5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0xe000000, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 299.586442][ T7] attempt to access beyond end of device [ 299.592615][T20569] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 299.599771][ T7] loop5: rw=1, want=143, limit=63 [ 299.604819][ T7] attempt to access beyond end of device [ 299.619179][ T7] loop5: rw=1, want=144, limit=63 [ 299.624350][ T7] attempt to access beyond end of device [ 299.628531][T20569] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:13:51 executing program 2: r0 = add_key$keyring(&(0x7f00000005c0)='keyring\x00', &(0x7f0000000600)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, &(0x7f0000000380)='asymmetric\x00', &(0x7f0000000100)=@chain={'key_or_keyring:', 0x0, ':chain\x00'}) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, 0x0, 0x0) keyctl$get_keyring_id(0x0, r0, 0x5) unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r1, 0x0, 0x0) [ 299.630108][ T7] loop5: rw=1, want=145, limit=63 [ 299.645377][ T7] attempt to access beyond end of device [ 299.651200][ T7] loop5: rw=1, want=3649, limit=63 [ 299.666865][ T7] attempt to access beyond end of device [ 299.669936][ T1938] tipc: Disabling bearer [ 299.672897][ T7] loop5: rw=1, want=23057, limit=63 [ 299.677944][ T1938] tipc: Left network mode 09:13:51 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xff00, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:13:51 executing program 3: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r1, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 299.690560][T20575] tipc: Enabling of bearer rejected, failed to enable media [ 299.702983][ T7] attempt to access beyond end of device [ 299.708678][ T7] loop5: rw=1, want=55553, limit=63 [ 299.724166][ T7] attempt to access beyond end of device [ 299.729996][ T7] loop5: rw=1, want=63513, limit=63 09:13:51 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x0, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, &(0x7f0000000000)) 09:13:51 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x10000000, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 299.767365][T20584] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 299.802862][T20584] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 299.844919][T20589] tipc: Started in network mode 09:13:51 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, &(0x7f0000000000)) [ 299.870120][T20589] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 299.896064][T20589] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb 09:13:51 executing program 3: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r1, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 299.935771][T20589] tipc: Enabled bearer , priority 10 [ 299.955371][T20595] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 299.974204][T20595] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 300.003073][T20598] net_ratelimit: 11 callbacks suppressed [ 300.003080][T20598] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 300.063816][T20598] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 300.509278][T17006] tipc: 32-bit node address hash set to fbff1eac 09:13:52 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, &(0x7f0000000000)) 09:13:52 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xff04, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:13:52 executing program 3: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r1, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:13:52 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x11000000, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:13:52 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, 0xffffffffffffffff, 0x0, 0x280900) 09:13:52 executing program 2: unshare(0x44000600) r0 = syz_open_dev$usbfs(0x0, 0x8, 0x58bd41) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r2, 0x0, 0x0) lseek(r2, 0xe7, 0x0) accept4$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000000c0)=0x14, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="40000000140000002abd7000fcdbdf250a1f01fd", @ANYRES32=r3, @ANYBLOB="1400060022000000000400000106007f00ce2990de20eb7680edff07000000"], 0x40}, 0x1, 0x0, 0x0, 0x1}, 0x80) [ 300.884363][T20605] FAT-fs (loop5): FAT read failed (blocknr 63) [ 300.899002][ T7] attempt to access beyond end of device [ 300.910949][ T7] loop5: rw=1, want=78, limit=63 [ 300.915905][ T7] buffer_io_error: 38 callbacks suppressed [ 300.915911][ T7] Buffer I/O error on dev loop5, logical block 77, lost async page write 09:13:52 executing program 2: openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x141002, 0x0) unshare(0x4c070a80) r0 = creat(&(0x7f0000000000)='./file0\x00', 0x82) syz_open_dev$usbfs(0x0, 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000100)='NET_DM\x00') sendmsg$NET_DM_CMD_STOP(r0, &(0x7f00000001c0)={&(0x7f00000000c0), 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x14, r2, 0x4, 0x70bd26, 0x25dfdbfb, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x40001) lseek(r1, 0x0, 0x0) [ 300.930273][T16995] tipc: 32-bit node address hash set to fbff1eac [ 300.948800][T20618] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 300.962174][ T7] attempt to access beyond end of device [ 300.975104][ T7] loop5: rw=1, want=79, limit=63 09:13:52 executing program 3: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r1, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:13:52 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, &(0x7f0000000000)) [ 300.980179][ T7] Buffer I/O error on dev loop5, logical block 78, lost async page write [ 300.989063][ T7] attempt to access beyond end of device [ 300.994967][T20624] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 301.002146][ T7] loop5: rw=1, want=80, limit=63 [ 301.007084][ T7] Buffer I/O error on dev loop5, logical block 79, lost async page write [ 301.015599][ T7] attempt to access beyond end of device [ 301.021480][ T7] loop5: rw=1, want=81, limit=63 [ 301.026528][ T7] Buffer I/O error on dev loop5, logical block 80, lost async page write 09:13:53 executing program 2: unshare(0x64050600) r0 = syz_open_dev$usbfs(0x0, 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r1, 0x0, 0x0) lseek(r1, 0xe7, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000100)={'geneve0\x00', {0x2, 0x4e21, @remote}}) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000340)={0x0, 0x0}) r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f0000000380)='):userselinux\x00'}, 0x10) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r5, 0x0, 0x0) lseek(r5, 0xe7, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000640)={r5, 0xc0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=0x1f7, 0x0, 0x0, 0x0, &(0x7f0000000480)={0x6, 0x1}, 0x0, 0x0, &(0x7f00000004c0)={0x1, 0x0, 0x2, 0x5}, &(0x7f0000000500)=0x1, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)=0x7fffffff}}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000680)={r3, r4, 0x0, 0x1d, &(0x7f0000000400)=':&user{)nodev/eth1cpuset+GPL\x00', r6}, 0x30) unshare(0x20400) ioctl$USBDEVFS_REAPURB(r0, 0x4008550c, &(0x7f0000000080)) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = socket$inet_udp(0x2, 0x2, 0x0) writev(r8, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001400", 0x6}], 0x1) write$binfmt_elf64(r8, &(0x7f0000000240)=ANY=[@ANYBLOB="8fbf259608a927ce928b"], 0xa) close(r9) socket(0x10, 0x3, 0x0) r10 = openat$null(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/null\x00', 0x20800, 0x0) setsockopt$inet6_int(r10, 0x29, 0x24, &(0x7f0000000700)=0x7, 0x4) splice(r7, 0x0, r9, 0x0, 0x80000001, 0x0) lseek(r2, 0x0, 0x0) r11 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_GET(r2, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000001c0)={&(0x7f0000000280)={0x60, r11, 0x2, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_NODE={0x24, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x81}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x23}]}, @TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xfffffe01}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x100}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x41}, 0x0) [ 301.035859][T20624] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 301.043141][ T7] attempt to access beyond end of device [ 301.048780][ T7] loop5: rw=1, want=130, limit=63 [ 301.054464][ T7] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 301.065345][ T7] attempt to access beyond end of device [ 301.071186][ T7] loop5: rw=1, want=131, limit=63 [ 301.076214][ T7] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 301.089164][ T7] attempt to access beyond end of device [ 301.094917][ T7] loop5: rw=1, want=132, limit=63 [ 301.104094][ T7] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 301.114690][T20632] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 301.130110][ T7] attempt to access beyond end of device 09:13:53 executing program 2: syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000200)={0x3, 0xfd, 0x2, 0x0, 0x8}) [ 301.135974][ T7] loop5: rw=1, want=133, limit=63 [ 301.141443][ T7] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 301.150230][ T7] attempt to access beyond end of device [ 301.155862][ T7] loop5: rw=1, want=142, limit=63 [ 301.161211][ T7] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 301.169961][ T7] attempt to access beyond end of device [ 301.175597][ T7] loop5: rw=1, want=143, limit=63 09:13:53 executing program 2: unshare(0x44000600) r0 = syz_open_dev$usbfs(0x0, 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r1, 0x0, 0x0) bind$vsock_stream(r0, &(0x7f0000000000)={0x28, 0x0, 0xffffffff, @host}, 0x10) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r2, 0x0, 0x0) lseek(r2, 0xe7, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r3, 0x0, 0x0) lseek(r3, 0xe7, 0x0) ioctl$sock_SIOCETHTOOL(r3, 0x8946, &(0x7f00000002c0)={'wireguard1\x00', &(0x7f0000000280)=@ethtool_dump={0x40, 0x1, 0x3}}) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ADD(r2, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0xe8, r4, 0x100, 0x70bd26, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0x30, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}, @TIPC_NLA_NET={0x48, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xffffff81}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x54}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xe2d}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x5}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x200}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xffff2278}]}, @TIPC_NLA_PUBL={0x4}, @TIPC_NLA_NET={0x58, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x5678}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x9}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xbf}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6b}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xf}]}]}, 0xe8}, 0x1, 0x0, 0x0, 0x4000000}, 0x4) 09:13:53 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x12000000, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 301.182065][ T7] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 301.191726][T20624] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 301.199009][ T7] attempt to access beyond end of device [ 301.204983][ T7] loop5: rw=1, want=144, limit=63 [ 301.210262][ T7] attempt to access beyond end of device [ 301.212883][T20624] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 301.215895][ T7] loop5: rw=1, want=145, limit=63 [ 301.217046][ T7] attempt to access beyond end of device [ 301.236117][ T7] loop5: rw=1, want=2217, limit=63 [ 301.244843][ T7] attempt to access beyond end of device [ 301.254507][ T7] loop5: rw=1, want=9281, limit=63 [ 301.261086][T20643] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 301.280168][ T7] attempt to access beyond end of device 09:13:53 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x50000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:13:53 executing program 0: unshare(0x44000600) syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f0000000000)) 09:13:53 executing program 3: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, 0x0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 301.287359][ T7] loop5: rw=1, want=40697, limit=63 [ 301.314718][ T7] attempt to access beyond end of device [ 301.321182][ T7] loop5: rw=1, want=63513, limit=63 [ 301.326571][T20647] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 301.342299][T20647] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 301.350338][ T1938] tipc: Disabling bearer [ 301.355669][ T1938] tipc: Left network mode [ 301.366430][ T1938] tipc: Disabling bearer [ 301.373691][ T1938] tipc: Left network mode [ 301.373719][T20651] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 301.431008][T20655] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 301.438847][T20655] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:13:54 executing program 0: unshare(0x44000600) syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f0000000000)) 09:13:54 executing program 2: unshare(0x45040400) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r1, 0x0, 0x0) lseek(r1, 0xe7, 0x0) sendmsg$unix(r1, &(0x7f00000014c0)={&(0x7f0000000080)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000001440)=[{&(0x7f0000000100)="c456f08c9600785112d9ec1e904c8711aa57eb9da7107cfd8543b518f8c4b92f25a653a0b514486075c7b8c14eb3eb8c9f6bde9f43a4243ee296dd43d1d4b80b09102636ae2630", 0x47}, {&(0x7f0000000180)="890a4bf3608dbe2cbdb4f5b9ad610a767afa0b790e5316622dff0a8c98c2b540a632a4dee067f315eacb8c58615e9f23b9556907205ad0813db423f44db18ff94a0cdc65e18cdff0bc6fe4f9353fd15af36b80b28c0a723a95cc5278300d157ace0abf1d0df4ebdaf6b545ff9e490a57", 0x70}, {&(0x7f0000000200)="fa72e74a1caad6c327308fe87cfa8cfdc7b259cb82eb0f9423a5d25cb27b25ac3257a4abf2a4ff3f0cb5f6375b3a9eea47c3196ea0b2ed532a816d93f7479a36765a485dd3097019d57f198eb3c21367a2234129c84aba453ca70b76b4c4118142b613d219f8539a968aac87cc5fe97845addfa889ae2e9c580180cb74bf141d9c2363f36c97243b06beb6dd49287c38afc28649a2e92d0f863f564ac0788529e0a9c12ccbccb5f1114d67822196bace7001b9761b29fb66d6cd1434b6988835ce88c0dbdbf897ceec004bbe838cd7473c8937926e359ab8835a8de39f74d49a893f3855004b403a263a2be49216", 0xee}, {&(0x7f0000000300)="85a17ab13051b8a7aede445c5175f0f4f1396a5a584df16d7ddf0d554684d307714de483bda9c52562aa9e25e202619aacf4d53635696ceab447c5e1cb65ae4dc67ad4472a38baab051fd8137456473c872aa24cbbe822a9228deacf4959f29c9f15d0cccde1ff0a675385539018b1b17c8dd4b16eda8c3a97b45cf9ebcc2e616918a6e1c2dbf7b683f532f0d9d61905952d1089fa66bc96dd781f6a9e84a0272860d12a6723e9c45c0a7cda5105db2af686", 0xb2}, {&(0x7f0000000000)="802e88d8523036df09d2b1f15319176973c56d0ed3aa37398f7e879f275fc9bcde0faf3743dbec77e63c215a272bb9", 0x2f}, {&(0x7f00000003c0)}, {&(0x7f0000000400)="e29bc65dacff489248b8a5e4c0e94e19fd6daac0c8fa17fe6513b441f9e78744a25f8d2133f8069c03a7b13bdd5169641eea8ff654d05be54e5426e4a552cc1c02c6aab08bf36242cf2137e19e13d7f2a4e931bf6842278be591a61a62a22a86a2b84c4b173a5738b46a137db0ebb91a9aa61d347354307205980200e8c0f22de5f90938536483e9317aa390092f994fcf80df8ddf640a480fc0c103fe320df367d81f97ff8606150b4ae001e8acacbb516d8ec41edd1e03cdc3764d903d04706f6605d4fafb708633db9b81f968deeabd3eeeb9a7fe6b204e28f575bcd5934f06f448614c88c5c36d116b0409501a96a00920b1d52c6747b00df75837113002b79a0195825f854e94c3deb643f9a8082c0a18ff0d6e86923532e6b46bff4098d976f3d4a071bc43c931c9a652474f096639195b9235b17cb72ca31811aa659d1ab773c5c4dc9037c147ebf5d1a69e8a9f8e9ef2ec142bf5b005bcf064f8a0ba9219becc49a87b7d8b31d2e0409dce0e19b97236fd9ddbd1eae4bbcc245fc9fd77ec1c0d28658d9acd5de6f36d65a0ff832b7ddc40c5b2686dee2469b66bd93874b28340288b58e07e45292deeb37ad2d4323dcde5c500db5c36839badedcc84cec5c3d501a507c05088ab99f7b3caee40b9bff7719a10405200bd9a8c60bb643e4e56a06a238b40d2bd0382af548af048f1c177c2b5a16ba52fed62ba8c454d8679e03ab66a5977d1aa74b4ef14894f6c551fa2bdabc05679fce7c77b9f0425e27d0ff42a04f464cd64b3153d435270cfb97fc58592c5d55b33a48e14611af9419fc898e3315d1145740bb3c848ee418a929dafe61f04bcf03d8326e8fb89802666ec4af235a674ad56e97dd9b2119d283cd986c760a6e0914072cbc8c7e2706ea6daa62e0439df799b20981e8dc3e8e806e270de844adbeff4428b453a82a2c62ddc09d0a307818aa4cfc27c8d5e7d21a571ec8350163e71255f8cd018391d8a217e55083dfdb44670b334876608672becf9372931180c595289935aeae1afe849f1135cf58342bbf591c6c926af8be41ddc3504746b9b0193c002b4bd47f2c86788c0fdc9caacb68531d50f664897bb153efe17d46e273a48f805f1f384f9b6722a199d2e31f332147ee0305a8ac163d036b7f39624438dc2d96fead0925865171acb4e4a5632e7c637aedf2ef7ba0261509dc44a790d1f3dcd42c4f84ba5dc8b27200f6b6e987fcef3c6209103b68a3f66fab979c7dba6940b547d194aeb141c107af783a470125ae6c51317d148a987016ddbe080f10b1cb43143832add9f5bcca74d6fbb0c23dae91332e4c422316420c81dfc98b886469433ba1d48f096df72ba94fecea26f43059f2a9e2752d6fd587cf3e40fe899023cd7945063805348fa229cb7cce66a3f46f7f9fae964db652631d90e5ef131df5e4731a25e233d685e05c15c54eae02bc1aeb52f901c2406356e85fda526e33a20dec3dbeb165c7fea3fa41f95beafe5e1f0b9bce2c5b376699bb3ae6f84f4efaf0a40ebbec810ba70a1db7fd7f601904489c475c1db4a268fdd81efb6fb61d429f13b257c7d34e29b07071dc14bb894f2bc564e48b7fafb2ee5cccfc2e79567966f6624b6e6339a3390feaedd95405aa94898cf8a1aa593e1960cbc59ffa3b6e9fa262d1113e77220e49e38f1c66517cf7c7a32c4b5703d0bb2c6522bac49a601d10fbc64ea891daf12fec470450f70c36ee6ccbb702c6f65391b3bdf5fe2e20fce670c0e95f8b1a386802cc38883b99b5a6458394b8736b9d8a6e792bbdaaccb8b317c9cb092b76ff6d4e190e89500a1dbd58f207fc9af54e155d89bc60f3fb891c7ee4c1a3da35c3dab83b2ec96966ea844cb42170255b61471bc2bee1139793bda9a6cca0ea48ac69137f02a7986b57830ef77a3e6ecef7515461ad88ac193f9460b678942d3e68ca74b9c6c8092a9385883bc379273e1b3db7644fc93b199e3b0db48fe2a2414cc14fdc3f4fc1347c6caf0e619b76a51262723f26a571aca94192b27ef32bf5f30e162ee40c6da65c8291de81474380fe42f1846100432599474c5d7a041975d1a1e35eaab7a3d6d21631372ef2aef17698bc6a017da1bc5408831b8cf8c3dea5dbdbfabf1bac9a822e63954b81dfa1e7f67011dcfa437ebdfde8f36d9a753dd074761f3b596c4c0fe6ff69ecd15b2808cf26d9a162e2a345cf81d80b65f3c69e9e0237a0b0a15dfe22fef412318961f4f22ba6b4ceed36e02f9a84b9660fc7853cb3ea2962e57307335c4fe473035d663d5ef282109d8cee71b8f13b50b45f1b0d16a31fb044b704828d7288c9078416c894c7280a6a1716c14449918b67db285d27035f4e274a1529f92a0fb7594c0c87a8382b8e4ab1d87b288b9f6d3280b2da5fe1af3fb9ca38e09da067215c19ce020975d4f14f0cca0eda69b1cf7103f1702f163fea4f6efb0e2bd7dd29b6f7d2aeae01c7f1211acd44619f9a6895d801617695be07183635d0f124b5d636ed3f61917bf4fa8a4c3ce50f74c3c2a3ddebdb858c883e674b46611a345a616b205a459730e3c5c9896cfbad4e027ebc4c47f5063b2a987f1991b29b38eac26c4758524bf835cee19e447ee3e8439d4bc1c9f7be642ef06892ed35a32f3d2cc1ad51e3a5efa7d43f9e362efd17490ff9f2bab4565d7be22abb3a3773b0edc64602747896d30413bbcdc383774f2662fedb6ecef3c3909171549b538575c9c6e6d922441fe5f462e5bb07bed0b5cafa0ff5a51006baefb3e99244e77292ca0e3c39d2174c0d7a4b58e95ea9971644945fc4d442cbc04dee2be292423a9de2e8fd8c41a8d47edf7b03eda9f8b2bbca7f7b03b9128add5199259d777c42d33b110db84a73a0ad4b2fb3b177d8837017d1dc29eb559075786290d6cedec380bc17439220ed6ff69ccb64008282be844863e74cd23d9441f8979cab9f9e32cc30b17032e5045f17a8dc54c32214ce1821bea10223344cfb13e25963cca8143f6a233f23c84a099b6e727f1680c63900b9b26a9211d802d14904103f753588e9f8a43802c1e18df7c05e95708abc1f7f26e19ce49076b03783b561a9f0b2779970afc4e3cd8a65b8827dc8518425d84edbc99e6c05d62e4948d9e5ecfe540ec538ce476632f41298db8d30d803fdd8adf38e5d5746f8ba5bbdbef26d7bdc1c2fdf5c18668d7919e3dab80532b3e69bdc295ac425d968bc23ccf6b519179312c26313bb779