)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfU\x9c', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="6469725f756dc905f8ff3030313130306a3030b190f817c719b85c30daba88ef6f9e258484c95731a8d260ee1a6ed5d1244c498015c61f7a2b55c4a2b30f77bb0c2e1998ae821bc1b6b558e2de20d3a39a9f2bfecdc4549907dbbca960d1d7ad3a0e9f213119a7a949d3457b801eae45fea21b5923a2"]) 03:23:28 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x7, 0x0) write$FUSE_INIT(r3, &(0x7f0000000180)={0x50, 0x0, 0x1, {0x7, 0x1f, 0x2, 0x12000, 0x9, 0xfffa, 0x6, 0x7fffffff}}, 0x50) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r4 = gettid() rt_sigqueueinfo(r4, 0x0, &(0x7f0000000080)={0x0, 0x0, 0xfffffffa}) perf_event_open(0x0, r4, 0xf, 0xffffffffffffffff, 0x10) r5 = getpgid(r4) lstat(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000540), 0xc) r8 = getpgrp(0x0) r9 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r9, &(0x7f0000000140)={0x11, 0x0, r10, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r9, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r9, &(0x7f0000000d00), 0x1c4, 0x0) getsockopt$sock_cred(r9, 0x1, 0x11, &(0x7f0000000a00)={0x0, 0x0}, &(0x7f0000000a40)=0xc) stat(&(0x7f0000000a80)='./file0\x00', &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r13 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r13, &(0x7f0000000140)={0x11, 0x0, r14, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r13, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r13, &(0x7f0000000d00), 0x1c4, 0x0) r15 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r15, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r15, &(0x7f0000000140)={0x11, 0x0, r16, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r15, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r15, &(0x7f0000000d00), 0x1c4, 0x0) r17 = gettid() r18 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r18, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r18, &(0x7f0000000140)={0x11, 0x0, r19, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r18, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r18, &(0x7f0000000d00), 0x1c4, 0x0) getsockopt$sock_cred(r18, 0x1, 0x11, &(0x7f0000001dc0)={0x0, 0x0}, &(0x7f0000001e00)=0xc) r21 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r21, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) lsetxattr$system_posix_acl(&(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000280)={{}, {}, [], {}, [{0x8, 0x2, r22}, {0x8, 0x0, r22}], {0x10, 0x6}}, 0x34, 0x0) r23 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r23, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r23, &(0x7f0000000140)={0x11, 0x0, r24, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r23, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r23, &(0x7f0000000d00), 0x1c4, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r25, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$TIOCGPGRP(r25, 0x540f, &(0x7f0000001e40)=0x0) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000001e80)={{{@in=@multicast2, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@dev}}, &(0x7f0000001f80)=0xe8) r28 = getegid() r29 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r29, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r29, &(0x7f0000000140)={0x11, 0x0, r30, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r29, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r29, &(0x7f0000000d00), 0x1c4, 0x0) r31 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r31, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r31, &(0x7f0000000140)={0x11, 0x0, r32, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r31, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r31, &(0x7f0000000d00), 0x1c4, 0x0) r33 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r33, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r33, &(0x7f0000000140)={0x11, 0x0, r34, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r33, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r33, &(0x7f0000000d00), 0x1c4, 0x0) r35 = syz_open_dev$vbi(&(0x7f0000005980)='/dev/vbi#\x00', 0x2, 0x2) r36 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r36, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r36, &(0x7f0000000140)={0x11, 0x0, r37, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r36, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r36, &(0x7f0000000d00), 0x1c4, 0x0) r38 = accept4$vsock_stream(r36, &(0x7f0000005bc0)={0x28, 0x0, 0x2711, @reserved}, 0x10, 0xc00) r39 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r39, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r39, &(0x7f0000000140)={0x11, 0x0, r40, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r39, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r39, &(0x7f0000000d00), 0x1c4, 0x0) r41 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r41, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r41, &(0x7f0000000140)={0x11, 0x0, r42, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r41, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r41, &(0x7f0000000d00), 0x1c4, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000005c00)={0x0, 0x0}) r44 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r44, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r45) r46 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r46, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r46, &(0x7f0000000140)={0x11, 0x0, r47, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r46, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r46, &(0x7f0000000d00), 0x1c4, 0x0) getsockopt$sock_cred(r46, 0x1, 0x11, &(0x7f0000005c40)={0x0, 0x0, 0x0}, &(0x7f0000005c80)=0xc) r49 = getpid() r50 = getgid() r51 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000005cc0)='/dev/vga_arbiter\x00', 0x4ae802, 0x0) r52 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r52, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r52, &(0x7f0000000140)={0x11, 0x0, r53, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r52, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r52, &(0x7f0000000d00), 0x1c4, 0x0) r54 = gettid() rt_sigqueueinfo(r54, 0x0, &(0x7f0000000080)={0x0, 0x0, 0xfffffffa}) perf_event_open(0x0, r54, 0xf, 0xffffffffffffffff, 0x10) r55 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r55, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r56) r57 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r57, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) lsetxattr$system_posix_acl(&(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000280)={{}, {}, [], {}, [{0x8, 0x2, r58}, {0x8, 0x0, r58}], {0x10, 0x6}}, 0x34, 0x0) r59 = getpgid(0x0) r60 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r60, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r61) lstat(&(0x7f0000005d00)='./file0\x00', &(0x7f0000005d40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r63 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r63, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r63, &(0x7f0000000140)={0x11, 0x0, r64, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r63, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r63, &(0x7f0000000d00), 0x1c4, 0x0) r65 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r65, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r65, &(0x7f0000000140)={0x11, 0x0, r66, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r65, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r65, &(0x7f0000000d00), 0x1c4, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000005ec0)=[{&(0x7f0000000200)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000440)=[{&(0x7f0000000280)="3704e4586e68b69fcbd23c0681c634eedcfb181440c8b960", 0x18}, {&(0x7f00000002c0)="9bd3c5013e4c2d6286fe0c225d6fdedd3a1fa0d3a0430e869ee351bd6fabc980bd762aed91ade8326321b0388649192321f0f25fe16dbe4ea72b75e17062746016608fcfda920c11d3222f4ca13509064e34e8d3837b2829b0837381f19ddba9884392874b6378ac709016698683cca26bcf86b8131b6021f6e12db0862db844", 0x80}, {&(0x7f0000000340)="a59e3214cfcc211a11182e134820fe28a3620a711e0cb0528b36002983f840ec83d8fca2102a3d21317bb8ff6ad21e2bb97f9681da138c56aeb0aab3d5b3e276150e359dc19216c540a4786f8345f04c64a1d63b94bf06331eee0dca2eba3fccf215ac53d4a97ef31be8d58652dc734d271d77aba0976a", 0x77}, {&(0x7f00000003c0)="1453794f4ffded943f256572f9fc76eee439811446c0c68403fd8ca176308cc7a3a5718401eb8b6bc042e7e9a84644ca253c6df6dba8ef2fbc6e738efa1e4b0392f710495012cec284bdb26355933be768d9a51588ac1504e3cc9427ea76e9c829b4f41aca9ef5861da826bdfdd225a806", 0x71}], 0x4, &(0x7f0000000580)=[@rights={{0x14, 0x1, 0x1, [r2]}}, @rights={{0x14, 0x1, 0x1, [r3]}}, @cred={{0x1c, 0x1, 0x2, {r5, 0xee00, r6}}}, @rights={{0x18, 0x1, 0x1, [r7, r1]}}], 0x68, 0x10}, {&(0x7f0000000600)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000980)=[{&(0x7f0000000680)="463eb8f579930fd3ff06ea5796f2b7872e0e99b81ef26d58a90106511298697925c127da40ccec40ec0800f4d651f395f981982f5effa8ffbabe14b20ea24eab7bbc0b7ba8a8", 0x46}, {&(0x7f0000000700)="392f2e06b731d2151a63284adde06ce79008a3bb9d1bea990484cccd615b64a520ada2ebf7054b4c2f9c7fa2885ef177afc0f1fb7b62bf90c1ff9a83ed79ea768f1e837b4b134544d090eec50548bd63ca5a2894734ccbae6c33c0543434f9da6fe9e99c1e90e7fa36ebb40ebcdb78db7d691f3fc74d37ae1ee5cc35d7cdfacf3f30", 0x82}, {&(0x7f00000007c0)="65d8a0c248b27a5bffa51cd8d3217ba0d0c2cf9e03d5e09616ca70e8fe4b83255c5765527a12241bf7bcb560e228a8689d1651b59f581122b2f2ccbf1b21c8bb919b4fe730ee40ac0d20", 0x4a}, {&(0x7f0000000840)="0cb98647478873030a92ae919444ba8004f3a6242436fc0329d870408188ad7d5a6ab513210dd2feb288d7332bcbb446803d78834de560432e72c5a063fef8bc041bbe5306a7f0317e5f1a0d6ca12a158c34", 0x52}, {&(0x7f00000008c0)="0a17ca0adb99363705abe987e4d3e97a06f17d2b30", 0x15}, {&(0x7f0000000900)="054c0185d71e7faad1e047d24b8b4d5dec60715b41c0", 0x16}, {&(0x7f0000000940)="9e19c13b41d269268ff54b474713f5f3211e2625b1ea1276c0b62f", 0x1b}], 0x7, &(0x7f0000000b40)=[@cred={{0x1c, 0x1, 0x2, {r8, r11, r12}}}, @rights={{0x14, 0x1, 0x1, [r13]}}], 0x38, 0x20001804}, {&(0x7f0000000b80)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f0000001d80)=[{&(0x7f0000000c00)="b702a259a00e87c2de7983030978878ab66751740e6b0e2c790a769e54a2ff34b976357175e55bb9f85490c6d4257e2417138065604c8a2b1fe2ec4d7bf4846ed8fb03575ad298375fa22911b114894491c3d0720b770867c3959a1bd7cb5d8a60b8c44e48089397617b4ee03db219f115d2f7d7abd8d969571b052b02430147c657bd22cb", 0x85}, {&(0x7f0000000cc0)="fe8cd08e10e017f5c82a92af78eb59f9e18a0e91ab5dd4e6b4b8f0bd6ebb1dc2360ba430804ca9253eb9956ef9ce6b2bf06313b25e5c9b5161e124978d221d373d6db46061412f5635c51290041f7d7160891bbb4a2f2b2ce186234c8ba9306518aade62ee754b924fedf8a5c99b2aff637bdd64ff689501cdf9aa538766c8237a66fb162bbfd81c7749d06c2144a4306e3b52cd91a4b2d53ded557a12ba925263154763af361c7bbc977568331f74f47e090d372a09", 0xb6}, {&(0x7f0000000d80)="e7c579609173dff179200590bb01f21b5fbb3ec3549c217a7dee11fb70251aa9ddfd613dad6f901e8770a278cffa404c574e340c85dd11bb0e6f8edb18f8c2e28c519a7d72a231abc3a2ecfd4478dfc4fc0652225378924d3e0631f028c09d2176ca5ca89f4913b43f0809c67458424268b49eff1f90dc460d05baac97bb98dd50cbe7e7ec2a1eab2611098fe2d25b7d858d6f6e4467ae1f612843e3a75eae82f20f2374d5f691db1bc8935ca076631234aac62d96c396c4106bb47b4ec33193e09c0bf603f5c32d8e4b0af021b217e0575c57829484c339fcfc46578c103a27df06966df527964fd512c6d36e07d472091717c38116fc4ed4ba26d7985424e85724398b94ca2aa0a3e20d3e0619da481730413bcc32feae9ce2d1d35e40b8f4beb85b4c4a167a9bfd81f88983fadc82fa510bcc4cdae89a9526c4457703b3b782c9c41a673fd6654cd444b3593d0fd562f1b2e6079ec11398101ee182b250dac7536125bb8bd834764fb846796d5161f1e9d5d3b1060da84e5bdfd524feb8fa07b6fda693b6f25795ee436cc589d16bd52777c0c056813ab151134d902999b33aa859b9a5fa653aeff03924fb9d26d814a1870fcdcfd71be9ac73f030872b1b03f119824b58faa16940ec00247402eb294f95da622fe6274140aa678b7314f904eee979a0cbc230ee5d5e8786e345003a6f0ab5ea6788206a915cf6fe9ae85a9555a2c0f4e72ea72c37a89c232ba311e0fceed5b5942ea67e07e276d308e7d4f36bb8a703efad65a9b20e90ab7bb702c52bda9ff07a84b6edcb129c3b5937c9d77463c55e9e3efde2f8d6fb61f3bf4b2ceafce38f5bbedf7383ff4ed5169bf69adc52435ae78f3b339da0dae274ceb0960517b5c2dc065522884b286c93162f5e5327834341259519f1d3afcf644b10493bc28383a47200c723c95b64876b5dbc6fa4ea62f20145dd9d4f58c56fed95ba8ccbac313748a44121e061e498be9da3714a2758e1831723f373e74872ca94d0a1f03813279f07a723ec83bcbd5152b61136810481db0c394ad08c3ae7f09987745d2ee04eea2459324105e63465370f5de3e0ab7b42a4e8fdedfd6c61ad1c055c8238838aac3e12e1b2f75f54be84aeecf3f1ca79c1bcf289f70428eae93f304aed4c2cc729aa61f0099aa0e6a397085b98d0c787ca5ac9b39e81a410cb41e0ef38e5dc5bed13b808d06e4f85db166f667591aebafc61c281c10668b05fb327db171f7558962c1d0571ff1b9a698d68f15262cc3d7704d71a11ce23481610806a1f735e2cdcbabbdd374bb2831bcdda0e562ac2590abed50bd62398745cce4e6e55ac8824069a55fb7fd20b164ab5e91cb28738096bbff3f96759ce36fab0877945fb2d6589d27203c897e6016dd14acd4784ef057e34f5ea8fb20d8d28267a2ed1f7d786bb8d5e4c9860b6d39b2a42e02d03294689da1492563ca20d0d7ad9976db1af83962c515bee1e85987db00e1edfce917d2c157ffee1d76c613fe8d343c65521b0a102fd9df083773de4ee2e1ac48e18eef71708bf77907de6e6dd061311833750a834ec26a99d1b8d6a619683af2ccc0b02194a60a4f49af397bc135d3b2b25dd617b68a5f8940f4f84531edf831b0e23be40de2b951c7bd39d2eb9439143dc50f465cfeab74d285b12ed85e4307e129c2abeb391d8983e72ce48b8d6f2e68580397e41d459ab39346bf7aaa1b1b094175f3a38f6d56146d9c6e0ba00d274633e5f8e473f22d4ede5655803affc883d53fba3c446b297fb3112b60d0d50cb2861054557be46f43978ebe5961f1834e9d9cb982baea45ed0a46955b70e8d5f3a71eacafbf5f33bd561aab0ec23bec593339aba1fc44337914f2c4d52ff57f2f53085d3386c829e94bdb4f6f90ac5cbd7fcbdda4dcd292b6b67d76b638b48a5dd0312514949c55ec4e31df53beaf3bdfe7af49032da2416ffc9aa70bd19bc33b7784a14fafd580349587745a8064f05a5e79a530460a9217ff88fb59e0c2bafe238cd2030e8c635031f6aa589511359cba7abbd196d6b5b5ef39cf2dcbdca0cd9ffafe2c68300281e19893eae2e68a0a182e1fcff02dbc15b99e892d2c2c027092a447c3fa9f5f0fcaf672fd20d639eb2db4237a9590e451d03f6e6c323235ab51a0db680fb91651b17ffecc463371325331fdb512ee1de6896463a53eccca158ef732193aa80af741a5952726a95c569a631dec4634ec272cf123229311eec2b1d050cbee85b2939fe20771a9a8346f774657abec81e8f2cbde42e25ca019d5192891b26e62ee0fe0692194c918f71eb66dd27e3a086686bd25ef78da89ba34095a646ec21f8a9af7c79b88e9ce74db1e38ec912dcd4c46588414b896e5b70b646ea97f0f5e3205e64e7bdcf629b439dda4fd5dfa879441be9fd70b99ad54aaa73dc97e4c30a86e9c85433768cea9717db19f9436a779a1bb5d69c9ce9598d7e02fd4aa1f797ea11e0ec077156decf4bc76b23a8d4c671c399de2072645040efa640112160a736a12ff17bcbf3a136f7dfd9c0485994cfd7ea5fb7c3b74abd935eb161b0abda1b13d48df1db059c61b9b729ac17690bc7893afb145344dff904c934791de6383ca8d82816e126ba5c3f26c0ca527180575b4cb52d846b65aca7fcbabc3904bc580817a27b4e3dfeea761d2bb5c9cb44ff84675c4a28d9f0c9e3d631d81cd7dc5bc915824a1a4b6e2ed6da50c60a2f588af8dccaccb7e58edd7e36b7c736947b6982197f3a554e39326d732138651a204f8835d04a4917087846b02b991fa5063e2739df385aad57d3c49f030e7208d909509339124d32bfa10f62ef13f69b6ec0f393fb7ea2eceffe74185602aa4a1817e3a0958a139d05c00719e79b0b6e0ac9902d3f677285bd1be79b645a7f8cbc05293e22ce3996ff7b35a6c19f444982b2e960280ee52b58eb3f755ab1648b6d36b4fb6660b39b2da68cfd3469550c5a0877f06ace21b6e391d44600ddd32b2c55409ebfeb3905806f764cdd40c6e4d69b6e5b387a91bc7e8bdfc7d70ceb1be325ef4f52f6671adf56daea3ebe5f4a7ab81adeb9ceb5bd9f5a6f15b4f53c6b994f2bdc48ab7b3937994bdbe70eae665992891953e5663b2c8652e3b1758f5524a7266648a50456ec8bc5f78f471e94fb1f551b4f1cdbd889f4df24d70f3aa50d711085306ce1f65098696be5f0306bb18986c94bc7af348070849e2c02efcb60d34934df85edfd5ca6455eb046f78e6b777bcb5e64edafe0a39b57eec74385b326b28d9ef90247d0688fc333481d8a13a5ce7e71985a232d17564e9f040abce49e68bffdc5f83fb9d6ed3cbffba9fb767f16a102d8b6916b786df720dd3d1b7e1da15510dc3272f6d3371558213e7b61cd8531198bdedb3b774e4f0d259a5ab4ae85ce13fc31dc7912e9912888b7c537f7f97d402dfc047b980e049655286a1103f315f20d1394b6a323a48ed1db74a7422753f22ad1359576bf0ca6397f2fbdb4de3e47d850cce7d3830da0eb7a4cad2cbfc8e296e3034163a9f0ac591362938086b16677f5cca26dca10fcf3e61701d78792d04bb84f252672b932ef2089f5aa65509603ad3e12fea73b6562976a34e2edc96e35d42630ca1a6696166118ddf3ac4b15a77cf6272753c7f10e6c49c3da6092c6f9a65a1a950792d2a550f79363390791becb1ac43d79466296a0797dd831643e9fb1e73e2def433e6946c2135a20ac2c1675bc52729155922c4c47e40f4be0bc8362f08edd6e9b6fd7aefa818b0ca7005321de57701e10ef526f1c0d9d0faeddf92889c7b88744428c1325fbecf260ddf4c929aa0795436dec62827288f45ee314c3f6258bea248262fd08cae7e0e73e2c2f52a50cc39d4c6c1e56ca2c1017b9d994cf57c79a5a198b075d729c7b12bf49b1c25a1c4de7af0ba38d1bae5e40801b35942611827e05395e80662cb3cf3d4b84efe9710259c7e156791b7ec3b835fc3ed9c465e158b1f5b8bb125a49356f738cc0b2f5c2a9aeb5ab5c38320efc68f17f06ea064b2bd62cb47abbd36091fea8eff7f28401ed83021002801a2d85cf40f34b8a49dba6485262004dc70c11e92b9d0e8e838c9f8a36f7b1398f257e1119c6565feeca801cd5b1ff6d979ceadabfca32581da1a1e48d61c1a04f097e405a764ff6adbfbe15fa0f53ba765d0c73d538e160b5f54640ec8789a4128df539948634a217feb521ab07e1a014dd053b1687bac95da04246c0dd5ed64f19fa721c086acaf45cd0c3e7c7d20450fb2313ebb50ee14159c2e2d1503e546c19bc3fbb4e2c5a6920e43dd776b4910fc4514e93afeb384ab61150e1ad06c28e7fa6fa0f811965a97da8934710132efabd0b9186c826ad477282432b4265e8d2232bcc5276cd235be66e02c1183fddbfe474735ebe2173b517481ebc43b552426530dcb6f8151d643d33dca38b05ade56ac3887d7e064932854008e0bd96e33a917b46bd52cdd8a8ea23b6ec4fd4a4e5da3b258d10ee7eb3b6bc8f891f74dace2963e38019e5c75fb073463584f525da579a3c0c753b8c6ff42254b6748c2cecdb9bab25bd760f4ff833af87ae9be4c4beba0cae51d9a7346d91e16df2ecf0ecf59a889d06169838f9101af5bb5eeae2f7194d94fb5fdbe8044c233204d57013ffd81c3c757cc768869c4ef6f64c2b47ccf7b009e5f834efac8ed0a05ae93c856da766128ad577226f38734de978eea275bed3296126262946ca15b19ddb403e1177e4265520ee48a28c0d4a89b40263e4e3757d14d1ea7143957aa64f33ed3b006590a9f2e433f5331d817d3daae20512a37c60a6e18720be0514331da684719da0bfc757436b2b8a3636c09cd0f12c6f00efd37d05c39a5199d961498807b3e2432ca593faf4cade8de84304da483a5f280bd3770c69c84c347556380410525f27db3057008567153d74b6b6c15438fec4c748334bfa9cee836aa738e72a0942cfd3d205b0c772b48966936c60848dd6cf5952d05e3439d9dd9d7cb65caef4603874c4e3f10d9ba61a473286be4ccd2073ae541dd531bcaec788d6809b5eb83d058c363e871033a5cd39d881fafe1a8aa9beedcc54321865b5f851acc0c7079ce7dbdb942c1b82fa09b2dd83a22b3b61256299343661480a855d5e89de201c1f249ec3aa6f3a0b55816df15ae043b18d4ef83f952b2fea0784fe2f84ff3861ac0cb3fd790c8a04c9514c25464ba1427c2f2688ee048adeadce62782684a215573c5366a1a160a909545af1a02647ec2855a1eac707b00c12fd4a2cf8561dae6b3bdf04e89571a7fc29d7005ce5e97b15e8a45a37a1320aa81e1d314d9afbe6b445821a160bf4e5c0a46fba7cddcd0544685de3c084647e2e43138608462eaef0b950733898bee4ac20132172dc36058e9d44e9ff6f6001bdfbd0bbbfb2ab2769cb986ccb2d242af05e4e3671645f1c7349b4dd0fe6bb7dc4873a2cc471e7f3b41346c404648c2b287faab4b096a2bf21ea7bd63b6f141fce1d3bb6b2f3b62a147d61d716fb9ee7e4597c54aab425ed14d02e84bcdf5fe6992621c8db9766b159f36083140c4d9e227bd1e8a772a1ad207f3514249f35d1cfde03ea00868ab2b960557ba8dd4d2d6bbb19eb2c29e887f8cdb968378b12a43f84faaa258d614751b8ff94cffbfde429947b87d6da5b2f52e79b86e570b52fac115cf4a7e056871bd5b0fb9da3cdbc41dedfba013ec66be6a418ff1fd9a6467e9906b9428391af48710df1deb54e420b1686176150818dd6fc8cc880a1610b1922764b25822e962d6ace9c", 0x1000}], 0x3, &(0x7f0000001fc0)=[@rights={{0x18, 0x1, 0x1, [r0, r15]}}, @cred={{0x1c, 0x1, 0x2, {r17, r20, r22}}}, @rights={{0x14, 0x1, 0x1, [r23]}}, @cred={{0x1c, 0x1, 0x2, {r26, r27, r28}}}, @rights={{0x18, 0x1, 0x1, [r29, r2]}}], 0x88, 0x80854}, {&(0x7f0000002080)=@abs={0x0, 0x0, 0x4e20}, 0x6e, &(0x7f0000003380)=[{&(0x7f0000002100)="9e2ac05be1dd751fda906536479752c8e19332f9719af342af3d0732f69583b21b28af2d5e2be66ed07c5fca12c6e33fb6157ccc92b4bd6497187bea6cc3896cff29ed929d8c343ac923e3fb2cc102e7340e06ed6ca05f02921717e8808910d45d4070b5c02cf8ac17f51465535372f055d31c2408b0e4a62a7c6bfb28a3b47b99fa635bad933ea00598467060c380e5e5a0632e2fa9dc201a91131e0468c059af46bf8215c9492a1ecbe883a9fc4a49a1ad9ad4fa636953bf291dc11ea2f989a76355c20754fec9ebc441c2f72ca962892be9ade074e80a5c1cb81eb97b5610aa342f6e2c7cd5c6a1d69b82c47c66d0d92226b1f39ec4db0ac1caa8fbeecaef8229268a99f8825f1253469ac6b4857083445fbd05b5a9b03d2fb930b91e48fef0067dac993eff1c727bca4dd2f8e7e08c24031ad483a7332ddd122ae7f35f181c2d6bfdc6add4d4b14ca6b011ffddf2dc6d530983dd523144eebc1ba731f441c87cbc3276b579dc7b1d37a1104e6da8dc84b90a4e49cbe48d7ea561d7c251ba0fdd78629e246c6ebe6021d74c4c1ab1ff0ad58ff79cf169bcbc8639a289b05f5d2373d44de7e6910e2bb352fd128fafb2d026d54052c16c96834c9e9b1821231dd25f935605c32a9e0d6518c85e3042ac8faafd0139d3d32cba95c4856bedf335d53a78686eb836d6faebee39889a378fc6d0c422f91685a609f2c4bdd80d242b1bba477c0db9e3979d4579bdc6160450676a4e579fdc576ab17ae405a5b79d1c84618a9364581b2152af83028bb545cf3c46e0ea03a0032d75ddbbae18507f83ae80076d867015a20da78e88c389fefebcfb97b0e7962655729b04541b5f7b1c9cc934e7f9fc2dc2aa2403b2f9fad5d4fa762dcd69f8291983502e37930088d08bb2183635b79c61ec48b728ba0108cf8baa0b165c880386394b8e9bd6b91adaed9d731c2bd6ba8c9fb8b3fba471e46e6310e074acea79a9261433db0de6ecef2285e70238fed861abe99ff20d0877f73af767443aabeea60a088dbb7cd9ca3c10eb579040dad96c722af6880550d39498046a22458fd2c7e918f057fae14a7e4e48e68e6c2434518e8c9bc00721afd2c5f0b5aae560780cb45e641bb74fbd67a52a72a25668c81cab737211ae0840c9063242fe7b6eb538d97068fe589b607afeab725cc0c942d9c9f7a13814e92aa1aa6073a532617ad76db5a27d52b30b27254694903247a97a9b0d62b9da8ce3c07b5acee990a93a5c7bdbdd22faf7eadc52a6106ccc866aa4e4d023271e748cadd4a6869bde68e579741730aa87d31e353b8871b8eb303a502de95c8e78c895882ef721506e5c1ba849bb5fe4f0e639612a968796ee886697e1c8248248b6c271a92dd331ce1d8c57070dc06243c818556f9c958bb0a86a4ec8e155dad62ed9d412a0e2f482aa9696f2accc803865aef7086c515208d79efe7b3c1603e6a9941aa52489384fd8bab89d2d27b3e22b3f81315846ba6e10ff8572cc26c24bf9fc4d12a22cab76299482b270f8ddffa23d16047e9bb0b7b145af23c8aaf099902b274ac3ce6c73456f4bcb8db47a463914455cf1dc815f15f8171de673699457037391739e346c8ab15af58012087077a8682205ed3342accb8c0bffdd69d840c627233291130dcfb4df829f7f3c789ef83b2edc130d0cf30af221039ff43485d1da30d338594f1285acec323e77edf4e4325162de1b4c9b1fc5cd4c6e59dec5bb34d75863f08e17a2eae70fffb783d1874e23c26308e96b7e799fbe357a634b98a3ff7bb3f114b42fa39a567c2b93f109c77285bc0eca3c37364fa5a871f11dd41208e9e1fd3d8181c513af1724e9d399b79f8d26c137283a65a13c1f35bc5a227978989c80665cb6098e0088a39c15360d386a336d864f9507ada8f9fe2ed237d51a6fa0e0408a792fc81420a4d2e30e796f31513a90a896fed8664ebc9bf50bda35119cc2e1d821ad7581012ab951bea89e0416f59d35a65dce6791c110b141ae9a640469a2f8e4a5fd74fe350538bac5d2968f51dd4fa97dd724d89325a23fa29ca282466e86ca78a7c481f2a73facf721c5636ba0f88c21ba4feb1804d1b45f8c204c6fc486f89aa0ab6f6950c9a20ddbe7c53077f8bc86ba0a371e2c0f7e5bf4aa5e4270cee5f290d069bc4e8280d32c70339e224e045d8df6e4f4f4297937be93d52b6be5e580f2af8a98572b7efea88f7fd086a318628d37315fdaac4443e572bef5dec47f4172619e63fed4b092150e244d29d0aa7eeae4da5fd275ea48ad1b5eb5171de688b479293263dcc93f426bc1a9b8df88f46bdf17074e67fdb39ef869a1134a60332c001a31e8db763d337ccc0ad2e15e937a9c444d24b69fd14bcaaf8c1e32b859cec64490634ec8452d3515bc1ae7a8086ea86597c530600589a00202974d9b740a8c9e1ecd3ae79c947823e15c669ee75e1a2d1549abb33e6bc0f9d0f5525381a1cd585c90ac39d6657a548e1b901304997d1447a917f0c5406cfad3ff2bd83f263a46afbc244bad3708b76a357bc006f630c49d411f5db1a765c983b0a7fbf190cc6ed2e9d85bcb9a9dae22c68aabb2cd6008695e136056570c800de7298d00728cefb43061fb6705497aa7605d3d1f00a7dc02ae9777af0dc8003902597445d5660f6e50dc3d5dcd692a28f24e53352d5ceb1a4f37eed1282469fe2b39a49ca4820301dae71f9d40c5baa1c94db001704c36d68b0a54efd6d0fc336689eaec930240e0635ac3d73b7e3835dcb4396502c7c472639a24e3b4cd1655469