b615aa65b9c5b0e18aff7e2406d91c082aa554fdcf4e9ec921588fa9173fbaa3bf4cb7576c76f5ad5a93885402d2b45124ff39fd0ec3a5f0ebe6a9badff6bb9eb704f6c3319a269e0012ddd34d68971945b9a0d2eb1028aa4233973fe589be073b4a041f59e2e9658cc1cd8021e012b0f4dc681d9d5cdb5779afa837224e2b4e7a908e6a7028d8d3b22739b58a4f08ff7d81cb8903f78272315f4fa318338e536dc7ee6066543a628e4aacb26cc619eeb8bfe94a8eb10b5873755157bad66f05fabc5c62d88781c1beb7b57d532c1022a89418e8b06387b1f77bec6743980c1cfddcbce6f698cc5e0f32b3282de277735813caa854c0ca096495c55931023e669f94ea096a2b1bcd7e858edcc73096097a22c3a5a453e9ff59b32c1e07ca763d7cea7cf9b35ee4896392bdd8ee148cfecf7c51953a2aa01ad10472b7e4db96cfde6ced31ad4c9d457c17a251b190314dc665da10568b719d622d458ee329ec3f544f8e53cd2728a6327935155da828736043a18a48674ed752c4cd8ff45b022186f34635d3dd65048362f32e75971b4f28beaf17e43ae2d1b6dfeb44cc8d7d58456efb584e4f2aa4be13e26a8e2855c2983d782d86fd9005e3d1404ee65e029d8e5275d1727f1a17bb0481ec7d64f88c8528d0eda4db7fd5194c563fc0d3582e3b88111ed1086b3372ee6d5a8012e214870155f73d1137d88688c9be247b1e501ab39bf185d9d80d66e88382f318c29cc8842978a7c9fa010d6ad91bc03d94c54aa4b07b79b2d329dde3936404dc3fe5c922a658e9d936a14b2590b299757c648f6eb9fc168e56de838ec7076327382c5aa1a8bc9cffde1776a93dd38c690ae86271ca94d5076dfc9de1514c67003217e4a94d5da26cf14afec2234d54174be7c0179b0e013e14a96bda19d061a9ac2720bff154f978ce50ea2c1dd3243035d3541e82e1b10bd8e3e393b238ac64a7c212e540e76977f96cd75653c8f44c2f900c9c5cd20f6f621dc6b151612ff90ef779f76f122d4ed793c7643ba33aa9b2721d149241167caf31fd5202e08ec8d3d5b006121416547a9d93c192858d0f6550db7661bb4c7873c522323b35853d69d70f03fd29a390324b83b8403d59621dbd5825e601ff298ab9b8c3e72c47d1603d5a638c60df0163cba4c94bd7fd10f83cc286099cf0b53845d3ff4dbd9511e8d4775a160dbde097ba7349e8f809a18dd8c145aa12e8b8cd5c9d048504042373850b25166fe7bf07c6b0ca005917de3daf0161a200bc86f654ddbc9a1261e1161b6311add538a159e6aedd91fdabf7788a930ef09fa197bd4a678c7dcf64567efc382e2ed96c23a83b112922966199a3fb12a0390d0f921d2ce60d6cb0701dc090d4ae26a5395e47b4e1944046bc321a94ebbf2d42ef92525bf6ba92b03a56f8da31cc2b767bf94d6610e896ce6e0b211843ac5f606440f839b1752c21aee2d1fd8e54a3e7b9dd7d57976281229488daf82984d570a9bda7ee5004a4bda151efa2e528128bdd7efea3060f02a8ff9fff9bc66b815e684b34d5ba1224cce9df25803e177e47ad288dbfce9dbe7239b4610387134c9ce796eefea2f7cbdb10cc3e565cebbd52dbe2badac77620464298e9bd29bba19021bae9e4aa432e043656c407d1a7b98cdaf328417a6d6e3487dd45a68a1d0dc3638f80dc7475e4f524e324d22c3bca8d9f7faf34f3a5600a386f3fe06d03c204e1da1f461d6376899694b087a45ffedc7900dc1cee095ac0c8bc0480a76fbc28e44e07b28ffa64a1ef69593b54dc1427bbbde33d88148eb7e1702a4df9b4aedd8254dc31fac221433315ce34fe8493c9d85eacd090043d206dde73de9aea27b2571bfa4408e9c4b01ba37f54f0989602be81516e528ba8df6754c40cb6786929078daffcf608f09071d375afa2d88097b2e3e8c8974c97b2db4f2f00f79fd3cac021edb0f109d343afa38b7007853def2c19e171b6e334243e2d89967b43edbc7b669c739eafa26717a3d64320b51b809284868eaef51a2c152f93868ddb44aa421238fb41c82b034670b2bd00a12acaa4fb49f3265c6dee96b2bce618d64eb3466cdb4c3979aa642eabf44a068473a9c4e8a0d0101dbc8d68d443b2e94760bb636f55bad8891bbca1ded868915445f5ca3d34b58f21f80f9967f3ed49457cb5be79084bca06e3f20e5f6d627b288e1b012a8fed5b1c5883dcd611e0d53791a35cf68b93ddfcb4ae3d2d6e478dc19060109ed0dcd9482f81e236376b141edb869511dc4729e53be336602ff5d8e2efe52255f3c0e48cd75e9c92ebb85b0239e5d8aa1d993dc36e4695ad4dbe559a868ca83e788513732b67cb8a9cb5f5dcf6e7acd30732755ba1d6752dd06fbf8ececb3b7a09a282a057a207163e9cafa21384cbc65a40a0d3c2040b3aafd19e0b22f2d2cfd20698ff3a65b8a7743ad04c3d116093f9ebebf1387ebbd40818d1d5282a950147a3c359bfedfd17691d05a7159464adcd4a133f21f2e32cdb155aa2d33aae8bb1cf2747bea399e78462869e18a9844a1aa92b74161df3", 0x1000}, {&(0x7f0000001400)="2914d31b346eaefcf12a101c624d3fdb663e2c6ff52171ad51d1a5ef178d5eb5", 0x20}], 0x8, 0x0, 0x0, 0x8000}, 0x41) 09:13:54 executing program 3: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, 0x0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:13:54 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x20000000, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:13:54 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x0) 09:13:54 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x1000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 302.172333][T20658] FAT-fs (loop5): FAT read failed (blocknr 63) [ 302.187135][ T7] attempt to access beyond end of device [ 302.198628][ T7] loop5: rw=1, want=78, limit=63 [ 302.208398][ T7] attempt to access beyond end of device [ 302.217523][ T7] loop5: rw=1, want=79, limit=63 09:13:54 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0) lseek(r0, 0x0, 0x0) [ 302.217950][T20668] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 302.224902][ T7] attempt to access beyond end of device [ 302.251785][ T7] loop5: rw=1, want=80, limit=63 [ 302.256764][ T7] attempt to access beyond end of device [ 302.266088][ T7] loop5: rw=1, want=81, limit=63 09:13:54 executing program 0: unshare(0x44000600) syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f0000000000)) 09:13:54 executing program 3: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, 0x0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 302.271826][ T7] attempt to access beyond end of device [ 302.273978][T20670] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 302.281172][ T7] loop5: rw=1, want=130, limit=63 [ 302.289890][T20670] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 302.299174][ T7] attempt to access beyond end of device [ 302.306932][ T7] loop5: rw=1, want=131, limit=63 [ 302.312084][ T7] attempt to access beyond end of device [ 302.319585][ T7] loop5: rw=1, want=132, limit=63 [ 302.325612][ T7] attempt to access beyond end of device [ 302.336832][ T7] loop5: rw=1, want=133, limit=63 [ 302.342069][ T7] attempt to access beyond end of device [ 302.347705][ T7] loop5: rw=1, want=142, limit=63 [ 302.348984][T20676] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 302.353107][ T7] attempt to access beyond end of device [ 302.378372][ T7] loop5: rw=1, want=143, limit=63 [ 302.384948][ T7] attempt to access beyond end of device [ 302.390685][ T7] loop5: rw=1, want=144, limit=63 [ 302.396256][ T7] attempt to access beyond end of device [ 302.407522][ T7] loop5: rw=1, want=145, limit=63 [ 302.413871][ T7] attempt to access beyond end of device 09:13:54 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) [ 302.423438][ T7] loop5: rw=1, want=2361, limit=63 [ 302.433203][ T7] attempt to access beyond end of device [ 302.442172][ T7] loop5: rw=1, want=6793, limit=63 09:13:54 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x25000000, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:13:54 executing program 3: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:13:54 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x2000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 302.469679][ T7] attempt to access beyond end of device [ 302.475492][ T7] loop5: rw=1, want=33577, limit=63 [ 302.510007][ T7] attempt to access beyond end of device [ 302.517092][ T7] loop5: rw=1, want=63281, limit=63 [ 302.528233][ T7] attempt to access beyond end of device [ 302.534171][ T7] loop5: rw=1, want=63513, limit=63 [ 302.535869][T20693] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:13:54 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) [ 302.589586][T20696] tipc: Enabling of bearer rejected, failed to enable media [ 302.607850][T20697] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 302.615924][T20697] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:13:54 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x40000000, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:13:54 executing program 3: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 302.639746][T20699] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 302.693932][T20705] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 302.701959][T20705] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 302.721746][T20706] tipc: Started in network mode [ 302.726690][T20706] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 302.736070][T20706] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 302.744232][T20706] tipc: Enabled bearer , priority 10 09:13:55 executing program 3: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:13:55 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) 09:13:55 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x2010000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:13:55 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x48000000, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:13:55 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x0) 09:13:55 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0xe7, 0x0) ioctl$EVIOCGEFFECTS(r0, 0x80044584, &(0x7f0000000080)=""/72) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r1, 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x420200, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sync_file_range(r2, 0xff, 0x3ff, 0x3) [ 303.455987][T20710] FAT-fs (loop5): FAT read failed (blocknr 63) [ 303.470283][ T7] attempt to access beyond end of device [ 303.476076][ T7] loop5: rw=1, want=78, limit=63 [ 303.488065][ T7] attempt to access beyond end of device [ 303.497124][ T7] loop5: rw=1, want=79, limit=63 09:13:55 executing program 0: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x50000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 303.504574][ T7] attempt to access beyond end of device [ 303.513653][ T7] loop5: rw=1, want=80, limit=63 [ 303.518624][ T7] attempt to access beyond end of device [ 303.524385][ T7] loop5: rw=1, want=81, limit=63 [ 303.529484][ T7] attempt to access beyond end of device [ 303.535263][ T7] loop5: rw=1, want=130, limit=63 [ 303.540889][ T7] attempt to access beyond end of device [ 303.546882][T20722] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 303.554115][ T7] loop5: rw=1, want=131, limit=63 [ 303.555195][T20722] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 303.559380][ T7] attempt to access beyond end of device [ 303.566678][T20718] tipc: Started in network mode [ 303.572376][ T7] loop5: rw=1, want=132, limit=63 [ 303.577101][T20718] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 303.591467][ T7] attempt to access beyond end of device [ 303.595365][T20718] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 303.597132][ T7] loop5: rw=1, want=133, limit=63 [ 303.597164][ T7] attempt to access beyond end of device [ 303.605727][T20718] tipc: Enabled bearer , priority 10 [ 303.610820][ T7] loop5: rw=1, want=142, limit=63 [ 303.616498][T20728] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 303.623174][ T7] attempt to access beyond end of device [ 303.633235][T20728] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 303.635491][ T7] loop5: rw=1, want=143, limit=63 09:13:55 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:13:55 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x4c000000, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 303.645184][T20732] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 303.648429][ T7] attempt to access beyond end of device [ 303.648436][ T7] loop5: rw=1, want=144, limit=63 [ 303.648450][ T7] attempt to access beyond end of device [ 303.677018][ T7] loop5: rw=1, want=145, limit=63 [ 303.680138][T20732] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 303.683954][ T7] attempt to access beyond end of device [ 303.698719][ T7] loop5: rw=1, want=3305, limit=63 09:13:55 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x3000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:13:55 executing program 0: unshare(0x44000600) syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, &(0x7f0000000000)) 09:13:55 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 303.708052][ T7] attempt to access beyond end of device [ 303.714491][ T7] loop5: rw=1, want=7417, limit=63 [ 303.737682][ T7] attempt to access beyond end of device [ 303.743484][ T7] loop5: rw=1, want=28097, limit=63 [ 303.745453][T20740] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 303.767874][T20740] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 303.771378][ T7] attempt to access beyond end of device [ 303.781774][ T7] loop5: rw=1, want=60585, limit=63 [ 303.793187][ T7] attempt to access beyond end of device [ 303.798977][ T7] loop5: rw=1, want=63513, limit=63 [ 303.808721][T20743] tipc: Started in network mode 09:13:55 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x60000000, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:13:55 executing program 0: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xff00, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 303.814454][T20743] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 303.823899][T20743] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 303.846718][T20743] tipc: Enabled bearer , priority 10 [ 303.859176][ T12] tipc: 32-bit node address hash set to fbff1eac 09:13:55 executing program 3: r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:13:55 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x4000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 303.859233][T20747] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 303.878338][T20747] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 303.897538][T20750] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 303.912732][T20750] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 303.925732][T20753] tipc: Enabling of bearer rejected, failed to enable media [ 303.937219][T20755] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 303.961848][T20755] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 304.035689][T20757] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 304.047508][T20757] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 304.599720][T20532] tipc: 32-bit node address hash set to fbff1eac 09:13:56 executing program 3: r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:13:56 executing program 0: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x7400, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:13:56 executing program 2: unshare(0x44000600) r0 = syz_open_dev$usbfs(0x0, 0x10000000000000, 0x400601) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r1, 0x0, 0x0) r2 = openat$ashmem(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ashmem\x00', 0x210200, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r3, 0x0, 0x0) lseek(r3, 0xe7, 0x0) ioctl$ASHMEM_GET_PROT_MASK(r3, 0x7706, &(0x7f0000000000)) ioctl$ASHMEM_SET_NAME(r2, 0x41007701, &(0x7f0000000080)='-selinux}vmnet0GPLself\x00') epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r0, &(0x7f0000000100)={0x8}) 09:13:56 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x0) 09:13:56 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x68000000, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:13:56 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x5000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 304.746951][T20760] FAT-fs (loop5): FAT read failed (blocknr 63) [ 304.763698][ T7] attempt to access beyond end of device [ 304.770460][ T7] loop5: rw=1, want=78, limit=63 [ 304.787919][T20770] tipc: Enabling of bearer rejected, failed to enable media 09:13:56 executing program 3: r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 304.790793][ T7] attempt to access beyond end of device [ 304.820681][ T7] loop5: rw=1, want=79, limit=63 [ 304.825665][ T7] attempt to access beyond end of device [ 304.827606][T20774] tipc: Enabling of bearer rejected, failed to enable media [ 304.832490][ T7] loop5: rw=1, want=80, limit=63 [ 304.840929][T20772] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 304.845141][ T7] attempt to access beyond end of device [ 304.851965][T20532] tipc: 32-bit node address hash set to fbff1eac [ 304.863687][ T7] loop5: rw=1, want=81, limit=63 09:13:56 executing program 3: unshare(0x0) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 304.868654][ T7] attempt to access beyond end of device [ 304.872366][T20772] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 304.882037][T20771] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 304.891290][T20771] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 304.894367][ T7] loop5: rw=1, want=130, limit=63 [ 304.904648][T20778] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 304.908165][ T7] attempt to access beyond end of device [ 304.917357][ T7] loop5: rw=1, want=131, limit=63 [ 304.922609][ T7] attempt to access beyond end of device [ 304.928241][ T7] loop5: rw=1, want=132, limit=63 [ 304.933773][ T7] attempt to access beyond end of device [ 304.935301][T20778] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 304.939780][ T7] loop5: rw=1, want=133, limit=63 [ 304.952227][ T7] attempt to access beyond end of device [ 304.958050][ T7] loop5: rw=1, want=142, limit=63 [ 304.961151][T20779] tipc: Enabling of bearer rejected, failed to enable media 09:13:56 executing program 0 (fault-call:2 fault-nth:0): unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) 09:13:56 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x6c000000, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:13:56 executing program 3: unshare(0x0) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 304.963405][ T7] attempt to access beyond end of device [ 304.977262][ T7] loop5: rw=1, want=143, limit=63 [ 304.982472][ T7] attempt to access beyond end of device [ 304.988198][ T7] loop5: rw=1, want=144, limit=63 [ 304.993377][ T7] attempt to access beyond end of device [ 304.999378][ T7] loop5: rw=1, want=145, limit=63 [ 305.008059][ T7] attempt to access beyond end of device 09:13:56 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x6000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:13:57 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) 09:13:57 executing program 2: setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000180)=@random={'os2.', '/proc/bus/input/devices\x00'}, &(0x7f0000000100)='/proc/bus/input/devices\x00', 0x18, 0x0) unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) [ 305.017602][ T7] loop5: rw=1, want=2313, limit=63 [ 305.028797][ T7] attempt to access beyond end of device [ 305.039137][ T7] loop5: rw=1, want=8897, limit=63 [ 305.062471][ T7] attempt to access beyond end of device [ 305.068257][ T7] loop5: rw=1, want=37505, limit=63 [ 305.081654][T20791] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 305.091239][ T7] attempt to access beyond end of device [ 305.096896][ T7] loop5: rw=1, want=63513, limit=63 [ 305.097548][T20791] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 305.111521][T20790] tipc: Enabling of bearer rejected, failed to enable media [ 305.134684][ T1938] tipc: Disabling bearer [ 305.140101][ T1938] tipc: Left network mode [ 305.141580][T20793] net_ratelimit: 9 callbacks suppressed 09:13:57 executing program 3: unshare(0x0) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 305.141586][T20793] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 305.182768][ T1938] tipc: Disabling bearer [ 305.189272][ T1938] tipc: Left network mode [ 305.189357][T20796] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 305.203295][T20796] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 305.213187][T20798] tipc: Enabling of bearer rejected, failed to enable media [ 305.224904][ T1938] tipc: Disabling