416701c8e4d377bd4aacf36dada92aa2d4b73db59483a13d8151dae313b05b97d1414695f45e7670753514281b596059cb021e9328e690ed15bd43a6ae3f686ff36117897b3198063ddc25bcfbdd722a8a8af63ffcd6c51fcc7e74fba4f25f100f368ca77226cddee177e760ad06a7b3dc8b6407be572a49d38e8ebe60c73a9bf244c5e3cc9593200203b3d1d3cf705a4b0480aa9ab1bc4afbdef12648beb764550cdef6a642a852f6ba3204167228807b6013bba5b0498c913fbf0a294950ed8cf46e5b7f54245ce369761a7f4efa2449c31d3d5e2ddae1e2a040fffba9965498f23620faf34aa3b9d69fdfb1e26031108d4d16e6113564da270f39a345052c33ceedf2bf9284f2dda674f7677ce35cf89814f33959c9f798748c8a07ceddc0a617874f58a30158a16499a7a3c0ee618118eb1adad699d06d99f1cf20ed3c8bef57fe72dc3f2b7d61788094f26fede2e08a4badd2f794ae06966625dd25524be1db33b021d9aa639985b60729bab8c90e85183f88c6b17902d833e70dac6bccebf6a8398d8751fdd749d623f752704bdc3bec97283727023c661a738f03b22dee3d683515967400f5df5f8c9cec067374b46feb408a64ae2e11208eac417ca83f846cdaa8d44dcf395ae989fc55b1fba8b9ca6ed205356a6248ea3e1b4dc1830440ebec38a133fa985304d8aa71af6a26890ca3e125ecc22ebab32fe34207f7757dd3be0ddb2ef93aa6fda1dc3279ea6f96a4aca45495f3eff028bb874a208d96b2d0452357083be16c80d8341463b8d0cd2c4aacc153b6a7aec1997ada297d004a591f18e10c360dd141e5428ea880224f747aca0268cdbbacc561fa56c93f49f24330815aa4df4b09f413df07c827032f90d843d3173bc57468d9b775528a1a451b1c8dff3736be27004f307e0626df0a89d1102e6477bb1af084636fc273ace3c557d8c03d64de52130650f13e4cb8d46d550bdaa6407f7acaf47efc0c15a9f16bd2020e5956161581cd9544055933939c2b31d31e215db8094a4136e1b4406e9d87046535377e162abdfd8ba80c8794fb869df4fc3fc999794d8761d60467058fb2f69978d37c50cec9920bc273679929897e5757b038e9b126fb3d1ff6decde21400d8b1896d560aa80a717e6a40b3f03e630e38eaec226c8c71ca690cbb06ee274df7651d9d378e738bdb1b49fa5d513f305e45e65d1d1af52a47badc5f0032240d4f05466430942cdeeda3b1c76ef58c9a4b524d53d7940bd2bcd87e4e8a6ef97b453bc8a05f1c1c9aa5e6d3a3055ff5f317cf94c0afe6313c7cf9e58ecd8d66003b9bd5f03bbff2e45142b30df891a84f6d6e340b4487f02ba34d1027fc949f3eb64e4fd63571f4bf27c50a9ac220e4a8c3876c2e49fc8f69f110f14fdbcd29b283d0f56b33ec00acc172bde02d05b5be2b7761ad8899a9b1bfb98649ffca011d11f5f20f291616399dd55ac8d6e0d03d5b37a6e49cef7b1b1ea40207d473d25dcc16911b1273bd8cbd28c8a0a93cb429363313c2479415f5cc0472ab3c9028efa6f8c14df10b170e21349f85c7badf4d2ab983d8406761c583d290b7de1b6f1a5f47809d5abef72794321a72f3bce688a342e5369cec1b770f7b4a74a7b428d3928733b9e4bfc8104675a93b6ad51bbadf0bd36761f886f6b412e72dfc1478d6ff5ddd76128528bfd50d1c24f338477879095772b5adaa59bd809ca5412922f2f43cb94e0f586707f3da504fb8c4d87245f213c43f0f397a11b1df4fb5eebed3effa35833e993cfd7027fffbc9aced48170b8c006bb84f706f451fa1b574de85fb9055c3c09eeaaaf00c626ab744d5ebc352756cda1d950235a38f4c24a8e2ee86a15dbc766a84cf1067d7a5940fa5a56bfd7459146cc4e46e6169273e2031195e7da129fd0591919dd89c17a6b33e1ddbd6c26ac74e8278e4359b95157aa168c60e35e4a71a096d98074a29e15799b6621f707a4e81ba24479b10e85517bdbf3a2cb04b3134e69cf569bbfe64e627371c7d736616613192894320a0298213032ffc991ae5e57462020e1d448f2b54c72cd5aaea9107bf707ab15c2c672745967dcf7d8816e28c97fd6f580baaddc36e45319090d20b2b13d06218dabeb2402dae1e9272d05b99df50e554d4afbbd1d69384cad5696fc5b9f755a6cd792fbd18d3fd0bc7c05e9c90c3124318435dc44be43f9b9a4bc0ba9df800246eff46838c3a0328baeecedcbcd7304e517d0951a665f2df97a8f5d485d001a7b372bdb239865168a835250996672c41963cf3ee6c90b01b39c396c7515b24128bd1b7c04003cdd5eb70dd78205e3efe6275f5a7fca06cf2d2d4122528119a0f2eadc3b555dd032a92ee0c0e675d003bba250930f3e25dfef7ef572ab2a16814e89e8dd5ce3fedbb64613d7f52c718d8f85b08df3dcca3c4d97257bb0834a2c5fb5ffe45b41ebd6305a9882f43a285244fe94dbff8e962f60a7432698c0347d40fbfd3b155f588eb75409a2b719979ad83afca6d1f297176046b67425df2381340f92892d12470faed6a922faab7138aaa05c09836223b7fb1757aa84a215fc794316640c888ad7daae2a2c8be78485fed23d7b8d98e5dc767ba1838ee7ea68004402bed31a0ab760e30e5f344add00d71605005d9450261c45084a568db86cdf71b0b79ea0ce673ebc8ae41b75dcd9ec9d0a7a383a2893aa00915efbdd3dd7b131b68d43eadfe19693d58d1459ff94f932e53692143415c4effa2e06cc8b63779ea66228f719387ec0d70f8c89b3d7fcbabcc9ba194f24872a2f3a6538862adfe630c61954bf2986be38bb5430f7edca752e9b4a7c38f27b18753bc76eec37d795796fcfa1599be374f6adf5ef5cf3648e5d70acdd368ef01e6722ca4b4ba19c715c2dd8d0bc29c6bf9efc9546c0f7ca27c4defbfb6df5b9be51a029a6c033ff1d14b5715f59fb396a3f202a5b9796b726204d4960a193e4fa61dc6992081130eaf63f566e810c0a7b", 0x1000}, {&(0x7f0000003100)="9d3d38b3fb0120280b67b70df7df69ffaaa549d76911d78e9d640ca2212fd15688b2e9f1144df576e19a870cfac834c39c7822c8e105433dd96db34197ee5d2b6ee222ef82c7d1f4a217d85c26f11deb15737acb250e08cef72abe99173f94947991a4c646dd8c2b34f9ccd4b82c4d243fcbdc951736c1ca", 0x78}, {&(0x7f0000003180)="dc9502b13f48286d523e40b0912023ec57c7e18a3c6ed0e9d7a7b084f81bafe2205bd95bb09771a8da282989aef481491ad8e7a1d70c71ab7d4c6cba53aab9edd503f55d4e3cd9db274cff5009a30c09c1eb3a4e7fdf721fadc90b1f20e6d19d4f514146db52f8053193f81343088fb9a37c91d8e15ed9d792b46135aca2ef58e8ee9c18f5012ce14c2c90c832ee86e252c0f05b1e9c1e714745842f326f1b158db61ada1470e350e933739539b1", 0xae}, {&(0x7f0000003240)="f9ccb4746c842c2c07795a7d00b974353726531b472177f5065d93db22b6e42fe21a7c", 0x23}, {&(0x7f0000003280)="e266f2419aecfe5a78bc6a862568c8154b90d1256b9d1f1e4704a16196224ce5701577fd7b2cf99c37885f9c47c20018b7799f916ffcf38aa2af6df4fd8f7d20da9e09cc849a7002b9802c55f5e33c02ca1cbcdd42982d3073d11b8ae0283cfae946808a5180c82d0009f2e8732b8be46d653a1626d3a3ce4117043e5a96d466b8c1571319a4c9cd93c8f9a78f7f77cc3d94db64569c58d94db6c58c09b4c78ad09bab03c7b59ca3722e992986c83d523d66f0250d13e230df774f10676441a3c953a95a6998ee174ca1f1bc85a1df93e8990c24802a9f", 0xd7}], 0x5, 0x0, 0x0, 0x20000044}, {&(0x7f0000003400)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f00000058c0)=[{&(0x7f0000003480)="ba1e949e6e97148fe524595161ec45b3015d2ec15f64229219814e8add681269a653b667709bd485d00e12edb5a2a8b309012cc0683373b71ed436d785636c745dc681a831509360e33b23e1997fe3cf496aa6cb399dca1f6c719f0f5c65dac127b2495ee0714a400a57b6ceef2ac5ac3ac3ecc98a11af1f59b9e0c02f230cb686799501b8363f0cb3f66779849cfbe01ecb52aad619b67ea3be41b9f70208a439c7b6245baa84e4fe4f61a3e4455f5d714b3afaa98f213da0266f64f9c435b1bc37e6be4b153b019339e8cf8ad2aa79b8cccf05e36cac5fa33d1cca1652f9630da5f8d838dc403c6414ff41b2a52c4467fc3db4261624329779dad67567122ded844c500a5c3cfb55e9e394f0b4820065aa767d8c0baf0a911206a67ef2b477a18740818150bf402e38f396cf629744d9c168441e8b76e8f5b35efb212937e2645e614fba35e7e723a30063deffbee975163ab6e057a4afa704b218e7f612bff2ff4ed5ae531a0f36435306019e00c6bf812b05c96697b30820a3469f159662cc580af16aeca8d26c3f2af6382d9e39b022b01d61557d010dcbaee019160bf8d4a96d0118cb1645fbc398e0c2c386a2143b813651b0a0682001197d60c287f88ba2bf0c16346f49799b0fb5e48415b57ae937efb03388668c77a74e09a0f97e1c860de70a22c742340af5de222a6c9e2cda39c1d2df6cbfb33152931c16fcc99c4049f47ab21fd9f9214a7582782ec8c991f67ae933e20438a7274a8415c295e3968aeecc9d73144b34db594fd85b4d66b9d4e2733ed56120c2218da3f3e2c2e43d953d2275d0f6be9a95cdf90a0e2c7512ec2cb3d42cf7f226de53af32c3790709b4a94ef4e789d4015613042daa131d21c0ad3ad0e6349085ce316f1307a61a76e99ca19deb67c11a0d58e948c89f64f8197324dda3c6a6a216b05aa4a1fc0031cbe26ef4b6613d30ad4760fde554627a75a69fe2ea83b69bd3f5469c84ad555e9a61a89bf1abc0d6cf09a8256fc1bb776c4a1dc654c9035a5c3ed9f13a9c2f0feaf025ef403b5cf3f12cea058118496f31e401c0a06b0175c3ece02acfa565e3fe946b57c36a0e15d436d97c746e15d73af3849cf0c0ff68864339b72aebffaf4f428f2534763e2177b11c2f8e7a62b39c6d5a79fc165168fff2ac493c68f25e910cbeb37a3a751f03d333d03749be22f2bb5347a8676f98700b340c37fcb1c162f688efd081e0d6bbce07323329237e8741b5fdfe789bdaa8d506b9a44c9b5da242fefa11156c841b9d930758e06782ba07281786e11a20162f81212b2dfdc547d4a90cc5c76aa705f4af198d16123be8ab3913a45d66ef48943e72bcd754b05024fab9f221c609a2d4934663442f816363c73f4ef9cb631d6f1e3e883b1ac668d736c698c0082d51946c782beabee02d4b46a3f14d070bd40b42f5fd55c1b77149af18059b2e995685b067cde3e1e71a4f450bbfe36b289235f96075ff10d4e45027f4e5695b0e1e6bc84f6da4d4369f0075188bc1ede56f805116adab016f9ba68f22bc30214746211c18e769432c1f64eb2a722e6bc7b320ea2f99d48a07166d6e7220a189b90ef28463d4018da83c4c2a6bf3092908203fe4cac817bfad6c54de28124aac7734f8ae61060b056f3f1580d35b32d88e12bf9175c93d1efdbfdd7df80d447bb0ed103a8f4ea03feaf2fba9d503b7ee48fab52773929520c7e5369f219c785fbd034dc1e886daf8155e8af4e0ee83a6943a11e89bed7dba181d0400b2a70f14d9bb07b8e7deec33333a8db5d98c3e631eddab380e742b1c89c29c40fc042e7eb4523408284a60d0375d102c9a9bbb36018e9c22351522427b48c2eb36b67fba3b323b5b692230777d1e01167cbde9c3b84df75d03eb9db3bf27c4efb654e8b4df125a85d32ff61a32549c662f8dbda6e434274cebbe4d4c42c08bbbae95814340fe8c9d5e9daeacc4fb9a095f32200a10fd47aaae4ed3b1ddeacc715fe2322aa0b93d6e72442acb5c1ac7cdda3f63b3ab69e041eacaf969967cfec8fa0dd151dc61458fc9bf875f11b9132526607ddcebbb211c728cff62a2e07bea7957e48ea91702e85b9cb513a7089a349e99385207920906663522379b575c8506f55a07c232cd18417b5500751f451b8693c2302b083d28e314dcb27b07e3997aa1f7e669138dc4c62486660434fcafe55a6a1ec74991a7c5ff9e10205b57ca1ebb61c5d8d621e3857944a4a5df0f023a3082e3d7aa5079e3a43cf7e05454c8ae3cc516144cb97088eda97de10b6d68e1045cf388ea544f8328f1ae8b7c03b46ccbbc57fc69e58e19cfa034669206967a9200a9d575f8ed125eae839015238fefc88e2e297bc5971753230a50dd60e5fd20cf179a210b541c1e46996602aae98a0b60abfacd86f929530e2589fb67293b28799905fc4c74299d498f767e288546c7e937eade3f85f0731aa79fef0be7de8281edaee9fbccb0735c6280fbe7c346e946b087ff406b0c723a9177b1d730e138cee81981c443e17e9a53bf529d3e29ca0f721d3c43cd768354c6a477b0b89d328f3fe11e3a01565b454e4b3ad41d4c5db92721140b7a2e9ff8b36fab5038b8a161f600eabfbcd003345cc1a9dfc2a949455b9ede633858d0d870316d092e54eda0e4f4c085c7e4b40a333f7d4c696c0f821146bdf27c9ae3f8280b9ca89e502801bde6998c1aa33c111c7d297d3c4dfa4c3bdc10d0611043d52ba2922c9f4cd88b467b21d9c882b407e23115cd1639e6d5af29f4a7de83133879ee0269da7748b244df211971b876a050e614b616bebc6bb997929aaa12d84a0e8a118887b866d2f9343289eed3c425f7916b616ac910ad21a6ec586e11da3eb87d47c9c102aa9cf21a67412b3605dbd10e767ad23eb28aaa4a5e118d0269deab0cd278c39ea6a7fb2e3f58b55976e6f7a71f612a0f82c03957e306969d0c6eed56e66e73b785b0c1ba2b1a72af50d7940bcb31562e13a92329cd0200382503aa7c07c566566b7a7164db06464c34825477140783d04cd309f782854bec6a1a0e683b2c31c3d72e495ad764b77c38f419836367c75ab2edda94077d1294e7e0b6fb8d2cb76dcfdd24e62d8ab4064c3ab57ff75adbdc12efa093349161b62c32e8ee9e7eae1a95d95e997e442a0674c1c4f5f2b7d5a5339fafaec4b0334158ab07e2ecab31a9be65412e907fac08c05bda23aea077504794fb75fac9a042f6ce76d5f1505f8b99284843b140748c5774a4ba273154cd635597c0a0616a7f442a65cc759fb5fbb74c8fa796d33a2b4cf8542a3558be8b87de92d96ec44928731d85e7b3063fac906f6f2252b0b709f96eefe93da9b55cfd3537c1fb9627e4e9e24f45e3fb128ffcfcc2a5ed11e47fd378c3fc1a45ee3166de97ada7a87dcaa1fb27cb28cda5b5608bb4273283dca632b966483d59788f7dff505d6651925775ec63c4d39c2068bba9edc454c44d15c844a260db4fd501b32a7c024a65e384debd6c238926afc97cf6e46018fc7515c06072663a08eabe9ca71f1b8cfbde0eff9ccd609e9008fda7f185483bdf5470527428306029f82cf5fa4252fff18fefdeecfe6c504dec50db8e101d4ec34c554ad9ff8ca2088a456048523dea90c387c4d163a72302a89c7fa835b8da1219e11f941079838c5d716770e4214141e513755a8365b2bd11245e8113c4625c970d4e6baff1481ecf505ab2165b7ac1c29247b1eb36b3ffac5ff9f04f9f0226cc2dc0baf0c5bfb639c41aa64621b67b144d5d7e859674dee395d9610cd6055c01f3b099a3472d52dc287699e2982ec821e8151f104cb7b010fd403eb97b78d901e32e09f72ff52aca3312dfd2bbc754fd731873c0a92541a6417b248f570990b218073335802a0cf6fb9d85ed67e664e8e030cfc8ae926ccbc2ece602f78044781703182030c766eabaea82868dc64d733c51096fb55d1796c70a19e16fddb3f7dc2a936cf5c72b29fe3f7c2144aeb079788733c79e0a5122201ebee2d0811497384988c6555ff9a8dc3c2f57fa690d53718c2777fd24b4351cd7a99f74a1ed4aa66f507e31052a0d59b95af70d8d039f8edcc440a141a7a96978a2f5c89bef4d1a07ec6c136807cd0fb490b0f0016da511572587656574b1f111a94dddf4f1a66046b2a9bbef33696b736b3a7a9b4f8575113680564e6dff6d98e5bb3549e6d21b5704094ef56c0d0d3378ffb4129fbdeac57d4fdb2b08b9c630d485c0ccacd4d0ecdc6fdaee14730c2013d13700875a54132eff5d4dd0c2568752ad20eac20b1b99961805070bfc49c13d446849139bed0366ddf4cce8cfa663d847da5213623c80f3694a0532194af2861c2bd4c138d69996b7f51b76f4a5f524dd3a4123c63ad8fa9902a7f50fbfc73eda6ecc602397d516e965e567f74fcdc27792d9bd7ea5e6b457d7261de12a1719fc9e6530dc28936dbcce7ef27ae9e7c97746d0da59e968dc51e3a9ccec0ab1cae0df585f7612eb6a93901610a44db8ea498b021a4ec5a6689f0af2c3e51961f5cb8e1eda051cbbc9185c790057c8ed862f9dd7335cd4e0c127c8741ebd5920ae4036f60b7819cc433bbc4da2cc07fe831702dadfcd7ea5b5420e9165cdd36d77f63c3be1fa324f7272e4b8d2aa4c6d2cead794027b0bedb7752cb02af838f06aeadce90cab203aa9e3cfb617083c877ab9bc424af6c9f7fb96d31e971ce18635930f2f50877baf409d8f8cab74956e82de25bc87d93f09ce16e1021171912be38bc39e2a04f609a1a82b6e72b7fca5c9355ab3447726b0f546b1cbd021e2d254503ddf4df9cfaf5569b5efbde4eb44f988d9515c0d07bc006283faa8f1b966090e25f64a53e11d2f7a5b34ccec0bc8939b61f4f097bf9bb1bff28abeede07c0fe4b298568cdaec1d66c4bf27e0bdc200696d7c6881746c39fa1d8686591022e494bda076c13998206269701e8735fc1677db25442580063956a3c41bb18098af73196f80f124a42c1ba7834256de7dbb54eb2ee24140e4f92e6117223e1eb7a8a785261a778c416d0dc399af98901eab9f34c2bb27022544f7d93cc3253cb4872fcc5cff34bc4646d6c1dcd85e4cb50bf660bb032174571f1b8ca300b894a83fb9dfad17dbed6d092c64b1c568f8e3d8037686a9459e8d21a6af376bbc7839ea327e6e4f317b8d8de913999a7684ba192ea251428979c318a06ee80807d77160245d9a8a32a69d73f57dfaee4de6dd43434f49bc852cdbb6322250448cb449a30267c218876cd58417a559810ebba3f4a1be7017fc728f44f58ce1a052f7d6be9fce9e599014e229087810007041d9992a6597fa602915ea040c355c283800dcf6d03b9c5610ea99c96db468686a6be23a7633bd45978d43360d6b695bb7d3494a73c533fefd09fc55a7626fea2ba5e7467eb883ee584d683682e15609b93f5ee1963f3bd5f4456101457b09cb23bfcc890aab297eda7189556726a9accbc3ac483141b53570e6c904d45e4e4c26c192164de12822c8a4e335dc8faafe5862ceb5ec8231ca804770f15cc63fa743f3f3a674c964182977246107aab57bfdba4e295df3d9bd39ba60a82d1a5c9d76594f86e1e474c93c75b454f88f6b8079c96906e27a4eb28ecd83e2a1940740327e7ffdb6ab3a3e37621c36e3757b63e00ff332810b69e7abc8f9f9e44ac68b96f05e98f12bab604c1444ad022001b9d64ae7bf21afeadb7d59904538d92268f1cc9b3eeac0d25bf1c2a98b532ba149e4794f94d3ccc09831b4f308f5354b261eb83cb6c6db47a86b3703", 0x1000}, {&(0x7f0000004480)="bc7f0c1039a5e6f57abc8779b0d2a6a0688c05cfb63a07db65bbdb2d9c04c5602d8a63d232e5f98a9d4e22068d31d9aa7c8729871797761383f61a69142b1bf79c6c04cf68183d6759b56435b2a6cf8c273a1c04020277a8a934f0c43f492e20eb7c5bcb22bf0374fe205f704de53de008023109b1aee460144d1459d6ec4c2dd3f146b5122e33f8bf613745a11806bdf7646452ccdf8d8cbfec3fb07432190c51807a1cb0fe6b05ddb6ccc54b30d07eec001dfa3d9583c395e2aac46968e1ed529dfcf715bc337b5e52fdc00ac2a7f16ee7971a8d3709dd3416b6348bb2967c65d7b294cf020003483f3176da4ee5d5395cecd91a0d05eac8332775aa80ea958742fcdc570b54206c5b8a943f7c2adb9ffd59a63a9e3ce156a4d1717dbd0703c9a18ce1c58675a33175a575f709b92ec997f5450da819b7d034dc663d9b9c4206345a73d18a5da91280ff17bebc8d8ae1c811ec15e6d1c056b102cd6b35882695e0797be69942b37e9e7951c685c438eb0e3b28552c6b2df2d892e8c5b50ce78cd4c5dd51e2f09a968434de5daa4b9a7af9b2d9cc60105c1b87061a7b7ea8b0bc50c73207b962be564034afa2d1f859b395736dc325c7d01d072df02753da86fae9bb6b239a885d80cf9d0b6c96823e8bc8f74c7df6a0a7449ac7b21503511372e7b0012170b15790c3e439162c479dbd9755319285ae3b427fa14eadbdc460381a6bdf0b9c196ed273fb216f8fcab0211d335b7548360080b970ce41429c2c95754841655b4e27bcd4fd61b6b5962a6bba6d2720b04748ff23384f004b355a78ae1044dae075d94f01e9cf6e33d0e76924ec972a9866a4517db803329aea490aeed84a91fcdc4b7cdd2bb39f12d5f1b29ab030b6ed74a76f5acb16568be6f2c24ee16d0e4eb7087c15df201a9f5f896eb55bdd75c7f67391b1ee490978a1e8067ec81bf109c86a117fbdb9c14a0acfebd854ca357f620bf3470573f9d1f1e3d50f60952cc699c6f17d777ad66534e3882bf26c1a08fb9caa952873f8b8c3562fd17d097bb1ef5f097be069cb1bc14978d63a7de0aefc7143d074586b2f38981e37b40630fe8a8bf10e45ed7e7d3bb0605515a9758f5fae517c376489507c1d4e1d154917a8c494527e797b91e9330b132d90d6786f39823e720889134d32fc011d4e3c2a21b38f87309a129ee6206fb765872b52dfcb3d0c7777935058c8572a660144a37eb8d300db12f77f5c758947649513e9cddd32f04d4ea870a7159e923e7c75b62c90a61c15cfc2200fbaaf89b794ef162706873c587b1cbbb6e165bdc9292d68d27009f490c8ad05960383b0176bde01c2c91e1c144d29ee4970a0b065543a637732e0aa6d99cbf9be09ddf21037b6c298f48c9e84663c30e24cc0b74d09434e0aa39121de74851e43523d50e2aa4a6a8c0e0ae710965be773cc7d9a3f094137426d53b1778017296489ec2d91a5772bf8cfa8931eff6c41590335991bc13843feece07dee87a4fb0c8e08e5456a9340b850082f1a308e7ee3fca5f3c42eb1462ac6c94622ab1eb65aeaef94564fe1c1d85cf50f297f47d062465889234593c86b4d9db10898e6221b09ea755ec1768dd97f398c70aa53391c880bff8fa6fb6f37f59906eeaf055e07d1815900669c26fe748fca5564d00e566a325e9afc6ecf8b0155882528e94f8c9d4b8aaa6153c5ce77c287ac93fa47efe00e728962fcdadd0e45fb47c8ec3cc33b233a60950a28d81ea23a7583f057dfb0cb2cd47e460579a070a17da480dc8f6cba76132a7f0a457d344210277dfec02c58bc19fd9c5332f61f89a5c957a6f243b856ee093ec0994e609ab6eb79e81a485efc8d27d23ec5bec0250a99d5d1753c8b618c87db413e9b9776a562805cbe62beda634fe6452f1759840f83fcaa3f2c747b2d410f5f429b0a9abb7a174eeff20927485c7fdf4c644d045416fdc40c13a7ae9fccba2227199e1ae96d21379f3858078ba7d91f516ed1b806ec3b3c6d279c388f651e6aa8ba330b0e77c2529003d29fa83d91bdda8dfcc0646703b62ec52197e6c64e4d9bc90ecc00b9784218e3c8b18bef04d27ea1779d99a41357bd792773079c4ccab710fe934aef39935162cd62b7d64c36b87f3bb70a38a4ff118f3a83c0c4956d0b00ddc81c9a6036bdf529849f4092517b4e72c50bbe2c140144dd7027f7ff5f1d501233d6cfb7a11792f31daa296db5f37af8cd3481e437f2f83a6f3444ea6a32525c458b47c9b81e35f4d96bcfd6e5e5d0bd75ea2a80c3aefcb2a085adb9725339ff691a6b6b6f77bdc6b4856e7852cd954c811ad2a47bd7db209accbf8877aff4f76c03c05757c841acc370d810b90f08978da18d682dc5a71d9d721ee8916f5a9eece9946a1e39131b606740ab4930720156b72d2d1d3d809829ee89ff6a1acf9c253fac3865fd864f45dc798eb99b387b1665e7dc934c02592673027ddd51b82ee848eddd2fe0c878b619020b83bf5016ec42504e4065d3bbcec854fc4aab4749901cda46fa6944edd47f2e93206e608903f106eaecd4097fd4e5f20661c83dd51e5905051cf510b666d323d1dd6d634b59fbc30b7bdc3acd54b2b55146d495b56e5124d8c3e8be240fed7a49630ba2f3dae90b235924d8ab0704eada1c631a13cd9d682941f007b9cc9d2101eb6872c3a53271125eb22f13b5bdc32f12a02e30036d93bbbfc336d7adc29ffe4d356f190205d992cd9354a3384a4b194f55a67e3def22ea2790838280ed586318a9c9dead6fe53faa4bad8e48a276a0ede43a0cbcd0ce7c1d1046a7e0856d694bcf67d4f13b3d714479a435ee12979bb6d33a526584861e7bcca40ae4ce4d21ce4c237034d4842a4b567c01081c386cb43ef35c256405a2df443772630b5912d6d8a708aef81f9074c08bdbd39bcd7c2eea7d2d8abc694903d09cbb0bc4e9c5840340db6fc36c5dc3961c83bd031fee88ed6cf6964934575cdda99c852bffec09c60f4dbfa6f623ea532242e4d382e75464e86b10744942e14f4e5d4b48973c556ad6df1e8bca7c2a85cd78e1c39c801e3b7aa69a74ea1229f0a64dbede2b79228d99fc648452cbaeb7fea50bf2ac0a309f92b4a549cf92b003882d0f082131ff1f121c686870e599234324072ea6cab651a932f919db55b667126214b71bc86e8331bc278e754954f830e174a00de5183fc7d4d8b2939439862567a5c62251aabe6bc7f4f3ecb4e323e9427d02b6de9029ea0f5ac93fa2635e71dd6849c7819d273f4913539222e05fdc6160ec0ac42ca675cc475a30858dfb10d1b84d298718676693927198fd950529c32e0d41c7173d3128245ca19b3d8c0ed39cc00ea3add9045939e69775bc30987865d9284997510f9f699aedf18d2e40f7c11367a356b5eeeb5c175f3617eacf23423e4ef8059340f5382491e7713b3c344b05947aee8187d4a25e7f65ee64befb007430724db843074d885d16b36cdb0d93853b1015d3936c9eb16c28b789af8f32f9e23d951932e0b9d091b1d6a0dd0fc1292f923329154e656a2b3907e67bc720d7e62d699cb3342abb49340d8bd0dea4139e5b1a8859c9d9b24461288e295eb2f0e071a6513ca8b616dd134567a56a2fd566ce885907987f3f08e9ee11edba7fdfe9b566d834fb1ae1d0af322707bde6ce565593947a660885cc74fe3230fee350e8df5b52bacb18199014ca3a100e927b2f0f133aad66fda886ecf2ba8d16efd42cc3e1a0352abd3e8977baf4a2fc83bfecfe213f59be97882a62b1190a14928f90968ed3e379a7c6606206b4a5dae72b03d3fc456fb0b8a481557d8ebefa376bf31d675a781d1dd7b5dc4298014326ff603a385c0502ae44ac4769d6afc0e1166d9075fd3ea4e1e8f44d7806e7fad7c93638a86bf9506c844dbc37a319bed25eaa4ecdadd0b0c2507d552aae343aa64b5009bb039818b97c86f7eb0b30dcd0511dcefbac3dff12a944f564b0bc3867d422e091b96da51127fc7637888bad98d6a01c20318c00b25a94bf51007301719aa7583898945b898f2b24a862097b5df4b36e955a6853189c1905fa249ad5c505a2939ec619aebe05ce7437b37c8d11485ac038fe4a072f3c4bea4a6497f65fb656caea20ea487d4f6069d6965502e98d8318a5960ca119c80db85dc1eac361bc16a8fef46776ea40c4f6683077d4e828f31a102e6e930c593fbfe18c615bba450ea0f66cb4b104b54d720cdb10661d4e48f88c48fc6e9d9c353a76aacd70d449b9c34664e89bbb401e0b384729293826c23bcbe8613175fd6cbff773d765c367d898cf5582720e42b56cbae9a934aed7bd9ec1fe0be6a017923a64c719c4620c6132a28e19dbb07fd2fc7f1340ee324911b8f9c4992775a2d9d21714974dd6c868d3463680f26bdd949ca6cdc893d857c811f4ecccbe16d3c338af7840ad8ffc50cdf7ef2342055dfd419424824dc6a67749e5da6fd0c59b1813dbdd1eac637717e31a4096c947382639fc381e17d5496cbca21e1c042a4efe9291dd543cd13fe217ad20fc1526e53c0ceb8dc0cd144a9c72fab8bf7f8f7b558e30783e095018380655be946b3b934632796fa25030e709ef412b9671ef8d2c0767aed89426094d6a37e60694f7c7fee65380be600065df489729dd90611ca324bfdd2211553cf9be803b9919d6f653e94db66d0ed0b68440f347729f4ac41ef805bb2ccf330f11f6fac701b92b4d5ffb111388fbdacf9cd730e032fac4a4cc4a02660d17b76881b924f31505acc35e107630d36aac8116368116e64342e933bf4ada076fdf296183148d04863b9dcbaf44e05510feadcb4b7a34ee36ec495262f2505de921e8860902528080f7c112509b678bb78203943814a7414824dcf8783a70398fb17ca1a5543679a6935573a6f59a59b23184ae7871167315b140eb3730856386d3b6de3a3814667e845def8d42ac065052abd871049fc6c4a7867e90961165020786b1f3102b7414c050f7039ebdb1c121aa22f2004487205c04805ba83e43201d170edd3cfe9fc8d126120b5437b20a3a485709ecefcea57216b63475ae122854df577baca7f9775598362ad31622491d7c079d3ef6369e556087d5a5df845d449493e23c187ced3be2b004912c8f463e7aa44da285248a03188256844e9696d1851ae68b0389f585f855eda8f40fb6469dc723811f74a59ecdd82f775da5b71c60e06dd993109fb5be46d175323e903332a080cd9b7af522d094296533b4627febd7da6f9599ad26b8789f45030412e77a8e969121f59079578e231f3548e8ae8152a56795597872af817f5cb3d2292c4bffc315a8e42c199d71ca6a605869c86a8ef2b29b680dfdcdc07ac9b4293b4c734353112c2f9e62bfe288e1f2f9820104c1cf13fd59ae0599106be9680c576aba890996fc7d2f4326b4428493400223724fadc8815a0939b9482fa418ff420f5dcf99a64219e804829f9ed9acaa48526ae63f83448b2d655347db55643f84c224dc2a0c19a9dd0ade076fe2b43ee583373825883b9efb805601cf0df15d674d56c50e2efea3d3b9a3f05ba8d4c343c55793c2ea82d89ff3fdc8e943ff587f87b938104e0c8dd44482084938834af6f9b5ecc473e2a126b981e10b5a389e61e3962158f156d8dc965977c37a4d72e33c48fda22496a8302d4407d2037446469579ccccd955cc45c2c41174cfb99cf312b35401169528dcee2cee0d32f617db6d5ca3a399f3e38de9f546faea0244dbb8ee18978a8bd2c3f4d566d8223aa42b07af7c32e587120beef0d141f14ceedf", 0x1000}, {&(0x7f0000005480)="c11dfc7a028d32b3f6ef8be393adfbe4544c8e450190b749de41091b06c9c051dfc41b57da39fb863e5b8b6dccf2745de7840a65e832e6afef1a99845d9bd0011929ace27a031cea5ba694bf782edb41251457e11111368b777e1f19b246a5d172b52775f86cf0cec471cb1ee1c0cdf4d1b920202e007bd26ec8c75d9d141b9c7429cafac9b7f4869a75c8ca88709d038f4a986ca53e3bd86559f0ce6fe6fd7cad5b7a4b5dd4ec471fb78903b980046b7fc1983b46fe06747e30a92c63a776e6a65feaf58103099687a60e49d026b334219d908b4bad83555340e75897c64437123833a10a4562958bfeee152c554685aab9801c", 0xf4}, {&(0x7f0000005580)="f8850e6a2353ac5955e4c83f0084bb70702df4c4751b2a0e0d0a69022994a0fefd1e5747f5abfe3ced96efb59c42cf503213936b44677a0c14630cf4bab9991c836730550e6ed0b44471e5ddb96a814352985826f1ef1724d99715a7db26a1b85e6eefe796e2eb7d8809a66e611aca59662f8f7d62290f153e78b4cf107a7b0b8ea770", 0x83}, {&(0x7f0000005640)="4ba70d7816444e8682475728d2084c1fc1f046a88ed2a804a7be63684eb4ad4dbfa9c38ccbe893edfc400ae557b6581cc5ac0baaabff4e0501c447f0f47acdc91014c656019a382e43c7efb87e8929b41ddf8635b2edbe39030c52cf0af00543861378a8033fb644cd8f8eb08bde483b2d", 0x71}, {&(0x7f00000056c0)="69100f3863bd250fd870d2517552e8a94061b14a912356fcfa54b1b9cc79252f3a9484c349cce440", 