bearer [ 305.230390][ T1938] tipc: Left network mode [ 305.238286][T20799] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:13:57 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r1, 0x0, 0x0) lseek(r1, 0xe7, 0x0) sendmsg$NLBL_CALIPSO_C_REMOVE(r1, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x4c, 0x0, 0x400, 0x70bd27, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x4004080) r2 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x905, 0x800) ioctl$USBDEVFS_SUBMITURB(r2, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$F_SET_FILE_RW_HINT(r2, 0x40e, &(0x7f0000000000)=0x3) lseek(r0, 0x0, 0x0) 09:13:57 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x2, 0x0) 09:13:57 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:13:57 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x74000000, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:13:57 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x7000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 305.996853][T20803] FAT-fs (loop5): FAT read failed (blocknr 63) [ 306.010954][ T7] attempt to access beyond end of device [ 306.016650][ T7] loop5: rw=1, want=78, limit=63 [ 306.029159][ T7] buffer_io_error: 38 callbacks suppressed [ 306.029166][ T7] Buffer I/O error on dev loop5, logical block 77, lost async page write 09:13:58 executing program 5 (fault-call:10 fault-nth:0): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) [ 306.036627][T20812] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 306.063010][ T7] attempt to access beyond end of device [ 306.063953][T20814] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 306.068667][ T7] loop5: rw=1, want=79, limit=63 [ 306.068677][ T7] Buffer I/O error on dev loop5, logical block 78, lost async page write [ 306.068698][ T7] attempt to access beyond end of device [ 306.103882][ T7] loop5: rw=1, want=80, limit=63 [ 306.108867][ T7] Buffer I/O error on dev loop5, logical block 79, lost async page write [ 306.120087][T20816] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 306.130801][ T7] attempt to access beyond end of device [ 306.136843][T20816] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:13:58 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x7a000000, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:13:58 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 306.140811][ T7] loop5: rw=1, want=81, limit=63 [ 306.148977][ T7] Buffer I/O error on dev loop5, logical block 80, lost async page write [ 306.161172][ T7] attempt to access beyond end of device [ 306.166826][ T7] loop5: rw=1, want=130, limit=63 [ 306.175521][ T7] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 306.184376][ T7] attempt to access beyond end of device [ 306.190077][ T7] loop5: rw=1, want=131, limit=63 09:13:58 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4b47, 0x0) 09:13:58 executing program 2: unshare(0x44000600) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r0, 0x0, 0x0) lseek(r0, 0xe7, 0x0) sendmsg$IPCTNL_MSG_CT_GET_UNCONFIRMED(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, 0x7, 0x1, 0x101, 0x0, 0x0, {0xc, 0x0, 0x8}, ["", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20040040}, 0x20004880) syz_open_dev$usbfs(0x0, 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r1, 0x0, 0x0) [ 306.195114][ T7] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 306.203941][ T7] attempt to access beyond end of device [ 306.209726][ T7] loop5: rw=1, want=132, limit=63 [ 306.214114][T20824] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 306.214762][ T7] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 306.214786][ T7] attempt to access beyond end of device [ 306.244241][ T7] loop5: rw=1, want=133, limit=63 [ 306.245477][T20826] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 306.249545][ T7] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 306.268621][ T7] attempt to access beyond end of device [ 306.274536][ T7] loop5: rw=1, want=142, limit=63 [ 306.279793][ T7] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 306.281797][T20826] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 306.288337][ T7] attempt to access beyond end of device [ 306.308681][ T7] loop5: rw=1, want=143, limit=63 [ 306.315866][ T7] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 306.324962][ T7] attempt to access beyond end of device [ 306.330848][ T7] loop5: rw=1, want=144, limit=63 [ 306.336629][ T7] attempt to access beyond end of device [ 306.343039][ T7] loop5: rw=1, want=145, limit=63 09:13:58 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:13:58 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x8000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 306.351038][ T7] attempt to access beyond end of device [ 306.356762][ T7] loop5: rw=1, want=2865, limit=63 [ 306.374792][ T7] attempt to access beyond end of device [ 306.385853][ T7] loop5: rw=1, want=12593, limit=63 09:13:58 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x81000000, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:13:58 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/timers\x00', 0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x9c081, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r1, 0xc0105502, &(0x7f0000000040)=@urb_type_interrupt={0x1, {0x9, 0x1}, 0x3f, 0x41, &(0x7f0000000140)="fe", 0x1, 0x2, 0x3, 0x0, 0x7f, 0x4, &(0x7f0000000180)="8e00aa6ffa2e87f14194e409164a9bc634bea60e6a7c72d12b45a42fbd05"}) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r2, 0x0, 0x0) lseek(r2, 0xe7, 0x0) r3 = accept$unix(r2, 0x0, &(0x7f0000000080)) ioctl$UI_SET_MSCBIT(r0, 0x40045568, 0x11) r4 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r4, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0}) tee(r3, r4, 0x66c, 0x2) r5 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r5, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$USBDEVFS_DISCARDURB(r5, 0x550b, &(0x7f0000000100)=0xffffffff) lseek(r1, 0x1, 0x2) [ 306.418209][ T7] attempt to access beyond end of device [ 306.427139][ T7] loop5: rw=1, want=44905, limit=63 [ 306.453017][T20843] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready 09:13:58 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4b49, 0x0) 09:13:58 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 306.464427][ T7] attempt to access beyond end of device [ 306.468852][T20843] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 306.470149][ T7] loop5: rw=1, want=63513, limit=63 09:13:58 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 306.520793][T20848] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 306.548806][T20854] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 306.557916][T20854] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 306.575289][T20857] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 306.885699][T20866] FAULT_INJECTION: forcing a failure. [ 306.885699][T20866] name failslab, interval 1, probability 0, space 0, times 0 [ 306.898587][T20866] CPU: 1 PID: 20866 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 306.908730][T20866] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 306.918903][T20866] Call Trace: [ 306.922340][T20866] dump_stack+0x1b0/0x228 [ 306.926675][T20866] ? devkmsg_release+0x127/0x127 [ 306.931652][T20866] ? show_regs_print_info+0x18/0x18 [ 306.936846][T20866] should_fail+0x6fb/0x860 [ 306.941266][T20866] ? setup_fault_attr+0x2b0/0x2b0 [ 306.946329][T20866] ? arch_stack_walk+0x98/0xe0 [ 306.951090][T20866] __should_failslab+0x11a/0x160 [ 306.956024][T20866] ? alloc_pipe_info+0xaa/0x3d0 [ 306.960872][T20866] should_failslab+0x9/0x20 [ 306.965375][T20866] kmem_cache_alloc_trace+0x3a/0x2f0 [ 306.970663][T20866] ? kstrtoull+0x3c4/0x4e0 [ 306.975080][T20866] alloc_pipe_info+0xaa/0x3d0 [ 306.979753][T20866] ? kstrtouint_from_user+0x1cb/0x230 [ 306.985123][T20866] splice_direct_to_actor+0x94e/0xb00 [ 306.990488][T20866] ? avc_policy_seqno+0x1b/0x70 [ 306.995343][T20866] ? do_splice_direct+0x3d0/0x3d0 [ 307.000368][T20866] ? pipe_to_sendpage+0x300/0x300 [ 307.005498][T20866] ? rw_verify_area+0x1c2/0x360 [ 307.010347][T20866] do_splice_direct+0x279/0x3d0 [ 307.015199][T20866] ? splice_direct_to_actor+0xb00/0xb00 [ 307.020745][T20866] ? security_file_permission+0x157/0x350 [ 307.026455][T20866] do_sendfile+0x89d/0x1110 [ 307.030953][T20866] ? compat_writev+0x390/0x390 [ 307.035702][T20866] ? __kasan_check_write+0x14/0x20 [ 307.040810][T20866] ? fput_many+0x47/0x1a0 [ 307.045127][T20866] __x64_sys_sendfile64+0x1ae/0x220 [ 307.050434][T20866] ? __ia32_sys_sendfile+0x240/0x240 [ 307.055809][T20866] ? syscall_return_slowpath+0x6f/0x500 [ 307.061347][T20866] do_syscall_64+0xc0/0x100 [ 307.065841][T20866] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 307.071723][T20866] RIP: 0033:0x45b399 [ 307.075623][T20866] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 307.095338][T20866] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 307.103841][T20866] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 307.111815][T20866] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 307.119782][T20866] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 307.127860][T20866] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 307.135828][T20866] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000000 09:13:59 executing program 5 (fault-call:10 fault-nth:1): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:13:59 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x81ffffff, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:13:59 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:13:59 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x541b, 0x0) 09:13:59 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x9000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:13:59 executing program 2: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x228200, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r0, 0x8982, &(0x7f0000000040)={0x8, 'veth1_virt_wifi\x00', {'ip6tnl0\x00'}, 0x5}) unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) lseek(0xffffffffffffffff, 0x0, 0x3) [ 307.446059][T20863] FAT-fs (loop5): FAT read failed (blocknr 63) [ 307.463228][ T7] attempt to access beyond end of device [ 307.468905][ T7] loop5: rw=1, want=78, limit=63 [ 307.474777][ T7] attempt to access beyond end of device [ 307.480794][ T7] loop5: rw=1, want=79, limit=63 [ 307.485789][ T7] attempt to access beyond end of device [ 307.491956][ T7] loop5: rw=1, want=80, limit=63 [ 307.496917][ T7] attempt to access beyond end of device [ 307.502753][ T7] loop5: rw=1, want=81, limit=63 [ 307.507809][ T7] attempt to access beyond end of device [ 307.514069][ T7] loop5: rw=1, want=130, limit=63 [ 307.519434][ T7] attempt to access beyond end of device [ 307.525150][ T7] loop5: rw=1, want=131, limit=63 [ 307.526913][T20876] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 307.530409][ T7] attempt to access beyond end of device [ 307.555178][T20872] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 307.559165][ T7] loop5: rw=1, want=132, limit=63 [ 307.565318][T20872] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 307.567406][ T7] attempt to access beyond end of device [ 307.580173][ T7] loop5: rw=1, want=133, limit=63 [ 307.585327][ T7] attempt to access beyond end of device [ 307.590996][ T7] loop5: rw=1, want=142, limit=63 [ 307.596186][ T7] attempt to access beyond end of device [ 307.601850][ T7] loop5: rw=1, want=143, limit=63 [ 307.607021][ T7] attempt to access beyond end of device [ 307.612828][ T7] loop5: rw=1, want=144, limit=63 [ 307.617870][ T7] attempt to access beyond end of device [ 307.623633][ T7] loop5: rw=1, want=145, limit=63 [ 307.624574][T20881] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 307.630430][ T7] attempt to access beyond end of device [ 307.650169][ T7] loop5: rw=1, want=2993, limit=63 [ 307.663712][ T7] attempt to access beyond end of device [ 307.669436][ T7] loop5: rw=1, want=16353, limit=63 09:13:59 executing program 3: unshare(0x44000600) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r0, 0x0, 0x0) 09:13:59 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x5421, 0x0) [ 307.696119][ T7] attempt to access beyond end of device [ 307.701803][ T7] loop5: rw=1, want=46329, limit=63 [ 307.725457][ T7] attempt to access beyond end of device [ 307.738745][ T7] loop5: rw=1, want=63513, limit=63 09:13:59 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x95010000, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:13:59 executing program 3: unshare(0x44000600) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r0, 0x0, 0x0) 09:13:59 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x9effffff, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:13:59 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xa000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 307.808035][T20890] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 307.873750][T20898] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 307.881531][T20898] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 307.941164][T20900] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 307.948964][T20900] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 308.143588][T20906] FAULT_INJECTION: forcing a failure. [ 308.143588][T20906] name failslab, interval 1, probability 0, space 0, times 0 [ 308.156788][T20906] CPU: 0 PID: 20906 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 308.166937][T20906] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 308.176991][T20906] Call Trace: [ 308.180432][T20906] dump_stack+0x1b0/0x228 [ 308.184757][T20906] ? devkmsg_release+0x127/0x127 [ 308.189695][T20906] ? unwind_next_frame+0x415/0x870 [ 308.194837][T20906] ? show_regs_print_info+0x18/0x18 [ 308.200044][T20906] should_fail+0x6fb/0x860 [ 308.204457][T20906] ? setup_fault_attr+0x2b0/0x2b0 [ 308.209493][T20906] ? setup_fault_attr+0x2b0/0x2b0 [ 308.214519][T20906] ? arch_stack_walk+0x98/0xe0 [ 308.219282][T20906] __should_failslab+0x11a/0x160 [ 308.224218][T20906] ? kcalloc+0x36/0x60 [ 308.228288][T20906] should_failslab+0x9/0x20 [ 308.232894][T20906] __kmalloc+0x64/0x310 [ 308.237041][T20906] ? kasan_kmalloc+0x9/0x10 [ 308.241535][T20906] ? kmem_cache_alloc_trace+0xe2/0x2f0 [ 308.246994][T20906] kcalloc+0x36/0x60 [ 308.250995][T20906] alloc_pipe_info+0x1ca/0x3d0 [ 308.255762][T20906] splice_direct_to_actor+0x94e/0xb00 [ 308.261169][T20906] ? avc_policy_seqno+0x1b/0x70 [ 308.266031][T20906] ? do_splice_direct+0x3d0/0x3d0 [ 308.271054][T20906] ? pipe_to_sendpage+0x300/0x300 [ 308.276292][T20906] ? rw_verify_area+0x1c2/0x360 [ 308.281259][T20906] do_splice_direct+0x279/0x3d0 [ 308.286185][T20906] ? splice_direct_to_actor+0xb00/0xb00 [ 308.291874][T20906] ? security_file_permission+0x157/0x350 [ 308.297590][T20906] do_sendfile+0x89d/0x1110 [ 308.302102][T20906] ? compat_writev+0x390/0x390 [ 308.306862][T20906] ? __kasan_check_write+0x14/0x20 [ 308.312077][T20906] ? fput_many+0x47/0x1a0 [ 308.316405][T20906] __x64_sys_sendfile64+0x1ae/0x220 [ 308.321626][T20906] ? __ia32_sys_sendfile+0x240/0x240 [ 308.326914][T20906] ? syscall_return_slowpath+0x6f/0x500 [ 308.332454][T20906] do_syscall_64+0xc0/0x100 [ 308.336958][T20906] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 308.342869][T20906] RIP: 0033:0x45b399 [ 308.346771][T20906] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 308.367334][T20906] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 308.375753][T20906] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 308.383728][T20906] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 308.391790][T20906] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 308.399777][T20906] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 308.407911][T20906] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000001 09:14:00 executing program 5 (fault-call:10 fault-nth:2): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:00 executing program 3: unshare(0x44000600) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r0, 0x0, 0x0) 09:14:00 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x5450, 0x0) 09:14:00 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0xeaffffff, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:00 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xb000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:00 executing program 2: r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r0, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0}) r1 = openat$selinux_member(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/member\x00', 0x2, 0x0) fsetxattr$security_capability(r1, &(0x7f0000000000)='security.capability\x00', &(0x7f0000000080)=@v1={0x1000000, [{0x4, 0x10000}]}, 0xc, 0x0) unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r2, 0x0, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/timer_list\x00', 0x0, 0x0) read(r3, 0x0, 0x0) lseek(r3, 0xe7, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r3, 0x6, 0x23, &(0x7f0000000100)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}, &(0x7f0000000140)=0x10) [ 308.730422][T20903] FAT-fs (loop5): FAT read failed (blocknr 63) [ 308.755402][ T7] attempt to access beyond end of device [ 308.764525][ T7] loop5: rw=1, want=78, limit=63 [ 308.773402][ T7] attempt to access beyond end of device 09:14:00 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x5451, 0x0) 09:14:00 executing program 3: unshare(0x44000600) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) [ 308.779051][ T7] loop5: rw=1, want=79, limit=63 [ 308.788103][ T7] attempt to access beyond end of device [ 308.797736][ T7] loop5: rw=1, want=80, limit=63 [ 308.805986][ T7] attempt to access beyond end of device [ 308.816741][ T7] loop5: rw=1, want=81, limit=63 [ 308.827630][ T7] attempt to access beyond end of device [ 308.833610][ T7] loop5: rw=1, want=130, limit=63 [ 308.838654][ T7] attempt to access beyond end of device [ 308.845444][T20918] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 308.850202][ T7] loop5: rw=1, want=131, limit=63 [ 308.854018][T20918] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 308.857425][ T7] attempt to access beyond end of device [ 308.871042][ T7] loop5: rw=1, want=132, limit=63 09:14:00 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x5452, 0x0) [ 308.889206][ T7] attempt to access beyond end of device [ 308.894864][ T7] loop5: rw=1, want=133, limit=63 [ 308.900329][ T7] attempt to access beyond end of device [ 308.905959][ T7] loop5: rw=1, want=142, limit=63 [ 308.911304][ T7] attempt to access beyond end of device [ 308.922760][ T7] loop5: rw=1, want=143, limit=63 [ 308.927832][ T7] attempt to access beyond end of device [ 308.933721][ T7] loop5: rw=1, want=144, limit=63 09:14:00 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0xefffffff, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 308.938762][ T7] attempt to access beyond end of device [ 308.949184][ T7] loop5: rw=1, want=145, limit=63 [ 308.955647][ T7] attempt to access beyond end of device [ 308.966934][ T7] loop5: rw=1, want=2617, limit=63 [ 308.969299][T20918] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 308.977015][ T7] attempt to access beyond end of device 09:14:00 executing program 3: unshare(0x44000600) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) [ 308.985011][ T7] loop5: rw=1, want=10937, limit=63 09:14:01 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r0, 0x0, 0x0) lseek(r0, 0xe7, 0x0) write$FUSE_NOTIFY_POLL(r0, &(0x7f0000000000)={0x18, 0x1, 0x0, {0x6}}, 0x18) unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r1, 0x0, 0x0) [ 309.023979][ T7] attempt to access beyond end of device [ 309.029672][ T7] loop5: rw=1, want=41393, limit=63 [ 309.045122][T20918] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 309.051766][ T7] attempt to access beyond end of device [ 309.058013][ T7] loop5: rw=1, want=63513, limit=63 [ 309.411737][T20946] FAULT_INJECTION: forcing a failure. [ 309.411737][T20946] name failslab, interval 1, probability 0, space 0, times 0 [ 309.424771][T20946] CPU: 1 PID: 20946 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 309.434918][T20946] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 309.444980][T20946] Call Trace: [ 309.448397][T20946] dump_stack+0x1b0/0x228 [ 309.452728][T20946] ? devkmsg_release+0x127/0x127 [ 309.457663][T20946] ? __kasan_check_read+0x11/0x20 [ 309.462696][T20946] ? show_regs_print_info+0x18/0x18 [ 309.467893][T20946] should_fail+0x6fb/0x860 [ 309.472439][T20946] ? setup_fault_attr+0x2b0/0x2b0 [ 309.477467][T20946] ? current_time+0x2e0/0x2e0 [ 309.482143][T20946] __should_failslab+0x11a/0x160 [ 309.487085][T20946] ? kmalloc_array+0x32/0x60 [ 309.491690][T20946] should_failslab+0x9/0x20 [ 309.496199][T20946] __kmalloc+0x64/0x310 [ 309.500352][T20946] kmalloc_array+0x32/0x60 [ 309.504785][T20946] iter_file_splice_write+0x21d/0xf20 [ 309.510835][T20946] ? __sb_end_write+0xa8/0xf0 [ 309.515514][T20946] ? touch_atime+0x22e/0x270 [ 309.520155][T20946] ? current_time+0x2e0/0x2e0 [ 309.524830][T20946] ? fsnotify+0x1390/0x1450 [ 309.529328][T20946] ? splice_from_pipe+0x200/0x200 [ 309.534355][T20946] ? splice_shrink_spd+0xb0/0xb0 [ 309.539410][T20946] ? splice_from_pipe+0x200/0x200 [ 309.544440][T20946] direct_splice_actor+0xf7/0x130 [ 309.549468][T20946] splice_direct_to_actor+0x496/0xb00 [ 309.554846][T20946] ? do_splice_direct+0x3d0/0x3d0 [ 309.559872][T20946] ? pipe_to_sendpage+0x300/0x300 [ 309.565009][T20946] ? rw_verify_area+0x1c2/0x360 [ 309.569865][T20946] do_splice_direct+0x279/0x3d0 [ 309.574721][T20946] ? splice_direct_to_actor+0xb00/0xb00 [ 309.580380][T20946] ? security_file_permission+0x157/0x350 [ 309.586149][T20946] do_sendfile+0x89d/0x1110 [ 309.590652][T20946] ? compat_writev+0x390/0x390 [ 309.595413][T20946] ? __kasan_check_write+0x14/0x20 [ 309.600517][T20946] ? fput_many+0x47/0x1a0 [ 309.604849][T20946] __x64_sys_sendfile64+0x1ae/0x220 [ 309.610049][T20946] ? __ia32_sys_sendfile+0x240/0x240 [ 309.615468][T20946] ? syscall_return_slowpath+0x6f/0x500 [ 309.621015][T20946] do_syscall_64+0xc0/0x100 [ 309.625516][T20946] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 309.631499][T20946] RIP: 0033:0x45b399 [ 309.635394][T20946] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 309.655087][T20946] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 309.663542][T20946] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 309.671731][T20946] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 309.679813][T20946] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 309.687811][T20946] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 309.695782][T20946] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000002 09:14:01 executing program 5 (fault-call:10 fault-nth:3): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:01 executing program 2: socket$packet(0x11, 0x5, 0x300) unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) ioctl$GIO_FONTX(0xffffffffffffffff, 0x4b6b, &(0x7f0000000000)={0xbd, 0x19, &(0x7f0000000080)}) 09:14:01 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0xf0ffffff, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:01 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x5460, 0x0) 09:14:01 executing program 3: unshare(0x44000600) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) 09:14:01 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xc000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 309.991637][T20943] FAT-fs (loop5): FAT read failed (blocknr 63) [ 310.007230][ T7] attempt to access beyond end of device [ 310.018364][ T7] loop5: rw=1, want=78, limit=63 [ 310.025955][ T7] attempt to access beyond end of device [ 310.035108][ T7] loop5: rw=1, want=79, limit=63 [ 310.041418][ T7] attempt to access beyond end of device [ 310.047062][ T7] loop5: rw=1, want=80, limit=63 [ 310.055849][ T7] attempt to access beyond end of device [ 310.062625][ T7] loop5: rw=1, want=81, limit=63 [ 310.067639][ T7] attempt to access beyond end of device [ 310.073587][T20953] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 310.076072][ T7] loop5: rw=1, want=130, limit=63 09:14:02 executing program 3: unshare(0x44000600) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) 09:14:02 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0xfeffffff, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 310.083605][T20953] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 310.092927][ T7] attempt to access beyond end of device [ 310.098557][ T7] loop5: rw=1, want=131, limit=63 [ 310.107702][ T7] attempt to access beyond end of device [ 310.115527][ T7] loop5: rw=1, want=132, limit=63 [ 310.121188][ T7] attempt to access beyond end of device [ 310.127030][ T7] loop5: rw=1, want=133, limit=63 09:14:02 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4004550c, 0x0) [ 310.137443][ T7] attempt to access beyond end of device [ 310.143288][ T7] loop5: rw=1, want=142, limit=63 [ 310.148324][ T7] attempt to access beyond end of device [ 310.154352][ T7] loop5: rw=1, want=143, limit=63 [ 310.156486][T20965] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 310.163147][ T7] attempt to access beyond end of device [ 310.171797][T20965] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 310.174424][ T7] loop5: rw=1, want=144, limit=63 [ 310.185092][ T7] attempt to access beyond end of device 09:14:02 executing program 3: unshare(0x44000600) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) [ 310.191081][ T7] loop5: rw=1, want=145, limit=63 [ 310.197651][ T7] attempt to access beyond end of device [ 310.203633][ T7] loop5: rw=1, want=2569, limit=63 [ 310.213715][ T7] attempt to access beyond end of device [ 310.220446][ T7] loop5: rw=1, want=10201, limit=63 [ 310.222051][T20968] net_ratelimit: 10 callbacks suppressed 09:14:02 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0xffffff7f, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:02 executing program 3: unshare(0x44000600) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) [ 310.222057][T20968] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 310.241587][ T7] attempt to access beyond end of device [ 310.252210][ T7] loop5: rw=1, want=39641, limit=63 [ 310.281576][ T7] attempt to access beyond end of device [ 310.287243][ T7] loop5: rw=1, want=63513, limit=63 [ 310.311798][T20974] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 310.362026][T20977] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 310.639849][T20983] FAULT_INJECTION: forcing a failure. [ 310.639849][T20983] name failslab, interval 1, probability 0, space 0, times 0 [ 310.654904][T20983] CPU: 1 PID: 20983 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 310.665401][T20983] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 310.675589][T20983] Call Trace: [ 310.678901][T20983] dump_stack+0x1b0/0x228 [ 310.683379][T20983] ? devkmsg_release+0x127/0x127 [ 310.688322][T20983] ? __kasan_check_read+0x11/0x20 [ 310.693345][T20983] ? show_regs_print_info+0x18/0x18 [ 310.698551][T20983] should_fail+0x6fb/0x860 [ 310.702994][T20983] ? setup_fault_attr+0x2b0/0x2b0 [ 310.708973][T20983] ? current_time+0x2e0/0x2e0 [ 310.713657][T20983] __should_failslab+0x11a/0x160 [ 310.718681][T20983] ? kmalloc_array+0x32/0x60 [ 310.723383][T20983] should_failslab+0x9/0x20 [ 310.727881][T20983] __kmalloc+0x64/0x310 [ 310.732385][T20983] kmalloc_array+0x32/0x60 [ 310.736795][T20983] iter_file_splice_write+0x21d/0xf20 [ 310.742174][T20983] ? __sb_end_write+0xa8/0xf0 [ 310.746962][T20983] ? touch_atime+0x22e/0x270 [ 310.752249][T20983] ? current_time+0x2e0/0x2e0 [ 310.756919][T20983] ? fsnotify+0x1390/0x1450 [ 310.761413][T20983] ? splice_from_pipe+0x200/0x200 [ 310.766441][T20983] ? splice_shrink_spd+0xb0/0xb0 [ 310.771389][T20983] ? splice_from_pipe+0x200/0x200 [ 310.776419][T20983] direct_splice_actor+0xf7/0x130 [ 310.781437][T20983] splice_direct_to_actor+0x496/0xb00 [ 310.786810][T20983] ? do_splice_direct+0x3d0/0x3d0 [ 310.791832][T20983] ? pipe_to_sendpage+0x300/0x300 [ 310.796858][T20983] ? rw_verify_area+0x1c2/0x360 [ 310.801709][T20983] do_splice_direct+0x279/0x3d0 [ 310.806563][T20983] ? splice_direct_to_actor+0xb00/0xb00 [ 310.812108][T20983] ? security_file_permission+0x157/0x350 [ 310.817942][T20983] do_sendfile+0x89d/0x1110 [ 310.822443][T20983] ? compat_writev+0x390/0x390 [ 310.827205][T20983] ? __kasan_check_write+0x14/0x20 [ 310.832505][T20983] ? fput_many+0x47/0x1a0 [ 310.836878][T20983] __x64_sys_sendfile64+0x1ae/0x220 [ 310.842076][T20983] ? __ia32_sys_sendfile+0x240/0x240 [ 310.847360][T20983] ? syscall_return_slowpath+0x6f/0x500 [ 310.852914][T20983] do_syscall_64+0xc0/0x100 [ 310.857424][T20983] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 310.863726][T20983] RIP: 0033:0x45b399 [ 310.867639][T20983] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 310.887244][T20983] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 310.895744][T20983] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 310.903801][T20983] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 310.911898][T20983] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 310.919871][T20983] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 310.931837][T20983] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000003 09:14:03 executing program 3: unshare(0x44000600) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, 0x0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:03 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xd000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:03 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0xffffff81, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:03 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4004550d, 0x0) 09:14:03 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x2400, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r1, 0x0, 0x0) lseek(r1, 0xe7, 0x0) ioctl$PPPIOCSNPMODE(r0, 0x4008744b, &(0x7f00000000c0)={0x0, 0x1}) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r2, 0x0, 0x0) 09:14:03 executing program 5 (fault-call:10 fault-nth:4): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) [ 311.269572][T20980] FAT-fs (loop5): FAT read failed (blocknr 63) [ 311.293925][ T7] attempt to access beyond end of device [ 311.302980][ T7] loop5: rw=1, want=78, limit=63 09:14:03 executing program 3: unshare(0x44000600) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, 0x0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 311.314343][ T7] buffer_io_error: 38 callbacks suppressed [ 311.314351][ T7] Buffer I/O error on dev loop5, logical block 77, lost async page write [ 311.328791][T20993] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 311.333179][ T7] attempt to access beyond end of device [ 311.355989][ T7] loop5: rw=1, want=79, limit=63 [ 311.361454][ T7] Buffer I/O error on dev loop5, logical block 78, lost async page write [ 311.370274][ T7] attempt to access beyond end of device [ 311.373377][T20997] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 311.376051][ T7] loop5: rw=1, want=80, limit=63 [ 311.396525][ T7] Buffer I/O error on dev loop5, logical block 79, lost async page write [ 311.405263][ T7] attempt to access beyond end of device [ 311.410999][ T7] loop5: rw=1, want=81, limit=63 09:14:03 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0xffffff9e, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:03 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x40049409, 0x0) [ 311.411291][T20999] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 311.415989][ T7] Buffer I/O error on dev loop5, logical block 80, lost async page write [ 311.431513][ T7] attempt to access beyond end of device [ 311.437327][ T7] loop5: rw=1, want=130, limit=63 [ 311.443171][ T7] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 311.445756][T20999] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 311.452220][ T7] attempt to access beyond end of device [ 311.452229][ T7] loop5: rw=1, want=131, limit=63 [ 311.452237][ T7] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 311.452255][ T7] attempt to access beyond end of device [ 311.484579][ T7] loop5: rw=1, want=132, limit=63 [ 311.489662][ T7] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 311.496823][T21007] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 311.498258][ T7] attempt to access beyond end of device 09:14:03 executing program 3: unshare(0x44000600) syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, 0x0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 311.498265][ T7] loop5: rw=1, want=133, limit=63 [ 311.498277][ T7] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 311.532907][ T7] attempt to access beyond end of device [ 311.538574][ T7] loop5: rw=1, want=142, limit=63 [ 311.543643][ T7] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 311.552194][ T7] attempt to access beyond end of device [ 311.557826][ T7] loop5: rw=1, want=143, limit=63 [ 311.562895][ T7] Buffer I/O error on dev loop5, logical block 142, lost async page write 09:14:03 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550c, 0x0) 09:14:03 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 311.571565][ T7] attempt to access beyond end of device [ 311.577213][ T7] loop5: rw=1, want=144, limit=63 [ 311.582399][ T7] attempt to access beyond end of device [ 311.588031][ T7] loop5: rw=1, want=145, limit=63 [ 311.595179][ T7] attempt to access beyond end of device [ 311.600992][ T7] loop5: rw=1, want=3673, limit=63 [ 311.608628][ T7] attempt to access beyond end of device [ 311.614305][ T7] loop5: rw=1, want=7121, limit=63 [ 311.631951][ T7] attempt to access beyond end of device [ 311.637616][ T7] loop5: rw=1, want=29457, limit=63 [ 311.662145][ T7] attempt to access beyond end of device [ 311.663087][T21016] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 311.667832][ T7] loop5: rw=1, want=59593, limit=63 [ 311.684597][ T7] attempt to access beyond end of device [ 311.689876][T20999] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 311.694086][ T7] loop5: rw=1, want=63513, limit=63 [ 311.719924][T20999] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 312.005602][T21022] FAULT_INJECTION: forcing a failure. [ 312.005602][T21022] name failslab, interval 1, probability 0, space 0, times 0 [ 312.019210][T21022] CPU: 0 PID: 21022 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 312.029629][T21022] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 312.039687][T21022] Call Trace: [ 312.042986][T21022] dump_stack+0x1b0/0x228 [ 312.047399][T21022] ? devkmsg_release+0x127/0x127 [ 312.052362][T21022] ? __kasan_check_read+0x11/0x20 [ 312.057455][T21022] ? show_regs_print_info+0x18/0x18 [ 312.062657][T21022] should_fail+0x6fb/0x860 [ 312.067081][T21022] ? setup_fault_attr+0x2b0/0x2b0 [ 312.072142][T21022] ? current_time+0x2e0/0x2e0 [ 312.076941][T21022] __should_failslab+0x11a/0x160 [ 312.081884][T21022] ? kmalloc_array+0x32/0x60 [ 312.086469][T21022] should_failslab+0x9/0x20 [ 312.090971][T21022] __kmalloc+0x64/0x310 [ 312.095912][T21022] kmalloc_array+0x32/0x60 [ 312.100352][T21022] iter_file_splice_write+0x21d/0xf20 [ 312.105723][T21022] ? __sb_end_write+0xa8/0xf0 [ 312.110400][T21022] ? touch_atime+0x22e/0x270 [ 312.115015][T21022] ? current_time+0x2e0/0x2e0 [ 312.119687][T21022] ? fsnotify+0x1390/0x1450 [ 312.124185][T21022] ? splice_from_pipe+0x200/0x200 [ 312.129351][T21022] ? splice_shrink_spd+0xb0/0xb0 [ 312.134291][T21022] ? splice_from_pipe+0x200/0x200 [ 312.139420][T21022] direct_splice_actor+0xf7/0x130 [ 312.144440][T21022] splice_direct_to_actor+0x496/0xb00 [ 312.149811][T21022] ? do_splice_direct+0x3d0/0x3d0 [ 312.155177][T21022] ? pipe_to_sendpage+0x300/0x300 [ 312.160325][T21022] ? rw_verify_area+0x1c2/0x360 [ 312.165283][T21022] do_splice_direct+0x279/0x3d0 [ 312.170134][T21022] ? splice_direct_to_actor+0xb00/0xb00 [ 312.175793][T21022] ? security_file_permission+0x157/0x350 [ 312.181508][T21022] do_sendfile+0x89d/0x1110 [ 312.186012][T21022] ? compat_writev+0x390/0x390 [ 312.190863][T21022] ? __kasan_check_write+0x14/0x20 [ 312.195990][T21022] ? fput_many+0x47/0x1a0 [ 312.200321][T21022] __x64_sys_sendfile64+0x1ae/0x220 [ 312.205515][T21022] ? __ia32_sys_sendfile+0x240/0x240 [ 312.210821][T21022] ? syscall_return_slowpath+0x6f/0x500 [ 312.216475][T21022] do_syscall_64+0xc0/0x100 [ 312.220993][T21022] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 312.226880][T21022] RIP: 0033:0x45b399 [ 312.230892][T21022] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 312.250529][T21022] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 312.258937][T21022] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 312.266919][T21022] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 312.274941][T21022] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 312.282917][T21022] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 312.291123][T21022] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000004 09:14:04 executing program 5 (fault-call:10 fault-nth:5): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:04 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:04 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0xffffffea, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:04 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xe000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:04 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) socket(0x25, 0xa, 0x4) read(r0, 0x0, 0x0) lseek(r0, 0xe7, 0x0) statx(r0, &(0x7f0000000000)='./file0\x00', 0x580, 0x100, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r3, 0x0, 0x0) setregid(r1, r3) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r4, 0x0, 0x0) 09:14:04 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x40086602, 0x0) [ 312.602855][T21019] FAT-fs (loop5): FAT read failed (blocknr 63) [ 312.624589][ T7] attempt to access beyond end of device [ 312.630298][ T7] loop5: rw=1, want=78, limit=63 [ 312.635243][ T7] attempt to access beyond end of device 09:14:04 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0x0, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:04 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x40087602, 0x0) [ 312.649348][ T7] loop5: rw=1, want=79, limit=63 [ 312.657800][ T7] attempt to access beyond end of device [ 312.667020][ T7] loop5: rw=1, want=80, limit=63 [ 312.675471][ T7] attempt to access beyond end of device [ 312.686463][ T7] loop5: rw=1, want=81, limit=63 [ 312.694323][ T7] attempt to access beyond end of device 09:14:04 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x14, r0, 0xc573de0d27bdfe6f}, 0x14}}, 0x0) [ 312.702560][ T7] loop5: rw=1, want=130, limit=63 [ 312.707637][ T7] attempt to access beyond end of device [ 312.713691][T21032] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 312.720966][ T7] loop5: rw=1, want=131, limit=63 [ 312.726005][ T7] attempt to access beyond end of device [ 312.729583][T21032] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 312.735078][ T7] loop5: rw=1, want=132, limit=63 [ 312.744900][ T7] attempt to access beyond end of device [ 312.750340][T21035] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 312.750898][ T7] loop5: rw=1, want=133, limit=63 [ 312.780740][ T7] attempt to access beyond end of device [ 312.786400][ T7] loop5: rw=1, want=142, limit=63 [ 312.791840][ T7] attempt to access beyond end of device [ 312.797476][ T7] loop5: rw=1, want=143, limit=63 09:14:04 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = socket(0x1e, 0x2, 0x0) bind(r0, &(0x7f0000d80f80)=@generic={0x1e, "0103000000000000000000000000000009a979f321b30c7bc8790405c7bad62e0a43a632ed4938d36d73fb8f8401a3ff59829a2b0afe7ce43a4b2470a0c5216669ca021f6f65dcf160e7e58f358c0002f0000158d19bcb31f1314a8ef151622ca5bdb9c8ead2000077aeb81c90001d6d7c980ee590c8b9f70dc136cb184a"}, 0x80) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x0, 0x0, 0x2}}, 0x10) r1 = socket(0x3, 0x80000, 0x9) bind$tipc(r1, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x0, 0x0, 0x4}}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x3c) ptrace$cont(0x18, r3, 0x0, 0x0) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r3, 0x0, 0x0) process_vm_readv(r3, &(0x7f00000001c0)=[{&(0x7f0000000080)=""/63, 0x3f}, {&(0x7f0000000100)=""/79, 0x4f}, {&(0x7f0000000180)}], 0x3, &(0x7f0000000480)=[{&(0x7f0000000200)=""/148, 0x94}, {&(0x7f00000002c0)=""/208, 0xd0}, {&(0x7f00000003c0)=""/150, 0x96}], 0x3, 0x0) r4 = dup(r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) bind(r0, 0x0, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r5, 0x0, 0x0) 09:14:04 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x14, r0, 0xc573de0d27bdfe6f}, 0x14}}, 0x0) 09:14:04 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4020940d, 0x0) [ 312.802882][ T7] attempt to access beyond end of device [ 312.808619][ T7] loop5: rw=1, want=144, limit=63 [ 312.815043][ T7] attempt to access beyond end of device [ 312.820893][ T7] loop5: rw=1, want=145, limit=63 [ 312.828028][ T7] attempt to access beyond end of device [ 312.834231][ T7] loop5: rw=1, want=4153, limit=63 [ 312.843082][ T7] attempt to access beyond end of device [ 312.843566][T21051] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 312.848850][ T7] loop5: rw=1, want=8073, limit=63 [ 312.857939][ T7] attempt to access beyond end of device [ 312.867039][ T7] loop5: rw=1, want=23273, limit=63 [ 312.878093][T21051] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 312.885955][T21050] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 312.892336][ T7] attempt to access beyond end of device [ 312.907065][ T7] loop5: rw=1, want=55041, limit=63 [ 312.922968][ T7] attempt to access beyond end of device [ 312.928813][ T7] loop5: rw=1, want=63513, limit=63 [ 313.226298][T21065] FAULT_INJECTION: forcing a failure. [ 313.226298][T21065] name failslab, interval 1, probability 0, space 0, times 0 [ 313.239042][T21065] CPU: 0 PID: 21065 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 313.249191][T21065] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 313.259511][T21065] Call Trace: [ 313.262814][T21065] dump_stack+0x1b0/0x228 [ 313.267232][T21065] ? devkmsg_release+0x127/0x127 [ 313.272402][T21065] ? __kasan_check_read+0x11/0x20 [ 313.277613][T21065] ? show_regs_print_info+0x18/0x18 [ 313.282996][T21065] should_fail+0x6fb/0x860 [ 313.287526][T21065] ? setup_fault_attr+0x2b0/0x2b0 [ 313.292557][T21065] ? current_time+0x2e0/0x2e0 [ 313.297239][T21065] __should_failslab+0x11a/0x160 [ 313.302201][T21065] ? kmalloc_array+0x32/0x60 [ 313.306805][T21065] should_failslab+0x9/0x20 [ 313.311528][T21065] __kmalloc+0x64/0x310 [ 313.315773][T21065] kmalloc_array+0x32/0x60 [ 313.320197][T21065] iter_file_splice_write+0x21d/0xf20 [ 313.325576][T21065] ? __sb_end_write+0xa8/0xf0 [ 313.330248][T21065] ? touch_atime+0x22e/0x270 [ 313.334952][T21065] ? current_time+0x2e0/0x2e0 [ 313.339631][T21065] ? fsnotify+0x1390/0x1450 [ 313.344235][T21065] ? splice_from_pipe+0x200/0x200 [ 313.349256][T21065] ? splice_shrink_spd+0xb0/0xb0 [ 313.354195][T21065] ? splice_from_pipe+0x200/0x200 [ 313.359218][T21065] direct_splice_actor+0xf7/0x130 [ 313.364245][T21065] splice_direct_to_actor+0x496/0xb00 [ 313.369724][T21065] ? do_splice_direct+0x3d0/0x3d0 [ 313.374764][T21065] ? pipe_to_sendpage+0x300/0x300 [ 313.379790][T21065] ? rw_verify_area+0x1c2/0x360 [ 313.384762][T21065] do_splice_direct+0x279/0x3d0 [ 313.389611][T21065] ? splice_direct_to_actor+0xb00/0xb00 [ 313.395161][T21065] ? security_file_permission+0x157/0x350 [ 313.400884][T21065] do_sendfile+0x89d/0x1110 [ 313.405390][T21065] ? compat_writev+0x390/0x390 [ 313.410326][T21065] ? __kasan_check_write+0x14/0x20 [ 313.415926][T21065] ? fput_many+0x47/0x1a0 [ 313.420252][T21065] __x64_sys_sendfile64+0x1ae/0x220 [ 313.425565][T21065] ? __ia32_sys_sendfile+0x240/0x240 [ 313.430854][T21065] ? syscall_return_slowpath+0x6f/0x500 [ 313.436433][T21065] do_syscall_64+0xc0/0x100 [ 313.440940][T21065] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 313.447607][T21065] RIP: 0033:0x45b399 [ 313.451499][T21065] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 313.471108][T21065] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 313.479531][T21065] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 313.487543][T21065] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 313.496299][T21065] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 313.504278][T21065] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 313.512258][T21065] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000005 09:14:05 executing program 5 (fault-call:10 fault-nth:6): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:05 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x80086601, 0x0) 09:14:05 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0xffffffef, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:05 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x14, r0, 0xc573de0d27bdfe6f}, 0x14}}, 0x0) 09:14:05 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xf000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:05 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x1e1) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f0000000140)={0x30, 0x5, 0x0, {0x0, 0x3, 0x2, 0x4add}}, 0x30) read(r1, 0x0, 0x0) lseek(r1, 0xe7, 0x0) lseek(0xffffffffffffffff, 0x20, 0x1) write$FUSE_NOTIFY_INVAL_ENTRY(r1, &(0x7f00000000c0)={0x23, 0x3, 0x0, {0x1, 0x2, 0x0, 'lo'}}, 0x23) r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x800, 0x0) mprotect(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x8) ioctl$PPPIOCSMAXCID(r3, 0x40047451, &(0x7f0000000080)=0x1) lseek(r0, 0x0, 0x0) [ 313.815552][T21062] FAT-fs (loop5): FAT read failed (blocknr 63) [ 313.830088][ T1959] attempt to access beyond end of device [ 313.835870][ T1959] loop5: rw=1, want=78, limit=63 [ 313.845433][ T1959] attempt to access beyond end of device [ 313.859369][ T1959] loop5: rw=1, want=79, limit=63 [ 313.859827][T21072] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 313.864896][ T1959] attempt to access beyond end of device [ 313.864904][ T1959] loop5: rw=1, want=80, limit=63 [ 313.864916][ T1959] attempt to access beyond end of device [ 313.900083][ T1959] loop5: rw=1, want=81, limit=63 [ 313.906294][ T1959] attempt to access beyond end of device [ 313.912138][ T1959] loop5: rw=1, want=130, limit=63 [ 313.917322][ T1959] attempt to access beyond end of device [ 313.923081][ T1959] loop5: rw=1, want=131, limit=63 [ 313.928114][ T1959] attempt to access beyond end of device [ 313.933866][ T1959] loop5: rw=1, want=132, limit=63 [ 313.938979][ T1959] attempt to access beyond end of device [ 313.939324][T21076] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 313.949145][ T1959] loop5: rw=1, want=133, limit=63 [ 313.952418][T21076] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:14:05 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x80087601, 0x0) 09:14:05 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x28, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}]}, 0x28}}, 0x0) [ 313.956621][ T1959] attempt to access beyond end of device [ 313.956629][ T1959] loop5: rw=1, want=142, limit=63 [ 313.956645][ T1959] attempt to access beyond end of device [ 313.995379][ T1959] loop5: rw=1, want=143, limit=63 [ 314.000505][ T1959] attempt to access beyond end of device [ 314.006203][ T1959] loop5: rw=1, want=144, limit=63 09:14:05 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0xfffffff0, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 314.012255][ T1959] attempt to access beyond end of device [ 314.018491][ T1959] loop5: rw=1, want=145, limit=63 [ 314.030123][ T1959] attempt to access beyond end of device [ 314.035793][ T1959] loop5: rw=1, want=2673, limit=63 [ 314.045748][ T1959] attempt to access beyond end of device [ 314.051444][ T1959] loop5: rw=1, want=6025, limit=63 09:14:06 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0xc0045878, 0x0) [ 314.062824][ T1959] attempt to access beyond end of device [ 314.068475][ T1959] loop5: rw=1, want=16793, limit=63 [ 314.084508][T21087] tipc: Enabling of bearer rejected, failed to enable media [ 314.092779][ T1959] attempt to access beyond end of device [ 314.092789][ T1959] loop5: rw=1, want=48329, limit=63 [ 314.105228][ T1959] attempt to access beyond end of device 09:14:06 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x10000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:06 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x28, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}]}, 0x28}}, 0x0) [ 314.119150][ T1959] loop5: rw=1, want=63513, limit=63 [ 314.187027][T21093] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 314.206786][T21093] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 314.269768][T21094] tipc: Enabling of bearer rejected, failed to enable media [ 314.335172][T21098] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 314.357484][T21098] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 314.562095][T21104] FAULT_INJECTION: forcing a failure. [ 314.562095][T21104] name failslab, interval 1, probability 0, space 0, times 0 [ 314.577552][T21104] CPU: 1 PID: 21104 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 314.587701][T21104] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 314.597764][T21104] Call Trace: [ 314.601058][T21104] dump_stack+0x1b0/0x228 [ 314.605522][T21104] ? devkmsg_release+0x127/0x127 [ 314.610490][T21104] ? __kasan_check_read+0x11/0x20 [ 314.615623][T21104] ? show_regs_print_info+0x18/0x18 [ 314.621052][T21104] should_fail+0x6fb/0x860 [ 314.625552][T21104] ? setup_fault_attr+0x2b0/0x2b0 [ 314.631010][T21104] ? current_time+0x2e0/0x2e0 [ 314.635695][T21104] __should_failslab+0x11a/0x160 [ 314.641266][T21104] ? kmalloc_array+0x32/0x60 [ 314.645867][T21104] should_failslab+0x9/0x20 [ 314.650479][T21104] __kmalloc+0x64/0x310 [ 314.654640][T21104] kmalloc_array+0x32/0x60 [ 314.659056][T21104] iter_file_splice_write+0x21d/0xf20 [ 314.664426][T21104] ? __sb_end_write+0xa8/0xf0 [ 314.669125][T21104] ? touch_atime+0x22e/0x270 [ 314.673861][T21104] ? current_time+0x2e0/0x2e0 [ 314.678542][T21104] ? fsnotify+0x1390/0x1450 [ 314.683049][T21104] ? splice_from_pipe+0x200/0x200 [ 314.688070][T21104] ? splice_shrink_spd+0xb0/0xb0 [ 314.693007][T21104] ? splice_from_pipe+0x200/0x200 [ 314.698150][T21104] direct_splice_actor+0xf7/0x130 [ 314.703179][T21104] splice_direct_to_actor+0x496/0xb00 [ 314.708572][T21104] ? do_splice_direct+0x3d0/0x3d0 [ 314.714996][T21104] ? pipe_to_sendpage+0x300/0x300 [ 314.720031][T21104] ? rw_verify_area+0x1c2/0x360 [ 314.724887][T21104] do_splice_direct+0x279/0x3d0 [ 314.729731][T21104] ? splice_direct_to_actor+0xb00/0xb00 [ 314.735279][T21104] ? security_file_permission+0x157/0x350 [ 314.741106][T21104] do_sendfile+0x89d/0x1110 [ 314.745618][T21104] ? compat_writev+0x390/0x390 [ 314.750377][T21104] ? __kasan_check_write+0x14/0x20 [ 314.755646][T21104] ? fput_many+0x47/0x1a0 [ 314.759975][T21104] __x64_sys_sendfile64+0x1ae/0x220 [ 314.765173][T21104] ? __ia32_sys_sendfile+0x240/0x240 [ 314.770680][T21104] ? syscall_return_slowpath+0x6f/0x500 [ 314.776333][T21104] do_syscall_64+0xc0/0x100 [ 314.780844][T21104] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 314.786734][T21104] RIP: 0033:0x45b399 [ 314.791323][T21104] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 314.811621][T21104] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 314.820141][T21104] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 314.828115][T21104] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 314.836215][T21104] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 314.844197][T21104] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 314.852170][T21104] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000006 09:14:07 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x28, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}]}]}, 0x28}}, 0x0) 09:14:07 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0xfffffffe, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:07 executing program 5 (fault-call:10 fault-nth:7): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:07 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0xc0045878, 0x0) 09:14:07 executing program 2: unshare(0x44000600) r0 = syz_open_dev$usbfs(0x0, 0x0, 0x200080) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000001300)='/proc/diskstats\x00', 0x0, 0x0) flistxattr(0xffffffffffffffff, &(0x7f0000000080)=""/4096, 0x1000) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040)='nl80211\x00') sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, r4, 0x405, 0x0, 0x0, {0x7e}}, 0x14}}, 0x0) r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000001140)='batadv\x00') sendmsg$BATADV_CMD_GET_VLAN(r3, &(0x7f0000001200)={&(0x7f0000001100)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000011c0)={&(0x7f0000001180)={0x24, r5, 0x8, 0x70bd26, 0x25dfdbfe, {}, [@BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_VLANID={0x6}]}, 0x24}}, 0x20000000) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r6, 0x0, 0x0) lseek(r6, 0xe7, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r6, 0x29, 0x23, &(0x7f00000010c0)={{{@in6=@dev, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@empty}}, &(0x7f00000011c0)=0xe8) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x11, 0x800000003, 0x0) bind(r9, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r9, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r11 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r12 = memfd_create(&(0x7f00000001c0)='#! ', 0x0) mknod$loop(&(0x7f0000000280)='./file0\x00', 0x8007c2, 0xffffffffffffffff) write$binfmt_script(r12, &(0x7f00000002c0)={'#! ', './file0'}, 0xb) execveat(r12, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) sendmsg$nl_route(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r10}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0x14, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x8, 0x3, 0x8}, @IFLA_XDP_FD={0x8, 0x1, r11}]}]}, 0x3c}}, 0x0) sendmsg$BATADV_CMD_GET_HARDIF(r1, &(0x7f00000012c0)={&(0x7f0000001080)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001280)={&(0x7f0000001200)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="08002dbd7000fcdbdf250500000008000300", @ANYRES32=r7, @ANYBLOB="080034000500000008003c000065b90008000600", @ANYRES32=r10, @ANYBLOB="05003000010000000500"], 0x44}, 0x1, 0x0, 0x0, 0x20008800}, 0x80) read(r2, 0x0, 0x0) lseek(r2, 0xe7, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r2, 0x8982, &(0x7f0000001240)) lseek(r1, 0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x0) 09:14:07 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x11000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 315.142915][T21101] FAT-fs (loop5): FAT read failed (blocknr 63) [ 315.158175][ T1959] attempt to access beyond end of device [ 315.166962][ T1959] loop5: rw=1, want=78, limit=63 [ 315.175573][ T1959] attempt to access beyond end of device [ 315.184927][ T1959] loop5: rw=1, want=79, limit=63 09:14:07 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x5c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x48, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x5c}}, 0x0) [ 315.192115][T21111] tipc: Enabling of bearer rejected, failed to enable media [ 315.192321][ T1959] attempt to access beyond end of device [ 315.209920][T21110] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 315.210386][ T1959] loop5: rw=1, want=80, limit=63 [ 315.220025][T21110] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 315.227783][ T1959] attempt to access beyond end of device [ 315.235107][ T1959] loop5: rw=1, want=81, limit=63 [ 315.241556][T21113] net_ratelimit: 3 callbacks suppressed [ 315.241561][T21113] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 315.242497][ T1959] attempt to access beyond end of device [ 315.269315][ T1959] loop5: rw=1, want=130, limit=63 [ 315.274839][ T1959] attempt to access beyond end of device [ 315.276993][T21118] platform regulatory.0: Direct firmware load for regulatory.db failed with error -2 09:14:07 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x5c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x48, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x5c}}, 0x0) [ 315.285079][ T1959] loop5: rw=1, want=131, limit=63 [ 315.291982][T21118] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 315.296644][ T1959] attempt to access beyond end of device [ 315.309968][ T1959] loop5: rw=1, want=132, limit=63 [ 315.315041][ T1959] attempt to access beyond end of device [ 315.320869][ T1959] loop5: rw=1, want=133, limit=63 [ 315.326593][T21121] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 315.333944][ T1959] attempt to access beyond end of device 09:14:07 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0xc0189436, 0x0) [ 315.339823][ T1959] loop5: rw=1, want=142, limit=63 [ 315.345018][ T1959] attempt to access beyond end of device [ 315.350900][ T1959] loop5: rw=1, want=143, limit=63 [ 315.357551][ T1959] attempt to access beyond end of device [ 315.363135][T21121] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 315.367367][ T1959] loop5: rw=1, want=144, limit=63 [ 315.376876][ T1959] attempt to access beyond end of device 09:14:07 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x12000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 315.383991][T21120] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 315.392337][ T1959] loop5: rw=1, want=145, limit=63 [ 315.412343][ T1959] attempt to access beyond end of device [ 315.418134][ T1959] loop5: rw=1, want=4049, limit=63 [ 315.428656][ T1959] attempt to access beyond end of device [ 315.437691][ T1959] loop5: rw=1, want=7537, limit=63 09:14:07 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:07 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x5c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x48, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x5c}}, 0x0) [ 315.453459][ T1959] attempt to access beyond