0x28}, {&(0x7f0000005700)="88ce7e0f239f92df17c08e0b2f146f236208a1df878ad3428638154b1d16d746fc5593a39feedfb8af8f00f4a6a1d580151e4de72af8f7e8a75b538443e54605ff380ce6f79490a9695954af4df9d27a44ddcfd1d497eb70f1d21438a839aa842bea61f503930ca949750149e933dde706e6a98e91837b2c806d323771c15665e7f0c3096f55714dab20911a0afd0d2cdb2800ced7e3acf9a42487b7880570689ec1971ec1d221f8baf5cf88b8bb125c8d9705e67f7722c9", 0xb8}, {&(0x7f00000057c0)="35b780db263dcfb953b0ffacb6762d8aa7c897d579", 0x15}, {&(0x7f0000005800)="a2c2406fe4f57fa5f4e8a15a4e2f38a995f9a3b46ee424abdcdd99dc295356e1d1a9427ba7af5006a287a527b8592fb31f85192f1688cce0548a4e3161de3b039fadb32add8c9a16e14c166c07e9a740b417ba2bdd88e9cda1490b2b039b42da3d5c1f0a2bd43287850211c5282d6e7331af69f87ca417cc8078075b62300d451650f9be2549675672", 0x89}], 0x9, &(0x7f00000059c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [r3, r31, r33, r35]}}], 0x38, 0x8072ae65ee052c36}, {&(0x7f0000005a00)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000005b80)=[{&(0x7f0000005a80)="0e68adbb0cca69726a43c11dc8502271e260017e6fe457f69c4372d874b19280dc0b352bc8c4d3db8acd16be6d2155d3d5e41c819efc726d2ea6cc3067566ee2a42fc82206813c12a30f37b571291b29e6ffd724e43479ac086b8891adda41e96e600cf9e37094c2de33a326dbf17487faae4a627d58c253a3ce3289b74659b8e9ce5c5439d15991bdae0c74cf79d2b7f676c3e01d1bdc6d3915993a3988bdba17c9a74f6e9876d4b2d2a289ac59343f3cf65312441044c5c044f204dcb7eff7d0818c92590c7e7cd85813290d31711bd9f9e6b1958098d6b99a1de871a13aa54d5697fc569a", 0xe6}], 0x1, &(0x7f0000005dc0)=ANY=[@ANYBLOB="28000000000000000100000001000000", @ANYRES32=r38, @ANYRES32, @ANYRES32=r2, @ANYRES32=r39, @ANYRES32=r2, @ANYRES32=r41, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=r43, @ANYRES32=r45, @ANYRES32=r48, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r49, @ANYRES32=0xee00, @ANYRES32=r50, @ANYBLOB="0000000024000000000000000100000001000000", @ANYRES32=r0, @ANYRES32=r51, @ANYRES32, @ANYRES32=r52, @ANYRES32=r0, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r54, @ANYRES32=r56, @ANYRES32=r58, @ANYBLOB="000000001c000000000000000100000002000000", @ANYRES32=r59, @ANYRES32=r61, @ANYRES32=r62, @ANYBLOB="0000000070090000000000000100070000000000", @ANYRES32=r2, @ANYRES32=r63, @ANYBLOB="18000000000000000100000001000000", @ANYRES32, @ANYRES32=r65], 0x100, 0x80081}], 0x6, 0x8000001) r67 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/as\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00', 0x0, 0x0) ioctl$TIOCSETD(r67, 0x5423, &(0x7f0000000040)=0x4) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) [ 3301.418117] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3301.453626] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:23:28 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xfffff000}}}, 0xb8}}, 0x0) [ 3301.526850] Bluetooth: hci0: Frame reassembly failed (-84) 03:23:28 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x5000000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3301.575719] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:23:28 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xffffff7f}}}, 0xb8}}, 0x0) 03:23:28 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f0000000180)={0x5, &(0x7f0000000140)=[{}, {}, {0x0}, {}, {}]}) ioctl$DRM_IOCTL_GET_SAREA_CTX(r1, 0xc010641d, &(0x7f0000000200)={r2, &(0x7f00000001c0)=""/22}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) lremovexattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)=@known='security.apparmor\x00') write$binfmt_misc(r0, &(0x7f0000000240)={'syz0', "94184b02027d5936dc31b4f8dc788c99ad84449d876b96cf99214e41d3cad870831e80fd9b6d3d585e3085a13dbe76c76caa7e535ca53205972aee853933dab5939cffb5dc51f69fb74d4066092a74372b62c9a55549e8b7f0c2eb5b8eaa114ae3f8480dedaa99060e01c8d8ea38a0eb189d9be92856558d71c8a26c1ad9263c383c2fd83a7aece573670cb9d9b4cfc1df05b57731439e99ed114a002fb8be3e376f8b920f9306333e9b9599713ca1e6dc02df67b048d5b5c39edb28196f5333a0821b7ce4bca24c91f76360f5f1f5"}, 0xd3) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:23:28 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0xffffffe4) [ 3301.670933] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3301.720492] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:23:29 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x53d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3301.774587] hfs: dir_umask requires a value [ 3301.807141] hfs: unable to parse mount options [ 3301.850509] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3303.538961] Bluetooth: hci0: command 0x1003 tx timeout [ 3303.544432] Bluetooth: hci0: sending frame failed (-49) [ 3305.618975] Bluetooth: hci0: command 0x1001 tx timeout [ 3305.624381] Bluetooth: hci0: sending frame failed (-49) [ 3307.698974] Bluetooth: hci0: command 0x1009 tx timeout 03:23:38 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000180), 0x8000, 0x0) ioctl$GIO_UNIMAP(r1, 0x4b66, &(0x7f0000000100)={0x1, &(0x7f0000000080)=[{}]}) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:23:38 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xffffff9e}}}, 0xb8}}, 0x0) 03:23:38 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1000000000) 03:23:38 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000000)={0xffffffffffffffff}, 0x102, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r2, &(0x7f0000000140)={0x4, 0x8, 0xfa00, {r3, 0x69}}, 0x10) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:23:38 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x6000000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:23:38 executing program 4: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x40200, 0x0) ioctl$USBDEVFS_CLAIM_PORT(r0, 0x80045518, &(0x7f0000000080)=0x7) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) ioctl$HDIO_GETGEO(r0, 0x301, &(0x7f0000000280)) r3 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-monitor\x00', 0x80, 0x0) ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000140)=r3) ioctl$TIOCSETD(r1, 0x400455cb, 0x0) ioctl$PIO_UNISCRNMAP(r1, 0x4b6a, &(0x7f0000000180)="0f4416d9862ea327376f4ec216a76cb1242de7e8b1d7ac62a9a95e9f282eb219d7c6fc6e53498d141de3a282585b646e889a42c594c2e0d4fee7a209f66c226a37d2e0474b133b7ef3172e86cde606c1a9116341aeb1c33abd4cd01318bb557004f93a295e46e4d2c0ca5534a0a074430b352f3816ad9b400261f65a367fa7ddf85bf18f2d2e37c675dfdc3cc16a61a45771bcfcc61db579321362d440cc50a80128d45dcfbb5ee3d0a9576a1762e647c52b9b03da0d6906c57030d669d175d152477718cd03b8a44a04ef00cbdb116703130d33c8705eae16") [ 3311.668792] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3311.671820] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3311.695695] Bluetooth: hci0: Frame reassembly failed (-84) [ 3311.708356] Bluetooth: hci1: Frame reassembly failed (-84) 03:23:39 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xfffffff0}}}, 0xb8}}, 0x0) [ 3311.714438] Bluetooth: hci1: Frame reassembly failed (-84) 03:23:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x63d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3311.761874] hfs: dir_umask requires a value [ 3311.766241] hfs: unable to parse mount options [ 3311.797348] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:23:39 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x40030000000000}}}, 0xb8}}, 0x0) [ 3311.856418] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3311.885770] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:23:39 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xf0ffffffffffff}}}, 0xb8}}, 0x0) 03:23:39 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x7000000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3311.988800] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3312.005322] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:23:39 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x100000000000000}}}, 0xb8}}, 0x0) [ 3312.096671] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3313.698908] Bluetooth: hci0: command 0x1003 tx timeout [ 3313.704373] Bluetooth: hci0: sending frame failed (-49) [ 3313.779115] Bluetooth: hci2: command 0x1003 tx timeout [ 3313.779132] Bluetooth: hci1: command 0x1003 tx timeout [ 3313.784687] Bluetooth: hci2: sending frame failed (-49) [ 3313.799021] Bluetooth: hci1: sending frame failed (-49) [ 3315.778955] Bluetooth: hci0: command 0x1001 tx timeout [ 3315.784366] Bluetooth: hci0: sending frame failed (-49) [ 3315.859170] Bluetooth: hci1: command 0x1001 tx timeout [ 3315.864572] Bluetooth: hci1: sending frame failed (-49) [ 3315.870131] Bluetooth: hci2: command 0x1001 tx timeout [ 3315.875671] Bluetooth: hci2: sending frame failed (-49) [ 3317.859068] Bluetooth: hci0: command 0x1009 tx timeout [ 3317.939081] Bluetooth: hci2: command 0x1009 tx timeout [ 3317.944496] Bluetooth: hci1: command 0x1009 tx timeout 03:23:49 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x4000, 0x0) ioctl$TIOCSPGRP(r1, 0x5410, &(0x7f0000000080)) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x8082, 0x0) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000200)='/proc/capi/capi20\x00', 0x20000, 0x0) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, &(0x7f0000000140), &(0x7f0000000180)=0xc) r4 = openat(0xffffffffffffffff, &(0x7f0000000280)='./file0\x00', 0x8402, 0x2) ioctl$TIOCGSERIAL(r4, 0x541e, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=""/38}) 03:23:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x73d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:23:49 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x200000000000000}}}, 0xb8}}, 0x0) 03:23:49 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cgroup.stat\x00', 0x0, 0x0) ioctl$VIDIOC_SUBDEV_G_SELECTION(r3, 0xc040563d, &(0x7f00000001c0)={0x1, 0x0, 0x0, 0x1, {0x0, 0x9, 0x2, 0x4}}) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r1, &(0x7f0000000d00), 0x1c4, 0x0) r4 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r4, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r4, &(0x7f0000000d00), 0x1c4, 0x0) r6 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:23:49 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x4087ffffffff) 03:23:49 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x22a42, 0x0) ioctl$KDADDIO(r2, 0x400455c8, 0x4) r3 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r3, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r3, &(0x7f0000000d00), 0x1c4, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(r5, &(0x7f0000000300)={0x0, 0x232, &(0x7f00000002c0)={&(0x7f00000001c0)={0x20, r6, 0x105, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0xc}]}, 0x20}}, 0x0) sendmsg$IPVS_CMD_SET_CONFIG(r3, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x18000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x98, r6, 0x20, 0x70bd26, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xba}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x34}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'rose0\x00'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x37}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x8}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfffffff8}, @IPVS_CMD_ATTR_DAEMON={0x34, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x4}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}]}]}, 0x98}}, 0x8040) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) [ 3321.950641] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3321.967834] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3321.991949] Bluetooth: hci0: Frame reassembly failed (-84) 03:23:49 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x300000000000000}}}, 0xb8}}, 0x0) 03:23:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x8000000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3322.116113] hfs: dir_umask requires a value [ 3322.129505] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3322.150498] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.4'. 03:23:49 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x400000000000000}}}, 0xb8}}, 0x0) [ 3322.168248] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3322.177603] hfs: unable to parse mount options 03:23:49 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x83d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:23:49 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1000000000000) [ 3322.276580] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3322.287749] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:23:49 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x500000000000000}}}, 0xb8}}, 0x0) [ 3322.346614] Bluetooth: hci1: Frame reassembly failed (-84) [ 3322.374651] hfs: dir_umask requires a value [ 3322.392088] hfs: unable to parse mount options [ 3322.436673] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3324.018909] Bluetooth: hci0: command 0x1003 tx timeout [ 3324.024312] Bluetooth: hci0: sending frame failed (-49) [ 3324.428917] Bluetooth: hci1: command 0x1003 tx timeout [ 3324.434328] Bluetooth: hci1: sending frame failed (-49) [ 3326.098938] Bluetooth: hci0: command 0x1001 tx timeout [ 3326.105627] Bluetooth: hci0: sending frame failed (-49) [ 3326.498900] Bluetooth: hci1: command 0x1001 tx timeout [ 3326.504304] Bluetooth: hci1: sending frame failed (-49) [ 3328.178926] Bluetooth: hci0: command 0x1009 tx timeout [ 3328.578923] Bluetooth: hci1: command 0x1009 tx timeout 03:23:59 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x600000000000000}}}, 0xb8}}, 0x0) 03:23:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x9000000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:23:59 executing program 3: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x200, 0x0) ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, &(0x7f0000000140)={0x17, ""/23}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x20000, 0x0) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="6469725f756d61736b3d303030303030303030303030323030b9000000000000002c00"]) 03:23:59 executing program 4: futimesat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='.\x00I\xa6\x1a\xc8P\x16t\xa2', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0xe594fe911baabd8, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000140)=ANY=[@ANYRES32=0x0, @ANYBLOB="210000008d27d8e1e26da3a490e23567cd63d026b28d9fe7a3abcdacb8f105953e3e136000"], &(0x7f0000000180)=0x29) setsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, &(0x7f00000001c0)={r2, 0x400}, 0x8) ioctl$KDSIGACCEPT(r1, 0x4b4e, 0x1f) prctl$PR_SET_PDEATHSIG(0x1, 0x2d) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$TCSETS2(r3, 0x402c542b, &(0x7f0000000240)={0x0, 0x85, 0x4, 0x4, 0x1f, "dec765a569280d03d57de721494bd3d1e5189a", 0x6, 0x400}) fcntl$getown(r0, 0x9) 03:23:59 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) getdents64(r1, &(0x7f0000000100)=""/1, 0x1) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x200, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000002c0)={&(0x7f0000000200)=@newtclass={0x84, 0x28, 0x10, 0x70bd2c, 0x25dfdbfd, {0x0, r3, {0xb}, {0xa, 0xffe0}, {0xc, 0xe}}, [@TCA_RATE={0x8, 0x5, {0x81, 0x3}}, @tclass_kind_options=@c_dsmark={{0xc, 0x1, 'dsmark\x00'}, {0xc, 0x2, @TCA_DSMARK_MASK={0x8}}}, @TCA_RATE={0xfffffffffffffff5, 0x5, {0xfc, 0x1}}, @TCA_RATE={0x8, 0x5, {0x3f, 0x7}}, @tclass_kind_options=@c_dsmark={{0xc, 0x1, 'dsmark\x00'}, {0xc, 0x2, @TCA_DSMARK_VALUE={0x8, 0x5, 0x1}}}, @TCA_RATE={0x8, 0x5, {0x7, 0x7}}, @TCA_RATE={0x8, 0x5, {0x7, 0x6}}, @TCA_RATE={0x8, 0x5, {0x3f, 0x8}}]}, 0x84}, 0x1, 0x0, 0x0, 0x4c080}, 0x8100) 03:23:59 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) [ 3332.185605] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3332.206404] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:23:59 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x700000000000000}}}, 0xb8}}, 0x0) [ 3332.250910] hfs: unable to parse mount options [ 3332.262686] Bluetooth: hci0: Frame reassembly failed (-84) 03:23:59 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x93d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3332.297766] hfs: unable to parse mount options 03:23:59 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) r3 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0xf347f2100a45bd59, 0x0) ioctl$KDADDIO(r3, 0x400455c8, 0x8001) ioctl$TIOCSERGETLSR(r0, 0x5459, &(0x7f0000000080)) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) [ 3332.329669] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:23:59 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SNDRV_CTL_IOCTL_ELEM_LOCK(r3, 0x40405514, &(0x7f0000000180)={0x8, 0x3, 0x0, 0x5, '\x00', 0x7}) write(r3, &(0x7f00000001c0), 0xfffffef3) ioctl$VHOST_SET_VRING_CALL(r2, 0x4008af21, &(0x7f0000000080)={0x1, r3}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='file_umask=00000000000\x00']) [ 3332.397865] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3332.546805] hfs: can't find a HFS filesystem on dev loop3 03:24:00 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x6b6b6b00000000) 03:24:00 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xa00000000000000}}}, 0xb8}}, 0x0) 03:24:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xa000000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3332.783499] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3332.791269] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:24:00 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xe00000000000000}}}, 0xb8}}, 0x0) 03:24:00 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xa3d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:24:00 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xf00000000000000}}}, 0xb8}}, 0x0) [ 3332.870285] Bluetooth: hci1: Frame reassembly failed (-84) [ 3332.876993] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3332.900530] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3332.947782] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3334.348909] Bluetooth: hci0: command 0x1003 tx timeout [ 3334.355930] Bluetooth: hci0: sending frame failed (-49) [ 3334.898920] Bluetooth: hci1: command 0x1003 tx timeout [ 3334.904461] Bluetooth: hci1: sending frame failed (-49) [ 3336.418975] Bluetooth: hci0: command 0x1001 tx timeout [ 3336.424376] Bluetooth: hci0: sending frame failed (-49) [ 3336.979034] Bluetooth: hci1: command 0x1001 tx timeout [ 3336.984447] Bluetooth: hci1: sending frame failed (-49) [ 3338.498967] Bluetooth: hci0: command 0x1009 tx timeout [ 3339.059009] Bluetooth: hci1: command 0x1009 tx timeout 03:24:09 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xb3d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:24:09 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x2000000000000000}}}, 0xb8}}, 0x0) 03:24:09 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:24:09 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$IP_VS_SO_SET_STOPDAEMON(r2, 0x0, 0x48c, &(0x7f00000004c0)={0x2, 'rose0\x00', 0x1}, 0x18) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f00000001c0)={r0}) r5 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r5, &(0x7f0000000140)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r5, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r5, &(0x7f0000000d00), 0x1c4, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e23, @broadcast}}, 0x58, 0xfff, 0xe9b, 0x1, 0x60}, &(0x7f00000002c0)=0x98) setsockopt$inet_sctp_SCTP_ADD_STREAMS(r4, 0x84, 0x79, &(0x7f0000000300)={r7, 0x1646, 0x2}, 0x8) r8 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r8, 0x8912, 0x400200) r9 = syz_open_dev$audion(&(0x7f0000000340)='/dev/audio#\x00', 0x8, 0x0) write$P9_RREADDIR(r9, &(0x7f0000000380)={0x122, 0x29, 0x1, {0x800, [{{0x8, 0x3, 0x4}, 0x5458, 0x6, 0x7, './file0'}, {{0x10, 0x0, 0x4}, 0x101, 0x9, 0x7, './file0'}, {{0xb, 0x0, 0x6}, 0x9, 0x1, 0x7, './file0'}, {{0xd, 0x0, 0x2}, 0x3, 0x3, 0x7, './file0'}, {{0x20, 0x3, 0x4}, 0x1, 0x9, 0x7, './file0'}, {{0xb0, 0x1, 0x7}, 0x0, 0x9, 0x7, './file0'}, {{0x5d, 0x1, 0x2}, 0x0, 0xff, 0x7, './file0'}, {{0x50, 0x3, 0x2}, 0x1e28, 0x2, 0x7, './file0'}, {{0x4, 0x1, 0x5}, 0x306, 0x20, 0x7, './file0'}]}}, 0x122) r10 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r10, &(0x7f0000000140)={0x11, 0x0, r11, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r10, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r10, &(0x7f0000000d00), 0x1c4, 0x0) setsockopt$bt_BT_VOICE(r10, 0x112, 0xb, &(0x7f0000000080)=0x3, 0x2) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) chmod(&(0x7f0000000000)='./file0\x00', 0x164) 03:24:09 executing program 2: r0 = accept$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs, &(0x7f0000000080)=0x6e) getpeername$unix(r0, &(0x7f0000000200)=@abs, &(0x7f0000000100)=0x6e) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r2, 0xc034564b, &(0x7f0000000280)={0x1, 0x37303250, 0x5, 0xffffffff, 0x8e3238861a5598c9, @discrete={0x6, 0x8246}}) ioctl$KDADDIO(r1, 0x400455c8, 0x0) ioctl$TIOCSETD(r1, 0x800455ca, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f00000001c0), 0xfffffef3) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000000)=0x1a) [ 3342.375725] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3342.385766] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:24:09 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x3f00000000000000}}}, 0xb8}}, 0x0) [ 3342.495530] Bluetooth: hci0: Frame reassembly failed (-84) [ 3342.520582] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:24:10 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x100000000000000) 03:24:10 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x400, 0x0) sendto$inet(r0, &(0x7f0000000100)="435eba0d747f813b13175a499d22eb695f04cf57a376d57968b91671db00c245b3817c8188b05c60b357e4b0b5119d31bbbd542ce4759da8c96947fae629d3f9c5459788567e53ffb1da65b8c3accffeee3b745ebfef5e2d4b8aa1946c105936b48b240582f89acdd02c8130b105338c0d8e8d74ff859687d0c003a7f50cecdcfdc82086116544a72fa79568fd91432117dda7ac7bdabd9f81ba893610030f48af9153e27c71bf470f09696ccaecb4db55a003b80265", 0xb6, 0x40000, &(0x7f00000001c0)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x14}}, 0x10) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x18, 0x2000) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0x13) ioctl$KDADDIO(r1, 0x400455c8, 0x0) ioctl$TIOCGSERIAL(r1, 0x541e, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=""/28}) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/autofs\x00', 0x23a0, 0x0) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r2, 0x5386, &(0x7f0000000240)) ioctl$TIOCSETD(r1, 0x400455cb, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$SCSI_IOCTL_DOORUNLOCK(r3, 0x5381) 03:24:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xc000000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:24:10 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x4800000000000000}}}, 0xb8}}, 0x0) 03:24:10 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) seccomp(0x2, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000000)=[{0x2, 0x3, 0x1f, 0x200}, {0x800, 0x6, 0x4, 0xfffffffb}]}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="6469725f756d3d38cf75cb18e33030303030303030303070322f3030303030363030302c000000006ce2bb1f0e807631c99136122eb9fcc671fe487d94"]) 03:24:10 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x4c00000000000000}}}, 0xb8}}, 0x0) [ 3343.034782] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3343.044876] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3343.066504] hfs: unable to parse mount options [ 3343.127587] hfs: unable to parse mount options 03:24:10 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) write$vnet(0xffffffffffffffff, &(0x7f0000000240)={0x1, {&(0x7f00000001c0)=""/91, 0x5b, &(0x7f0000000680)=""/4096, 0x1, 0x4}}, 0x68) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xfc, 0x5, 0x9, 0x7, 0x0, 0x7, 0x6002, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1ff, 0xb, @perf_bp={&(0x7f0000000000), 0x1}, 0x180, 0x5db17517, 0x7f, 0x4, 0x7ff, 0x1, 0x9}, r2, 0x2, 0xffffffffffffffff, 0x1) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0xb5, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x7ffffffd}}]}) 03:24:10 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xc3d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3343.256360] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3343.279293] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:24:10 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x6000000000000000}}}, 0xb8}}, 0x0) 03:24:10 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r3 = accept$alg(r2, 0x0, 0x0) sendmsg$alg(r3, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r3, &(0x7f0000002380)=ANY=[@ANYRESDEC=0x0, @ANYRESHEX, @ANYRES16, @ANYRES64, @ANYBLOB="649278745cddbedd2bbceb4889b95ae98bef8e576648fa53b272bfcdc3111b67a29332dbe99ca6debc70cd2a9765a300dfa82cc25dcfe389b0403f39df29f20f8aa5ce2c3ca25e0934d14fd8366455705c8ec66a2f28853a29e6cf70b093105483e5f150462f5e5f4ea92ec77654a7a31cc054717bd0ba68108f84d6ea3fb5d80b5e215adcf79bda94944393ffe1b619cae176fec1bb08c6c618c5a78723a3631adad7c5ab35cb07197fb353a0b52d3592f46b171623a2ccd9747ec1d6e0c297a39d2ddafad643a085fb32ffab3525c07c7b02a96deea302723f52bb1e46bbbd85024e5cf2b39c9190b6bfbfe91505b7bd642032028343b862f541772bb66c8ded6ff980065aa1a2582f26b1a72e8d53274d7cad45a451c20e456ca40473ada209f862fb511e1361be572a25edbd1873a3231501147222e4543f3e6cefad9e7e21f497c256a475a946797bca1fab14780fbdc4d51d7ca5a5b936784062562f8ce9e7a9e19859f1ab5d678c1ea4906eb795ec2937e8647ab6e0634a0f331c58251154c00549bc8fff0680d9d999b87afb5647fa6e0f9781e989626bbbadb4baa0cff79b7be2a5137059f2f877412cc98e8f175652c011fb78c2e6cd5dd61145cffde75f33c68dfbccac7f47262f740ebf6257c67d91eee5ba156c1e36239c69084cdc50fec3e289564f23806ca45a8fdacb93728f02e9acf96f9fe4f8d56e86060ac39332c9ec498b3788dd184d5222d8ae823ffd63829b58485d270396f7dceca9c0f8e8b15141b78a73fcbacf23f4919b0fbb1389627b3daa76c29d4701a20d4c49b8b72c3b5bfeffa62b2dea3a7a5fe19d0efb9abfd193fcefda3da86eef790b883221b3dc59d062a47e01f9bc3fba7b783f0f2992ada31d1c354f2fbff7104ac8c712d38f423627ad8ee175d71d37ce3d161dd42c45403f46bab9028cc804a1247437106da0b6bad93ba21f0324162e9661caa467df3d562962a90b51814d7481679d811e714a22f1ae44b27db4618f5158da0381f60c5b30553165e44d191e83b1a3742dc8794f58ff1d18dab634eac2da12b9cba94f6e14ca079047bdaab4a3591dc5cdf1c57823f385ad03a418fa76daaa566bb92300b64ab4f90feac675db5d39d3a72220547b5cd238bbb75867ab6966d65454b4f7dd2f1b018ae07994ea6baec725f30bf46a36acb24db95f716d7cba3a70f3bef4401d57e356c868cfdb1d15563c622ac322a1816c35c116c6873677c6059f6715cf498275a65e49b2de74902d3df36cfb4841230d48329b3460cadb84f674967665197d8e13563e2c66ff6cc24ad58cb9ba10d9641704d8c166fa92b3b5135aec33199df84e8f0efed777f92495123ca5e24807397a0917399db85001fbd551ad6c00e2610aa3c5b55057a1979280fc8c350aeeeadfe0a36118f1c03af61651dcbb13add1d27b852b853ebcb7cd3b0341678c0c345ad64dc10bf5192fc146b3ac4681c996f3d2a2005aaaa137523865a247dc792907cf4c1d3c58ef27b961378c73b2806fa2c40334b8a92c495faaa4d7774ad3769165ab0d067a6e97731f63abd8620b1b3853c42205a045a684fb2b46d1596aa9062e77eb0fd88097f194ab87eb26377948226bd6bf6fe7c908bc29db128a18a56a38fa586df2fef2a97b9ee2bde58925af557fe4ec18f617e0f4733ca19304b8097337dc3a619a2c93ded17c94f8b94853901061f387ae6e0d8676fe6b35125938090b863de7a18cd1393059da3277c6318b53df01b08cdf4331fcff3c4d76ba7e427202cc6e2bcedcd2bf4346ee0c7ab3e381c8d650022edbadd12a175d33b0f6e9a91b8d50e324970b922ca410985eb5a74ace28a87638a00b68a55b8b34474a5462f35934ad222e5e9495f779415e7621eed0cfe0cd1cf033b0908c90ca5b25d6aec50eca63f8f2ae19b9a27fda1b343b194e6724403c893998879f5e100ebf514d3afdaff7b15fa8fce29086527a93cca4534948ac27ba12e926e3bd5ef230a089164025453b1ebcb4070a2e8ba386e4cce5c41cb923e6b56f08196997d6de0ec7ed61a652670b9ee8b459f8775a81724312f950b7d68ebda1f41d1664ee096a5797976b4eb30d759b4648edabb9b882bbe9fbce15de7f3d34789bfe3fbff9ccbfb4a9dd348254daa86119b9dc8910bd6fd802383076a3698c79541f53247f8ca5e7c36803b84235990543b556823f04e8819287747937d4b07574ab4a1367cce1e88778aa710df2b9d5a53eec3feb0f0ab24bfbcb40a22aebca9fe664213e1a8307c28f1bc43342106ca339629cd6aa013404cb823134f5f08046aeb335f282fc2544815301823ce5de0868f404e06151a8e59fe749e9c44a44be0aaf5949e0eae1ab38706589f19f5cd8642d00b733d442c06d6ea5e6c2942b51dea41c0831f2d36032b32c434961486b2485d029a331cc8da64dd76237e5ba0ec4a27d89f85d52eb7ae8a86b39458c1a548fac11754016077e3556703750add0619315f1b3da29dcf9c1be591e20f25e2523ef1579b1abcca0f41477c81649f51d72e6fd4899aa399c65c45474e520710d67a7b58fed996f71d6103eb934053a560f8f8b4b8b2568331346b2672d8ba8ec727b9ebbace2981358eda309f1f5231cf86a815d12d62077c9a813626e31b9ac601705c0e25957c4bef671046c28c9d7ea59867fc58e84e7f01a3cc6229491df0c69dc3d5024cebab9f40debe141693db03e594355abdc92c215a87e5a42bd0068267b38b0b9c1795561993a812beda3bf52d766f9e30d24656054ff7b36ab2cfad957228059f7a06e3c65dbd000a67c32442277de2f7c8557ac7f5f197640603e364a2e4ba69b97a2a2bb5460294a7947bf4c9a8c813b4dba5312243e5bdc5b0519f9bd989f45951da774c826395cf6fb01fedc6712521f0700b3607d70426c78f358405a93faf173f481f5690236d6fc71110c268405bd24e485d9ff7df3e50fc711473586f47d129384e7e0c989e7ab6c485d6f55bfcd95adc74b6b0bafffa50828f136150f51ed6c11a0dbc2510dd1e0a3aaa7a5c15a7d012c0b0ab0dd2059295d6e015816f96027eeec3c9740dbf27336be25d79d782cc6e6c6c0877f567c9b4e63f5a1a6a8d365409348fa282121a740fe3f7349dc3d88a3a9a62565504095fcd89afdaf90559a56447fc1e55f61ec5b5347c4da4ba2f1794bbad9699a8013a67420c3cf63ce4171caa3d880f0ba8816340ff7df0bfd2b945ab0398d777afef221dd4ceeaaf2a016a750903981770e4beb90f8d1f9c260f1d511925ee1c725a42fa9f5b89ff76a37991a8b34e4e902ecb593460de39ade2dc7828457c5820de752232e023a13951bd687d0df86fb007aec70117fb53c6bb1a5d93feeacd7c1e6f9083cf5b4e10d75de95602821e5a251c19b6fb1751541e1f7c04dcfb9b4866f90441717986bbbba61104506ecafe575e994698c2940138f1b78e483b257902ee2a0bdebf665cfd0d8bce3a377c1fef9613a16186f50e7c7aec501a7893927672357963708d3af8d10d170fd4fa9c615c2671fe49faa926178d910a0f1c83e29ac78167f9440afdc5b8c241619d9d956fc1ffc55917977bfcc0c61d9e91635c0c6eed070346c966616859ddc4cc95165eb05ea71540b469f91ddfbbc335acf31cc4588994036283cc2d6b70e9026e99d825f257a104c77c9510f5beb731b3330375c2edeaf8555328ef0ccfd9e85cfa873d35f7bbc8e26b95a31632be5a0f5be138bb6a79d5db134d8de3535e9aed59d4d0c5a5cfcb4956df34ed7cca1153ee3ab549561256997374bf9f724cc2bc693961549d43b7cf195badf032b16b3c02caa6f88e79ebdc4fa70e401cc2f1fa0ee9e37608b80a32d1a3be36ce34980e9ef2f764a6705dc6287a271170e7969ddd10fc819f1b409ffbb97c0ae9056790635161a7e1944c7987e9d1019ec9365fefd4e84158eab5a27769de20c7a93b5283d4c9dc5a429f6ba0a07c73583fb915633ff3a38adaebd10400c3cebed1ce2c62affe9b47bc7ee618a1f53c25b1e20b622799120d43b31af74f69c3f528fa4cd5dbd452e894851be416d29904ca5fb3168402e3b39dcdb1aafe3c77d44789d78f185c0c2096d5da4cd0aea6be4a3f3ece14f0c5daf69fd4e86466b3c17fd0f53054642c4fa5367ec2e887e83bcb6a301f376f26278fb03975ebacf50bda7da1319b6c41784e7d198c71c8abe8a26172eac9dbcef3d230a6f6ad4afd3aea3f00599f7db2d156c8e190bb09c0c8dc9ecd1aa8a9f28bf7d47bd5948f040d1c3ffd96e1626e0b25c70c461cbddc79a3f3cefefc980a7a7595757b4f78193cc442394e09e0c6f0bf37a2b00328186833c91af897763b635f510bd69d0096fbebc22f8798b967140805e4b20117d393b96e2f788921fcd5325594fda632ff4b4235d49629b8f10b414ea0d0b011bb2582b68fbc97dba9bc002c0118a4ece027a62dbbcf857119f70a67341313581a3ca0ec90264f670311614b3fc36ab06a79e3f7224b926d8a59de59139115dfd7acd3de6add5646bbcd546ca303d3ee36af7d7ead43950a4d012fe5035254e87ccef42768286ec153fd4130e8af2f880b6a32b1bd5413853638c9ad43f48480ae5bc5c788d52a552372aca02fb0c5a8768ada307cf7dff20004d29147f08533f140dfc899370835ffb1c2f4e057f40cf08dd4e0068995f516745651e52c799f84dc2ebe4113218fe97f0af219566e39e64d0032580de00c2cbbb11589760dae717e8289af30842a58726497f19e2e0bf0d90b59d170ea31038121bbed8edea7d1c8719225a98e6b11dbc0f3b60aaed0d96450e54a54867435fc4b6bdca18528352fd0bb90ebc328fbe4e2db6b34e6d216ec0acd4f4024dabebf904763e1b8a6d61c5bef5959d4a46ace0cf950530ad9c5009720a446b1b92f50527040c9e67ce2f10f2095214678cdeaced190019eccccb448cba680846af1fad31b8dc95dd64655a9618fc254e9502cd8ae95b85b38521e2ccaf7dd4956a4c8a91b630838bde441f50a4fb466f6198fc51c07339d7a3fdbbe70fa34a349ae4e3edc8152109fe5a2ef47dac05564e8f8b50d48827776ca7f1b3f07d090d4614047ec82c4503f02c2ebcd5d00a7e29824803cfb1df511ab8dae801080a2f2357e4970ee0e5c0a85a4dcca48de18f4ab8926a7273cf6e7e4960abad03f8a455bd11363a3b932b7490d2d7bdde1dab1d7854d574269a21c2410f2003339a52a4cf3fac78d6c4cba75c05a2a45c86211bff11525450a24b7e2184230857312c5bfbc0cbdca0064c60f57c716dd4c125b752f7c5388f5a6d694892ebaf01aa2607fc851f2f4a359a9096d90e8f1e5f7978c534602eef879b8402a4ccbbd123fdf332e85ec4fab8832d535fc97985e24051409255c2f46f67f5d51c0924dd4cea4073974d87e5c1c0a492403269969060746ff7f178ba0ea2c0a1854acabfe459badb2a5f901cd1315c2903694143235b4570de0779d586cd6c9dcf368c52cf2a7f76ab5d82d8041f6528b5647b718b692a3f87329c8d21b5c885a94e353eec33f7901db1bd390cc8bc403544bde01bf73c466c32cca11f32904494f7579cdedf76d98aad6cd5008239aa6aa9140c763fdacb19bec65bb784d93711a3bab300975a2d1acf2a413b1f67063ba77da03ee24a180afc2c878e14e2a603d017b53b04847c09b49051e2ddbf67534cfa6b3339e4562a3cd37eb8"], 0x1006) recvmmsg(r3, &(0x7f0000005880)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000100)=""/37, 0x25}], 0x1}}, {{0x0, 0x0, &(0x7f0000000f00)=[{&(0x7f0000001380)=""/4096, 0x1000}], 0x1}}, {{0x0, 0x0, &(0x7f0000004580)=[{&(0x7f0000001000)=""/197, 0xc5}], 0x1}}], 0x3, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 3343.311157] Bluetooth: hci1: Frame reassembly failed (-84) [ 3343.368078] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3343.406041] hfs: dir_umask requires a value [ 3343.425749] hfs: unable to parse mount options [ 3343.479491] hfs: dir_umask requires a value [ 3343.483854] hfs: unable to parse mount options [ 3344.498917] Bluetooth: hci0: command 0x1003 tx timeout [ 3344.504431] Bluetooth: hci0: sending frame failed (-49) [ 3345.379004] Bluetooth: hci1: command 0x1003 tx timeout [ 3345.384510] Bluetooth: hci1: sending frame failed (-49) [ 3346.579132] Bluetooth: hci0: command 0x1001 tx timeout [ 3346.584549] Bluetooth: hci0: sending frame failed (-49) [ 3347.459018] Bluetooth: hci1: command 0x1001 tx timeout [ 3347.464421] Bluetooth: hci1: sending frame failed (-49) [ 3348.659193] Bluetooth: hci0: command 0x1009 tx timeout [ 3349.539008] Bluetooth: hci1: command 0x1009 tx timeout 03:24:19 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xd3d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:24:19 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x6800000000000000}}}, 0xb8}}, 0x0) [ 3352.617002] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3352.634845] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:24:21 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x200000000000000) 03:24:21 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) r3 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r3, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r3, &(0x7f0000000d00), 0x1c4, 0x0) sendmmsg(r3, &(0x7f0000006f40)=[{{0x0, 0x0, &(0x7f0000000280)=[{&(0x7f00000004c0)="ecbbfe9b714d8651069dcc02df18bc771ed5f5f0c00f532e1ea371260fddc5e0d3328102be10eba67bed18f47214350b3083a768ee15e847b1f5f06644a4158b4767f53e06edf61fc07362cb9343039115feaec8929ee81bdfb64c318221c1d1f40c49514b845329d2ba018ad4cdc09da1ad941dfa5a2ce7f32c3c0ec1475973db031a0c063937a4148e8f2b1c3808bafdbde6bd723dc55d45c7b0b13cddae7227c70f862184ffa01b469267dbb5d6db98eca466aa5e3ace333e4cb107d94ac9567466", 0xc3}, {&(0x7f0000000680)="d470d35860f6a250cce34f32a849085c89d1e8988898b4f44850fe6a3a7a3486ec4fe80f19b528d879fc1f0797587d725744475d72b5720ce5a3f235674ae5fe9e81418266e47f045378122b272477dc2dbef4b75a5626f8f0d702f54db5d7dfab9f94a3366e16a838f1cb858ea0ce5ead7bffe4f51503c293d35fbbec2f4649200ecffdd2f8b08ff3fb5ed277d011195dcf91824cf178966c44611da3c31e1da172167b6bb1a13c8cc28c9ae474a2c36ebc09e824f251d16b02ec66dcb0bfde165ce108a4af71d3383a9ed143e0a8340b811744c05c9ec386840c04b95984eb14ceeb98c114dacf5e2b383d51faac9d508c09988584f6a2f99458", 0xfb}, {&(0x7f0000000780)="a602dfe3b1ea818ef580c98c6a2b200230af160871f359c7d14f39609b7dac7dcdb22ce93e566cf4cbcf2037afcb3f20b9ac64c46642cc197d08edc17decd9415b255aa5ec13c8917554fdc431ff34e6b521dd6c4b7ed4b297b9c84abf50be8572c62075ac97314f6a71c0da3d4ba485b8cf3dca80251cc1247043e0947f6dd598a6b6e4f23d269f6eb0c653eaa02b07f34487d2ff2d9af980c852e0b65c6ee91d986a646d5d842b09340e8a19570e64d3724bbf1587a17b8f661c60f50d9ca2858d69e9a921dc970786dc9b8594cfcac6a725c851d16fe854875e80a194104ace9e54ccf47a10549fa2559c82bbcc4cf86c07f48538c944369ba1", 0xfb}, {&(0x7f0000000880)="8e9c7effc623460b225951b63f9a41ed21f756d3ead20feef943d64ef3a4908538263c68542b97011f75ffda09361e823b1fba921071b1ef07a9d2794248ffbe5260a4b84c800af8a9a7cf54e386ad2253839f96f38de339c4d06abf1d5338980268e28a91b0c4ab747602639c187c689ac7e1fb97080d3430e644b3c1be4478c6d90ba41e25d999db449a9e6c62e82cd8ea48f0eafd4164f398ab5453b88952eb110592c5c85565121afdd341650cdd81e5c54a565e1bc8b3ab23fa0c1080660ce5437f11e0634cf6b723c758e8e583ae6a01330969ce9e36e05a9b5a3c5672c31614e7b6f5c524ca20784782bd52196422632b6de54e406b89eb0be6b7ba267feb699ade1d70f1e96b80c35e2ded1cf73160ecbccf0b6bfd742bbdb92c011d9de0d56c2fcbdbb39e6b160e889276d366e05b47ea6b70585dbd39865e163bd7dcbf0bcf61fb0a7304e17930a47b8550b8fefdf5455618907da04ac8e83c89aa1ef9857e79a47865c8b950344c887e599a3318f99303a41e7246c53bc3389529e567790ee5d65e7a29fbb665ea718a83987f8670688567a6b3594d875fea4ec16e3410a295d7110af668eda91885b8bd39a032e3fe11462918a9d3c61d01b6ca62f4ace5c002f64c181d1ce3d44a5b25ebc5b480499205800e1a2866a7ec6752594711b817fba6f43ea59020ee44dc8279b75a9cbab5235f1d4be9ca28391ac00282bace8fdb42d26b75bef996ff0ec88a525db55af4a4116c78d29d23543b89bf7cbfc9d665f0e80305fa07583ec0d1e86488fb34819c4b9cf2f2748e2a27871e347fb013dee681acfd5f8f22e0d10823d52b12c4e633d4b73a7d1b83dcfd14ed36fec4188c613beacf578a632a29aaa274cd6f51899372a89e0844d9dc0db77fd69b6c242a05c4937220ce72e2bad148a0fa898096c66524fc74f8adea2fdde43c37d3f0737e104d82ad300d0d0da2440ecb032f7910d5da61270bfd511dba251b2ac494c3bdbba01a0c6fde9a6a509144f044eece3726335cd1dea218c221fff76ad3a5232be0c5a9b995c89019403da137fbb55860998de9f9e4d97796c8937f491f640f1b35791b1f2a3034179ca6c8cd112daba3f67d8f6fca0a17661badced16f96be419ac98f3f2a8509d8e9f4c0afc933a40427c85da05444afb184e7fd4c3ef0faa5676b143a7532e1448caa8160ed95621f510a97084646dc0751f38d6f0a2f34d71d3f38fedb4870f8f5464d22bb9424f75faf158c10b76547c78b78e1fc3a2d3c31ddbfac90d750af7397db1e86d895836281cdf87ee4adb99790536f5b858a0aca479d2d1974333ae8dbe2327d290903fcb1984b966d97b82c9cca8c44a8a8dfd88f2a9673937baab8ed3d14bdc839e130026556d0a774c34fb70b53d51a4d486122e9c1bb4f2d9c5ba18567d3590cc9de3912301980175187744d44ccd3c76257027a9312699134d068c6634831ab3933de4de23d2be6fe7a9053ae8d1423f7bb149a734314653c52e0624f1b019c3e50b5f1f5e717ed5b31300578c7c5d99942cc587e8e9920322a3b419906f4135ac3b254de62ae4ca1460e654ff0c8d8348bc6c8919f4655a591a35043caffd445449512d5213083fab7710517f920850cfb64aa1de54f7836302c1373167ed778d924cf343bbbfed8cda8178c3265be162f60e15c1b5fb6b5dd6cbc663342b85ec105c4b8b0f57248281fdaa64b098a44edcb0922aec096425ba0693adecd3b1a8877976f6f50a1332a8f89a939e8cdfd75a22234c8b362450cefb295d36ce1b36d5e97e26fa57f0a8198d8585846d71d1761e7433e278eb996953f517346e39d3db829859064874c5aeb938bf70bee66d94eebbcc0d7953690bf81979c5b4c4a2b17e578155cd7873b4a4a35f53f2c7d04f96e86be78312d99d367012e202573262cc63d570630e9c5aa8561fd160f48d4dfd17f0f96c5e9480edc777c9b6bcfb21a36929bb6ac70536075bfda88416e0ed3d53d5b2a086dee7821ce4a9d25acd45804ff619500fc1d2e78526310233fe4ed5e44661cff8b824f09042294841020c76928a3f76607a96bdcc795681ad59efa03a00120ee678e7542963b6f01e9f402581ada14085eced38265750b0a6cf747232847bfff14ca06ae1082ce6c307f429aa119766cfad6605f0e1a5d76acfa0a8bb056a2e068e663ca5582614ad4cfb0ad7eb0d6dfba55612284f91b25bc2d684e9d190c0f3f3a9700515330ed1f683fa4bc64349be5ee9c1256b1eaa4ae6c14d9a1c843f93328c1b11d8f02090bb7172a8807d6c9b8a2e71734d4f5837d75a1bfd9a7e83b00518c0dce92a94f432721c10eabf595407a9bbc698ba09326e34d8e7aa701f3ff51b5b090c076c7912400c9bd5548863a9df4f0e994243667792dd6939882c72b385fc77e46766ae7f139ccc1f3b3be4699e89ffaccfbc910d7e859086ef89cf8abfaaea7c669ae5e6bb0d024d0851ba6d9948d3bb6c07cfc4e9e1f3e69524a398ae24698e44d84e390c67c5ee44598cdbde192e07540e59c90609eb600d02c4a6792c69350d3bc38b1bec33ba6c8ea0887c10a155f0ca6389fd8d35c3e47193a5bbe9c01523436ae33c4d7beedba3f3acec4413a3a202d62c18b746c6fc77aa7d5a132e5c3939d110c03f64946474d7acb01190a646620206d9e5a69af958f604ee1388b7bb893c0369f274f3d2e3495ece51705da8110299113de81e6402c26fffb3259c5d8eabe3ec8c6a3d67f882e499beba5d0edf3cc8a938788358675200d05f51f09b9975d94406b2d9ac86b8dd6bdc0c59556bf3ec6c3b8db58b99c0655755f1c9538ca7c2b0d7bf5bf1b68f05921b9882f08d8bd3241ed2b4fd8f2091efa63d7d8dc6c5154529d81d36a4e68670334aaa8088c69d1ef0be27be4d01b1dc7e6b575f9510564f98941ad67d8d5b5445a5bfb6aa95a32b55fc55c9430797ec957458560f69b3bf8f3ad7047a6e70edd24110c5ca02df657ed1e7eedcf09407dd4c309a650ada45c2c8ee2dcc1500835af4c433a3f981c97b44deb27b033de96579c6baf3aefd11a1d0b3f8f50e5c1706632a7a175c028843d405b4d6e6e2ded366a35c7a0786935cf43b681261ac31152e4436a8657d318698ee6d0b2b1f0fbb97aa7d9f9abe3b41b8e5eff3e18072439ca148c370dfe53191216d5c9bc19e38c536ee499e66088d263d1eef916a212dfeabc295fadc9b98723f6b21abaa509b27afff799fcbdfbfe4273d51390fd0ee4f7fc0f43e67f2be536039b9686c72f827a2113ef7ea29db1fe96392a6a03bcc1b3b03f0929eebd01f73a4a6084cf64eb21c5a9c9150b02da2f4b773b090d0c050e05025c443a5b375dffbb8030c95475085f914031f372b6d16416bb8cebd35d4904ee42e10d43122d5f0f2629e3cec8ff20ff72f057e0d35b16d63037f5e9acb6a812e7dac8a4765b5259c9aba45d71b866dd4fa88400432bfa9a873d326e27708b63296204dea23e0a3029fcbbf5f71577e17c925bc961b0d6344b7db209051de1c7fa664a3d1eca23ed5f8dfa40b0b582a84d6dad26a357414a6bb6a231e866d47e0e2bf93e09b8a4fd15f811d56ba5c2a7e89e768f5c5ea27fe1635591af8268f3c3248f448434c9e9f52095f32dedb1946cd827ea5980ff6e286c4488f517d0e052b6425b7909b732407fe062d857eb7abb35376ab2c112a33ab9a589ed1b299d66fb56f92e29083d81590470e3ddea7253b197d8dc0ac74d23e834feff1e11ebfa1221ff5431b53531d853d288d34356f4a6da9685c09537e4dc6d3d2ac36aca5aa5a6b6a62ff0464faf014c2e31169fad22d3bb51e6a3f841d888c86f7e15070a4500721ec118caa4c8ba06313017db10cdbe316c851bcc8131316b423a4fb67a982910174dd88668291309a671cc1cb7cb8067485e5973d320fe60725756f76875f1ea66fea4afb998a3d89c1e2d75f77761c981c03acb18d80a63baaf0f49febbb7df1e432f5430d15f0f0c565b619ea6d9aad3e2330801fd45cfbd427ae8a16b2b40fd6f55c92b4250d1db64fc6ac7b23e14be4af8b149e391c04d95804a2885eebf8da9732c5de0c35704ec12c29a24f7543ca2ff1bcd7f68e868e0ed2e59d2dd7d0edfa55ed4eb17b678203200699dafd2fdea6ae0a03495158539124d7fe264dc8ebf0af5bbb340585ff06d33df65a880e5f1a72b4f5dbb065a343472e3e77d0a1850a123290b2cfed1ce0f5639feb7b64483d8d456909c1850361e5abd1e11d15ecb9441f56400f96a633ac2a7d179fd6b2d2408be5d12c0bf4e84b4f6806ff7c29bb7231f777e6f18d934a5a0ed76351561992cedec06ca49278257d7fc5603088cf164c7d4ce017932918bdb5a851990f4777ad1e3db642ded1e55c8e8e4f775f7d09295fb3ef68440eac8554e91cf983ebac07fcd743937b0e30a95c1f148cd63470da95bb8fd65103c69e99e154b1d2f285590b37172d96cdfd6e629687b89058bf53c637296d51974590680bd36fd0e4ececa18730cce490084b7acf828dbb51dab6080976e6c70b3cd82b64c169da06245af603d2d73888dd42f355fd6aaee2e288453cd9fe444a787247abf5a15e09ec50c5e092c1de3b90a685afd0ce7fab80aadaa6225eb938c130097b59691f403791e62a22bbdd52d95684d881f2d5b7374b8bfa941f1d6ed31d6ca3bc0dd6694f8fba840edee2ee03eeaa05f94f72e2b3df4a8f338fb61039224962dc28923587295f83f103cc9e90b24056a9c66687bdfa3e5ed81d6fa09d621484f2d55ce6ba3b3935cb04dda37533e4738f7cd3dee745922a610576525da82f68a7309082e5fe6b3bf72ad75593b25a07d338e4c835926efc27ec935ce7e7dc0d43c5dbc0d8df2823230d9500115c432c1baa652d779101be94e70cab4c737f6c0b773d466678ef241e403edbbdb537075d9c011cdbf2672b8411a864b27f8278a9b78a909fca7ec3b357fd172015a01f7ce39bb3f72b02315824c4fe423a7182cfbf752da583f42bfe75efde00bf5657343559ce9bf2c5ebb011b2a090cfb10ce6d10d486c3d174c504762648d11954d454117f8abe0328a612bbfe84193ca256a317cf0282cd90c0436f1abbc0b135688c8e1d644ed796f2aa73768c90dd9d02d5ca8b71393db6a6acd05aae0056903f12c90cf18a1b31037589817fd840b47c4e596769db6060edf038d9bcfdd7d8fa9200fa6cf534b4b538a43e013595aab90d2806c6553c0254ef6be88a966761b749332e4fa3893078b770c418566455015af861135647855421fe53d54988283e8e1abae110c247efa7f53f56a47968bb9308e8665e7297e491aefa5c325161a213a0049e46601a83114ff32a79821837f4dc87890a8b2330e3cc4cd39bcf9f4108b115fe3bd9d6b02c5812cb62c2427c11e4b8e2981f6a8c2f8aa8fe38415ae7785c3ffd0b169f13a9481ead6c4cd9aeea35af45961c0d54c4f57508ed743aaf3e9ed0daaf2d30b5abd6fb2dbb5866ccf980929683b17ac1af7fa00cf4de65bc2f313dff29f8e6f79783be8c85ca92511d785d05ed325b1ef1a36ac06a78a048737c85a45d835399e8513b6ce194049b83b5586d02ee73c5f1028d4a263aff472075a3e66a3b29832ae975beabdfb68f0c179ed10336e6e1c591a817569d9d4dce97e7d56d78ed95ab86242e5840139c4796491ac8c481b99c1c4e7b7c45f79b4adf8c428d4e3515aec77d78daf2259d00d0ae9291c8924b5c615009efab43d2dd47b3019a257572a0ae80140a919056b4dc177c8c2d1bbb", 0x1000}], 0x4}}, {{&(0x7f00000005c0)=@rxrpc=@in4={0x21, 0x2, 0x2, 0x10, {0x2, 0x4e22, @loopback}}, 0x80, &(0x7f0000001a80)=[{&(0x7f0000001880)="21663ba5f852d5937bbb1f086e44a8e8a57421f5b9318fa013d998af05a035a691782919f2ed1714a9b7072221cbaa21966a51c3e16c7bdcda88ac0705add3cd04b701d19dbeea6ebecc8fa5da9fe7629d021b0915d96ddaef2884fd0dcf4360", 0x60}, {&(0x7f0000001900)="72ee449708020c", 0x7}, {&(0x7f0000001940)="fc912aa11aa74498e01d39688e1e27c33dd511abe7dd23", 0x17}, {&(0x7f0000001980)="53849876143c1fc958190928ec34395b6b471180570a1aeba73500c336cd66decd85432106303aa59c42023e4f7d79ba5edb1e831026fe05c451a6e17e8fa32481965214e03ca96ed02e1f511cc24149bb207aa76e45ac9dcb3f5b0a491f799670f483ca9d33d01e716fbe283ed31cc2b0f470b967868fca24258910eba0ef6a5aa11207215802de9664c0ac9cbf7b642487a534a121a53885702f7fad19e9145bede674684f46a8e7bb8fb303efa2197026741ac9659ddd8eda7803712e6e9b0685d9c1ee61ed252f0c01c31770b168338c6b39db7f", 0xd6}], 0x4, &(0x7f0000001ac0)=[{0x28, 0x10b, 0x9, "f837bc0ee1311d2e34a2a4ef6e032fc85484e3f512"}, {0x1010, 0x104, 