end of device [ 315.465439][ T1959] loop5: rw=1, want=20689, limit=63 [ 315.482838][T21142] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 315.493095][ T1959] attempt to access beyond end of device [ 315.498763][ T1959] loop5: rw=1, want=53185, limit=63 [ 315.502515][T21142] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 315.516630][ T1959] attempt to access beyond end of device [ 315.525772][ T1959] loop5: rw=1, want=63513, limit=63 [ 315.528357][T21147] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 315.568160][T21151] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 315.594252][T21153] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 315.602378][T21153] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 315.899077][T21164] FAULT_INJECTION: forcing a failure. [ 315.899077][T21164] name failslab, interval 1, probability 0, space 0, times 0 [ 315.911825][T21164] CPU: 1 PID: 21164 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 315.921970][T21164] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 315.932182][T21164] Call Trace: [ 315.935474][T21164] dump_stack+0x1b0/0x228 [ 315.939814][T21164] ? devkmsg_release+0x127/0x127 [ 315.944958][T21164] ? __kasan_check_read+0x11/0x20 [ 315.949982][T21164] ? show_regs_print_info+0x18/0x18 [ 315.955192][T21164] should_fail+0x6fb/0x860 [ 315.959762][T21164] ? setup_fault_attr+0x2b0/0x2b0 [ 315.964904][T21164] ? current_time+0x2e0/0x2e0 [ 315.969609][T21164] __should_failslab+0x11a/0x160 [ 315.974538][T21164] ? kmalloc_array+0x32/0x60 [ 315.979124][T21164] should_failslab+0x9/0x20 [ 315.983747][T21164] __kmalloc+0x64/0x310 [ 315.987899][T21164] kmalloc_array+0x32/0x60 [ 315.992315][T21164] iter_file_splice_write+0x21d/0xf20 [ 315.997712][T21164] ? __sb_end_write+0xa8/0xf0 [ 316.002382][T21164] ? touch_atime+0x22e/0x270 [ 316.006967][T21164] ? current_time+0x2e0/0x2e0 [ 316.011676][T21164] ? fsnotify+0x1390/0x1450 [ 316.016178][T21164] ? splice_from_pipe+0x200/0x200 [ 316.021837][T21164] ? splice_shrink_spd+0xb0/0xb0 [ 316.026791][T21164] ? splice_from_pipe+0x200/0x200 [ 316.031809][T21164] direct_splice_actor+0xf7/0x130 [ 316.036835][T21164] splice_direct_to_actor+0x496/0xb00 [ 316.042318][T21164] ? do_splice_direct+0x3d0/0x3d0 [ 316.047339][T21164] ? pipe_to_sendpage+0x300/0x300 [ 316.052358][T21164] ? rw_verify_area+0x1c2/0x360 [ 316.057207][T21164] do_splice_direct+0x279/0x3d0 [ 316.062051][T21164] ? splice_direct_to_actor+0xb00/0xb00 [ 316.067592][T21164] ? security_file_permission+0x157/0x350 [ 316.073309][T21164] do_sendfile+0x89d/0x1110 [ 316.077905][T21164] ? compat_writev+0x390/0x390 [ 316.082691][T21164] ? __kasan_check_write+0x14/0x20 [ 316.087827][T21164] ? fput_many+0x47/0x1a0 [ 316.092161][T21164] __x64_sys_sendfile64+0x1ae/0x220 [ 316.098007][T21164] ? __ia32_sys_sendfile+0x240/0x240 [ 316.103293][T21164] ? syscall_return_slowpath+0x6f/0x500 [ 316.108837][T21164] do_syscall_64+0xc0/0x100 [ 316.113473][T21164] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 316.119451][T21164] RIP: 0033:0x45b399 [ 316.123342][T21164] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 316.142943][T21164] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 316.151353][T21164] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 316.159443][T21164] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 316.167415][T21164] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 316.175508][T21164] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 316.183757][T21164] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000007 09:14:08 executing program 5 (fault-call:10 fault-nth:8): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:08 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0xc020660b, 0x0) 09:14:08 executing program 3: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4004550d, 0x0) 09:14:08 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x2, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:08 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x20000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:08 executing program 2: syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) setsockopt$pppl2tp_PPPOL2TP_SO_LNSMODE(r0, 0x111, 0x4, 0x1, 0x4) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r1, 0x0, 0x0) lseek(r1, 0xe7, 0x0) ioctl$KDSETLED(r1, 0x4b32, 0x4) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r2, 0x0, 0x0) [ 316.472992][T21160] FAT-fs (loop5): FAT read failed (blocknr 63) [ 316.487769][ T1959] attempt to access beyond end of device [ 316.498855][ T1959] loop5: rw=1, want=78, limit=63 [ 316.511359][ T1959] buffer_io_error: 38 callbacks suppressed [ 316.511366][ T1959] Buffer I/O error on dev loop5, logical block 77, lost async page write [ 316.532722][ T1959] attempt to access beyond end of device [ 316.538416][ T1959] loop5: rw=1, want=79, limit=63 [ 316.543701][ T1959] Buffer I/O error on dev loop5, logical block 78, lost async page write [ 316.544922][T21173] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 316.555892][ T1959] attempt to access beyond end of device 09:14:08 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r1, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f0000000000)=@v2={0x2, @aes256, 0x8, [], "75ea24e8a32ebba2283abb2e6d9a55ca"}) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) [ 316.570091][T21172] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 316.581391][ T1959] loop5: rw=1, want=80, limit=63 [ 316.584089][T21172] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 316.586342][ T1959] Buffer I/O error on dev loop5, logical block 79, lost async page write [ 316.586367][ T1959] attempt to access beyond end of device 09:14:08 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r1, 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r2, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fadvise64(r2, 0x8, 0x6, 0x4) lseek(r1, 0xeb, 0x2) sendmmsg(r1, &(0x7f0000002740)=[{{&(0x7f0000000080)=@x25={0x9, @null=' \x00'}, 0x80, &(0x7f0000000400)=[{&(0x7f0000000000)="380b2800dd02ad5309de447879062ddc", 0x10}, {&(0x7f0000000100)="ef64568fbfa25c90869d8d91b3112a0440dd960a22d1903fec29244520efa55c2ffff4b63f80143ca15c06d2cf4e2ef1500d353603014aaad293bffadc1ddcae553cee4caf855c33", 0x48}, {&(0x7f0000000180)="3c9fa1a318482a043bcaeb0c3d59018aa1c9003ee2ea26ae4b6b85b83ada07b648c4a8587387bac5eade59a0795c9ba301735843fd1f94c1bd1aa5950525d3706592c6afb547f33a2fd3740e87e5a58428894f4d6a944a3f262f3a1caca86a8561398f7fa4b72eecf985e13940e550b953a84b91632d842f22c7ad1ca6cf2113adafb454ba9dc496e375985d42dd66c3761abb7e17bafd9cd0f607953e5e6e858b3598af1cb8933f12980a9e1783124e99ebb5d893a763c8fc18f9ee85ff1d3b179d752714c8cb60b01274de7d0d48e258f0c92742d7905b36dfbd76023b2e9612949bb5ff2cbd10ad6fc4", 0xeb}, {&(0x7f0000000280)="d6b4d19eba0bc58bc4cc0546c062bcf557c94146e6d4fbd811331c1262535351f459c441d9ee00dd5a31dfba7c8f395c8e4571946cd7d190d9904826f4ccf11c9398c0ee87247fa5045f8a744e3f5e19642585750f2128b39cf18b6c24d7321a4e43af207804", 0x66}, {&(0x7f0000000300)="424e0515b5cbb32c2b9b0be571f030577ea59ac812069313e460779b09e1cf65f12b409dc5e30f70", 0x28}, {&(0x7f0000000340)="e541b3c03471f7e4cb7ed3c8140c6f7b0537fb0bc478e9a7433e06def79d9ded0399b55ff78921ccd9b05a7f8d1e661997ce10161069492bd6ff31d0adef1fac13e3db13318ae43ff940bed4245e6b195c20d4ec7b0e7f5a6ab87bd81704cdbee6b03316307d7148ca4f55979b9894fa0e51ec49fc", 0x75}, {&(0x7f00000003c0)="c294a196a9f5c509aae30ba28e721f0e2405db36fc84a6b5702fc45f2ea1f3be6ff3daf1de860dd56bde2edd7365", 0x2e}], 0x7, &(0x7f0000000480)=[{0x98, 0x10d, 0xfff, "90d0c93a316e4d2265680f1d78758cda3a638cbff911f1d85f01a351bd7664a1e9a110c8576bfa068be250c4914d2d2a640d3912520ecd3dcef49b4ac75c16dea3e92a5302ed0d4a5ca908cf0f909b9550d085e117217eb271a9adb9e3604782f28c9d7ad0a4a7387a9e352abb7fef45f44b5eb5cb24ab632027ec3a6e2e009f1db85ce9"}, {0x98, 0x10a, 0x3, "3f0309ee2a6416e5818a00986b3d76115f435352915b9f0fdfe7d20d206d17be98835f8417b8ad96e19b8e1f893dfd6b30b3007479de09adc41c27ce2da92b0980890fb467ccd918b4e443e07ae23d8a6e6a8a8b18fca904f87114221bdc85f78fc0dfb3679dec0123d33776d6fcaeb5be39aa4411274cf7aaf9926801163af5c4e1320095"}, {0xf0, 0xff, 0x24a8, "8024ee7bee69bb1aa5e8774d968898bdfb03641ba95f54caccbc3ec46ea85f091e89c94cae9c12af6260721b5836a727c9ddf7451f80a50a4a302d4eb495fb1fc41ec53f3085a438e7b8cee196fc390d5eb074aceaf2eae89a173a2ee1a73194f96013807e50d6ff2b0c5e2a9e857e44b8816ff0196da96566f2ff790beb312e4a8cf0482555b7de767dacf13745d03a381d0f2f6823ec574e1357682282116d06c756be8c8d7f387c2323f25d62bad4cd4d2939883ae2834065fbb9411ae9d23a8a67fdaac5a304eff45dbd51bcf94ec98459ba7e2957dd2d7e3cb072739e3f"}, {0x1010, 0x11, 0x6, "872fc5e53caaf30f607de493438e8c76530283f2e03e60c22a8c0c413ac7feaf06258491ad78eea529cab1ebed61cf16173cadc52a8b7c6af73e0c88e5619f389a6da2e10db2ba694546af2e7078109d2979ecddc677f0040f659341e60e1a67a8a3db8fcf5eab8417d63109e4a6dc3976454637e6da1e2708dfa7f17ecd385fa8875c0c0b3fce0cb3214dbc1fcb9a76d4ba417c28676f0c845cfd63c9536e35029015a03b01b42ba311c7d8c7608b2f610c39b9385dd8b2edb4d6a19e8b8d78cfd75768765dcbbb927a69efada625b79151f2fd807331b6d383fe8d293a79d8a180f94423d8fd9fa14c7f35c63c6f2d6b6e1d940f4cdf2523699a65fc65fd9b95fa49f5d22257f2cbb6fa60a8472a325af36078e6b023d2180d4100ba11bb36a15c830d0195a62c9c4241f0841b41e0ec9194ef1b3891eb4e2ec323ff107dab9b0fcb6ea4ddf21956f861e0bf5c389ce64f2bdb8b52c4e2b53df0a9c1d87926d71e3dcd0fc70cdc7aa6aa9536eb313449abde346f50839aff0640ed238a8f53860ccedef5e1de8242b13efbbb4b8977241630bb162ac9975861be606c812c0d912cf0e8a3f2456751a3dda36e13839b84b62510c00020796ad3976c11ae185a11f70972c7970d4c5fd8a6c08939a2c7a7b17e89fc70bdde3c11cb40efd9b283e22fd7714239f4a0a6edf0a8f2902c7952ac6c2a736d64ede7c7a136133cba1b1fa2b4eecf486aef548c8d87bc4a795504b77d5b62d8eaaeb057447998246a4d25b8551a4db3fe4d0ba1482484fa77b6efe3776cdf3c200d2a4708e5f5740f9f9e3e4d8e3ee5bdeaa6cc571a002d8fba5c0d826aaedffb13321b118982b5b9bfccab3567867f61246099d034374e4ecc295b111e0c708a366886e8e45d349a3759ce3c8bad5ef5ac64b1f22e4ef3a0a78f34d2f869724bd5c04f3a245c5a8323e4c7f83d6ed1930fde08902ed87c1f56867e09b75f94f754cde4e5c4b1887b2c3f6046f56f6b8437509cdc7c13ede88fa0572fef4de5be162b06c9258ec2984b4f03bd8ac9ca7d700089ceeb0c894f863d23ab00d8b24579fda451bafb60c62e0a674ca72b279907feae9f69969f6c1b28595ced4ba7fb58a32b2d2b124ac3482c5c20f4b82d937d291a47f120bedcfb9f18b5d58e7e6ad2d00a2e725efed31837e8279b44dcdcc159aa7ccf2164a27a0dbbd25dda1e0ae05441325480fec824b5a603558c05d1c6c92d7cb9d0ace813b32c231b18aa517a32a19a8a45f284f029ad6812b3b29d2679aa776dff9f1486c9eebd58c43e4944db28d4f23ecc9e3cb65ba277d55c8ca2cd2130fa8094f66a7310a2848f32b3494cceb1510652a3f674c34c197e6c7071fb777a1cafe2bcc5d81e94b546f206843e90890006a2416e9c6e3525d12b6701c86a0285701739bd627fbfd3b59362d6d2bfea3a6d3896e1b32d0b4ff21d19961ddb48bfcd7ffc4be52f770ca84ba103da961bb018affa7d1231cc238459f45a314aecb664b5126af9abe51c64760bcf8ff55b36cbd241be2a7689f80e821f11bfc1b221028b7725c5a3139b09a8c9c389fbe0900cdb7fc21dc2a9a2a6440d5f6ce1c8ee9ef953ccdc3201652d77b4821e0da715de3afa0ecc084770ce16f85c1b7ac61f84bda974d3a01a484fd4bfc76e828f6ce20f3eb3c4177cfb3d8129f0103342d51fcd87fb4a39c65056d16fbfbedfaab2b03954c316a8782903f15713e21c03e9a0551ecd5285e1588a08a3d9f7e35cd750491a169314aa42143b9f6b3630bfd8f3a749d1a26e679f971d002850028e5edff43b1e845abd2da448a240de62edc3b78c8e1d5fbde56be4e972e67a039ffa4849ac3cab2c25e7782d83f19fb7122e9e003f9ad441211909426f2061fa707a78fd00616db636afe6e2e70c595de067c01b587fe1d67761aa54fc1db6107bae82c8ba828d114b3ec3a2afc8722864772f78f6a71b79aff54aa19db18b9a0dda3961418028fc26ba93c1f4dd9d66ffc7d3ba359a2682ded5ef39e8c9664aed241d57d5e05dfb3b5f242b961971ea51b0d084894c6e9774561948627e314387c2d3e8f23ca24d8e5356289839ec3a997b5f994d07ef39c390d4546c8ab57da749dc2446487aba98950b272f1d836e505c7765d0e404516d6e805d807a930a22fea492e3002c45e53dfc24c0ce4a81fd0ff3d65eae2f27de4d605891ef0f90b4f4155a8203e0acd663d8555b6d5ef41f4fdd050e845a40e26bd97fb1c28229b719d0df6fdb080a66f3457143378a647fe091b2ba62e12c8aeb4248b8b9cb44974da057fc0baded26697fc3ea19f9fed0492e7f139fb1051ef48a64a68a5f8ed97c2729f609d9e79d344e3efccefc7751718f4bcb3b2b0e198b309f9183d2f89dca9a15795f10af7aed580f4aa88a196cefaf957d9a8470964408eeef1f14527a5e8c5047a60f183a1b9b27a7cf5ff93125bc27b5cf6ea4b3bbca0aaab746944f78b55aa71a1037aa92a7ccb188047c9c2c06859819e99502e769caef9d9f12db326bb61894fb804dabf0aa4d91add6e042cb2b8e2e39f2953c0e6ce37eaef533ad4948997457a750e23fb76c740c127a544a3428d489c204606c7c2e5250bacc6f98f71ba1990482f6a778eae7f34101abc01ab012496faafe104599943a19c35fd5cdd03ebc9e5a2f34e589971bb9074ed92f745cc892590a53f1aa651c98f91892dabbbfccd6ec97210e56454171bc787d66c3ca4bfb01a776be5e5ec86cf2c96e90ac39f161beff6d17abeae1b35f5de5f2945b3687112441542c01b906c8eeb869170aacd0af59e7b8b7624779caa9d682f86220bf0d84bc38d832696dd46b87fda7decc955e467cbfe8471d455b2232eaf4cd9cee0d9acb909518d2f1a0ba83db66f61524f42713ffe46187f1c3acb7f403872c70d767f352287fd43599b42abe67307bc846eb64a7a5d0b947709246964f89ae1a382436ab4122f2b35c5678907ca38f22570f889c99b2c1a11644d568db20f30673035427f27ef2163fa63da41add572fada722d014e3153729b636347bff659becba88c6d49827cfae1ca95c3355089ff6325faf5e08593be8d61da05e16ffae42c516d3d0d96ff98a8c57ec41ccd5b2ee4618baf5e9c2484d847c28f28e667c4d004825d0772f780000b5e2fe41495cf190e82b6e26ff894ff66dcc09c90fcbc439be8d4216f021f5f1d3cc8cd24abdf35bc3b906d5aabade64b65338d3ede5218fe50e43bb40ba10f638ab4a057d17db65a9163820313fe1504f0176eb66ac69fc15021ef8b3024f4ffcfe9b129f668b738e9b218879065a55dbe08ed6d42e8310f60f5eec6408bf25ededb15fc159addff1e833469e8fdf62dc11aa6538910ac1da773938c59cd482faedfdd7a140b263ada2b8a055d3580bd1cbd253d0ec6bbb13054fc2d849e472fed0a9d2a7b67d2b72f43ae0aaa224f851d130bd170d0063ae8e01afc226ab80ce3942f71b81a4e93d01bbc31b70a44ba708fe8b3c80b0ff8cb14f300385a822514d67af2dc1ab81e6d1bdec3036c7da302a3fc7d4a266458192908abef9a2e2d0298bd5a0fb62e64715d38487ac9972579797d7cd4c646a192217cf419c844df4638c2a35abe58ea691f9246ea018f6e8cc07808d8e3c1cbad618f126fa2d9aba670b23bb160650b4cc6466717dac26d2f561bbd1aceb48ab67ce8bf54d71e25383be5a6c337500cfde567c31c02bf20fe1bb4d4ecef4786f860006383f49633e4307bf8a2cb91dc0bed8c12a88488c76fd74294779a8a5b6d6218cd5ef8783ca39fc4d1b16d8cf62b8d5080948dc2b084e5a57eddfdab4d7b4172d9406f89d89ce75c0e06f1d88ff4741c351d96a80e8aa5935fe8f85f8103080aed95b16e2efc1e655bbe927d3d0a09565682c3bdf56cc4dcc4b197b3348ba6ae4bcdf537036637f4867cad5c6f5e09aeac6a7cfc0832f408a83e2c179b918ee427d1239f15f99636d89bc927c240f0bd9188e210076e7f1f3a782ac2eb47708289d6ea0ced9e70e50dc7f1f244828fc177b76f09b66c3301aee804fc4ddf6e25588676f7ff25ec7ac79c408ae01b23c7946d4b227358c56ab3f8dc25a0f1399973741b6639e59e639642a339e8fa8a632451a8f9964b42e6e6bf428ce20dfb78cc479d8458b12101490d3ec3641d75e9a92304562635810d07c9f27cedec1a43a11c96dc919baae1bb19abfcc9c0afbb6bc7469d5ae3334ad52ea30f7ff39800660255b656ee681fb76b0f2339ac9d1d6813266e8adc115b64226a43ad91f636eae4d9e3ab0ff9ff482c945ee28829b1586e0d7a54267219755672e8355f6905d1171279df9c5265b0c28cbff7b74db09b2215ee0f95d259fed3abc1f2e74400f5fc1b1724edd961eb4520492ff7164395e6448d0f818afe2f342c5a1b7d9b3bb111d59c1c4f199d016516697d9b07b6a0122dac6168a3695f8dd2e21d018817e16ca22a78ac2b78b57251c69ec083707374f389f30a5d974c8a147ee75a799cd2c73b4490070d7ea847145dc9b85462909709fab3bedcee1c07b1b979e106354e8041298e622b27c03f2a0f7ad353dd6fa3cbb7daad407fceaa5132f529d1134f505d7a718b6f2beda0b08f0b6d8fbaa8fa9b2d263e30fc9741e56a809bb55a6c508b53122aa0f31cd1af607f3af276db68a78a7880a578cd45d7d1ca340b02f1b7f7d6073b827010672f02dcb96bae1377bf2104753fb24ea9221dc2ffb23b564c8034da1dfb2e088140d8cc0c4d9a83c9ba0073f9baae13830864d4d69562118b2d57f34786117adc809ba8152c37962e0dedcf0047c1db3d7cb1fafc7f3f87d3b1339607af7bf528b5a5331dcf29a0c37cb998e7cb55e0e0353d0e1f430d476d71e11863ef5b6f3e7c58f1671bf15431c0e1a0d318ac66bd43623d37edace9178f0920a029947a6c8291c4adb89a9289a2b47253ccdf20ac64daf0a46cd7418b0a059d7910e6c271e43a3d7f9cf574e859f3c5c47255eb303da29d06e64bf2468ee3de573f7a09c605597806856e8d70a6b1989327a8cd1f4e9d5c998e93936245391613726082793291a279ef66ca485542c94a76579ec366af0674c9d1a0793e160f6c84e71d5ddc5bba500d2a4e8cbb1b10fb796f5072d4ee6ab233287f5dad55007de902caa7e1fafd0e87edd01f05717e6560fb67fdc4c5eb112b0d4eb8a7dd7a2176089457ed646948bd1a51adb1b0d978519e4f90eaa89c871eb515bbda91976259b6ab013955342452d8f38bfa8162a3621e8f9b8887d68ca2dd0339dded30ca602a117d16c10d44ee8dcf06b3f061c40989224d5eafa35cb5a9f734b42b609dcc82418262f39b8424e04c45050d0ffb105d60d6e0cb84a70c7fbca02cea0ac3432aacff8e075ae16976e30c4132a2ab355b71bb8f8f4a7e3bc3eeceaa3513c3caf7e7e72ec960b066ee476f2a2fe66693410ae3ac27cb738d2eb717b2d6de386664085f42721c862f72cc3b96644430692c3902b86ce77fba797ac9efcd35b1fe8640ffd354296d390e9116e825e5b5e6b648a289ac2ef80189a5c7f51cacf0e5716296f0917f46bf3e750dd9ac52b9d3c4b1b665b0642b741356e1e29bded4a66a2f9079a6a4da11a27ecfcc5e9b42107d39a3760e2bd996645410d3edd8e8b4dcfb102720acf2c4490b11179ced889c3b579e2f11cd7c747651704a5a0811400ea1d7f291cd6286567d73fe4d132bf3ad7286bf7102de816c4dce261d70ff467f8bdd3fe222a0a860b18d91ddcd137fb9d7f061bb4f389e428e620561e2cc4fafc"}, {0x1010, 0x117, 0x8000, "8e092fba44cb21f6dcd87b8795164c798f74d65b2ef1dd9a75868f217110b889b508e419435f1df88f2c221b95b2f74bb83ba62e23e5c30736cde37fa118b78606d6abb959f8d2feda7f0dc70d65ffe496826792f8b343c260e6ecbc20b1abe5723588434d945f71639286fa7b313e918e7a0f1128e0220007145c29001fd03874833f6dd048ed468d80281002c24dcdc8454eb252b9e630cb3c766836992525339e42ccabfd60231c7f012f1b2fe91be639120934502986a8a96c614133113d259bf8f9f9c708f18ec279c12481595bf6cd29ebebbebe3a565b774f8484f88b0d31dd60b1465067ed58dbb9a8f6ad2a82d4d9126feb16ef02db65d5942627735ec4561fd16b400a0e2ad001301bce3ca5562e47e07305d9382adc3fd7e5e74b2a954ae3c93aa9280b3c825a243fb064bee7b3b41124d4cc0e269a52dfa8dc22fe0df2c2e71cd96bebf30cd0694569f3c2b5542a2b458ede05496483b9af63664dca9315cdbb2ffafa33d25d384d1f8f6bd8760d3774b627d45abe4ab4e1768297203d9f3cafaf9afbafab09c7fdf32b585de84e6a068a841a1e693a7e8521a82b34a9d8dbec7bd6b0e3d7d3e78764f5338bb46c3cb515558f1067520db6f414b922842e708f576b3ee9dedb7f6af1fe878c3df20093315692a8ea66bdea6a0e7cfea1c3234ba07cd3bca1b85dc36287175b008e622351209331e98cca21c585b3468a52f56008eeb64a417dd939c6a8875eaf739efb8716327491a84015ec01fbdf2e57b3d88432c24fefb82139bcf740928d08b7c75dd43391479a33411b829bb98532bb2cd8c855f34f817336c609e7f90a7308bc5fa99c78d8e5e89b0df7fdf26f99f54d3b6bb680d0f99a0629f3db2425c207ab55a5818a54436ef0d7d49850f1ba6c556c4554f67653fcac2c2ebd3e4f6185ffb6e667de2e4d217f83f902031641473d05650427e576a07e69b72b93c7a18c1eaedcbc9ca0f785936cd62bbbce01009b2679e7150ae2844c47838ec833ad0f92905e809a13dffb50a36682c6f90e3aeedabfd6bbb8ed280ab73253cab1f37d0a7c6cb84a25d75283e896255928ac8cc3476d9f956004bcb33dabbec650bfa31fe6b09723ab83b1ea76ec437f58a83ba7ec15d9ac35b6299970e3ce25cb19157212da8e399f733d1ac5ca281df23e4e072e4a2c0f4af091e06c9e5774ccf41ed11cdaa4bbc9e3a79aa925ce3d18dbde48c76dd36d790900b7d8b34e2c39500cfa27749593c0a8df825154882507eefdb1d360e203e478831f5495bc4b0502de41217b6cef4956fcd9ce2b3cb000367d5e6aa1d974af98928b7346ae572d4186d61c0aae68aa9f2603e5b781bea9945dbc18a90f8efad845a423d8aea1c90676b6c3fbd3a65fbfc3facedea3cb68705cbe2c8b0d2ca3dadcee7bfbc36a156314c472f5de40f6377249b3e366fca38ce0f9e02d4f8f1d0d5eb6791c21d9c56461a119d67d07e76ebab0c8f6cd43f4c04efa8b249976ff2beda2e9fe788171583c6dfe7ebec312f2a093a7ece16fe9ee64b5eee6972ff2fd36a0a2dc2629ac5562a027c27b159c151156661fe5e1c7c15426bfd324e538a21c6e4330847db1b7d6655ff9e16415ba1eedb8d4927c83ed29912de9c4854ce1e29c7991e6152ebfb65a8507f12a9e18ba9ea2f04f417dc02fb609776fbb70bc8cc3e3b624462308f3dc080719b2599834a08270381ef0238ec241d28b7f6245a550f6c0dba680b03fb261993464d269c81c79bb289f5b355ce3fc18f14afa5c6bf0298b1df32ded6f12a5946a3c7ac4595fe77effd9ac5da11929761dc3b796b6dc01de772d9e2faa8ed69dcaef87a3a1ca8ca4d8efdbc600881a01eb88e96bba013457bf01f00353de580bbeac55fa7b91096bc5718fac47172dd53a76b03bfc58c6fab7926266f8e122a730bc0644811e36c7354ed53919a90dc757dc1a58c94f0225e535a06ae03bd657f7d069e98d935a86b0dc26ed5fc37b38a6161a3e548ed086f95e95985f3b6bbb2264f889fca766a2afd9547dc7e5a5b2163c1a2ff9263df9651b359b914c91ae32389e185735e9b1f33c220151ba4adb7493bc5a4f0c53d19d726ffd1eb537d7664b2841c7f7a47ee6e3957d611313449d19dc55891db235062da239777d5e68073ba0f7353a1b663b1e2aaa4cdab37e0819d40c50cda596d52c1b3233bd23d8dfc863dd999b93829c20c2fbebc338e62cc5c8cc48c4a23a45a1f5517cc483eea74b48ad6588e0d82327714cc2806a6638628732e9f78dcdd6dbd5a370ba0c0b1531ae2385af3b2df75a1f4260d90e71364ec965fbfa3b57a1fbb236da327f8bcf3e4ad5099145d068daf6ef656b5f70cdf6fc568c7691d3082235625a5e4239fcb809bbd1fc7bb1f6e24cfa4e4d2203ea15612e2a9f848ccb5c2fb71defa721c8b2522c865f4522da2ddc8ac1511fb5946bdaba869a666d2fa5f4f967b0b32c40894eda4708e0e64d215f988e4c9ffb5cb22d0bdd41898a9414a24cd8e61b056f3b3197f42b0e017784eed2ef81f5cd2378f72cba18f040ac5f271d8754e2cd3162b208add23eddb5c550a9f57590af58410d092d905b6f291dd002ae4d5d6c4afe2e90e9c17fcbdaa1d7523479dc7538a1a7b49e8f14fecb5015e15e6715d4a2b227e191d1758ca6823877bd9a3029cfccc764ff868eb25a968ac9d13676d861bef16a30879e13467cc1b3bff5336b14b9aa05d73de904d158de4acebd771e1c23f177e896e2564597ce7c7988337cb0adf3061398f73344594945db70f452bff15ae24d6067badba09548602bb6fffee20a1b7b88842b587b98bdc598a81686fd55684ee1211649559353bce2e959435bc8a269178fd944e3babed4fa07c260543c2ab343e33963e99269317e993142896a2bbd3124741cac20801e802f2705c1904e62a3cae47ccf6178d7d1305661edbc011501a3db5025c36e5f2c4cf6fa8182d400d20f4152bf9b3216c291fa852753b7ae9bf785f97ddb4ecf93e1e4b0d998ddefbaf5501cf6fa61bc12e61dee77bf77ae37674bb9c2b56c35e17310f132aa610092092ad31d92758c0a1ca29d2a8a392fd3c2e4b43cce3e7842e4dbb65d660f8db8150c2c42a4a1ca3824af81a455da6f7563b9311a3b3f36859349ad5ed079b54fc5ee8e639ca91eeae22ba0895655dc89b708b58ed7707be0b7853e49b714adc058ec054f6afd292508760d8253e2dee0b529387eb7edb2fe1be5124c169a9ee5c985bc91dd080bf6fdf2d7c18366c937d0af9592a0af58d9a061e494b5f08a0354ffa1f937e1d13e36c392e07c17e9c811f98a71c9c8288bfe70e0afc8030af5e7f1fcafbe51bbfe28a9a9278c60158a5ca356f50b731931c70135b7be47e3bd9c6e0ae74fcbd0c560045ca80653f5e0faa2af431382b69ee0187fa0806c4aec151d11096baae1c590cb51fe3cd8f25b023248a31f40c2ea7667a0ccbb74fbae9e9d858b8e02b754b71c7d5d11059fa1b6e15c41240308df0dc761a885e7abe5020a3b6a92f8da67af621575c3d0ff43022084182d6ee094c244e992f487dc7b9cfe8576419665af4bcc3ee84e8e5196c52a45e49938bba1442599fefa3c78c137fac007fb3076e57bcc930652293295180edf05d6b8790049bde431a4d1c730f1ab4f2bdb01db0fd89e43efaf31790f2ead7a3ab7fc7a7a55bdc0e748cbf90adf5a4e1dc585ab12e541cba951311b99cf2cd4b66d924bc2c088fee5513fa4f9c3c08de85f3cf2b2630a8aa0e27b780731b81a2a686e4cffec66c6edf768f7c0c4777110bbeb54e6f542053ca2956deec86542d478cbd62ebc8a4cd4d33daa019c55f1e3d6350354e4fc8ef384690ff234981a61da5e95983968f6163a01bf94f2d2d757a3e015effdfc3e2020341e1330bbccf0d6c7da4d77a095c0d7c363086ed53d168dba78fc37606e74cc235a9f5f503b53b4b9d8498a0229a5f8dc4666a2f26de9856471df50c5c9efd969b1db7a6915fc4632b6092e292a647f0878f784a6727caff5a25c2bea463b87815a7e38a639279c56e1929517e8fb035cf2d2fc34fce437e02282f1623f14c927abae3318d9050b7784c7f8f88de243f016e51f8cbeb1bf798949b59849824c1a7674a859532d97b8169213479e40916d7fcd06d3b2520c39ac82c37f474305e03108b94fe83ad9e4765257d6f1cd40ad8b55dfc514002633c9fed865b1d834e9c707a4f34afc57ef66ca551ab44d3a6726ab603e80692caa23f69d9610fc6930e1b936a115ead9597ef6087d9cbf8d6a21343042c5389bb88c6a19c89fd198c91f653bb7785d5750a4ef64d72d2ae8c7d2f83ce5dcca556b0e906607603bab977efc47ff3491ec8e437ea6b26e4fd6854fb3e6b6d3a7f52199666b449eee347f4c7b1809be9fea8f8a65a1157d3bc264fcf77dbe1d7bbd02052d5ed4ff368954f3b7fc4118961df28266a78a613a5042e9e2a9f41fd536815d00938bfee00b76852ef4ff91946a3979d3069acaee54134b6820f8852e2e73c7ef3157364d710a7cad7a800d694f86b4014083678f0effea1063076cadc084f65c93237f43ff5c465b81b47c819372f68a86d64b0318d8e28ac732dba93949a1c9d4e0ba97c9b36f57647b68e8d778aa105c6484076561f0a631a8b2d1d62d4074380db93f54fa59e99973163d0471e749f4669d730e43cabbba2c9a4f925aa588ebf2cbb193f8b906915646b628eb0448f85d1e9b3c6a2b70cf1f56d771027d407be5d28f84f4997f6fb3a7aa6ecf6e1107010575b29888bb5055204c59628cc1c6108a495e1c035c48b811d134964c902f877af713d0bb96aa6a2a9dfa8ed2d22c71793ba3021e634bbef06607ed8a8b29bef07ee8846e0ad5667b408a0d95a5bd4cd5516fae92840f591f218510055c06195239aa64dd79e27765444a7109a563809831b7b9ad1d283d0d7825444cee542005c234154166e73f653bfa1dbbac22d058981e8e4d8be41a5f73614fdbb51173214b044881762b17cd752284fb6d8fa4a789e79669aaf519e28bb54d7f974a2adbf9ece04f38aeae733d71ce70bfafa63fd15cd54a6faf0529f13ef925fba39f400619baa31a4511c073614ce1a2de085987cc1d246211e50a2f31f0f986be17a460f9a528c9c234ec4263fb3a88daa7d29d3ed1fdc372c9b3779dfe51f099f33a731131153f412482673d4326b39790c3258e91cc0395dffb172c3e0d79849bc150c0f2b604191f65e687a154f6d0c8ac24fd34ff8613940565d0147337bb3a8797b56ca60f422cd5dc238a3d63310550db8e9e1cdabafb0e8237ccd8b130c5bae973a09c5711471244f98245df7a53001138b944366578d4d07574f0c146ecbfacac69f66d8369498ee6293f0d0c47c1935681f5fcf738801cfbd6853bf1f633b588d1a6cdb162c7a210aca913bbc96dda56333bd1ec2a2f07af6858f796faaa57a93f6012a18aaf633be0c3fadb5d3709ba88120895aefa98eb0b5d3e066210bfe9bdc3550ac3b6e05d716431947757f95a528ec23dd972f0b34a442eee771ae0e1098db8f00c1845d243873de364a5cd6bca38a69688dbab53428b1f10b52bff90ba019c22ebb76d1aa97f885e572a45445a7225b8c0cad4b6f6b25bf7d53e5ebc86ef4fdb33e15fc85cd539474584e6b4b9c8eec754fe0973701a6debabfd63ab4934c644e4990811099f0522aa005eec9104e81502ae1932840e6e9d6ad1e995a6c41a9ce1b95ede0b1aad0e1b3d2f5b3eed05c7a28bce9eeb8645275e816cf734fad8745c"}, {0x20, 0x10c, 0xffff, "bfdaece75c9bfe34c08c"}, {0x38, 0x29, 0x8, "6b147ac7ee93c8e6f6cb452d01fd11b31795d46dfda93b513bfe3d1f62231c1ce679ece2"}], 0x2298}}], 0x1, 0x4000) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r3, 0x0, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r4, 0x0, 0x0) lseek(r4, 0xe7, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r4, 0x6, 0x13, &(0x7f00000027c0)=0xffffffffffffffff, 0x4) lseek(r3, 0xe7, 0x0) bind$netlink(r3, &(0x7f0000002780)={0x10, 0x0, 0x25dfdbfe, 0x100000}, 0xc) lseek(r0, 0x0, 0x0) 09:14:08 executing program 3: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/timers\x00', 0x0, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x9c081, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r1, 0xc0105502, &(0x7f0000000040)=@urb_type_interrupt={0x1, {0x9, 0x1}, 0x3f, 0x41, &(0x7f0000000140)="fe", 0x1, 0x2, 0x3, 0x0, 0x7f, 0x4, &(0x7f0000000180)="8e00aa6ffa2e87f14194e409164a9bc634bea60e6a7c72d12b45a42fbd05"}) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r2, 0x0, 0x0) lseek(r2, 0xe7, 0x0) r3 = accept$unix(r2, 0x0, &(0x7f0000000080)) ioctl$UI_SET_MSCBIT(r0, 0x40045568, 0x11) r4 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r4, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0}) tee(r3, r4, 0x66c, 0x2) r5 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r5, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$USBDEVFS_DISCARDURB(r5, 0x550b, &(0x7f0000000100)=0xffffffff) lseek(r1, 0x1, 0x2) [ 316.627955][ T1959] loop5: rw=1, want=81, limit=63 [ 316.632747][T21178] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 316.635392][ T1959] Buffer I/O error on dev loop5, logical block 80, lost async page write [ 316.657814][T21180] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 316.660784][ T1959] attempt to access beyond end of device [ 316.672093][ T1959] loop5: rw=1, want=130, limit=63 09:14:08 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x3, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 316.674486][T21180] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 316.677222][ T1959] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 316.677247][ T1959] attempt to access beyond end of device [ 316.699154][ T1959] loop5: rw=1, want=131, limit=63 [ 316.704197][ T1959] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 316.713069][ T1959] attempt to access beyond end of device [ 316.718818][ T1959] loop5: rw=1, want=132, limit=63 [ 316.724100][ T1959] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 316.733758][ T1959] attempt to access beyond end of device [ 316.739438][ T1959] loop5: rw=1, want=133, limit=63 [ 316.744458][ T1959] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 316.753128][ T1959] attempt to access beyond end of device [ 316.760447][ T1959] loop5: rw=1, want=142, limit=63 [ 316.765502][ T1959] Buffer I/O error on dev loop5, logical block 141, lost async page write 09:14:08 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x25000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 316.771828][T21188] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 316.775390][ T1959] attempt to access beyond end of device [ 316.796352][ T1959] loop5: rw=1, want=143, limit=63 [ 316.801619][ T1959] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 316.810248][ T1959] attempt to access beyond end of device [ 316.815999][ T1959] loop5: rw=1, want=144, limit=63 [ 316.821177][ T1959] attempt to access beyond end of device 09:14:08 executing program 0: unshare(0x44000600) rt_sigsuspend(&(0x7f0000000000)={[0x99]}, 0x8) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) [ 316.826950][ T1959] loop5: rw=1, want=145, limit=63 [ 316.834430][ T1959] attempt to access beyond end of device [ 316.840257][ T1959] loop5: rw=1, want=4377, limit=63 [ 316.848793][ T1959] attempt to access beyond end of device [ 316.859250][ T1959] loop5: rw=1, want=8785, limit=63 [ 316.861337][T21196] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 316.872507][ T1959] attempt to access beyond end of device [ 316.878155][ T1959] loop5: rw=1, want=23601, limit=63 [ 316.880585][T21196] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 316.902588][ T1959] attempt to access beyond end of device [ 316.908429][ T1959] loop5: rw=1, want=56225, limit=63 [ 316.924695][ T1959] attempt to access beyond end of device [ 316.930405][ T1959] loop5: rw=1, want=63513, limit=63 [ 316.931689][T21200] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 317.059254][T21214] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 317.079745][T21214] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 317.357555][T21220] FAULT_INJECTION: forcing a failure. [ 317.357555][T21220] name failslab, interval 1, probability 0, space 0, times 0 [ 317.370391][T21220] CPU: 0 PID: 21220 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 317.381120][T21220] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 317.391186][T21220] Call Trace: [ 317.394480][T21220] dump_stack+0x1b0/0x228 [ 317.398933][T21220] ? devkmsg_release+0x127/0x127 [ 317.403992][T21220] ? __kasan_check_read+0x11/0x20 [ 317.409022][T21220] ? show_regs_print_info+0x18/0x18 [ 317.414231][T21220] should_fail+0x6fb/0x860 [ 317.418651][T21220] ? setup_fault_attr+0x2b0/0x2b0 [ 317.423680][T21220] ? current_time+0x2e0/0x2e0 [ 317.428409][T21220] __should_failslab+0x11a/0x160 [ 317.433349][T21220] ? kmalloc_array+0x32/0x60 [ 317.437948][T21220] should_failslab+0x9/0x20 [ 317.442538][T21220] __kmalloc+0x64/0x310 [ 317.446699][T21220] kmalloc_array+0x32/0x60 [ 317.451115][T21220] iter_file_splice_write+0x21d/0xf20 [ 317.456492][T21220] ? __sb_end_write+0xa8/0xf0 [ 317.461167][T21220] ? touch_atime+0x22e/0x270 [ 317.465768][T21220] ? current_time+0x2e0/0x2e0 [ 317.470447][T21220] ? fsnotify+0x1390/0x1450 [ 317.475144][T21220] ? splice_from_pipe+0x200/0x200 [ 317.480168][T21220] ? splice_shrink_spd+0xb0/0xb0 [ 317.485108][T21220] ? splice_from_pipe+0x200/0x200 [ 317.490133][T21220] direct_splice_actor+0xf7/0x130 [ 317.495286][T21220] splice_direct_to_actor+0x496/0xb00 [ 317.500662][T21220] ? do_splice_direct+0x3d0/0x3d0 [ 317.505690][T21220] ? pipe_to_sendpage+0x300/0x300 [ 317.510720][T21220] ? rw_verify_area+0x1c2/0x360 [ 317.515593][T21220] do_splice_direct+0x279/0x3d0 [ 317.520438][T21220] ? splice_direct_to_actor+0xb00/0xb00 [ 317.525987][T21220] ? security_file_permission+0x157/0x350 [ 317.531708][T21220] do_sendfile+0x89d/0x1110 [ 317.536326][T21220] ? compat_writev+0x390/0x390 [ 317.541199][T21220] ? __kasan_check_write+0x14/0x20 [ 317.546312][T21220] ? fput_many+0x47/0x1a0 [ 317.550642][T21220] __x64_sys_sendfile64+0x1ae/0x220 [ 317.555837][T21220] ? __ia32_sys_sendfile+0x240/0x240 [ 317.561135][T21220] ? syscall_return_slowpath+0x6f/0x500 [ 317.566770][T21220] do_syscall_64+0xc0/0x100 [ 317.571716][T21220] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 317.577604][T21220] RIP: 0033:0x45b399 [ 317.581960][T21220] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 317.601567][T21220] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 317.610188][T21220] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 317.618251][T21220] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 317.626465][T21220] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 317.634437][T21220] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 317.642424][T21220] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000008 09:14:09 executing program 5 (fault-call:10 fault-nth:9): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:09 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000000)=0x0) ptrace$getenv(0x4201, r1, 0x2, &(0x7f0000000080)) lseek(r0, 0x0, 0x0) 09:14:09 executing program 3 (fault-call:3 fault-nth:0): unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:09 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x4, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:09 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x3e010000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:09 executing program 0: unshare(0xc77738162bae1aad) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) [ 317.943890][T21217] FAT-fs (loop5): FAT read failed (blocknr 63) [ 317.958926][ T1959] attempt to access beyond end of device [ 317.967459][ T1959] loop5: rw=1, want=78, limit=63 [ 317.975961][ T1959] attempt to access beyond end of device [ 317.985034][ T1959] loop5: rw=1, want=79, limit=63 09:14:09 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x2850, 0x2000) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000000)={'icmp\x00'}, &(0x7f0000000080)=0x1e) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, &(0x7f0000000100)=ANY=[@ANYBLOB="6d616e676c65000900000000000000000000000000000000000000000000000005000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000071140001000000"], 0x78) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r2, 0x0, 0x0) lseek(r2, 0xe7, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_NODES(r2, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x1c, r3, 0x200, 0x70bd27, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}}, 0x4810) [ 317.993922][ T1959] attempt to access beyond end of device [ 318.002972][ T1959] loop5: rw=1, want=80, limit=63 [ 318.008071][ T1959] attempt to access beyond end of device [ 318.016509][T21231] FAULT_INJECTION: forcing a failure. [ 318.016509][T21231] name failslab, interval 1, probability 0, space 0, times 0 [ 318.019154][ T1959] loop5: rw=1, want=81, limit=63 [ 318.036080][T21234] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 318.037633][ T1959] attempt to access beyond end of device [ 318.048301][T21231] CPU: 1 PID: 21231 Comm: syz-executor.3 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 318.058881][T21231] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 318.068931][T21231] Call Trace: [ 318.072210][T21231] dump_stack+0x1b0/0x228 [ 318.076519][T21231] ? devkmsg_release+0x127/0x127 [ 318.081466][T21231] ? show_regs_print_info+0x18/0x18 [ 318.086661][T21231] ? _raw_spin_unlock_bh+0x19/0x20 [ 318.093690][T21231] ? release_sock+0x15a/0x1b0 [ 318.098360][T21231] should_fail+0x6fb/0x860 [ 318.102774][T21231] ? setup_fault_attr+0x2b0/0x2b0 [ 318.107778][T21231] __should_failslab+0x11a/0x160 [ 318.112706][T21231] ? __alloc_skb+0xbc/0x540 [ 318.117214][T21231] should_failslab+0x9/0x20 [ 318.121713][T21231] kmem_cache_alloc+0x37/0x2b0 [ 318.126460][T21231] __alloc_skb+0xbc/0x540 [ 318.130793][T21231] netlink_sendmsg+0x73b/0xd40 [ 318.136073][T21231] ? netlink_getsockopt+0x900/0x900 [ 318.141391][T21231] ? security_socket_sendmsg+0xad/0xc0 [ 318.146850][T21231] ? netlink_getsockopt+0x900/0x900 [ 318.152035][T21231] ____sys_sendmsg+0x56f/0x860 [ 318.156892][T21231] ? __sys_sendmsg_sock+0x2a0/0x2a0 [ 318.162084][T21231] ? __kasan_check_read+0x11/0x20 [ 318.167097][T21231] ? __fdget+0x156/0x200 [ 318.171327][T21231] __sys_sendmsg+0x26a/0x350 [ 318.175907][T21231] ? ____sys_sendmsg+0x860/0x860 [ 318.180828][T21231] ? __fsnotify_parent+0x300/0x300 [ 318.185926][T21231] ? security_file_permission+0x157/0x350 [ 318.191625][T21231] ? rw_verify_area+0x1c2/0x360 [ 318.196483][T21231] ? __sb_end_write+0xa8/0xf0 [ 318.201157][T21231] ? vfs_write+0x424/0x4e0 [ 318.205565][T21231] ? __kasan_check_read+0x11/0x20 [ 318.210568][T21231] ? __ia32_sys_clock_settime+0x230/0x230 [ 318.216274][T21231] __x64_sys_sendmsg+0x7f/0x90 [ 318.221044][T21231] do_syscall_64+0xc0/0x100 [ 318.225538][T21231] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 318.231426][T21231] RIP: 0033:0x45b399 [ 318.235300][T21231] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 318.254891][T21231] RSP: 002b:00007febf8229c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 318.263290][T21231] RAX: ffffffffffffffda RBX: 00007febf822a6d4 RCX: 000000000045b399 [ 318.271249][T21231] RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000003 [ 318.279199][T21231] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 318.287160][T21231] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 09:14:10 executing program 0: unshare(0x54020600) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r1, 0x0, 0x0) lseek(r1, 0xe7, 0x0) ioctl$TCSETS2(r1, 0x402c542b, &(0x7f00000000c0)={0x6, 0x5, 0x1000, 0x8ab, 0x3, "eb50b7b00f1ec11d3386c46f9eeab3ef0ccbf3", 0x5, 0x10001}) read(r0, 0x0, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r2, 0x0, 0x0) lseek(r2, 0xe7, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r4 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r4, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) io_setup(0x0, &(0x7f0000000340)=0x0) r6 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r6, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x3ff, 0x400) io_submit(r5, 0x3, &(0x7f0000000680)=[&(0x7f00000003c0)={0x0, 0x0, 0x0, 0x1, 0x8, r6, &(0x7f0000000380)="90071c3ee5335f53b4e439a939b3", 0xe, 0x80000001, 0x0, 0x1}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x7, r7, &(0x7f0000000440)="0dbf031df2690036369f94d82cabca22f564de50f50038e5201cf1596f37e51b76e281280f6727ddfe576daeebe27b19a78f8818db7aab5924ddf005df8981b979f8c4eec81b78f41ff796dec657cc2c05e17066b8178cc0885ddac06030b6bfe5d34fcea7c1c498d8d0a248635159f27df557a105e6a9f38da749fe08bd25e1419844158ad0ba6a78", 0x89, 0x40, 0x0, 0x2, r2}, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x6, 0x0, 0xffffffffffffffff, &(0x7f0000000540)="a4d3aa5e63795efcce4bf7c0bc0b7222edbe60a04f8c77f99f9035984fadef1aef63acc475e2af58ddf13130bc470fa43ed5e1b934bbd1491d473d0f7e9fb3b7523fe04cf283fe21b5c25c850e8ac867b9ac663042d1a4932919b01b14850b0a51a6a5332b283c9bcc5436e4644794484ed36dfb6163a17b4164315e765c7f0d525fcdd0c2656e04b850a35008bf5cee594216d9ec8fe1d681e815ef2a0300b41bfc9c40df5099c5fe5a495cfaccf20df83ce421fd17f3e712c608e0b5cc83a3a5701e8281bbe2d41d4c1efaf510245001b84254591a6ad2a18f4027cd79cae10ff8c32f45c8a3082e5188d9c1cc53c34c4677dc35bc3462e38a635cf2e2", 