0xfff, "8c806c064fab10d60a18795911101d40a78e3d41b61ff65b48532bfed5077cf9f7538e682cda5e478a664e2f09f224b50bccbe5bf5af042dc2436abcec2544be106e1e7a6837111ca812cd0ef654fef396cbb6866e00228702a307db6437d1450b937b35b314c88337b5251d9523db0ab0cf18b4ba8a86ecbf8db9dfff6fecfe5e22d9aab067175f20b69d31d81aecfa46f503ae44f652752e0bd7c5759095e0e5f383803871c9a4228c8ac3db02f106f8a6fa84fe371ce11eab5732841493ee0081d9004052810e49da1551db55d022b9574d479548a6bb6a4544e3efab74a71f28712f9234d85269a60ab13ce7a81a986d639f5a5b362022bab899250a52e9202f058c7c0efb7fc43a366a26877c88aa604e70be507cae94f4863725a1b6f7e08ef1da44d1280b35b52e1b27590589c83bb4d1e6334d4d8b216e503b060f3bb19cf75f759cf39d0de07cd34a0b4c08fbe680ca61455b32fe7f6652a66c693a136023cf8f97ec57c15d0f4eece58edb5ff63ab135764b95e91583ab60b6290c45566b5ab6f9d9036579ec94fd838013fd63e62b5192e5a60244373383ecfa28a3b5c532ce961314b678c7f8401cfeda8c82bfc2db43bae91eb8fd7f46a69f24d6161769422676f0fde05c4ba33d7b1a7dcba5fe8a513d21fdb335b664e376282498eeb10842e46636ce6acc89244c954c58ade15e11e1f23c7e01f797b150f76041541f2f0e5e26c33b2bde0e40d3b786febddf057f7f29ed6040bb44e875de75cf8f5a728168ec5ffd2812a35f7d36806aab03bddd093f75d2197d133c523c46d61de6ef1568f0f17b907280035b941ea7aeb39713f4b2f79d7d5747ce08d98967edd075721b654a77d97863c4ad10c851a2daee85f335abed5ce45668de862fee5e668c94bdd5fc37448d9d846c34d904b1600abb269c46d036d8b9424191811bde4e6262ae8eb9cf532e8881e091f4593b3432f11d15b8be532b2f11620a6d08b872d7a3c6f19f43d692a222b150f4efcad1f3c913367eb7bf5bba8f3bda3c57765665a1b05dd79be40dd051ddbd1e284732a85ab713710e94df5d1e043289d0d9e65228b5037ec641ddfa89b7489d5bc553574cef7dd21a6eaff2a12ed4385ffefe31868dc80403b11c11150a2f35c31725a3183dd232a4e017be18069d5ef1993d37962f72e680845565bb57ebaaaa76784126368aabaa14b57dd3ec7cc324332bc29392b9ed2d08a3dec457b339d7d8ab21f120b05ad1aeff1919bc8e9eb92be6ab179128ead908833e5bf2a6c1e4c04599d9e149f76a887f93acc01dd1d06326fdfe58347cc3a381e3064b3c7702e64094be94ac0d1f22fa9bf1bbf4f11829cacc1f48df72c70c4010beedc201a8b9eee92239af0722ee3648cb2ff6a65f4981cbcdcc78b06a4bbdde3ba2383e2382c7e84b47b2a20fcf67facb798172e45a15c9bb6f6e8b3806d4fc5cf990b54993b4290d12d3bc7c45878499ae8e5eb5c4087acd3ced5d2e6611ec6ebbaba0de5e894f6fa88b7b39b91600883e2fc724751f67877f73a19d71693b0bae52f60bd3f84e18886bf0e8781c06b5b3b72cffc9a5869f4df9c6d68922f6508b737a810339aa41bd801a2ee94d8c54a2cd82c9324a2d8ade80ad83e4525e96503df84abde9c4b55707fb03561bc09198397ddfcaaf5b02cad3c487dd0983ef41dfc57f84fb39f1b04fd2fa1aeb4fecdfd4a464d35bb3af23df24e69885be4901844593f21750bf54f3ccceac63a8ee441db0600e4582a6f835e74bb08cbbb40008fa58c0533cf2691349e64305001fcc24541d72e42a97d90182f53d57e9da5c6edaad188d06e6d1272cdf6335e65e6667986dbb6a58efffb117920ee7aa35eaa27d2987b8d18d03baa41d8920a02849f8021634c32a00cc7f2660478a67dd455c570e571e791f9bf082357cce88403d3723cff12621041c073231c672a5befd5113f25321f1761c1f1434857cc42425c3d2797f35bf3809c183cc4afa629683d8909aeed5636a5d11258d9ba26a6434ae2f9288f47ff4283d877f59bbd7177c43e3f3570bd6918d757ed93d5adc6f6b0403f9aa468eccab9d7cda9ef9afa69f19ac7d10f44dd45f7eb1d3e5b19f7bd7a03e717a9d2fe2e73fccd452ebbf9b95060170a5a81f64eff0a070ca44397bd2d1d95e7ebd529426e5d7ec67270b4b5c43263a5e06a3bf44e721a4f0d848a5cf4d860378e4ac4fc643ef391f74f4d420670f525ba58d929f06d406c857b3d92b9102c7ab52859e06b325f0db685b4361871b84dd1d0f72b26f8ef5c84155e15eb840b22420dae88d2728880a792a82d0f281b6831a3433d7d88378b94a0b534d5c06d7facdee2e647a4d7a4672ea7fd0c5a23002cfa467c385fb3ce24a82a0c54afc05b9565de2defeae96f7d6ad18b72aba028bd60d07601926ff9b60718bcfa842ad99deaa238b534b07fc33ab67e2e686063255874c4cc5cb66272a4d527322e2dec83d7e2c550c0195254348efb8d0ebfb5a3e5386e9e24323f0127c57d512e6cb2001aae938b4777e794d337a5a97515d59b8af02e4f8dff2d8b614ea1f01a8fa9611b6c79e68ceb929ae214a2914e0781bc8a3014392129b9dc86339f1d0c71d98dd4b86c787528492830cb3e226e9c31be844eeb24f9a69f5db872867b5a48e6907b4e9733465cc4db11cb14f3966593f2a06ab10ba068cbef1d791e9695f3d21dc0a33e5ef6a915f647ff6f6ca868d90cc5bf2e90998d79be79b3377d2dbd7f42ccf71e7e9e642c74928c8fc1c5953233375f9d360342a658017ea50daf9ab28acdb2a0f924aec71401f6edce29a96ce8a55c742a088d183c058d02bb55f053cf18d910dd092166089c0d02a03bcd0b42ba8db3d7a9a9c3790a87d9ee86273f0d9327bc471619cdfc82af89bb8063dd6f692375eb68eb4d855bd9f7f5d90fca4e8855ba061d37eeb885cb303cb7eb8eee4e61645503cb46bc82af9eb68855a164baa8b400f6764865c63f840f3416dc5b7423b7668f71dc8cbffde85bb8467816d7d6ad48a3c01900026e46c8ef003950cc6f8d094d855a59556ebfed63dde3eec7acdeefff42501b2c5f7f9f9bbbae2ae6eaa3ab9f533e8133dab87f99131df156b61a60ef9743ff72afcbb9357b9f4039e82e076dfae841c2a86813dcf7d73fd1c0320fbe83ea39002e7ddd1907dc65cdfb302920a04367d946ccbe2ba9563bdb9b942901ace446e3f2896cde661d5e0595017090c7461e32a851b26087627120e86daec119173e5a85fa758eaee4afee19294ea70fdfd5053f9a0de669f1b81191e8baabd8ae883bda0850564c3512c34d1216cc7faa839dad0d6e6aa46f66d113b2247e562f8b4b7e3c9d663df996ad1946d8333587702b4380b26be616f70a07af0ede6706bfc465976d619de2030706163b47c14b7a4eb46e5148887144cd365619f4d0104c7e080ffdf4e58a6e1edbd5f009b91ed64ebb7c8c01753982d3536318d3e88b7f4c720d170bcac1924041db04078ee4fc71f91b26022c1c0a9ec11b645422c60a0ce7abfe7970ea87aa82cbd2688a62f7b21ec513c0eb259d190c5a26d246a68b5738b3651704a62beb0a2c2da67b6b5dfa2b7fb72a5db8ea552413afd4cd4be89ac27a275792ca99c0be1e60e1677118ad0f93aa004139a2528f025dfd6e23d1cbf30dc3b74342970495bbe137c414a4054e956e40ba0b4dfbd42a1b3832784690a04d393b75e729e494eb6bde41df2a03155cb2c4a54b8cbe59605cf201220a1fb4ff11163955701a7ff317ea2bfc6289bc5b707d2bdc7a58c10c23632689c1458ef1263cd776cfa6219b59d53b8ca2ec0cbe9853965a3516d2ecdc76522ed515c2baa0a2edd0bdb69ab9e28aa0654b6d34cdc56d83d1a968ed8a7ec4208ef76ab8b1fa363b8cd87a1bda68f9be7c2b78ccd50fcc5d5fb2247962cb14b8959f5731ae50df7f161c77ccb7e98a10d7ea660fb84c8834f60cd2056b1bc4ea6addfdc5d4b522b99df2d2732b71aacd0f1e90f2e6571f2ec29c59f2bddce4cba071472adcbcb1dcb707ad82b8330e40d60d2888a1396d1d8f2e22a8becd8e2c0af8a69ebb73c46e0810e30d54bae28e40bafee262bdc09de708124233ac84e58029bffd8aeb61a94529a5e7a8176cc1e63749a9b2e58b07f17702033a9ee088b4284c920cb1bca24e9fb77ad7d8931dba177e52ed5bcaac3e47d3685619b004b6d81118aa24d64d3cf75e5dab2001fdc24a28a6851696b9d4dac555a99859915039a104923f535f86e8af7f28c2401faaddabd91a0a82b7704a1ed035cf3909faea2388cac9f556cb7e9dfa797c74239ee45ac3cdbfd61901e96fdad58bc21590245c7326b40759d7464ebd09729ab9e6ecd718ebd6d13eb42cc3fdd78fa460c71bf63cf15fc809a67d1f25c5166757c362900c4ead97d779d013f7b98a89a4cc2d45dbfdc83e03396a285ed66538f989f5141645d5c18d486d3506bd29882e66db8d6919ba408b37a7b620a31513f60e3d3943a79b2cab5ba7b8a835958590a3b22a476d7a28ddaf061ccde46263053cc976d1f04d6bc7f04a73e186100b1b644ac7bb8c18c1b1d622dccec4246b8f2eb9ed7ddb7eca11d9eb50cebaad313407d1ff27c79b5ffc29ff5ab87d83c44603e9e5fc751f6b3fc9efa9bba28bf8c9e0f06c9cff46d1f977266bba2a1b0ac5bce6f6e2111e604f9bd2417ac6efce9308b4b7056460ada6c6b88419cd602c3750fd692a388437e8f34033d93bdda329a15195891312025e173e489e56c13e108c3fe8cb3ccdbd17bbdae681e0e9defcf71a943e6d1e2cade3e19ccbd133ab619f323cfe28860d34100b6f936a9b5fa3c777bae8cb688f6f701ad0607857e6874cf7de63b028d9131781aa740d97d0c477456805f05977e3a2f92a60eb33d65b9ddc3adb80da87a7fbd1aedb9b729e6dfdd3582245c4ab73d8d347c8ac78ae5bd6533d2a695cb6a8b9e875007b4919ebb8deb778693d181f4b7fc2f8d6176f176b418bb20d429341733bf285575e1c787e407be2ae21b1a9df815a81843599a2e15f4349e8c9f310415a8eb1c3da1fb19dcdff9116e76b9d46ea3ffcaad8ed90ed216b3c2c0b1a82818c1e2db226f18c60f2020b699be3cec192cf5c9b7bed4e074d2abf8395c98298360e8e6d9fdb390abfc8a3952224789659c5600e651d7de141ee51fe33373e9743cc6257a3493b85eba553a22fdfd47a6ec87915f55546809e90a6cfaca7438c3408b7f01cb8bda33334dfb388228f9036a77f8a64ff94370751a6b39820e1b3c6e0d3fb64e8a288d3a838a3beddb11224208530c46c186311f99df80741f3d11dd9f4f224a7052753cc46d4b9e7ee50701928159f4f1828e2225f0385d873b6f428088e6ba812c98598e92c261032478009e6f7ba534931e5127c2019e9a1e44362e0a19f510deda91adf62ba7bc9331e1952d62f693e7b8b4bdb0fe109358897b8ea99dc0ce562ec4922c78bf74481ec448bb1767cf56656ee771ac4cbadae7b5e61d89435de3e63ea1a06659f40a903e038996855881001a1d9c1f571b05ad7d49c5fdd081622985752c29bea0de72b6d99d283ea9a38ff15ede7ea08c314ae37f456b92ef6982627a3c8c1fabe71d4d25f793e3d44fd8c0e61ad709fee5a76c898596961e6bedb35bec4e04604d34092c21796c677e4c5d1c0bea0f2fdcc81b78b20907833902dfab5068766c20ea18e525cd8bbe40d05b78c6fbddd0f600ae416bff663b66d80f822a88b698b6ce155134c64b745ef045119b3b3d"}, {0x48, 0x317, 0x20, "836eeae56756acd6a8084719be9cdeeeb45e2399ca8cc6e9b3ef8fce2977237272d71bdd2e3f975d09b37b5b402a919f3561f92b8c12"}, {0x1010, 0x116, 0x3, "5478dc4735ddd2e7b8a05591fb0d4105b9c3afa7f79dba8da65d40ad36043f72643b2d5bb49924492e480533fff54674804b63f9383c1f926382fe6c70d66d743289d2d33f1fc1eed589fb2ea7560d25c639a2973f09e856d5c850add8075d708d220c4ba61addaf2f617597e7f15966f2731d57b04924d6d36177a7e8bbf9a9abdbf37abcad96d1d524db5508835174029974d04d89174f030347b9c69c59e8b6316181f6f92cf5ed06f210e340055127b2d61a83e03f7c3b5cac04423eb0843f44f82073af09ba748ed541efaaa1bbcfdcfd7da7c85ad14fa9a6b79564d0710d0586e69a6926e52ee91e99e71f88024d03841108d5fb2b8fea48a9be36be7858ea1eaa299da631b5053655e4b6212d0d190b09bff4521a057de910a862dd986a27ab2053435894745b445e367a612358a2ddcdc10d8d2fd96d4b8fca844dc8749a69ff1890582440e0cbc3694058d09eb7fefffcfebfa0608b629857e500b0b4b8978015e0961aa1b84895186af6c6f2ef9d49d8c5c6c4cd7c876d2acac5a83fb25a372fba48097e3febfd3e7eda65965f36e0c8c10de306de51fdcf75eacfc05fb680ba5cb9f4171f7cf9c3ce1f93ea96ddb2e96d654de005eb18de6efe4521832a9c1661b0367cea9e1803a87a165d4ec722a92a47c0898adf0a083b1fffac15ee99b8e5aa1b11b563fc4ff7e9e33aaf7b0bf452464e38efaa142de6d1fe14fa3bc7d39f08564612d39268bfe8e04b88256f2da9a2f2866e0e267574eca59bf8fe725f6ccbfa224d97a7ac865191f68ec176ad1a2d0b8403296ed659ecd3fa737f0b0d596b97e255c88cba5c2483296dc6f612f1bbe2ccec28c116401fac497bff34dccee57840b61d5da598ebb974645f8e1ed06d3c78e1657e9958dd5a02204b51e2fc0ef40dd2b08662713f46f4a2ab93744e4dac8c7cac5bd4abf30cee693276008aafe36d010df853dc9ab10962f7f589a3b38ebd67cc5400203eadb5f7e283ccc61c94ae569dd20937d4f1b93fdbdae63a378498f49186d4fd5125f251c984cf3ffc1de464dfe88d59af219920e53c22cf34ad1e586f2998a9e0a0149c307104204833542bff8d543338f8b0ea15bfa8131b43b2f31616d11943272543a9991e366416815caffdd1162fbc829975a63bb93e1ba4c8042c0c7df85e977d755bdfd3ff5bf4a29d118d5e5c39d77f8588e10885fb822bfe86c378d57d6d4818ef93b92270e803420d78386d2dc65484bf282fe8ebf52ac6c5c0833056e02084b3d27665e198bc409cf9fb7b35fce0ee0c5f702ce76258627a0bb039b3e05ea2c423cc728d8d583f169b2c7c91c4ed682f74c02a106ecf9965de538d4f69a0e30cd61fbd554605fde5bff7e6309c5341ba48928be91135c4c89dcfe013a313770a942e44b6c484f1cf05ae62e88429319245dd2302fb3562ae5d782970814fa0a099dbc44bcd9a5232f7b83dcb36f14e1ade696d29394043ddfc53785a7cda872b20594a982d500c1abe4b30a176ec6652c366f7eda06166b838f016dcd171322d8be5d44fd007c45424f560320e128869ae2522384b9fb7cbf85e5c703413475827e95fcc0d56be6746ab59200593b7459835aba9def62ab78165dd0925c4c6e42cf42a0b388dd1734c111427e5a19631ceff81e9e5c22a16f6e5ce76a97cebfb66cb070e3d2ae51cd630346321a654b5b5deaf3f79b5195656bbd9c50cc42145fe59386bc68b2d3ffdc90c02b4c92f01dd435c3537ac83973e9c51e951e7a523b7578799bcc1bb263add15d5b64ea6eb58e1dad13271dfc57bf8ba5151b79f311cf4c09104082eb58bf72932d278452a434d6a81b39aef53523565f2c218751ae1fbfe1c7fd7134d14d044329a57b56e6658dee28cbfd7e018107122f240703692c083db517f49f312e812affdb6ad55fdbf92f3a83f315dfe049675ce3e838c89f65977634a2d0bfe31570d5b49d2ef6b432d12bf246c8f818ad37e64ae2cd67cfc4b2c058ef4fbceb12160a29a6a029d6a0fced33cb9def14470aba55afd7505ce5b768c82d4b874521fa6f52e05cc03ecc6893a3bb0a895abada2ab3996e86ed84f9743bcc2918ec4e89f1a91834a74e7452e958d51eec32e20ed22387d01784224f4f277497d92b9d24ec93ff40594e33fe9f21f3bc7d77490f6335912c9b7cb6e672972877bf2f78a7f3ebae614f147052f619e6d0c09184792d3b6851b4900a2b186b07faf4a3966024504d3bead6de50f51449fb11cf5e4e74511624a9cab0ea2667e8fdc8e7af8f54b23d3b514b5c37f11b42ea66b3c5893fe9d564731c20b608efb7128163bd0cc671c5962f6f72093b7a727295f778cd3e7e375f348b6db5a63cb3e2bdbb12b4a6bca00f03c73eaec8d6b472debe58df2d1d4c8f5e772bae0d59890ded351777ebe2dc3ab9b2806a615434dcd16d1c354b93c862db663b8d3dff8a3f654eeccb235637f2f1e19812e8e6d7343f66ccd0e64e175af3f9ef27dbc67009dffd756058fb86a4b00f92c09b71d8d3f62602f7bcbb53a5bd09bf27c14d73b12f70cd7b19c880ec8a8660ae81d42c8de36cbbd974360ffe46d2ab2ccbb8fde6bd6161afb5c02b8625ea536d95e0a47bd4b9c22b7eaeb278b153406a2d10d6bda8e31ca9b36ebfcba2b777c411346430ad549cb4aacea55efaad546c788406ab99e956f2a0b43c899949b43bffa7d4ec35e7c2e93e5dc373a5df514a06acbf43cfaa3a9262b9d51dc4b2698681a3aab563b4cd31d8adc0192b0c04f3b6cd65f5915fe948aa87f2ac6b57a66621f06f68ee36ac745bd41ba4da2f49f6af1424f4cfe6ede1e9d8b2cf270e37577f84c882480276d30606139fc2c6a4687bd826842f417cc70a8cee3131a4e6cc5b97645f1e17083fb608c2e70195c6fb88c8cd50191820725a9d0813e4797252cb8c480d0bda4ae82eb33707ca1f8fe4da4dfd457a21f6bd828c7aa74cbb35947590c7da19af6033d34d90330a4839a2950a787d9771eeaebf6def0bc6f551ef8c10cd5424e1e27fdf449b5b4859adfa5b39bc1350260c80a0493fe4737b004a865f64c73d1e62842e1905e119a364cc9707a2c99fdc57f7497b89ae4a7430465e40a7c1032df8bee378de7ee875ac9ffe6a9163ad134421e415d921548733f61f09a7dca956d919328ffc65b88c1daf45d902f0dcab3362e6216a4b045c2885711196baec38a42c601137e74a84c3ed943367763d5ac72d8fb615176701656d4f204b05427810a9e4570c4ca86d42f415e4a54194358ef41282338c9981f0385fcda59ecd354d6c06230fd38a1ff6b05255cbbd4bf8957e3e56b628e9623268cba1822cbc4702dcfb99e76e912be3015ae5aa97d79f0fc93f69f240429d08d5246dde6ea3aa799b5a0313ac05761d232d0fc1fcc4e25d0c48602115e1b9083fde87b79f801c0f70c6a04776c72e97cc03743612289ece1844499f2bdb7d10faad4b83878351f7d695fbe43b019aee5d6734fe40b42fc7ac1da33481266039bdd452ab4ec839d7fef09964d3dea8f3bc8a15a531b6004989cd7f0995af6cb80d572ac548e89f8461b0a9a5102a55963f222065666516cb06d6353efca9b41b55813ef8db3b0a9c9fcb5fcf30137c052c2ab515dc552bc0cb21d6f377944ec364e4854d937830a9eac83e371dabe3889f4c74c26575ab173744b8e226e1b17776351ad803cfc2cbab7441f678ef8ddaae30f235a17e391e1d69e9cb190387f83ea8bf34c8bedfceb5c2024103e61998919de1bdf776d42cd4286226f81577d8e8af750cddc71fca8bcf7f77fb25619de28dcbcd31c186d9820d31578431fcb30d6ccb4e4fc198d29165e48ca974052fa60515c92b0961f0b74484f7bb30538a6a6e34992322a69fa6e0b90e8cead45a84e78075fb74c4ca8848208dd84edef37a0beeecd250188467a2d360233914395f04f9e455153086cddd4a47ff945aabf47fd9f168845dd5ae8fb4a41762465409b022a295fe8f3c70a5a47113c757621425d281cf233e34f35b2e3cabf3b1fe194df7761a3ebb93801c32794b69d468f9b0d33fae9e29c787587ca03cbbb5af0ba9ac91156e86e05b5199695d8a44fb19ce8bf788299ed2f26476267376467c1e235e00c8fe4dc3e148058eea95e641e86f33708b3cc43022f72835b1181c382b3e6b2258c66c8e08e28598516d57da69940ff88978d463d52be4afe8b0150e1df3176315eec15201fb6824df368cea4403e3846cc572fd5aca58210d214d76a77a30215e158fa2e80711cee035e314390caf200617744591288fa754f6e6aaf6ee420105712e30d8b131ff3b904a1ed6aa887177b71d171cb9c185499a72a813397e2aa5984bf9f351c445da77abf4286c5b616adfc67e2d1a1a884fccbb03fc39cb1447cf7cb8027264b3ec18bbbf453413406eb9c31d5439c152a3a0f0139b2a1639a4c55920adbc877959f0d70b304a9277cc200b16bbab20c98cc98f6125cee4585ca3ea5a04c967edcac249bb609370e188f9a8389c2f7f133ace1e858e6d21a8f626440b74ebe95f17628f826d46167ef22b9217f25ad90e77ef38061b5bc9b166c286e1cdbee70db370b853a6dd27d021f5bd8724044c6c1ae8df1e7825c1db0b30e25725bce14046850a36262c770de86de00b72577f1cf441c3c591f4d9d0e18cf10642d27013d951b9f407c22c91c29e53cfa6bd4ddb7340bff013fc63a37ae9b7c45ba1a17cb5ad14ed1647c2914d4c27f2eaac504120aed220ebb8e256d63faa5ec64d97e2d72eb0251fdb16ad745053d45ad5d287fcf0420ac43f2878659f4080faae71b0e6fe4ce493751b8ebdf29b07b052509edb9044e0cb52ed38764b5c7bcc602c3480d43ba386f850b38b8ae8ddb5230613d17cb0530968199b20349d3844dea8ba7d1f37183661acc0371ffdcb53f18c161add119b2c09d72bed790bed699bb43688ccda51d4975341db05a5895633d56a7409fcc67704ddf0de6fb99ecf299326f1f13ac77dbba64d07cf71154e5df2925852bd3574915edfd454ebe8edf7ffd07a5c2c2d69a1ed6349b5e0c622378268c3fe5fd7e71f25427083f065cb0ee22d11f02b03f3f770d078fdd7029ea3c2aeae0323cc57466910a6dcff1009fc7b307713b30b3d8ad8e87e5a753b7745f4ece9bdc9a71361dc2c2e92912c959cd51e28371f28a55cb0902f72a66d3abc23cb4b69a6501e019fb11709fc9e5974982b1677946d4d16b458184cc97995d6f86c014be827dd521c9882f842fb4019e6e23c8d3bf5871ca87844e351e16216214c5b7d22d2325c9b419580409b87db6ad616e1d841d5ce81a35be89fc7988a5530f0082e0010b8efaff5c56faa42be21902ccdc55d69f7f666ea86a855ce4e4ccdf50076b924af549c735bdaf5f137bd1a04e7d51a7b8b0040fb666cee33c6f667cfb252378923635425d0a7be75193535e97c4206a50eff57382e0b247a076afd05e11ea329c5d27c116b450cbf8fe41923a83949e8de54518e86d8616789196f823ae95500175bca656f50c81df769ce4ea3a1c1694ff39eca725237d9e378486ee837232519003b79d747020eec38e9785046bca7d0a2ecfd4efcd73aa9b5c8d9f8a880162f7d9a97b29b8fc73dc9cf8ab1710802f3ff80f8d6dcadc12291d3e27e980034af851e1785744c9fe3c7083aa851b6474ddb59443087f0fdd87a46765bc29394c2f6f7fea8646c37b4cee6153babb4f8617c7b3aee9314dd58d2031ced10cec58383269b87befd246708b9dd3c28ad2ac17f9bac61272ef78"}, {0x80, 0x10f, 0x1, "dba0753d679f7fd8f24aa0426cedc754e59cb59fde24a73b94fe642c90b830fcdc6f1ccda4e0d3e6cee40a89c6ed012ea4b8280935aa2224c6bd0ddaddb37ae38a67a7fc669576983cbae684306fd7aa5805625730f90602dcc9e7b98e09e827422cad82d36bc009a4889ec3b2aa5e"}, {0xd8, 0xff, 0x3ff, "c9e0300f159b9ec5f06d3a5ea3cdc9cf3d60aff07ebe50cfe12d5bc2ab38d44588469df101e138a03724a9630ba1af1a74d5cf54fa490cde2af08b3bf1261e1087fc7d70ee26330ced165860390ce1ac91fba591b0f44b821fa332020c0320d6389070509ff638dd9e32ec43b0e9058e297db6e0bd819fd79210345a36427000e5b09c613051bfd0caf0a525364a9bf6848cfa5f602d659ceec60df28fd8752aa24efbe8c7b03c975acbc13eaa0770543bcb0f1e9ea446f478b189adb337d5509dd3"}, {0x90, 0x1, 0x9, "c372430fb5938eb8899af1368a39d5fcf29362de5e1666a41907628049a8c44d659aa0ea520a7dfe5caa22def5224a1a9167b573d15f10d21faf47e5d996599eabe8f25e6057c67528fd0925dc68fed156c67b5f1f3fd56b97d5b35d50c0a3f8a69573f15c1c46d6dda8075b1dd55b2ee9f924224cc566d20c98bd"}, {0x18, 0x110, 0x200, "ac40c3160180"}], 0x2290}}, {{&(0x7f0000003d80)=@isdn={0x22, 0x5, 0x3, 0x5, 0x4}, 0x80, &(0x7f0000003fc0)=[{&(0x7f0000003e00)="67cf695f2c6402b9b05c0982d7d28591747607c135d8e3a0914da5dee1c88b645a8d51f5745a3edfa8784a8d9b07c530d1bb6ade4bb4ab5f6a12fc54e293307a2965c39c75996de52f58e17078d97c40930341885720", 0x56}, {&(0x7f0000003e80)="22144b86f960224aeab5f19076d456fff18dfa35d97321fabefd942a0f2e9e2ab8adef3c34a54b4cdeba8ab6bc025f6e50ffe163ffcd7b0a3a7adbcbc6f083d5f631e975723e3abe613e76d8d7501b84b87d6569f6cd3c14d1a9ff8fa5068b72de970e11adff8f8e1680c49c370b8e4ac7a6d5707d2c8065056d190956892f899664d27298e7d5f624fe65a1a65cd75c3261899d39f56a0b151b47df88066ebbf65582b8a7d4ca5de4713c8bfbfe32db552c07cffea277f359d14a97cc9b27", 0xbf}, {&(0x7f0000003f40)="aa32f2475b60c87150ce1403d42ccd3eccfcf14f87e2ca7c77298048553809b1566f4798c0d5626c5e2acdd44f926c1fff75b8cbc0eb7904bad453389fd17308ca750603faf773c0c2272eb246fc1a5857bb86de10beac1b07b16041c5fc2527d7952b5e001c591f", 0x68}], 0x3, &(0x7f0000004000)=[{0x60, 0x113, 0x1a47000, "16cd20adfa0751b73a988a29d81e21c03fa20c83a968bfc51011f6f52aa3d8405e6dcc007befa879ab61cacd5b44f0c6303f616fd12b70f00c16f5333087271d81b452972c41755acf36fe646117"}, {0xf8, 0x10d, 0x8, "6947e5c943aeac8780f230fbde4a7cfb9a4c30803d195104646f6d8c4d1cfe17c713a0c97c46f0e94cbfd6d4fbc17bc15abfbdca367952f3ea718292fd62ce543f0cc133d4090e4b131c8846a0b5f886cc558e8e0a3f8d2a00e108edf789edd9f58cb2539d987c2f4c67d06167d819a60e329054d8311ed70de9fcdaf5e09dfa987770fe35f69b0bce4493a1f8392047eb389e10a18f61f03fea3e47b3c3df5a5b2fbc86386ae0a5266907a871291995e1ff590ad11c0434334625021e72e1cef7ce9cccb1303e5787fec421ce2f621fe75bfcabe7ba1aad975d5e59fab1c91c9aa520c86185"}, {0x68, 0x111, 0x1400000, "f5b0bee644297cf0045278904142d5da70783f2dde2c6b21a2ab8d9c3fc62028a8243f1c85fca304abad6048404a37af1eda80cdbe5790d74d059b5fcafda6562a208d187dfb7796877da96b3fa741c0c42be340d0dc2373"}], 0x1c0}}, {{&(0x7f00000041c0)=@nfc_llcp={0x27, 0x1, 0x2, 0x5, 0x91, 0xde, "c2a35371248f28947b6127bcfc6837d6bc1d028c619f70feb9fe71fd648527d2e556f840e24f030b9edffa11d16ef52b70cfce031b87ca0faa4577f3ef9e22", 0x2}, 0x80, &(0x7f00000054c0)=[{&(0x7f0000004240)="b8d626a7e6e2e556cc785ec4a56f3dd304b92dcd9378e4c8ee415c8fd85ef19d83181c798ab54030a60717b2981b5b739483863190dd271cb6ff3ff45b4c531310773f96c475360a838d9b1a85345bf69d9dfe5aca477bdb6003499661ed1dce77a44b144c6250d8161dd3c7185ce3696f05269d08c1ebab027c791e7193ee97f2461f310c4fd6149c8a5aa7b436ffafca2db4be1ec50ede402525431f291c889e172eb4ec5664fd0eff756e44fe2f5d526b2d344d3989392157a8c228ee2d030748247a6ec7f9d6441ded6a7f12e03b38fcb8bee3f8317bdbcdc2dbf164e92a8103fac6547b12f2182c15eb5e4e1fba6741b187", 0xf4}, {&(0x7f0000004340)="c55d5d0d5b15f5108b4e64eb798cfc0004ce842fc16292851cc51a3dfec18df118e6215190e27c7c26d0dfae0d6a8e105c39ed76532be42c353125115699d1a179cfb6a8a614885a45b1db364910eb3957d83d37aad40073bc1ab8e969b05a5635648d5eb71fb968a11b9fbc703b983f49772db479d5b8751b9298737a766c4aabd4c2048ee1c6f341c8c800d766255b91cbcbddff7390f8498e01a52d91228b2e094c4841ebddb2efb31ca64400619be84fb86452214b943d2a4aa5cbf4b3768ca5333f91f441a1340800cb757497713857fbd875807f7f04510ce483446c6e4f0064aa06e87b8a77c2b5a523fd8b3af13f06b103abcd", 0xf7}, {&(0x7f0000004440)="68686ac00aa54823d9c48c9bc9708f095111ef76546ccf300633f723aa8ecc62acd49bab4ea05475f2135855ddf3add9c1", 0x31}, {&(0x7f0000004480)}, {&(0x7f00000044c0)="a448c0c18f9c7bee233464d5e050e5099d1c3d7a5fc9c326460394078109a16f7deb3e73b6bfced239a179595488076ae901229ae288f52c924160d04b95b023aec25204265c8d6c5a496c4fe91f612e8bd4bd8dd8c756f834af11fd30b79df0b2ec759ca93d3987c44efa91b48d4212910bbf384cc6a308c0ce9769a2c72d0ebca567cd7646d44f8db276718c7b3dfbeb994fc5403f1a0ce2755ef22e448b8da979fa57edd7ab113a2f9ed436604374b4d11a49096f16714b703ef0d31a800bd95b0c5f3ce72b54a47674c4e90b6a7a16654ad02dc7552575601d55c12407b4479848098acb27c3fb37865e28ff8e8e27d8c95be651ad951587274263a425e471635d936b36182ca9917f666d06f985c16723b22579c7fcf11efab951f242fd36b2089cc87e842b67f88afb8379cffecc8b465368c74a1c36251a0655558dd5ee19c2842c67a5ba46d040225d3dad9744ff533581a3825d4c0856d7defa7c9b1c0128e87104fc881e4506abcfd1316da65a938a250383eb63fa980a7cede51b4fc8b59339c083bec1a93748c4f8fd919c1b5c8786dee8f0ee4923b209cbc5b428a013247eb55aada555f0d55e78ef5f50ae07dc1ee11973d93a0704fa92f10f3f92d18dd901b9a573f09dcf135e498a58229cf83deed7de704bba742584f4ba337bb76c1cc10580701a2c110838b1ade7862a3c4a2b002fc4c7acfaf69a38e589ff4d4adb6556ffa2f90b6baed1f326491c69450ff5addbe14eb57cf2a8f7388c726bce7fadd6f9655a89bbc3f73a65d6fa3fa465390e8e7d79e7014ff048ff0500826afdf694adc90bc0c655f6a902c70271186220147e7bc945159f073152df05c1e3d2fc91a691b1de3727c30419b7597c87b1352b438bb34c87b57041ae58e4ce4949f3d5bc8cdd53ec938358ce1d7263981c2eed15ff217983dd741cab54ee2083e4144b42395a990dd26bfa5089e52eebebd5ae8f5cb753208dfc68a14bc64bb0195869ddc2d4cbbc923da4821afecb1e547d0a79730b5a3f97406c062fbfef123f113e6491e7bc47f0627fe0548241f8ab37cde8f6cf0c5a5594c55a26e2de1713f53c3a5f629be25a390eedb7a44857b9f2d7a16fe0eade862fddcd81557ba62d3a49525156129e885c230e9dd7439896d5d34b5982af4ae0cbab82fe1e03c96f8cfd0ac503d81001dd7e70d7ce5c69bbab8ca935f04e246a7ada1a662595dc4e7a4cbe0ffa2fb21b988df2b902b7e75c99f983c48c6a302969c13accc0f544053661933b16aed001846e0e399e383611930f0ce1a7e3a941205946e7dff68f00c1e834e63f43d7c08b0c61aba724a1276671974a903278074e071652b1cea0f0e85dccd4626222f2bf690efcdf5070b49c44ccd85ade48aa7758f44bd09104dfd73bcb23ab531e3894d108218c4776f027022caeb499c613b517a88067a6c0ad06e4723ee6a46bd245f416092dbefdf92d691675666796754c494d808932215972984a920db0fd3dd0ba35ef1d4db9940419ba9d0ccb38237c17568a554360599c5643668694b88291789309285a4ef570bcc1d171feceaa3ac3086f251838cf12aa2ea3405cfdf65ea02336cf6aa5d2fb562e0cc577215b13d11a6425d1379432925fdd4d482e2764ce98350b645b7e14c4df0c2317fec04984740ebc09352da641d918a26d389feb23214859f859b0144064fd2b54e3def1ddec666d8af69eb90c034929c7593c0c67bf70ce3880d51b2be97f21ea1793336dc2f3cb299a638a59d0a92c4672cc02467567ae68ad32cded3bed9d2e3093554025f741102b8a3c693b8748c16b320d05a08eaf5392955b954129910732673be740dc54ded755620b2bea4023f9d31ace644b4ba8869e63ec0b55ec4d473da9d7eaf5df308ccbd369aaa15a53bb9ba35c6bd8cb4dee9727844c1272e0ea4c48ec9f75e8406e4332aa1b246d545808b9277bacb87cd22aa6b31a0f8d1fe32cd32b2178b27598df1b4da7851f63ff7e7e216ef1a8bd680c687eece28d9729f9d3e7ccb638d4d4e87b1e8ae2e53319db3fba5b426b25c5e1ba4f76c966c7d8b27a058a46de3646d3fdd3505f2dde707c6ce397ee1d55e68f983cd18fb359f1c2fd46337f66133eb637af67ff2ef1eb9c0141a7612b013a2d73973b788cd6889325482e555d3e686f1b01d37a3074eebc9fb6eccc1be33792fbd4b4cbbac0c9ba392458515c4f447bf3286aa48cb4f9f1d14ae41f2dc492749a2ee386c989cd712c0f1a34dd4f885dda2f10b7a80b86db0eb2f8763c5521b3cd00185f3b216770b24bddd37f8cfaf57b9ac233b7ddb32f415ff5cd34e6399cad491f828b03c9a45106a805ded9d645c2f04527bf8a5cb4e7081b3fc66c0a9df8d5ebb45057877b95d4acc43508170463abe47276451aba7266f1f51187ca44a43ceffbe0b3de539f4729815aa3f4d78be8f3b72563bd36539d3c59b1830842292bdf15d64f39834d8648bcc054e91921f71a1ed8e1815691957b3ee3c191527b16bc8b172cb235207550646a612fe06f4cafdee6c57573b74691874db6ef7daf7fffffcf1453df9a8b1d59571282f19ffe1ddd9313fcd521f994268adc2560a7dda78b8ea3472d5f933daf48c7271dcd6ad810cd3c55cfb7a276c89d8b82554a151cade5d99edb1b33a93a8667e05d1c08876021a753747653da8c271122568abdc4543ae945ee17813b4aac0c3c9ca7d83460a585d6e473b552f3ad64783a32ce45327406c7068bd1fdfa6f5237de06a37645080bf32ad801ac7811249f3f89afbe5752619262a711dcd93580cafcefc0605c5039bc977b1bf4e2fe2dcd9b8aa5f880d7089090627516efcf49632390d1b0ff79d5ceb8a5bc78f17a286152980dd9a7b601db543e5e4cb413b7a90c7105f9a1be3108f2ef7bb8bb8a2f42e930e51515a5bf77ef79418c6fbe948aec51ffde2cde3f90bfc3317a3aae3ea11a2d708ed13784d6fa1c5578fa39c8935c0f0eddd57d7a3f496f06f469b183f59bb408e364e655cf7a18e6f7d30706fa9d561e904d22d3953e920800c51ebef9dc31d0d44220ea618d98cea436dc6b8d167ef561500834db1639fba0690e3e80d6ca8b5efee973f603f38dea2f4335c253694285ee3efbe2d6b984473a4f900505de1e02b2676f7ca575b5d42b040c191bd94be375350691d3c19cdf10c06e1c78450f43ec6019de0d9e2320d2bbd472908bd0ccb80b34bc77997db4dc5bdae65cf97b8600560051648c5181adf9912dc4fe7c8050edd0bb4dbb2f535e3bddfb4e496001d9549d84a73919fc125e7f06cdd2249d3b7962f5cb8db69a3df3c6d7b4183014b57c17c3de460cee3b8f9858c312488e66b2b8db689098945cbccb1b0f73cb99f50230b05fbfbf6b5fcae06364e763e7ca295bc986c1a96d458af684aa1d551d606275b32fcaaf6158d7a1af99db4eae67551dc082862df52f1302cb34f32680f0f450613aaa76aae830365c4e41a29b2c3a3e43aea5695687bbc58b0d6886ef6bc7ddd6fe0a63becea130ee220d657e2359bae4f2f94f42fb3d2663a4d99da01d5f7af5a855fde68b1dfc0ac351796fe87137fe51c3f016ce37340ea45fd10341bfd33b48489778242f93b8edff70c18f0c492a2a6539c993d199d0b674bcd3d2b18033635f970989de06daeb0eaabd51131035ffc22dfbfb3f2c1a9173cba4744409f35841a4a66a8756ea6786c82f8e8a4ad0689bbffd6863f1ebf0d1ecf045678d0d19c7dd4da71465d78c146c6c58260a229fdb777bf58e0cca944afd798c89a14b43c74e192bda15e3d5a9fb82fc9ff335766145ea109679bcdd09691fe5ec2c18ddd8ff272ff7a75fdb42d0fcfe6b3499d1419edf5c6b26d11056240781810ab95b949c3d5e8db563e12bf8d4113e5c1b69060b28dd8c9b0c20f3e1a89f0eba477cc19e861f67ca3de1993aeea9513a912ea3f567f5ca9dd2d54eb078595c683af1dfad205a04fa8778e6e5bf413ca1a9f4cc90d1c8b53598960b022228fe88efa0e03964cea0ebb5aa02573209d94254f5ff3ea8c9f8fa7e20fa52961e6bf21ed322e200b7cfb2bda5613f83b0a901808dd6f58102456db2e3e20cc9868edcaf5cb91c6cf7fa91b6e96d513cde1523dbc8491b3b898510b421ed1546c1f6aab15bb9d88ada7495da9cb8e738f2ef7f6dd9fa628b0cf2b1cafb06beb0ff1463d17b8250807aa9ee3dce2598d0d29dc794a8766c5be3fa13b6d2a6dcc5fe2e1b945890acfdaa3ccf8ab9743def31dd4b907a0502e2c7551160803649583687f18ce6186863007e3b35e76ea149fdbdcf3dceaab6cd9a2132fe30081a2be3f9b3753ba54ede982c26eb1378e9dcb2989f16df5a3634db208f07f0fed650861e139fb4578b5e73f8a357a6fc8a267be3e37be8ef2235a2f5038f8e48a2759283ceeaa9f3e6c9c6c503becf9a693a07556943e1c439b138ecdd561c7665814283e449c9244e1ab096fe5ab253a49cd6d0b807149583af3e90cb472ba64124ee5f49863a6052a4198f5ffbc3cbab675ad22ba97489b5d3ca068e264d675d5c7cfbe2d7ae7ea0cd1362dc1850c4354c3b49e4cb6c3a80b8e46b94df0eba16dd3860abe15b86c3147049d29fca3e1335eb0851bb6fd00ca18cb60664d5b6edca78d2298e58c91e2ebddd38e70a7cb945f829bc68ed2b0379fa7a3a193e508e873529d5ac15cdd1e6c541800d4100041896179284b7da85aa4abefd364238806b5dbc51fbab7c9794c291837032e9d3e88ee33a7ca6bf8068ea0f04c34a88a42a34352a603d8776429c6d32e529c9374cc7cd15fc8e9f5adc936397d80c7f12c39770905a238ee493b53274553d0135a6bee42dd81559f616cfe52e9566b476cd9b5ec058e74dfa514f2a46754a82d84afd30b33e8678091c9c140e80f51561c9d24cf0ffcc578a6ca27cc433888deb0e057e7c70ada4ffa3138014c0fb5d8ebcdb18f8408589a777b375227e4c60f7f4f35b3b732a76c14c9a80fdf38de085d42b96baac74485ae6162290a31cbdefdfb9f7400389bb542a206ea734edc82db8595cfb37eb3eac7d22e9b7093ed6216125fcbe7e228129b5e0d8f752b41ec60347b1abeb1564d82fe71a49b7aa8027b149a94dcc00ae5f5fe9d4f104a77c420a6f806f20950e2281e72644eb32ecd1a2e70472f90af4541063cf6b62ed43f41a457a4250a1dd7df208ba4fab51f65bc45b368670b459c3c0b3443964541352bcc4d183e12fa0b76a0e733dd592f0dbf1b07edaa9480a829c4652b9d4beedf86acdcb1b5d316d42cfe19fd2de1a5f4f691f3b90d2c30508c25980d3e1aaed0e2d91eac74595fbbeb03911dac714a0f9648d931f0dd60838e6087ebc4d248d84e5533ce275d37d1adbdcf97bc0bf3847dfa657402e36291b24eda449de0b7a196cda9ccfee812988678cfd87f8f8231568023d2768726bf690e9b7c8c6c354b459c2d0de1a04e6969affb278c191c753b20b986c1abb210664e5ee7e1e6d984a9f847238a6951fdc1c3c22bbfb8061c23b332be85d4c98881cfc223f833cc17406ccbcb087c7dcda1951e3dcad63f25c8b31d8fffa2a2688c8b006f191e3d161b981ad3232ed4bee865236b56c4e27fbe19ffe4e2aa1b009a2791237885d361a1027dbde1730be4c1f097938e39df539bf38e2c8aafc8c49d5337978de5e2c22e7d9af96b361a898bdf4cdd610e2e094cd11bfc2dc9e8b128e9667a6407c8a6d95c34deb065bd05a88104ef406d0fcd78215077b68eedd99b7efeb7971d52001192b97560c85c096be", 0x1000}], 0x5, &(0x7f0000005540)=[{0xf8, 0x10c, 0xe480, "a1bd825686dff081fb7eadf11ae3aa050b351427bb49a7b5fd430890c533301afda605a2169c7f48c645e16316081c8676919bdc5d770497c475c161ea4afc8be456a9c4ad191c972f63d49bf816ab05b42b7e5a5e2399038a3ad309f092bbf2493691cb29f5a33cdcc3145e02566fe2fabd9c120a83aa63cf7a33e04cabd85b433b5de890326b610f1fe339c331f0c9befe6a752ed9021499d4e80b84cfb0ee75db2526920f7e3a7a336a877a7e52908225c9d5baf17d1d601f4a0d25694b022d322b24359d589e95a1f27d56f62002d43c3831577c1d139df63411dd6da1daca22b2f3c867a54e"}, {0xe0, 0x119, 0x3, "94d0258a2155bb691a128e82f03f749282bf7a241a09b19ba278513206adc369d22350ea6c84a00854b62a01eb29c15859a2aba09ce497731785aba00f2a96be653de9f543d688f57c0b7f3af5c0cf559d15f5c951a066b3f7ebea52d7f912dc4eccda161b5abf97d6409288ff62ce7aefd30eb7e569e1a43eb99f8a916e6a0ac7591fdb013ca9f77f3664673b5d60182b345daa081d9b751052bc69e7fa173fbcbeabcb65964a6d6b7bc1e02d1209413b2be935a5bec4219bc5e69e2193cb233e17821d405639745e"}, {0x60, 0x118, 0x88b2, "930c96fbabbb82b89a80531f163d57ecbf42a286f86f33395c9a6f4c67a3f8f1b527f25dfd771a12adc0a72d879f8816db60392006dff5cea028c0f20c64d0eb6ecbc2aa4c77be16857563534735da"}], 0x238}}, {{&(0x7f0000005780)=@caif=@rfm={0x25, 0x1, "5c90e5aeba6fa7632510b2113a1ec828"}, 0x80, &(0x7f0000006b80)=[{&(0x7f0000005800)="5f0061f41f628ffba40794863f0320da2d957b3ca23edca798a1c0939e15b3a8ade34678b8863b78b79533d5abcb9717d86c88f0233d8d0a98e2a2aa1db66de2adea3503eccfa58f146faddef59f24c7828b5a953e80eeb2effbf489ab6141cc925dd6fb9cb9f4cc51c00469d8c76295fa1e0963926ce5e13e889b994e823830f8982b8c57a1906aca5cef680c265a1c1a4ed360e77e2429171d26131ee2d741a58274", 0xa3}, {&(0x7f00000058c0)="06ffbe158211858a774c76d0f906d477c22e32a3d1c8494e7b3dcddac1acc10debedf638d353b7abc21abb8162dbb77296621a9875e2b1702ac5f0367cf02bf64fa5f041a9aa00ace6cb7bbe0b9024ace19dab8c353cd9aef84bb1a3b84193b28cdc5dd1bcf0be1f7ce7080cd691a19ab951c438d8ba116059dc4447a709bf927d503a1b613bb7b81f65444f5c97aabe33fee189b883c0184f381f2d22b2f10f664f63f2854d4ab99a0456c56fe1a4fcf93c4d7aad97d43876acbcfe97d9d03441be078c11ea52fd02a8808a48c04d73b207a8", 0xd3}, {&(0x7f00000059c0)="80f321222cd05e9ceb91ceb35c2d5caa5134ec1ad53751ca17e80ffa7592b50e440d630413998437c823dc8542425183bd26ff73b6b5d531c229ce1e3e7ad42eddeb21c2bae14cbae6028acb6f6dcfbbfdee0d405e689fa74ae3a1b61035505670f702fb8f1912721de7cb17762233ad56239a7a58fdcd789be779073f7194c9c13d03d38bbe61928994df1bf945fc82a47ca7ea01d896153e0bcc9f891d78e9785ea793c26945f797818f88f1edf8cbc77531444b0f0a5256375093d6af7eb583ed92ebf37e7ee777732c8702c7e649686ed3bedf83533364034984178c", 0xde}, {&(0x7f0000005ac0)="005dfa05b7ba8f4334f79e44e200ec9af513a342383b3917acdbd95fc820af0005a5b08cc602004689ec6a9ddc7538a9170bf98eb5c182d9789c6796fed77960be1799040a3b3e9abc78236a2270abae68d5e6906e2ec3b8b6d6cb8037ccfde5fff392d08db071eab7f51fde43e4acf540801be1c444de26cbe4c854", 0x7c}, {&(0x7f0000005b40)="3d361f05d88af5f748db4d6b13ff9d5c7dcb141c49627afaf14211e2359d35528f2e6540fdcd570e4ca2e6371dc2831954398a79a384c436094bc212becb0d45d020b974c5c285582329f8c2d85d7030943a7963142544fd692ee3a92067cfaa3bf13b227ac7ff3649a5dc41d57f5a7f6169b80eaaff0fa2935911d7143803bff760b9856297c5e6e5f1dfa655d37d071ef8e86606dc495b29fd85bcd61c9c114df3d157ebe941fbcc95fd16f5c104d7681f6aeaffe85eadbf7a87cef3555f3551f8502b27b168b39140c7ff591b4c2233fbc36d5f74ebdf3a94f9c59d17b944e3241592e42747fef7f974dd5892221efae7a7741c184efee59dbe9ebf6a2164a01662acec4060306ff57f41f5b0b558522a50f43d2a550ce058d6c2fec80ee26ae1cf27b5ce9a421dcdc753258721f3798ea11cf5d2fe1a381ac025b1f1f0600575fb455bef3eaa38931732808e860b34de6018dd656ad03bc4e008f728b4e1279636097d279761e435465acc541526ced66b9420473f9b1dc2ac1bb369491cbc653c44cc0c92983673740b1c10baa73c9e4bbb5ef9ad03f1b29169c4cebdf566c68caacf4cd3e1ddb98577a9cee763877f381c67f53c97321d29d3c5747687c5fa0b5e687ed0d621eb018995da9fc7a324b72fae7ae4cdb6dbc5df8ca21ac92390f5c82519032f1331323da89e045439f7c758ca20615fabd3d2d4a678422224a097343b1f199587d2075b7a34a2ca7cab10f062adc23aa90c5c1540cd29161669c355ff7868efc9587c40e46e74bc4b3fc75f96e49152f9f499478bf18406f26d2172a9a544e8d12e3a9e68959de5a08591dd09a0cd65751d5c6c3d87acc44253e339a3d25cb3ab8830f308958532ac3bb3806bf72289a4f5187bf702a7a4543316686177568b3d04f9cadd36839d5547dfdfc890429ce4f98633d62a568bc7f613107de352d12dea756ac735ff5230df29a1d013493d0fc063a6df78792355c2a1b3e4672b853d0f5efe5320f3d8f07e09b65e7820643032c316c2999997285da91ac77361cabf96811bb309aa39c10bf7fca56e742d2d99ee095944b052470b4fb3420c1c2df4a8e9c895aa50aa428f8a971c9accd80f0fa0fbb1d969f4c3ccd638a1ca60547b710cb6318cef5c12d9d722c9eb58a384c21e1a589db357e061d1ac87dde3894b6dd2f2daad107fee9ae23d8af7a3298590ccf9098afa3dfc02327d1d6ad13d5bf55e511cf3dffeee92482164f8df3c0b814a2ebc1678ef137c63684e063a40566b493e0219f52133f64f0b3b5f918fa6fe2aabbbcd968813518c3acf073a7b30fc2b06c15d368a69280ef176e7b38d960df26d927b1626e966e8a6c867752e72551b30fbf49f47f9c156c1fb24024947ea2a11689c3cb03d2dc2d5c2f01056d8a53de0277c40d535731807137577537d510045ea70fe10ff4eb6c648794f52e6b31197d841a738d18027b6a87ea44f4a1d7baf3c0c3215a54eedf315ed70edc4119836d551a10d187bfc85b38698172f415098584c5513ed08a2fc3ccd1b6cd5b7ffc6b85df2ed4fa8b99ccde83d8e5d1e42786a1cd0342086ce1d5da48c2bfc8dec472eac5577e90df3942bdfa57a49b80a9e1f450af568b2e84899cde8a89587c22f9d30d2c32fdbdcf94de0583334f0b3d430871fe78e5568f9b17f4763bde09d934159b3360ea52e96db9c6cb0988c68698d6e2278de4d62b1c3d29b5e16c601fa0317adc3629ce6549eebf019248bd11232a299f37a0f2ab73851b0404d41b40848ec3992f71c0c8a65048cf5505ed8140b7d0808cb498495ea6546a53df2bbc77be9c32ff028ef86d992b65f124a59f0105164fdfa72330c1dd404e15ea91cced02fe42293ae044b6b3651a02088275bcf6fe8c96ac295c3f9155057aeb15c04a10285171ee404476ab0fb4805c3c0590a69af3af89e5bfba8e915313646e6d723bbc612c3aa1eebb7297c9c3a9c889d2198a01843bf45945f8c3420ec556e3c2b0ea21ccf3fd5b233f1706c6bb3a11bcd5088b324018763d7306aa4a106e38d8140060e827192f3f155a9cdf38adaa71d3b96af3940224b00acd9c7a5f7dd855d6d6d100b276ec6aaa30fa6e061f5bd117b07c13fc505355ad82b47846dc9d32b27c3cceaca1b6517cae0563f77ed6fd5de744de38457db91a080bcf27b649a7141087131da3afa7d9ef3dcb3305f4e439110ac96d9cfb7ee4fc129b42e7a54e5af985ebe51342e30201d4bcb88bb846b0de0214f5684c73b7c8d29455d684ed710441e3d82c9a9397068cda9aef74775a0138465d4aa4dc1ba02e1fc165a989bb2a180ba1f54047a4c39604fb2f623e455d06c61b09e34d8281741add3d25eefc3a5b9944044f81bf7a363613dedc78881218f24723c117f4f5d45246a795a78bf3dd75cde9d554b14bec7c2e37e4ea952742695508ef0977d80a55bdfd1085372b37fbc2cd44e2ba5272380af95fccb6763d5c3f3700893924ca42da39092eee43e379c1bbf5215b30b5f383742f95b4b0f522152c3cce55e2d9e37dc0a2fc9891582f2111a3378fe5018485be4f20894b9e7bf938cfecc19fd09a3b42b6366f05472487d2d6da2df69e5b48540acf77ea3126ee8096d80e0616b8d7f910370a59fd83e5ce0e9ccc872dd881e7273ccdf191067c118b40f7f15a6c06476723138cf03ad545b84e07719152c55076aea00af9cf3ed2b72d87e2e97096b81c652c878641a66fc0a6a2ac937c9d52ea2cdd78c0f7b29033e0d6c4f5214be418fc90d99407329baa7c27a986308e5c484c327f93675b7da463f6046f40da9bba209706537d1b33c4619141aba42e47df3a0f48bf63f02c133da5fc61378eeecc10b6d84321598a5a4fa04feb757cfbe5de376976338247e96828057ad651bc5c43a625a92c3b445b4228e2c20281184286b5f394ec3155d1bdf52c6f51026e0415f76a4c40e2d5a36a1dcbfdd6b99723dde6db294384eb28845ce26ee527e596cd4ba4b8ddd894e20376136a0e27bef67e2e5f2835c963872894c846458edb9e3b5d4514aeba1bc9653025cc8d720b2b90341e565dc7c0c49d4a1a0ce43a6aaec1a825e6eed281b5c93f6caf920c4f0ecd332e9c8ba9e2d3886f8540f95322406b212f5ca9245d23dae763af8010c05b72fdd92fe151e777b61c55c947a637d5f3764a8b356cabb549378c096a704cc9ff8dadcc6e86fe8146f3155c88e15426cb646ae1f3684fbdc2b7ec3275066b674422dfda8a452a925f3584a2322d129361d214ef442d67acaab40471a91e46a6f16ae89f0e252a4dd32a2348700fa19d79b1edff67b976389c1067546a5a523aca9c24c67b87f36eec9ee80ed80fb2c60211da44fb0f7a0c83b512d5f259578b4b8e40d6de0a056337f65ff6e7dedaab8f0f868e59577c9b170da65cdc03de0c2776fbb10de77a089af500cff7d028318aa58b42de20ae9af283d8655538453a16abd95cc56f7959c3cf4615879b1c76091730b28259b88f900f9d5dc2d07a6f0e6cb235c8caafae2bcc41cfa5d787e36effee03f5370a357f27bda89ea81ce685fe6009ca1823c94d3c10fc90228ca1f67703ff72ce57a533e38681f9dbcb71044435629493ac208487bd0d8e692f67f82db6e71d25ff96ba08cbb5308e656ec5d1657c3ab1c1cb92af23555c44c8773df7be65aa41e98bef14d5d766b7dedbacc26141ef83ccb3de9871aee3591662e1a2df562005d2330f2c7a5d8bc3f590fd7b980dd742f8e234893ff937beb59b2161376d022265578c1ab86277f0115151829472bfaf292a80337cf75f3a17f3f381c34ca3e39ae42656e2e7799ef3f61865cedec7c95922e7d4f2bd9d4adf1275cb64b7256a417cdfd739544d36818aa4684f667be5d0d1246855d2ec9e7eb5bc437160efe48414de5198df31a0f318278d464bdbb60ba77f993491e2f946de8eabe55eec4bdded08a9dba308ef2149e525138f9965a1d004b9247fe51c2c36922390de86f1c77717f8373d2e4ec49255c15da838f49da5b31fd2036b686468d5106caae8d6771af31eb88dc5990ec7f4ebc41cfca8c3307ef4715eb8caeeaa3017a464ba3f319f7bbacaf6b54eb06a95c17d69ab4a98316883cebc8aae675763125adc3b3eef93a648fad9077e55a6f60a0035823c703881bf633862199d9b133f81fc2c35e7c53af787d741b164d28028484ec4974277730e65cae73c54f617e2bac9de31c5ece80aaae516e4c62aa0b69232b13add89733fce113327e2109a2af698bde870e7eecab521e6ba9a963ca8048f4869fd1f09ef2190af69e28dbda2c0247c7a40fe2b580e99da38336d8a57f8babe55a591ac5ecf533e15653a6115d795e951f541ef9206f7506f8b2a935459699936afe34359c7dd04a632339243d542df433a1cdd60b860bb784eea67351a26b30cafc447141b58b0523b054ef8db46eb444df72405867b3a843be2ee757a4908665fc62728c8595fd4b6b8985ca88a8f9ad1523a2448ff3af00d3d38c89e859dfd0a7242c99e471dcfe593aea47faa777bb85f5d5786d9f040f54a6d7481718fe8e9b65dbca66b20682456755f8e684496ca51a3fd6be18edccd4261aff0821cc723fa7617f3d2a3cc7fe78be813a455168259a43b924611548933932eada647e713012b6bc2145bfeae9e180fe4b862d34e1365fcc6ab2f93600ae38c8187edc5ad38c31e059bd4a95aa928ef1f2e150fd28568e5b30c99cfa009a2a08c538bba3319aa3574f395cf15377e04b5495e1d4b8e44dc29098e07be59b0d88fa0f8eaeab9b601f2ab6a0256cd964c83f66280e9b86e12b71437d19c202a528864ac9d1452b058757b9756bade167f44013acfdd77be5e65e6a824770c89e5f4e18f2d4084620c37a4679f58d24d9573776c15180d90fb5763e02c87da7f72c16c534abc3753cea64f94deeb355201e93ba0c188657128a35bb9e0d2ba17f2c939a2ecc832e572a9e68ff6342064cc7c3bb0fc6aca3370f0fb50f97375f19c1da5d0c55f04190763f46faeff9c73252ac9ec2fbc5df8a33313c5b0d13ec6604eb95fb55ac111cbb7bdd7749977fd9e565fc9b3b285437e032c809ac3fb6fbb11c058f28945b53706e6247be03a3499494a3bfca221e46f576bae305551ef8283fda34b3c456d667cd86370957bfc710cfc1b49d90601b4abdce39d6fd1259f07425c182296072d75f539ad1c0d3601f871c6a1df03f4c74fd5db12815e226fe8ed37eab320c1763b7a9cda5809405f28d424c94a1df52a6ce31ca689c01767cc26841bd95f11ac5407b61b21d6d34ab9bca0a141d04cea49e0d3c0b1d9aadc4ae1920087af8e3972033060996b06b07d48d4844f02672e71e4e68d236cf903521a38cb7ead93d1c80ecb369d122a613695219924ac6b9fd1644554e95d10f496bab2d5e60a0aaf0e637bea17569e44c893402a16febe8dbd469aa4c70b17ee206326fdbe28ad3750a6f900825fd3835f76e6eb4c3d71477d184aadbf7368d24f91315efdcd8da673b35a5cde7d51d44af6d0e15e923224019c6bc37b89088e08fac1b882ac24175070763e3688b034bd1c522e9d8b8bba3a0fc4d9b6bebdc255742bf9cb893969bae594e059ff52e7a936fa8368f80cfa7fc9824b2408e1d00021bf1f72f02fe7d5c6e57374101c9b5e2eb76dc44771d8c09be9523b5c296bbf6649c4f3f238c255d1379eaec848feed85b17f7835fdf4201a27a76d13510ba20c761518a10e9ed2d9743f5f61026c7abe2f40c91fa8fb45a83b53110c84fbdd99d", 0x1000}, {&(0x7f0000006b40)="87b01ef6633209", 0x7}], 0x6, &(0x7f0000006c00)=[{0xd8, 0x29f, 0x34, "168743d3ccec53bc79429e16f81c7f1999e32a1a06c7683ebf129203c45ff6534e54becb73a3a22a893ac2bb0edacf670c0ca49743b9b94dd908d9abc2ba2706df9d1e910f54b69275eddd2ae744dc62a2733d11b4a29a643d205161eeb6442c282a05e8ba513eb57f70c9170de1baff890d56915fa323981e6d55c7226d8c65e79c2e33a17c72089eecc1b7b881574b4cbb4b9645544a9af13edba36da03db74f7cdfa39055f716e21dd760828c8f8b9789820e3b8ecd13831dc256064a049bc296ebcf47fb"}], 0xd8}}, {{&(0x7f0000006d00)=@ax25={{0x3, @bcast, 0x8}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @null]}, 0x80, &(0x7f0000006dc0)=[{&(0x7f0000006d80)="bb36d29f4474ea87e4b21ce1d62b4e2c336f4fa3527a9ebd237f3dac990a4b13b28edb9aaefc6a0530fbf1ac42ae34d5", 0x30}], 0x1, &(0x7f0000006e00)=[{0xd0, 0x108, 0x3, "351acfde83d8ea0f522865ac950e25b0506498141a0874b173f4e5ef196e7a7958f3436238b8229e9a623ddc4c32a60fe1b306c8dd800535747b204c06caceb0d7ade2ce1ad99fd29a348fbf15b18e59a4f9aeb0c3b287ccd97884de06eab99567c442fb5e477841dccddb63dd0c90afa60163eb6a590cfae92e99dd40e34498c054c3ae7aaee04de5c304fd8d4658f85aef782c3efc40d33b3a6096fc3b20262645e2d113db84fb8e168c6a8c96cbd343be2e1081888928d72ab8ed63"}, {0x38, 0x108, 0xe2, "6fd4a6cae3011b38c88ec6dfeb9536006a4f2434f13f6dfb8862a61e5cd4324053fad5"}], 0x108}}], 0x6, 0x10000) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(r5, &(0x7f0000000300)={0x0, 0x232, &(0x7f00000002c0)={&(0x7f00000001c0)={0x20, r6, 0x105, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_DAEMON={0xc}]}, 0x20}}, 0x0) sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="d7b2c700420ab0100c7503c57f2bf34c00aae8c5da5028f2e119c9f4d28fa93a8b8aea13be47e7acc40898223c7eab8c7392613b482fcd81a2d2c198b19d01ff00ea1e67eab183349e1de734a831d4d66b73cc7a70f5c5188744a809d3b7d3564c671ee32bfc69b7d348bc4ff9f58bc8ecca04e9d0bd6ea30e43ec017a16a4f2b2f38118cac4488254aeb0e30e23d5760e1ed8fee8daf9cd21e442b2ec49d71ae5aa", @ANYRES16=r6, @ANYBLOB="020027bd7000fedbdf250f00000040000100140003000000000000000000000000000000000008000600666f000014000300fe8000000000000000000000000000bb0c000700040000001400000040000300080007004e210000080003000300000014000600fe80000000000000000000000000000c080005007f00000108000500ac14142608000100000000001c00020008000700ff00000008000d001900000008000400940000000800050004000000140002000800040005000000080005004d000000"], 0xcc}, 0x1, 0x0, 0x0, 0x4}, 0x20000000) r7 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:24:21 executing program 4: getsockopt$TIPC_NODE_RECVQ_DEPTH(0xffffffffffffffff, 0x10f, 0x83, &(0x7f0000000040), &(0x7f0000000140)=0x4) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0xf) r1 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) setsockopt$RXRPC_SECURITY_KEYRING(r1, 0x110, 0x2, &(0x7f0000000080)='/dev/ptmx\x00', 0xa) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:24:21 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x4000, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0x11) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) ioctl$KDADDIO(r2, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) ioctl$CAPI_INSTALLED(0xffffffffffffffff, 0x80024322) 03:24:21 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x6c00000000000000}}}, 0xb8}}, 0x0) 03:24:21 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xe000000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3353.932024] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3353.936501] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3353.970047] Bluetooth: hci0: Frame reassembly failed (-84) 03:24:21 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x7400000000000000}}}, 0xb8}}, 0x0) [ 3353.980465] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. [ 3354.007536] Bluetooth: hci1: Frame reassembly failed (-84) [ 3354.027869] hfs: dir_umask requires a value 03:24:21 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xe3d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3354.046715] hfs: unable to parse mount options [ 3354.092773] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3354.104202] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:24:21 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x7a00000000000000}}}, 0xb8}}, 0x0) 03:24:21 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xf000000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3354.182467] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.3'. [ 3354.207327] hfs: dir_umask requires a value [ 3354.211710] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3354.219372] hfs: unable to parse mount options 03:24:21 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0xf3d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3354.230639] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:24:21 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x8800000000000000}}}, 0xb8}}, 0x0) [ 3354.333881] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3354.365113] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3356.019124] Bluetooth: hci1: command 0x1003 tx timeout [ 3356.024516] Bluetooth: hci1: sending frame failed (-49) [ 3356.030128] Bluetooth: hci0: command 0x1003 tx timeout [ 3356.035485] Bluetooth: hci0: sending frame failed (-49) [ 3358.099135] Bluetooth: hci0: command 0x1001 tx timeout [ 3358.104554] Bluetooth: hci0: sending frame failed (-49) [ 3358.110389] Bluetooth: hci1: command 0x1001 tx timeout [ 3358.115958] Bluetooth: hci1: sending frame failed (-49) [ 3360.179143] Bluetooth: hci1: command 0x1009 tx timeout [ 3360.184522] Bluetooth: hci0: command 0x1009 tx timeout 03:24:31 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x300000000000000) 03:24:31 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r2, &(0x7f00000001c0), 0xfffffef3) ioctl$LOOP_SET_DIRECT_IO(r2, 0x4c08, 0x100000000) r3 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r4) r5 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0}, &(0x7f0000000280)=0x5) setuid(r6) syz_mount_image$hfs(&(0x7f00000000c0)='\xc0fs\x00', &(0x7f0000000100)='./file0\x00', 0xf419, 0x0, 0x0, 0x8004, &(0x7f0000000380)={[{@file_umask={'file_uaask', 0x3d, 0x100}}], [{@obj_user={'obj_user', 0x3d, 'hfs\x00'}}, {@uid_gt={'uid>', r4}}, {@obj_user={'obj_user'}}, {@pcr={'pcr', 0x3d, 0x3b}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'mime_type@/!cpuset'}}, {@fowner_eq={'fowner', 0x3d, r6}}, {@fscontext={'fscontext', 0x3d, 'staff_u'}}]}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r7, &(0x7f0000000180)="17d5fd91c736215dfe20aa4bce53c1612346191e2535603567c09c1cf06d5da3663c0eca2fd28d664ec82e3882c251fd18a809c987d1cb7d4cc247cf749e4df1f99e97ce014dbbefa2fb04d8ed9b44ec72bcb20f298bf9c09798413624aeb428f910ca579b93e9fc266e44d3c74e0db1eb681b95ba590a1872978a4d5fbdb420d36baa44ba749bcd74c9c3ea6fbabc802ab8dd2358170176dbc16ddaf92daa1e5951cd6f09a00cbd345647cbfc3810f128d139162dbba1495a101782363d", 0xbe) ioctl$PERF_EVENT_IOC_SET_BPF(r7, 0x40042408, 0xffffffffffffffff) 03:24:31 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x10000000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:24:31 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x9effffff00000000}}}, 0xb8}}, 0x0) 03:24:31 executing program 2: r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x42, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r1, 0x400455c8, 0x0) ioctl$TIOCSETD(r1, 0x800455ca, 0x0) 03:24:31 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/de6.\xf8\x0f\x00', 0xc2082, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$TIOCGSOFTCAR(0xffffffffffffffff, 0x5419, &(0x7f0000000000)) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) [ 3364.149720] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3364.171410] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:24:31 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xf0ffffff00000000}}}, 0xb8}}, 0x0) 03:24:31 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x6, 0x400040) ioctl$KDADDIO(r1, 0x400455c8, 0x10004e) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:24:31 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x103d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3364.203584] Bluetooth: hci0: Frame reassembly failed (-84) [ 3364.223373] Bluetooth: hci1: Frame reassembly failed (-84) [ 3364.230672] Bluetooth: hci1: Frame reassembly failed (-84) [ 3364.293612] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3364.304718] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:24:31 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x1, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x5, 0x8800) setsockopt$inet_sctp_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000080)={0x2, 0x1, 0x9, 0x80, 0x6, 0x40, 0xe6, 0x9, 0x2, 0x4f, 0x5e}, 0xb) 03:24:31 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xffffff7f00000000}}}, 0xb8}}, 0x0) 03:24:31 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x113d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3364.403437] Bluetooth: hci2: Frame reassembly failed (-84) [ 3364.416896] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3364.435564] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3366.259032] Bluetooth: hci1: command 0x1003 tx timeout [ 3366.264406] Bluetooth: hci0: command 0x1003 tx timeout [ 3366.265625] Bluetooth: hci1: sending frame failed (-49) [ 3366.278991] Bluetooth: hci0: sending frame failed (-49) [ 3366.418903] Bluetooth: hci2: command 0x1003 tx timeout [ 3366.424306] Bluetooth: hci2: sending frame failed (-49) [ 3368.338990] Bluetooth: hci0: command 0x1001 tx timeout [ 3368.345772] Bluetooth: hci0: sending frame failed (-49) [ 3368.351581] Bluetooth: hci1: command 0x1001 tx timeout [ 3368.356937] Bluetooth: hci1: sending frame failed (-49) [ 3368.499525] Bluetooth: hci2: command 0x1001 tx timeout [ 3368.504938] Bluetooth: hci2: sending frame failed (-49) [ 3370.418978] Bluetooth: hci1: command 0x1009 tx timeout [ 3370.424374] Bluetooth: hci0: command 0x1009 tx timeout [ 3370.579281] Bluetooth: hci2: command 0x1009 tx timeout 03:24:41 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x400000000000000) 03:24:41 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x12000000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:24:41 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xffffffff00000000}}}, 0xb8}}, 0x0) 03:24:41 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$sock_rose_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000140)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0xb17, @default, @netrom={'nr', 0x0}, 0x4, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:24:41 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/d%v/ptmx\x00', 0x202a00, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) ioctl$VT_GETMODE(r1, 0x5601, &(0x7f0000000000)) r2 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r2, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r2, &(0x7f0000000d00), 0x1c4, 0x0) getsockopt$IP_VS_SO_GET_VERSION(r2, 0x0, 0x480, &(0x7f0000000080), &(0x7f0000000100)=0x40) [ 3374.383746] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3374.400016] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3374.421017] hfs: dir_umask requires a value [ 3374.429045] hfs: unable to parse mount options 03:24:41 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0xfffffffffffff000}}}, 0xb8}}, 0x0) [ 3374.441976] Bluetooth: hci0: Frame reassembly failed (-84) 03:24:41 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x123d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3374.506884] hfs: dir_umask requires a value [ 3374.513766] hfs: unable to parse mount options [ 3374.520884] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:24:41 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0x2}}}, 0xb8}}, 0x0) 03:24:41 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="6469725f756d61735c3d3030303030303030303030303230303030303030b5bff0aa30"]) [ 3374.557934] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3374.614332] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3374.680832] hfs: unable to parse mount options 03:24:42 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) r1 = syz_open_dev$video(&(0x7f0000000140)='/dev/video#\x00', 0x1, 0xab0fb7b3cc04e1c9) ioctl$VIDIOC_QUERYSTD(r1, 0x8008563f, &(0x7f0000000080)) 03:24:42 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x133d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:24:42 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0x3}}}, 0xb8}}, 0x0) [ 3375.017183] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3375.027629] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3375.057737] Bluetooth: hci1: Frame reassembly failed (-84) [ 3376.498924] Bluetooth: hci0: command 0x1003 tx timeout [ 3376.504325] Bluetooth: hci0: sending frame failed (-49) [ 3377.058985] Bluetooth: hci1: command 0x1003 tx timeout [ 3377.065976] Bluetooth: hci1: sending frame failed (-49) [ 3378.578982] Bluetooth: hci0: command 0x1001 tx timeout [ 3378.584386] Bluetooth: hci0: sending frame failed (-49) [ 3379.138942] Bluetooth: hci1: command 0x1001 tx timeout [ 3379.144350] Bluetooth: hci1: sending frame failed (-49) [ 3380.659058] Bluetooth: hci0: command 0x1009 tx timeout [ 3381.219025] Bluetooth: hci1: command 0x1009 tx timeout 03:24:51 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x500000000000000) 03:24:51 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0xffffffffffffff1f, 0x0, 0x1000400, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:24:51 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0x4}}}, 0xb8}}, 0x0) 03:24:51 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x143d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:24:51 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x10, &(0x7f0000000000)={&(0x7f0000000100)=""/221, 0xdd, 0xffffffffffffffff}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000200)=r1, 0x4) 03:24:51 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) utime(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)={0x5, 0x8}) [ 3384.640247] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3384.650290] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3384.679549] Bluetooth: hci0: Frame reassembly failed (-84) 03:24:52 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0x5}}}, 0xb8}}, 0x0) [ 3384.696594] Bluetooth: hci0: Frame reassembly failed (-84) 03:24:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x150e0000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3384.751954] Bluetooth: hci2: Frame reassembly failed (-84) [ 3384.767615] Bluetooth: hci2: Frame reassembly failed (-84) [ 3384.778826] hfs: dir_umask requires a value [ 3384.798183] hfs: unable to parse mount options [ 3384.830922] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3384.846167] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:24:52 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000000)='./file0\x00', 0x2ddd, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="6469725f30303030303032303030303030303030302c3a000000000919515054d6caca94bf5043c88ea893f338bcebc0acaf62f86b0cd7f15cf83b54f66dd4d859b96a62d5576b680ed444271571225cee434547611460d23864cffcf8e93793ca659a56ec4fbcb5b1af0c64250c9a5097e59bc32935edd268bb9d9ec0097779a4f011ea7badfc9078d91b321aa4"]) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x100, 0x0) ioctl$PERF_EVENT_IOC_SET_BPF(r2, 0x40042408, r1) [ 3384.964163] hfs: unable to parse mount options 03:24:52 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:24:52 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0x6}}}, 0xb8}}, 0x0) 03:24:52 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x153d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3385.260391] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3385.287294] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3385.310994] Bluetooth: hci1: Frame reassembly failed (-84) [ 3386.738924] Bluetooth: hci0: command 0x1003 tx timeout [ 3386.744354] Bluetooth: hci0: sending frame failed (-49) [ 3386.819051] Bluetooth: hci2: command 0x1003 tx timeout [ 3386.824659] Bluetooth: hci2: sending frame failed (-49) [ 3387.378971] Bluetooth: hci1: command 0x1003 tx timeout [ 3387.384566] Bluetooth: hci1: sending frame failed (-49) [ 3388.819130] Bluetooth: hci0: command 0x1001 tx timeout [ 3388.824546] Bluetooth: hci0: sending frame failed (-49) [ 3388.898979] Bluetooth: hci2: command 0x1001 tx timeout [ 3388.904446] Bluetooth: hci2: sending frame failed (-49) [ 3389.458981] Bluetooth: hci1: command 0x1001 tx timeout [ 3389.465854] Bluetooth: hci1: sending frame failed (-49) [ 3390.899020] Bluetooth: hci0: command 0x1009 tx timeout [ 3390.978955] Bluetooth: hci2: command 0x1009 tx timeout [ 3391.538977] Bluetooth: hci1: command 0x1009 tx timeout 03:25:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x163d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:25:02 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r1, 0xc008551a, &(0x7f0000000000)={0x6, 0x18, [0x80000001, 0xf5f, 0x7, 0x4, 0xd5, 0x401]}) r2 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:25:02 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0x7}}}, 0xb8}}, 0x0) 03:25:02 executing program 2: pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r0, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r0, 0xc0405519, &(0x7f0000000040)={0x6, 0x5, 0x2, 0x1}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r2 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x6, 0x8802) r3 = syz_open_dev$swradio(&(0x7f0000000080)='/dev/swradio#\x00', 0x1, 0x2) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000100)={r2, r3, 0x8, 0x2}, 0x10) ioctl$KDADDIO(r1, 0x400455c8, 0x0) ioctl$TIOCSETD(r1, 0x800455ca, 0x0) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x4000008, 0x10, r1, 0x0) 03:25:02 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x600000000000000) [ 3394.880700] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3394.906647] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:25:02 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) [ 3394.930795] Bluetooth: hci0: Frame reassembly failed (-84) [ 3394.951353] audit: type=1400 audit(1571023502.234:88): avc: denied { map } for pid=14013 comm="syz-executor.2" path="/dev/ptmx" dev="devtmpfs" ino=15395 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:ptmx_t:s0 tclass=chr_file permissive=1 [ 3394.967766] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:25:02 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0xe}}}, 0xb8}}, 0x0) 03:25:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x173d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3395.004697] hfs: dir_umask requires a value [ 3395.013269] hfs: unable to parse mount options [ 3395.069964] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3395.104657] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:25:02 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0xf}}}, 0xb8}}, 0x0) [ 3395.192846] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:25:02 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x18000000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:25:02 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0x48}}}, 0xb8}}, 0x0) 03:25:02 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) modify_ldt$read(0x0, &(0x7f0000000100)=""/198, 0xc6) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) ioctl$KDGKBMODE(r1, 0x4b44, &(0x7f0000000200)) ioctl$SIOCAX25ADDFWD(0xffffffffffffffff, 0x89ea, &(0x7f0000000240)={@null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}}) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="8cff7cf9080000005345204c696e75781500000000f601000800000007000000402c1100000000000900000000000000385a5800000000000000000000000b00"], 0x40) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r4, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r4, 0x40405515, &(0x7f0000000440)={0x1, 0x3, 0x1, 0x9d1, '\x00', 0x1}) ioctl$KVM_SET_FPU(r4, 0x41a0ae8d, &(0x7f0000000280)={[], 0x100, 0x8, 0x8f, 0x0, 0x8, 0x4000, 0x4000, [], 0x7}) ioctl$PPPIOCSMRU1(r2, 0x40047452, &(0x7f0000000080)=0xe03) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) [ 3395.502437] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3395.510837] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:25:02 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0x4c}}}, 0xb8}}, 0x0) [ 3395.602348] Bluetooth: hci1: Frame reassembly failed (-84) [ 3395.616611] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3395.671693] SELinux: failed to load policy [ 3395.749750] hfs: dir_umask requires a value [ 3395.754317] hfs: unable to parse mount options 03:25:03 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x183d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:25:03 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0x60}}}, 0xb8}}, 0x0) 03:25:03 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = memfd_create(&(0x7f0000000100)='/selinux/enforce\x00', 0x2) fchdir(r1) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0xb01480, 0x0) r3 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x41202, 0x0) ioctl$sock_rose_SIOCRSCLRRT(r3, 0x89e4) ioctl$TIOCVHANGUP(r2, 0x5437, 0x0) [ 3395.850598] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3395.859363] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3396.979191] Bluetooth: hci0: command 0x1003 tx timeout [ 3396.985151] Bluetooth: hci0: sending frame failed (-49) [ 3397.619010] Bluetooth: hci1: command 0x1003 tx timeout [ 3397.624401] Bluetooth: hci1: sending frame failed (-49) [ 3399.059048] Bluetooth: hci0: command 0x1001 tx timeout [ 3399.064709] Bluetooth: hci0: sending frame failed (-49) [ 3399.699265] Bluetooth: hci1: command 0x1001 tx timeout [ 3399.704684] Bluetooth: hci1: sending frame failed (-49) [ 3401.139063] Bluetooth: hci0: command 0x1009 tx timeout [ 3401.779218] Bluetooth: hci1: command 0x1009 tx timeout 03:25:12 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x700000000000000) 03:25:12 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r3, &(0x7f00000002c0), 0x0, 0x3) write$cgroup_int(r3, &(0x7f0000000200)=0x7fff, 0x12) sendmmsg(r1, &(0x7f0000000d00), 0x1c4, 0x0) fsetxattr$trusted_overlay_opaque(r1, &(0x7f0000000000)='trusted.overlay.opaque\x00', &(0x7f0000000080)='y\x00', 0x2, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000000280)={'batadv0\x00', {0x2, 0x4e20, @empty}}) r4 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYPTR64=&(0x7f0000001640)=ANY=[@ANYRESOCT=0x0]]) mknod(&(0x7f0000000240)='./file0\x00', 0x0, 0x3) r5 = syz_init_net_socket$ax25(0x3, 0x2, 0x190) sendmsg$inet(r5, &(0x7f0000001840)={&(0x7f0000000300)={0x2, 0x4e23, @broadcast}, 0x10, &(0x7f0000001740)=[{&(0x7f0000000340)="5627c010c51c49ee", 0x8}, {&(0x7f0000000380)="774ce17dbf7734fd4fb02559759900b6fc8e0feb3e66095b275a0aba84b90c236bf430172be0f5fe1ebddcfc0d0b9ddc6ca49b7f6f2e87013ba62f5f7b081bcb58829d8b1020eac2eea4aa5ac1ddcce84dbd16fc55198c22e80e257f389f0fb4bbfbb101a3ac79559cba779b1fe2cf956df21c42aac2a2a303cb3be69c17d298be0a3db295749ef7188e8682f02e97ede2c5e787b0503640b0fee8163fff054b4e06b7811d53574869ddf9b344afc9952b6297357861ec72779812c1356e8ba0bf01c75b0550de6b7dc9bd44934ab99f60c2115f4ebde0645cc3fe6155f5e2a4471137c4682ca1c889e4283754699039f0fba86a327f833a83be43f72d", 0xfd}, {&(0x7f0000000480)="dbc8f361181ca238ba7a8bd3d47d83c319d663061cf0f650c2fa93a4e2468c2a1080b0e24e5e09cd0abe7d3d3fa8926c2c05901136933ded152694135fb02d895c9da73b77d8d42242d46d8fdcfb0d5f88db397e43de546a562fdc5c3153221a6766edc18028a7afe2699de21d5fe88c73c05e3107525499fb3cf918d0029f0664ec44cf13d7786d6dad272544c64347ae07dc0afb2f72146f3fd88ea4bb800a65a312fd0f02acb5d46268bb3e203ba9bbb8e380aef076dc102915fbb44812d50546ccc9369f00d0a1e5e0a258c0a0cf47d877597ac4e9c89c13edf506a2689747d05a85973016e7856ea3f2ca5ae60920f006e89fac41bcdc1e01f3e255425ef7d0567a48b0825a212eb5c6601fa4fbec135fe91ded1da5a0547d847868d28413644174521818ea191d75095412598a79bf3e38e4ae71cbfef1e18ccbcb42d977ca1ce1b7149c764c1cc6024c3b13f2557046af919e98e4e75e1e5c0cb1f984ac6958f9f678dca41a7c8851f531091fa877522b288983cf09ed24219b2a825381a4d78911fc507357d73807246ddf0baa006cb3fd9bd9b3139d0da32d5f929cc94b93ec2ae5f260b819999a6c71a4cec87c9f67169b2594c4fae1a15a4dd5f7a46dba862c2846139787c535dd84dd80c82189768bd842039cddcb7cb92b585fd9858b0dce19bc02572295de239d8f4a5c2f570bd5cd71c6e66e85e2f2d0a53410d872233cf7f5aa99d6d145a2abeb6dc18f05cedb3423faf333f0eb34ebbf64fcb36f6439fc599b6e5d9911ce3208334624c38f32327d74ad177ecaff36b6a19cb184a6658677fbaf262935f65c0433d520354e613a4e1f359014f4c25f3eeeba49d25ecb34d7525f7332f2d99075135b0f7075eaecc89f9eae216b97815b1a9f595aa08a31578e8d862a63ca2d96af5911b60e1c4eea659aeceb98b751f73ba9513ce38bd1bd1b88812ce99e3abf1a7703cad7cb7f5049909575caed8f8b0b35b53e2090be4b08fd61ddff0043da49b7029ec1d881c2414f90a095387d8b426c0df09c4e0346b0b0c3020f43fc730666b68f863c402d2b412fb13999a4a8f4ee6e2d660d828346294e29c3032d7961edf3582114b3d305d4afd1868db481f1b48e593b6ddb05c5dfd3d649abd5ba073c730de92923c4f5ae5b529fb337c94f03a1aa5ac0481902e3500a4925e540d792a2992453a6435319b01a0b8b38bbfc032b9a7dffe495704eea567513675a2a021932f04be9d977a7ddf7aa5bac1488779c84c28e03d6e2bc13b8757df10cd5dade913f4ffbfd557f6e13f62f0d070e7976f36d22b8c5368260ee38d3ca434cacef01ce8223b6a57aa7dd389b98bf6c84d0fdc04fa8236ac518e66bfbf7ae338387e166a9148d54f52283782982975bed8f8bb0be29f519188897c40217883642d9c0ed3828b7594dbd66306fd5993c52faa2ba6c2fa1e644dbc91dab3e7370718ed64302331647400bef8411d9241dcea77a85495ac66a8d99e5af0a6b344a123e05e414b0dfa1a2ab508f750434948cc780db02e6261c18443a763d4281267f5bac8028320f00706933fc19ca1a50b005c6d61b4851dd2aebf6bcb776a67c8c09f976b122de89a43fd58a60d3cb56de727e6ceca48548d540eec6dc63e05bad3b2bb6f50b7884f93bdeb7ac3493a8865e84f7c5c6f7ad7ca8a309523440dc2eafc454a871d8fac69755b19711b9fd957f4dcd0259761618ad9ab7c911ab1a7cf446e7ac1847c219e6837eed57124e8ddd286c9701a21adb20854da6c032f06da39da8ffa98e8f0504204f15fa5232877ebc4cbff54440da79a7056b2ff011401cd16d39bc78317bbaa5b7ac3649a826afae66014d3b14a81d0af0c8eb22db206c6953060c9b16fb2d2f1d2c95ada15703db53e85a608f65a5bb948ce80b9b4a1c4ebd1c3011674bca7ed31be5377095acc1ba02ab78394e9a2c372a922b08440826da8aef4e268dfc71847038675a0ae5456752b6e8be5d7a89815f1bdb08caeb5ca88fb19a34a328e0a1fda6b3e4fc5796ecff0f0d5bd40484039cec0b254b2082d79d091a105e96b42e420d314307c82cc3383de227e51d0c6918f13cbc17c86f99b7dcd11ef30f57f563de9923b600b6d4ea83fa04d5d15c016ff92dec2c1f1d776795572288ef17b55baeceac666011bf61c4e011f0f43cf41a5946fe21894c3f70759bbfe7b7b2429e2a9b74e13ddc21165d273d4a6225a1af5b6acd2f0815587a8fa231362c9633725f46106bac1d287cfc26b49f93f13234b5ccef7a18f1137c9fb4ad4dcbd52b6a25255d95edd6baecbd16564315e729128e56a9fe6bf0c3ed18f2b8443e1e3d104fb0faafbe8d7035505adbbf72ab7cefa5837a9810ca591731588a69ad0aff8594af67d04bc75f8eb5cdb378de9e1de47fcc323fa9d7bf1e0f0f7ec408009dcdb73dbb2a11f79e20efe644fc54536ba5e88abd4d013edde616c78667baa76d3ce4481a2f96345b3e3c24a65ee2d634594439475fe2b7ace06207f33fb388083503a2b34bb116e23d5f42d4ca2cf869e99b8afc5b2bb4b93139bea7a845a5d406d457dc7d6f564f99e78bb36c816e7b5349441769282489395d1f4024cee012f9c1aaf7ab5874ad591da97d52bc7a3df4a550b3b408541cd10b8c2bb9bfe3072c87e7536e3764b009c0df8e27f4d1415a5a36657a675b107665ef9210e9cd94605b367c58acd2f210282c9bd64e2ee729332bd0671811947cd0665508ee90d8129c46da7e7363b2b478c0bd2f254196e7902ffa841e09e38fa01d197df7b2ba021bef61df0063da6a96485d18f13f2b30f9bf81c450ec818d6e1573406dd8c3a40d4395a392689094ced42401f13b078817ed13068b3ec40cd970c7ce3f83d3da0c28359ef6ceb6bbedbedbf8c4b625f44128edd4cd88b3ec5870a06a7f5a3b771adf92c587eeecf71361a4c4b4afbec643916ea4ed080d2b6a057fc3c377d259ed6dfb1820fc0f0c3362f51180cf500b26aed716c8cfdc42b03f326c6971d5ebc251b713c5c8b5e0b21c7c1ff6b4fd60728609ddba76d426a47fc746d9376f6cf5cf18a25788716d9ea239f4358a7df0ca2966846e054d81b35a63c86d82a1466f44967c84418d91a28505e9fa21c58dde8cc1f26f87df5268250d880550abbc0ceec5e75ad9f6a1a5f7612e6521c44858c4edcdcfc451f25d4f8d9b372f507ae0f36e3f52c121d1e749d5e6ece9c7692788dca56dec7fc1ec583ed20bf0c19b387fbd5eceeacd79d98ce9a66d5c6852a73f68de76b5edc6ca6c83e4f86184dc32fd53ffcb6ca9a3d29c6cf4beeb002401d82c930465d503be9ac85e6b21eba20e5dc005d84846494f11646199f8d0179234ccddcfccdc721327a1a899880453addaf9882cab0d3b84850a5e65d25b7076bface2c87ff9ef9f59c4c2c5cabad2b84f0478330910bbb157eb48b5558bb8b10d3940c7e0c1ce8ddec707d548843f9ac2d4bef91c5e6a2a30ac1f43ab76469623f89ed1a012981dce3fc5cc014d4d7532faf8562090a031f74c025a47aa06f271692d426b505b9037074afcf981207fd51d9aa0c1d5791ff926dbca1e5884a5b15a8750e73ef2383d52c477c4fb64af02064f091fa1f782a9886314a1d852cb3304dc68b2796e97f30ae158285f8441091e69425020840e2885752424927e9cb3c2a4eb4cf917b846ddd9cd82900d67967bbffc95f9a3d8e39bba9a73aa039022644c439c5520ba17e0a3e56cd3dd3fc8d3c2ac8687ca31ef1f655fbf7d467c9baec711e09766ab25f089b9a1497650098433d1b5770c51431d79718390fe6327f3f18140347bc1301aafc088ae7926ac26593dd7edf43082ef47d62553aaed71d89c8ed55e0fa95d9d1591189739974d36be668781c4b599ee357ac962c0d37e0fb56f2b46341ff93d2639c9b3a0d60b14c0b5b3d9eefec92c3dd479e94c49e55a8b9fed4288d482c1935e6b65c8c93b2ddec8dd78e0783e264ce53c52daf071f475d7e871091d90328eb4bf5ee441911a5eb65e541f65f8216f021c70b8492fd6ed2d93437dd39bc4bca5759e73710bf214650d1ee0608d2dc9c395ebb895433be9ab7b57e6fc17b5a6aa5c0ee2834d81333711162faca4bd4e004dbf7a1ca8a64a78994c5237b5d417c7e49baf43cf9a7a33ba836a02171aae74bac54b4e7c9d8998a6b836a61aa2899b5d269f5b242ccc3ac88a848c2592b4a7909f41aef28af5251a49011bd22b89d0db790185e7f905479c11e394b3bc03e7ec890df84330ff3e5f76211d7a5cb3ff359b1a0fd8f742bf7fe7f78c0b42f27bc58265ae0f4cdba1778266ccc5d0018559b9840e1da453a8fe586db980a2043fd5b1fbebc2dafe7fdb7695afb704f24e3289c80ceb694b956789a3006a928cd55ec65156aabe5dc906b9e4576d421e69843cef8d66c976af030d6376f9778edbfefa4424cc9242fba3ff561db351a48ebff99bba9c9345094c73d98f847ac94882aeda158729e9e5b07fae22b68515765fd101833b11e99b981d5b7abc2af83c59623863057386c62dd13cb0e0f1e73004c82ce1ca3c991e9249911942d43dfc4561b6c1c0706f6990e8459b6dc977217b6edf0a82b5367bade57bf03a388b484e21f59d33af0ae6df02bc09843d75a43162d9177d7701b4b56cc8653bf3cd379033ff4203ca7983f4faa928a7bb027a2a3ea811d46889b28f6cb3e9bc0ca726d904a6f5e7ba3229060d01cb5795341dd60e49492281418500a02b2e9eec7ebbb1f25d471ba0d877dc9ba89d3e90cc5689ff9c5c6b6b7410a2f5b7ae83ab179852d086d5e8f26864f28ce1e6378dd6f940c6c38051ab5b207384779444ff37e0e199ea0caf116a2d7b56916ac2122e89a767f06b30e6e04739d0e4a744258831e6171a305a293f7cde15f1f73e79d06ddbcdd443551ad993e40d32caddaab57c1bbc5e701db4e815757845a8cfe97e9a0b28e40442f3a7807fbf94e958bbc9c4e0f58b87b0cc2dd0c8ff1c30c452ff6fe4fe65c537aee2c56a4905d42333b1306a7cb156b40610a86deb13e207c58f2b5e2f8f236ecf05410d7887ceba5b63931a6bec9b9bca8ea3fc9088851545dd82a0db898eefec02ce3aeaa2b5875a7d21a7e4068d7921bfa1fc21bea68a52ecb357cc02363e5d60585ed428b4df300b92d8eeadaba8460dec9209c27c7f84317151d7dea3793b9a66bc604561883ccdabaa3cb2855b502a379709332f99364e696aa9a5d575faa7d1b71f57fbfd4ee88d50f8be9a2a8db0e7011e2852ea628e0c6ed6a581f9d1d84289428beb6fcc55ce6820f1a0d698157c923b2be61c81387576b677fa0362bd35884f08ca2399320049e63e6b2e2bd958002de24b6f6d312896e179c6989968c5ed2379d85bbd8f59d21c616b38bd740f97a6fae5c60a63b6f8965e7b924d25a3f2ff0455b645c1d48c15f14f94dd3895295213f598327cde01f9756e50d2463b887781c3bda08e2ba49578bd3dfad3e1d0f6f327f2fdffae8480fb84047bd6740dc486f99a58897ce7570e0500b7e0545308fccf6fe1ab35d08000821432f99c5846f27f8926ab0b75f8cdc55eac64a174be2b9cf6bd59a3b9f486d5069cd62bd7c337d11b17f2ff5cc8f0c1764e71836d5fbc958cc9a4718dec5429069f9e52dcb8ccabfd01fbe1ddf4ac8d746235cbce6a28c37945c595952ba0434c32b989010ad06fe55362190e60c2260c6d90398b1ab9cbdd5223d96839516e520e731329e5d52671f89f1840b112d4f0d71647dadf1ab8512b2b6a26a65fb78511", 0x1000}, {&(0x7f0000001480)="ca71d78f7b877e7356067c2f7b629b1c37a7d43f34e0cdfd701933433c", 0x1d}, {&(0x7f00000014c0)="be3c6bb061f75dd38c80263b7da20e3ba5a84616bd107229095bb06b1fc03d2ad5cb165aa42d692b35d7b08b1523436021a68ebe2983e8ab767a7cd406f9eeccdad6b72ad274c5a1bd1b9c4ca2d5f52ce1cb07c566", 0x55}, {&(0x7f0000001540)="fe86bcb2607a9f8c1773b2f773de0087c081fff7c63dd34d9569c22407cb49cb5efe2e1fd6a6d05795149bc6975b7d603a98fd6f138b315c9f354b302e724cb8bb9825c90ec9f22b14ccb00046f070d248b1fc9476695092353a69a633bccdc2b4363820b33f4758e216b619c5df73d126d47cfb02f574325137bf89ff050defe5330ca5c81a9f8966ca8a84a6f9938a1847354f9b8ee39449b08d59c8f0fe35ea500adfedb0ebea2502ca6d713529b33bdc475f1d955fe6380aacd9e28a8e3f4d5319c0a3429032b57d0303a517e28f8a75936ee02f57e425bb9121bd5b25ff8ab16afeb1b8", 0xe6}, {&(0x7f0000001880)="775dd480fe0ffd9dc60f5a0d9b2241e0d06ee9a7b075bf172c6c6e93de5e6dada489a853924ee15fbbc3b786424b95803f66b0f62262818345857bcd3a4b98d48f031bad84b2a0d963ffe6002af9d85464837c71cd2cfe60bdac2f68afe4774f1ebf72dc", 0x64}, {&(0x7f00000016c0)="8681f6d12eb03eb056b1c36e59e9aa64581db7986aa24013ca07558098331995b376ac869237ada71477a280be376c5f264fda1b9a55d22cfffd34c185e1e2029b73a76f", 0x44}], 0x8, &(0x7f00000017c0)=[@ip_ttl={{0x14, 0x0, 0x2, 0x1}}, @ip_tos_int={{0x14}}, @ip_ttl={{0x14, 0x0, 0x2, 0x7}}], 0x48}, 0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x80000000) 03:25:12 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0x68}}}, 0xb8}}, 0x0) 03:25:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x193d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:25:12 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r1, &(0x7f0000000d00), 0x1c4, 0x0) getsockname$unix(r1, &(0x7f0000000100)=@abs, &(0x7f0000000000)=0x6e) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) [ 3405.096129] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3405.102686] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3405.130767] Bluetooth: hci0: Frame reassembly failed (-84) 03:25:12 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1a3d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:25:12 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0x6c}}}, 0xb8}}, 0x0) [ 3405.188504] Bluetooth: hci2: Frame reassembly failed (-84) [ 3405.194447] Bluetooth: hci2: Frame reassembly failed (-84) [ 3405.257641] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3405.295088] hfs: unable to parse mount options [ 3405.357867] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3405.399631] hfs: unable to parse mount options 03:25:13 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$KDADDIO(r2, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) 03:25:13 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0x74}}}, 0xb8}}, 0x0) 03:25:13 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1b3d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:25:13 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) mq_unlink(&(0x7f0000000000)='\x00') [ 3405.742325] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3405.755202] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:25:13 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0x7a}}}, 0xb8}}, 0x0) [ 3405.816178] hfs: dir_umask requires a value [ 3405.824021] hfs: unable to parse mount options [ 3405.851031] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3407.138917] Bluetooth: hci0: command 0x1003 tx timeout [ 3407.144324] Bluetooth: hci0: sending frame failed (-49) [ 3407.218994] Bluetooth: hci2: command 0x1003 tx timeout [ 3407.224546] Bluetooth: hci2: sending frame failed (-49) [ 3409.218925] Bluetooth: hci0: command 0x1001 tx timeout [ 3409.225763] Bluetooth: hci0: sending frame failed (-49) [ 3409.298957] Bluetooth: hci2: command 0x1001 tx timeout [ 3409.304371] Bluetooth: hci2: sending frame failed (-49) [ 3411.299009] Bluetooth: hci0: command 0x1009 tx timeout [ 3411.378953] Bluetooth: hci2: command 0x1009 tx timeout 03:25:22 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0xb00000000000000) 03:25:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1c3d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:25:22 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0x88}}}, 0xb8}}, 0x0) 03:25:22 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffffff, 0xc0106426, &(0x7f0000000100)={0x5, &(0x7f0000000080)=[{}, {}, {0x0}, {}, {}]}) ioctl$DRM_IOCTL_GET_SAREA_CTX(0xffffffffffffffff, 0xc010641d, &(0x7f0000000200)={r2, &(0x7f0000000140)=""/181}) ioctl$DRM_IOCTL_LOCK(r1, 0x4008642a, &(0x7f0000000000)={r2, 0x20}) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:25:22 executing program 4: r0 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x0, 0x2) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000080)={0x3, 0x80000000}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000040)=0xb) ioctl$KDADDIO(r1, 0x400455c8, 0x0) ioctl$KDADDIO(0xffffffffffffffff, 0x4b34, 0x7) ioctl$TIOCSETD(r1, 0x400455cb, 0x0) 03:25:22 executing program 2: r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x0, 0x0) r4 = epoll_create(0x1ff) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000000)) setsockopt$packet_int(r1, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r1, &(0x7f0000000d00), 0x1c4, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x355, 0x0, 0x4}, &(0x7f00000000c0)=0x18) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000100)={r5, 0x3}, &(0x7f0000000140)=0x8) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x4a205, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r6, 0x400455c8, 0x0) ioctl$TIOCSETD(r6, 0x800455ca, 0x0) [ 3415.370929] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3415.381885] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:25:22 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0xf0}}}, 0xb8}}, 0x0) [ 3415.440783] Bluetooth: hci0: Frame reassembly failed (-84) [ 3415.450903] hfs: dir_umask requires a value [ 3415.455365] hfs: unable to parse mount options 03:25:22 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1d3d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:25:22 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x101400, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCGICOUNT(r0, 0x545d, 0x0) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) [ 3415.522341] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3415.542405] Bluetooth: hci1: Frame reassembly failed (-84) [ 3415.551643] hfs: dir_umask requires a value [ 3415.556862] hfs: unable to parse mount options 03:25:22 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$RDS_RECVERR(0xffffffffffffffff, 0x114, 0x5, &(0x7f0000000140)=0x1, 0x4) r2 = dup(r1) fsetxattr$security_ima(r0, &(0x7f0000000000)='security.ima\x00', &(0x7f0000000080)=@sha1={0x1, "a027585a693490c5f2b5c4f4d4df0ed62edf615a"}, 0x15, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="6469725f756d61736b3d303030303030303030303030323030303030303030d0302c00"]) 03:25:22 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0x300}}}, 0xb8}}, 0x0) [ 3415.607784] Bluetooth: hci2: Frame reassembly failed (-84) [ 3415.614896] Bluetooth: hci2: Frame reassembly failed (-84) [ 3415.635110] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:25:23 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0x500}}}, 0xb8}}, 0x0) [ 3415.668076] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3415.708164] hfs: unable to parse mount options [ 3415.731367] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3417.459135] Bluetooth: hci0: command 0x1003 tx timeout [ 3417.466352] Bluetooth: hci0: sending frame failed (-49) [ 3417.618929] Bluetooth: hci1: command 0x1003 tx timeout [ 3417.618935] Bluetooth: hci2: command 0x1003 tx timeout [ 3417.619008] Bluetooth: hci2: sending frame failed (-49) [ 3417.635639] Bluetooth: hci1: sending frame failed (-49) [ 3419.539128] Bluetooth: hci0: command 0x1001 tx timeout [ 3419.544587] Bluetooth: hci0: sending frame failed (-49) [ 3419.698965] Bluetooth: hci1: command 0x1001 tx timeout [ 3419.704374] Bluetooth: hci1: sending frame failed (-49) [ 3419.710188] Bluetooth: hci2: command 0x1001 tx timeout [ 3419.715554] Bluetooth: hci2: sending frame failed (-49) [ 3421.619175] Bluetooth: hci0: command 0x1009 tx timeout [ 3421.778979] Bluetooth: hci2: command 0x1009 tx timeout [ 3421.784393] Bluetooth: hci1: command 0x1009 tx timeout 03:25:32 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x150e000000000000) 03:25:32 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0x600}}}, 0xb8}}, 0x0) 03:25:32 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1e3d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:25:32 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup(r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) pipe(&(0x7f0000000140)={0xffffffffffffffff}) getsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000001c0)=""/70, &(0x7f0000000240)=0x46) vmsplice(r1, &(0x7f0000000000), 0x2ea700a76baac, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r3, 0x2405, r2) r4 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r4, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r4, &(0x7f0000000d00), 0x1c4, 0x0) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0xfffffffffffffffe, 0x0, 0x0, 0x3001034, &(0x7f0000000080)=ANY=[@ANYRES64=r4]) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000000)) [ 3425.580435] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3425.585276] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:25:32 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0x700}}}, 0xb8}}, 0x0) [ 3425.670880] Bluetooth: hci0: Frame reassembly failed (-84) [ 3425.678739] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. 03:25:33 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0xa00}}}, 0xb8}}, 0x0) 03:25:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1f000000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:25:33 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) bind$packet(r3, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @random="ecee8b1483f4"}, 0x14) setsockopt$packet_int(r3, 0x107, 0x14, &(0x7f0000000180)=0x20, 0x4) sendmmsg(r3, &(0x7f0000000d00), 0x1c4, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r3, 0x400c6615, &(0x7f0000000000)={0x0, @aes128}) sendmsg$nl_route(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@setlink={0x48, 0x13, 0x311, 0x0, 0x0, {}, [@IFLA_IFALIAS={0x14, 0x28, 'veth0_to_team\x00'}, @IFLA_IFNAME={0x14, 0x3, 'team_slave_1\x00'}]}, 0x48}}, 0x0) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) 03:25:33 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x800, 0x0) ioctl$SIOCAX25OPTRT(r1, 0x89e7, &(0x7f0000000100)={@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x2, 0x56}) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCLINUX6(r0, 0x541c, &(0x7f0000000000)={0x6, 0x1}) arch_prctl$ARCH_GET_CPUID(0x1011) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) 03:25:33 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$TIOCNXCL(r0, 0x540d) ioctl$KDADDIO(r0, 0x400455c8, 0x1) write$binfmt_aout(r0, &(0x7f0000000180)={{0xcc, 0x1, 0x9, 0x36f, 0x249, 0x1, 0x206, 0x400}, "", [[], [], [], [], [], []]}, 0x620) ioctl$TIOCSETD(r0, 0x400455cb, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) ioctl$KVM_DIRTY_TLB(r2, 0x4010aeaa, &(0x7f0000000080)={0x9, 0x6}) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(r1, 0xc040564b, &(0x7f0000000000)={0x7, 0x0, 0x100b, 0x5, 0x7, {0x4, 0x5}, 0x1}) [ 3426.259070] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3426.279300] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:25:33 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0xe00}}}, 0xb8}}, 0x0) 03:25:33 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x1f3d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3426.323095] netlink: 'syz-executor.3': attribute type 40 has an invalid length. [ 3426.362275] hfs: dir_umask requires a value [ 3426.367454] hfs: unable to parse mount options [ 3426.388744] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3426.399083] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3426.464944] netlink: 'syz-executor.3': attribute type 40 has an invalid length. [ 3426.486484] hfs: dir_umask requires a value [ 3426.491676] hfs: unable to parse mount options [ 3426.570059] Bluetooth: Error in BCSP hdr checksum [ 3426.829232] Bluetooth: Error in BCSP hdr checksum [ 3427.698978] Bluetooth: hci0: command 0x1003 tx timeout [ 3427.704541] Bluetooth: hci0: sending frame failed (-49) [ 3428.339047] Bluetooth: hci2: command 0x1003 tx timeout [ 3428.344621] Bluetooth: hci2: sending frame failed (-49) [ 3428.350502] Bluetooth: hci1: command 0x1003 tx timeout [ 3428.361621] Bluetooth: hci1: sending frame failed (-49) [ 3429.778999] Bluetooth: hci0: command 0x1001 tx timeout [ 3429.784420] Bluetooth: hci0: sending frame failed (-49) [ 3430.418969] Bluetooth: hci1: command 0x1001 tx timeout [ 3430.424384] Bluetooth: hci1: sending frame failed (-49) [ 3430.430172] Bluetooth: hci2: command 0x1001 tx timeout [ 3430.435519] Bluetooth: hci2: sending frame failed (-49) [ 3431.858993] Bluetooth: hci0: command 0x1009 tx timeout [ 3432.498948] Bluetooth: hci2: command 0x1009 tx timeout [ 3432.504415] Bluetooth: hci1: command 0x1009 tx timeout 03:25:43 executing program 0: perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xf) ioctl$KDADDIO(r0, 0x400455c8, 0x1f00000000000000) 03:25:43 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0xf00}}}, 0xb8}}, 0x0) 03:25:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x20000000, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) 03:25:43 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) ioctl$sock_inet_SIOCGIFBRDADDR(r1, 0x8919, &(0x7f0000000000)={'ipddp0\x00', {0x2, 0x4e23, @multicast1}}) [ 3435.831772] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3435.839598] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3435.864237] Bluetooth: hci0: Frame reassembly failed (-84) 03:25:43 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000bfff0)={&(0x7f0000000200)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in6=@mcast1={0xff, 0x2}, @in=@multicast1=0xe0000002}, {0xe000000}, {0x0, 0x0, 0x2000}}}, 0xb8}}, 0x0) 03:25:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x203d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3435.895848] hfs: dir_umask requires a value [ 3435.906183] hfs: unable to parse mount options 03:25:43 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockname$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) syz_mount_image$hfs(&(0x7f00000000c0)='hfs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)={[{@dir_umask={'dir_umask', 0x3d, 0x80000000}}]}) [ 3435.976162] netlink: 104 bytes leftover after parsing attributes in process `syz-executor.5'. [ 3435.978010] netlink: 'syz-executor.1': attribute type 39 has an invalid length. 03:25:43 executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x213d0100, {}, [@IFLA_LINKINFO={0x1c, 0x12, @bridge={{0xc, 0x1, 'bridge\x00'}, {0xc, 0x2, [@IFLA_BR_VLAN_DEFAULT_PVID={0x8, 0x27, 0xae}]}}}]}, 0x3c}}, 0x0) [ 3436.047784] hfs: dir_umask requires a value [ 3436.056618] hfs: unable to parse mount options [ 3436.074245] netlink: 'syz-executor.1': attribute type 39 has an invalid length. [ 3436.105837] hfs: dir_umask requires a value [ 3436.117104] hfs: unable to parse mount options [ 3436.430936] ================================================================== [ 3436.438575] BUG: KASAN: use-after-free in kfree_skb+0x38/0x390 [ 3436.444557] Read of size 4 at addr ffff888080484de4 by task syz-executor.4/14143 [ 3436.452081] [ 3436.453718] CPU: 1 PID: 14143 Comm: syz-executor.4 Not tainted 4.19.79 #0 [ 3436.460640] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3436.470079] Call Trace: [ 3436.472688] dump_stack+0x172/0x1f0 [ 3436.476328] ? kfree_skb+0x38/0x390 [ 3436.479974] print_address_description.cold+0x7c/0x20d [ 3436.485253] ? kfree_skb+0x38/0x390 [ 3436.488886] kasan_report.cold+0x8c/0x2ba [ 3436.493067] check_memory_region+0x123/0x190 [ 3436.497481] kasan_check_read+0x11/0x20 [ 3436.501454] kfree_skb+0x38/0x390 [ 3436.504924] bcsp_close+0xc7/0x130 [ 3436.508477] hci_uart_tty_close+0x1ea/0x250 [ 3436.512823] ? hci_uart_close+0x50/0x50 [ 3436.516821] tty_ldisc_close.isra.0+0xaf/0xe0 [ 3436.521325] tty_ldisc_kill+0x4b/0xc0 [ 3436.525133] tty_ldisc_release+0xc6/0x280 [ 3436.529290] tty_release_struct+0x1b/0x50 [ 3436.533440] tty_release+0xbcb/0xe90 [ 3436.537166] ? put_tty_driver+0x20/0x20 [ 3436.541155] __fput+0x2dd/0x8b0 [ 3436.544444] ____fput+0x16/0x20 [ 3436.547726] task_work_run+0x145/0x1c0 [ 3436.551624] exit_to_usermode_loop+0x273/0x2c0 [ 3436.556213] do_syscall_64+0x53d/0x620 [ 3436.560111] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 3436.565305] RIP: 0033:0x413741 [ 3436.568500] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 3436.587398] RSP: 002b:00007ffccbdcb8d0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 3436.595123] RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000413741 [ 3436.602395] RDX: 0000001b2f720000 RSI: 0000000000001dae RDI: 0000000000000003 [ 3436.609662] RBP: 0000000000000001 R08: 00000000e82d3dae R09: 00000000e82d3db2 [ 3436.616931] R10: 00007ffccbdcb9b0 R11: 0000000000000293 R12: 000000000075c9a0 [ 3436.624212] R13: 000000000075c9a0 R14: 00000000007628c8 R15: 000000000075c07c [ 3436.631492] [ 3436.633117] Allocated by task 728: [ 3436.636665] save_stack+0x45/0xd0 [ 3436.640126] kasan_kmalloc+0xce/0xf0 [ 3436.643960] kasan_slab_alloc+0xf/0x20 [ 3436.647867] kmem_cache_alloc_node+0x144/0x710 [ 3436.652887] __alloc_skb+0xd5/0x5f0 [ 3436.656604] bcsp_recv+0x8c7/0x13a0 [ 3436.660236] hci_uart_tty_receive+0x225/0x530 [ 3436.664733] tty_ldisc_receive_buf+0x15f/0x1c0 [ 3436.669320] tty_port_default_receive_buf+0x7d/0xb0 [ 3436.674340] flush_to_ldisc+0x222/0x390 [ 3436.678313] process_one_work+0x989/0x1750 [ 3436.682551] worker_thread+0x98/0xe40 [ 3436.686387] kthread+0x354/0x420 [ 3436.689865] ret_from_fork+0x24/0x30 [ 3436.693571] [ 3436.695197] Freed by task 728: [ 3436.698396] save_stack+0x45/0xd0 [ 3436.701847] __kasan_slab_free+0x102/0x150 [ 3436.706080] kasan_slab_free+0xe/0x10 [ 3436.709878] kmem_cache_free+0x86/0x260 [ 3436.713853] kfree_skbmem+0xcb/0x150 [ 3436.717565] kfree_skb+0xf0/0x390 [ 3436.721015] bcsp_recv+0x2d8/0x13a0 [ 3436.724644] hci_uart_tty_receive+0x225/0x530 [ 3436.729139] tty_ldisc_receive_buf+0x15f/0x1c0 [ 3436.733718] tty_port_default_receive_buf+0x7d/0xb0 [ 3436.739011] flush_to_ldisc+0x222/0x390 [ 3436.742983] process_one_work+0x989/0x1750 [ 3436.747216] worker_thread+0x98/0xe40 [ 3436.751017] kthread+0x354/0x420 [ 3436.754386] ret_from_fork+0x24/0x30 [ 3436.758095] [ 3436.759726] The buggy address belongs to the object at ffff888080484d00 [ 3436.759726] which belongs to the cache skbuff_head_cache of size 232 [ 3436.772997] The buggy address is located 228 bytes inside of [ 3436.772997] 232-byte region [ffff888080484d00, ffff888080484de8) [ 3436.784867] The buggy address belongs to the page: [ 3436.789804] page:ffffea0002012100 count:1 mapcount:0 mapping:ffff8880aa347ac0 index:0x0 [ 3436.797955] flags: 0x1fffc0000000100(slab) [ 3436.802207] raw: 01fffc0000000100 ffffea00029190c8 ffffea00026895c8 ffff8880aa347ac0 [ 3436.810097] raw: 0000000000000000 ffff888080484080 000000010000000c 0000000000000000 [ 3436.817976] page dumped because: kasan: bad access detected [ 3436.823682] [ 3436.825308] Memory state around the buggy address: [ 3436.830249] ffff888080484c80: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc [ 3436.837626] ffff888080484d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 3436.844989] >ffff888080484d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc [ 3436.852345] ^ [ 3436.858839] ffff888080484e00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 3436.866196] ffff888080484e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 3436.873548] ================================================================== [ 3436.880898] Disabling lock debugging due to kernel taint [ 3436.889173] Kernel panic - not syncing: panic_on_warn set ... [ 3436.889173] [ 3436.896576] CPU: 0 PID: 14143 Comm: syz-executor.4 Tainted: G B 4.19.79 #0 [ 3436.904889] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 3436.914323] Call Trace: [ 3436.916919] dump_stack+0x172/0x1f0 [ 3436.920550] ? kfree_skb+0x38/0x390 [ 3436.924294] panic+0x263/0x507 [ 3436.927488] ? __warn_printk+0xf3/0xf3 [ 3436.931379] ? kfree_skb+0x38/0x390 [ 3436.935012] ? preempt_schedule+0x4b/0x60 [ 3436.939160] ? ___preempt_schedule+0x16/0x18 [ 3436.943582] ? trace_hardirqs_on+0x5e/0x220 [ 3436.947903] ? kfree_skb+0x38/0x390 [ 3436.951709] kasan_end_report+0x47/0x4f [ 3436.955692] kasan_report.cold+0xa9/0x2ba [ 3436.960106] check_memory_region+0x123/0x190 [ 3436.964517] kasan_check_read+0x11/0x20 [ 3436.968494] kfree_skb+0x38/0x390 [ 3436.972039] bcsp_close+0xc7/0x130 [ 3436.975583] hci_uart_tty_close+0x1ea/0x250 03:25:44 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x2) ioctl$KDADDIO(r0, 0x400455c8, 0x0) ioctl$TIOCSETD(r0, 0x800455ca, 0x0) [ 3436.979907] ? hci_uart_close+0x50/0x50 [ 3436.983883] tty_ldisc_close.isra.0+0xaf/0xe0 [ 3436.988379] tty_ldisc_kill+0x4b/0xc0 [ 3436.992183] tty_ldisc_release+0xc6/0x280 [ 3436.996334] tty_release_struct+0x1b/0x50 [ 3437.000481] tty_release+0xbcb/0xe90 [ 3437.004205] ? put_tty_driver+0x20/0x20 [ 3437.008180] __fput+0x2dd/0x8b0 [ 3437.011468] ____fput+0x16/0x20 [ 3437.014748] task_work_run+0x145/0x1c0 [ 3437.018644] exit_to_usermode_loop+0x273/0x2c0 [ 3437.023235] do_syscall_64+0x53d/0x620 [ 3437.027132] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 3437.027437] kobject: 'loop2' (00000000dec3ae97): kobject_uevent_env [ 3437.032318] RIP: 0033:0x413741 [ 3437.032331] Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 04 1b 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 [ 3437.032337] RSP: 002b:00007ffccbdcb8d0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 3437.032348] RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000413741 [ 3437.032354] RDX: 0000001b2f720000 RSI: 0000000000001dae RDI: 0000000000000003 [ 3437.032364] RBP: 0000000000000001 R08: 00000000e82d3dae R09: 00000000e82d3db2 [ 3437.044488] kobject: 'loop2' (00000000dec3ae97): fill_kobj_path: path = '/devices/virtual/block/loop2' [ 3437.060820] R10: 00007ffccbdcb9b0 R11: 0000000000000293 R12: 000000000075c9a0 [ 3437.060827] R13: 000000000075c9a0 R14: 00000000007628c8 R15: 000000000075c07c [ 3437.062234] Kernel Offset: disabled [ 3437.119258] Rebooting in 86400 seconds..