0xfe, 0x3f, 0x0, 0x2, r1}]) r8 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r8, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r9 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r9, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r10 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r10, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r11 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r11, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$F_SET_RW_HINT(r11, 0x40c, &(0x7f00000006c0)) ioctl$sock_proto_private(r3, 0x89e8, &(0x7f00000001c0)="12961d84b09639a5349ff3fb80639dc67c7c19a7363631728c59be45407c0d6ec919c01d08a89b630fd86e429709eb58b822b3310e6d7385712ad8a14346534abf1688c298064b59d042b9b73a94ecdbe963c7094d07b2442192806fae180231fd7f6bbd0b32c0df5099da8f86ca02e007e319c40687999a4158410dfed0dd0af2c8e55e5882d2429a6f4ab524bb9518db6eb83978efb96b") ioctl$VT_OPENQRY(r2, 0x5600, &(0x7f0000000140)) lseek(r0, 0xe7, 0x0) clock_gettime(0x0, &(0x7f0000000080)) clock_gettime(0x0, &(0x7f00000002c0)={0x0, 0x0}) setitimer(0x1, &(0x7f0000000300)={{r12, r13/1000+30000}, {0x77359400}}, &(0x7f0000000100)) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r0, 0x8983, &(0x7f0000000000)={0x0, 'ipvlan0\x00', {0x1}, 0x400}) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, 0x0) [ 318.295116][T21231] R13: 00000000000009a6 R14: 00000000004cb100 R15: 0000000000000000 [ 318.303172][ T1959] loop5: rw=1, want=130, limit=63 [ 318.305657][T21234] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 318.308235][ T1959] attempt to access beyond end of device [ 318.321264][ T1959] loop5: rw=1, want=131, limit=63 [ 318.326385][ T1959] attempt to access beyond end of device [ 318.332333][ T1959] loop5: rw=1, want=132, limit=63 [ 318.333990][T21232] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 318.337377][ T1959] attempt to access beyond end of device [ 318.337384][ T1959] loop5: rw=1, want=133, limit=63 [ 318.337396][ T1959] attempt to access beyond end of device [ 318.368875][ T1959] loop5: rw=1, want=142, limit=63 [ 318.373968][ T1959] attempt to access beyond end of device [ 318.380094][ T1959] loop5: rw=1, want=143, limit=63 [ 318.385134][ T1959] attempt to access beyond end of device [ 318.390806][ T1959] loop5: rw=1, want=144, limit=63 09:14:10 executing program 0: unshare(0x44000600) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r0, 0x0, 0x0) lseek(r0, 0xe7, 0x0) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40000400}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x7, 0xa, 0x3, 0x0, 0x0, {0x5, 0x0, 0x8}, [@NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x4}]}, 0x20}, 0x1, 0x0, 0x0, 0x24004085}, 0x27df71f7532d84b5) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r2, 0x0, 0x0) lseek(r2, 0xe7, 0x0) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18, 0x0, 0x4, {0x1}}, 0x18) [ 318.395844][ T1959] attempt to access beyond end of device [ 318.401769][ T1959] loop5: rw=1, want=145, limit=63 [ 318.408172][ T1959] attempt to access beyond end of device [ 318.414036][ T1959] loop5: rw=1, want=2193, limit=63 [ 318.421834][ T1959] attempt to access beyond end of device [ 318.427499][ T1959] loop5: rw=1, want=6097, limit=63 09:14:10 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/cpuinfo\x00', 0x0, 0x0) prctl$PR_GET_FP_MODE(0x2e) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x904, 0x1) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r2, 0x0, 0x0) lseek(r2, 0xe7, 0x0) r3 = syz_genetlink_get_family_id$SEG6(&(0x7f00000000c0)='SEG6\x00') sendmsg$SEG6_CMD_DUMPHMAC(r2, &(0x7f00000001c0)={&(0x7f0000000080), 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x24, r3, 0x400, 0x70bd2b, 0x25dfdbff, {}, [@SEG6_ATTR_ALGID={0x5, 0x6, 0x4c}, @SEG6_ATTR_ALGID={0x5, 0x6, 0xc1}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x4010) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, &(0x7f0000000000)={0x0, r0, 0x0, 0x1e, 0x1, 0x6}) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$USBDEVFS_SUBMITURB(r1, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) dup2(r1, r0) lseek(r0, 0x0, 0x2) 09:14:10 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x3e040000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 318.430588][T21244] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 318.439421][ T1959] attempt to access beyond end of device [ 318.453434][ T1959] loop5: rw=1, want=17681, limit=63 [ 318.476854][ T1959] attempt to access beyond end of device [ 318.482583][ T1959] loop5: rw=1, want=48425, limit=63 09:14:10 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x5, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 318.501298][ T1959] attempt to access beyond end of device [ 318.506958][ T1959] loop5: rw=1, want=63513, limit=63 [ 318.554451][T21253] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 318.562322][T21253] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 318.623767][T21255] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 318.637418][T21255] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 318.865001][T21261] FAULT_INJECTION: forcing a failure. [ 318.865001][T21261] name failslab, interval 1, probability 0, space 0, times 0 [ 318.877723][T21261] CPU: 1 PID: 21261 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 318.887993][T21261] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 318.898057][T21261] Call Trace: [ 318.901352][T21261] dump_stack+0x1b0/0x228 [ 318.905684][T21261] ? devkmsg_release+0x127/0x127 [ 318.910621][T21261] ? __kasan_check_read+0x11/0x20 [ 318.915644][T21261] ? show_regs_print_info+0x18/0x18 [ 318.920843][T21261] should_fail+0x6fb/0x860 [ 318.925256][T21261] ? setup_fault_attr+0x2b0/0x2b0 [ 318.930382][T21261] ? current_time+0x2e0/0x2e0 [ 318.935056][T21261] __should_failslab+0x11a/0x160 [ 318.939985][T21261] ? kmalloc_array+0x32/0x60 [ 318.944636][T21261] should_failslab+0x9/0x20 [ 318.949135][T21261] __kmalloc+0x64/0x310 [ 318.953283][T21261] kmalloc_array+0x32/0x60 [ 318.957811][T21261] iter_file_splice_write+0x21d/0xf20 [ 318.963182][T21261] ? __sb_end_write+0xa8/0xf0 [ 318.967858][T21261] ? touch_atime+0x22e/0x270 [ 318.972444][T21261] ? current_time+0x2e0/0x2e0 [ 318.977151][T21261] ? fsnotify+0x1390/0x1450 [ 318.981653][T21261] ? splice_from_pipe+0x200/0x200 [ 318.986678][T21261] ? splice_shrink_spd+0xb0/0xb0 [ 318.991664][T21261] ? splice_from_pipe+0x200/0x200 [ 318.996796][T21261] direct_splice_actor+0xf7/0x130 [ 319.001821][T21261] splice_direct_to_actor+0x496/0xb00 [ 319.007315][T21261] ? do_splice_direct+0x3d0/0x3d0 [ 319.012341][T21261] ? pipe_to_sendpage+0x300/0x300 [ 319.017386][T21261] ? rw_verify_area+0x1c2/0x360 [ 319.022237][T21261] do_splice_direct+0x279/0x3d0 [ 319.027088][T21261] ? splice_direct_to_actor+0xb00/0xb00 [ 319.032636][T21261] ? security_file_permission+0x157/0x350 [ 319.038350][T21261] do_sendfile+0x89d/0x1110 [ 319.042847][T21261] ? compat_writev+0x390/0x390 [ 319.047605][T21261] ? __kasan_check_write+0x14/0x20 [ 319.053146][T21261] ? fput_many+0x47/0x1a0 [ 319.057469][T21261] __x64_sys_sendfile64+0x1ae/0x220 [ 319.062882][T21261] ? __ia32_sys_sendfile+0x240/0x240 [ 319.068158][T21261] ? syscall_return_slowpath+0x6f/0x500 [ 319.073697][T21261] do_syscall_64+0xc0/0x100 [ 319.078200][T21261] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 319.084141][T21261] RIP: 0033:0x45b399 [ 319.088039][T21261] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 319.107760][T21261] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 319.116296][T21261] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 319.124260][T21261] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 319.134006][T21261] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 319.141980][T21261] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 319.149946][T21261] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000009 09:14:11 executing program 5 (fault-call:10 fault-nth:10): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:11 executing program 3 (fault-call:3 fault-nth:1): unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:11 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) clock_getres(0x1, &(0x7f0000000000)) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000080)={{0x2, 0x4e22, @broadcast}, {0x306, @broadcast}, 0x10, {0x2, 0x4e23, @multicast1}, 'ipvlan0\x00'}) 09:14:11 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x6, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:11 executing program 0: unshare(0x64020e80) r0 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x908, 0x481) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r1, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$USBDEVFS_FREE_STREAMS(r1, 0x8008551d, &(0x7f0000000040)={0x3b22, 0x1e, [{0xc, 0x1}, {0x6}, {0x3, 0x1}, {0x9, 0x1}, {0xe, 0x1}, {0xb, 0x1}, {0x5, 0x1}, {0xa}, {0x6, 0x1}, {0x1, 0x1}, {0x2}, {0xe, 0x1}, {0xa, 0x1}, {0x4}, {0xe, 0x1}, {0x2}, {0x7}, {0x9, 0x1}, {0x8}, {0x6, 0x1}, {0x9, 0x1}, {0xf}, {0xd, 0x1}, {0xc, 0x1}, {0x7, 0x1}, {0xd, 0x1}, {0xf, 0x1}, {0x3}, {0xf}, {0xf, 0x1}]}) 09:14:11 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x3f000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 319.458503][T21258] FAT-fs (loop5): FAT read failed (blocknr 63) [ 319.474060][ T1959] attempt to access beyond end of device [ 319.484167][ T1959] loop5: rw=1, want=78, limit=63 [ 319.493168][ T1959] attempt to access beyond end of device [ 319.498822][ T1959] loop5: rw=1, want=79, limit=63 09:14:11 executing program 0: lsetxattr$trusted_overlay_redirect(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.redirect\x00', &(0x7f0000000080)='./file0\x00', 0x8, 0x2) creat(&(0x7f0000000100)='./file0\x00', 0x67) unshare(0x44000e00) r0 = syz_open_dev$usbfs(&(0x7f00000000c0)='/dev/bus/usb/00#/00#\x00', 0x3a, 0x113942) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r1, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r1) [ 319.509156][ T1959] attempt to access beyond end of device [ 319.519305][ T1959] loop5: rw=1, want=80, limit=63 [ 319.524288][ T1959] attempt to access beyond end of device [ 319.536110][ T1959] loop5: rw=1, want=81, limit=63 [ 319.536973][T21264] FAULT_INJECTION: forcing a failure. [ 319.536973][T21264] name failslab, interval 1, probability 0, space 0, times 0 [ 319.544758][ T1959] attempt to access beyond end of device [ 319.556861][T21264] CPU: 0 PID: 21264 Comm: syz-executor.3 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 319.568236][ T1959] loop5: rw=1, want=130, limit=63 [ 319.569930][T21264] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 319.569933][T21264] Call Trace: [ 319.569949][T21264] dump_stack+0x1b0/0x228 [ 319.569960][T21264] ? devkmsg_release+0x127/0x127 [ 319.569967][T21264] ? rht_key_hashfn+0x157/0x240 [ 319.569985][T21264] ? show_regs_print_info+0x18/0x18 [ 319.575726][ T1959] attempt to access beyond end of device [ 319.585284][T21264] ? _raw_spin_unlock_bh+0x19/0x20 [ 319.585297][T21264] should_fail+0x6fb/0x860 [ 319.585307][T21264] ? setup_fault_attr+0x2b0/0x2b0 [ 319.585314][T21264] ? setup_fault_attr+0x2b0/0x2b0 [ 319.585325][T21264] __should_failslab+0x11a/0x160 [ 319.585333][T21264] ? netlink_sendmsg+0x73b/0xd40 [ 319.585348][T21264] should_failslab+0x9/0x20 [ 319.592917][ T1959] loop5: rw=1, want=131, limit=63 [ 319.594075][T21264] __kmalloc_track_caller+0x5f/0x320 09:14:11 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x448080) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r2, 0x0) sendmsg$nl_netfilter(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="940000000e0801012cbd7000ffdbdf2501000004200093800c004c00070000000000000008008300", @ANYRES32, @ANYBLOB="08000240", @ANYRES32=r2, @ANYBLOB="a97983a96604f473e0681b415b0798d5fd1a79d2922a030700049ec042c569069dc58f316962ae6cf26a512dab4d8bdf85a169459c65d9c22490a162f5dc8d430bbc6cfeb6027bc5a6f91303b208e4f9748b01a5d6bcf003a27191eba960ea71000000"], 0x94}, 0x1, 0x0, 0x0, 0x41}, 0x40010) [ 319.599003][ T1959] attempt to access beyond end of device [ 319.603825][T21264] ? kmem_cache_alloc+0x120/0x2b0 [ 319.603835][T21264] ? netlink_sendmsg+0x73b/0xd40 [ 319.603843][T21264] __alloc_skb+0x109/0x540 [ 319.603851][T21264] netlink_sendmsg+0x73b/0xd40 [ 319.603859][T21264] ? netlink_getsockopt+0x900/0x900 [ 319.603869][T21264] ? security_socket_sendmsg+0xad/0xc0 [ 319.603882][T21264] ? netlink_getsockopt+0x900/0x900 [ 319.609967][ T1959] loop5: rw=1, want=132, limit=63 [ 319.614792][T21264] ____sys_sendmsg+0x56f/0x860 09:14:11 executing program 0: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r0, 0x0, 0x0) lseek(r0, 0xe7, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000000)={{{@in6=@empty, @in6=@mcast1}}, {{@in6=@ipv4={[], [], @remote}}, 0x0, @in=@multicast2}}, &(0x7f0000000100)=0xe8) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r1, 0x0, 0x0) lseek(r1, 0xe7, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) fchdir(r2) ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f0000000180)={0x3, 0x16, &(0x7f0000000140)="e5833cfcb876fb2188bdac44b940dec4a81a5bc94c86"}) unshare(0x44000600) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r3, 0x4008550d, 0x0) 09:14:11 executing program 3 (fault-call:3 fault-nth:2): unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 319.620225][ T1959] attempt to access beyond end of device [ 319.624273][T21264] ? __sys_sendmsg_sock+0x2a0/0x2a0 [ 319.629651][ T1959] loop5: rw=1, want=133, limit=63 [ 319.634309][T21264] ? __kasan_check_read+0x11/0x20 [ 319.640510][ T1959] attempt to access beyond end of device [ 319.644156][T21264] ? __fdget+0x156/0x200 [ 319.648641][ T1959] loop5: rw=1, want=142, limit=63 [ 319.653650][T21264] __sys_sendmsg+0x26a/0x350 [ 319.653659][T21264] ? ____sys_sendmsg+0x860/0x860 [ 319.653667][T21264] ? __fsnotify_parent+0x300/0x300 [ 319.653677][T21264] ? security_file_permission+0x157/0x350 [ 319.653685][T21264] ? rw_verify_area+0x1c2/0x360 [ 319.653691][T21264] ? __sb_end_write+0xa8/0xf0 [ 319.653704][T21264] ? vfs_write+0x424/0x4e0 [ 319.660007][ T1959] attempt to access beyond end of device [ 319.664732][T21264] ? __kasan_check_read+0x11/0x20 [ 319.670088][ T1959] loop5: rw=1, want=143, limit=63 [ 319.674660][T21264] ? __ia32_sys_clock_settime+0x230/0x230 [ 319.679074][ T1959] attempt to access beyond end of device [ 319.683806][T21264] __x64_sys_sendmsg+0x7f/0x90 [ 319.683816][T21264] do_syscall_64+0xc0/0x100 [ 319.683826][T21264] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 319.683832][T21264] RIP: 0033:0x45b399 [ 319.683841][T21264] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 319.683846][T21264] RSP: 002b:00007febf8229c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 319.683858][T21264] RAX: ffffffffffffffda RBX: 00007febf822a6d4 RCX: 000000000045b399 [ 319.690093][ T1959] loop5: rw=1, want=144, limit=63 [ 319.694500][T21264] RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000003 [ 319.694505][T21264] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 319.694509][T21264] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 319.694513][T21264] R13: 00000000000009a6 R14: 00000000004cb100 R15: 0000000000000001 [ 319.775167][T21283] FAULT_INJECTION: forcing a failure. [ 319.775167][T21283] name failslab, interval 1, probability 0, space 0, times 0 [ 319.777714][ T1959] attempt to access beyond end of device [ 319.784892][T21283] CPU: 0 PID: 21283 Comm: syz-executor.3 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 319.787429][ T1959] loop5: rw=1, want=145, limit=63 [ 319.792450][T21283] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 319.792454][T21283] Call Trace: [ 319.792473][T21283] dump_stack+0x1b0/0x228 [ 319.792484][T21283] ? devkmsg_release+0x127/0x127 [ 319.792493][T21283] ? show_regs_print_info+0x18/0x18 [ 319.792503][T21283] ? __nla_validate_parse+0x18fd/0x2010 [ 319.792512][T21283] should_fail+0x6fb/0x860 [ 319.792521][T21283] ? setup_fault_attr+0x2b0/0x2b0 [ 319.792532][T21283] __should_failslab+0x11a/0x160 [ 319.792542][T21283] ? __tipc_nl_bearer_enable+0x8a3/0xeb0 [ 319.792551][T21283] should_failslab+0x9/0x20 [ 319.792559][T21283] kmem_cache_alloc_trace+0x3a/0x2f0 [ 319.792566][T21283] ? __nla_parse+0x41/0x50 [ 319.792575][T21283] __tipc_nl_bearer_enable+0x8a3/0xeb0 [ 319.792592][T21283] ? tipc_nl_bearer_disable+0x270/0x270 [ 319.792600][T21283] ? __nla_validate_parse+0x18fd/0x2010 [ 319.792613][T21283] ? __mutex_lock_slowpath+0xe/0x10 [ 319.792620][T21283] ? mutex_lock+0x106/0x110 [ 319.792626][T21283] ? mutex_trylock+0xb0/0xb0 [ 319.792633][T21283] ? __kasan_check_write+0x14/0x20 [ 319.792675][T21283] ? mutex_lock+0xa6/0x110 [ 319.792688][T21283] ? mutex_trylock+0xb0/0xb0 [ 319.792698][T21283] tipc_nl_bearer_enable+0x22/0x30 [ 319.792708][T21283] genl_rcv_msg+0xe76/0x1330 [ 319.792717][T21283] ? genl_unbind+0x2b0/0x2b0 [ 319.792726][T21283] ? jhash+0x750/0x750 [ 319.792740][T21283] ? rht_key_hashfn+0x157/0x240 [ 319.792753][T21283] ? deferred_put_nlk_sk+0x200/0x200 [ 319.801671][ T1959] attempt to access beyond end of device [ 319.803814][T21283] ? __alloc_skb+0x109/0x540 [ 319.819220][ T1959] loop5: rw=1, want=4265, limit=63 [ 319.819318][T21283] ? jhash+0x750/0x750 [ 319.828243][ T1959] attempt to access beyond end of device [ 319.829106][T21283] ? netlink_hash+0xd0/0xd0 [ 319.879169][ T1959] loop5: rw=1, want=9241, limit=63 [ 319.886140][T21283] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 319.916877][ T1959] attempt to access beyond end of device [ 319.920363][T21283] ? _local_bh_enable+0x30/0x30 [ 319.920373][T21283] ? _raw_spin_lock_bh+0xa4/0x180 [ 319.920381][T21283] ? __rcu_read_lock+0x50/0x50 [ 319.920390][T21283] netlink_rcv_skb+0x1f0/0x460 [ 319.920404][T21283] ? genl_unbind+0x2b0/0x2b0 [ 319.959176][ T1959] loop5: rw=1, want=23449, limit=63 [ 319.963435][T21283] ? netlink_ack+0xa80/0xa80 [ 320.004640][ T1959] attempt to access beyond end of device [ 320.009317][T21283] ? __down_read+0xfc/0x240 [ 320.009325][T21283] ? __init_rwsem+0x120/0x120 [ 320.009332][T21283] ? __rcu_read_lock+0x50/0x50 [ 320.009341][T21283] ? selinux_vm_enough_memory+0x160/0x160 [ 320.009349][T21283] genl_rcv+0x28/0x40 [ 320.009361][T21283] netlink_unicast+0x87c/0xa20 [ 320.029152][ T1959] loop5: rw=1, want=50209, limit=63 [ 320.030516][T21283] ? netlink_detachskb+0x60/0x60 [ 320.046577][ T1959] attempt to access beyond end of device [ 320.049250][T21283] ? security_netlink_send+0xab/0xc0 [ 320.049259][T21283] netlink_sendmsg+0x9a7/0xd40 [ 320.049269][T21283] ? netlink_getsockopt+0x900/0x900 [ 320.049282][T21283] ? security_socket_sendmsg+0xad/0xc0 [ 320.054389][ T1959] loop5: rw=1, want=63513, limit=63 [ 320.058969][T21283] ? netlink_getsockopt+0x900/0x900 [ 320.239073][T21283] ____sys_sendmsg+0x56f/0x860 [ 320.243944][T21283] ? __sys_sendmsg_sock+0x2a0/0x2a0 [ 320.249141][T21283] ? __kasan_check_read+0x11/0x20 [ 320.254154][T21283] ? __fdget+0x156/0x200 [ 320.258397][T21283] __sys_sendmsg+0x26a/0x350 [ 320.262979][T21283] ? ____sys_sendmsg+0x860/0x860 [ 320.267927][T21283] ? __fsnotify_parent+0x300/0x300 [ 320.273040][T21283] ? security_file_permission+0x157/0x350 [ 320.278753][T21283] ? rw_verify_area+0x1c2/0x360 [ 320.284145][T21283] ? __sb_end_write+0xa8/0xf0 [ 320.288821][T21283] ? vfs_write+0x424/0x4e0 [ 320.293244][T21283] ? __kasan_check_read+0x11/0x20 [ 320.298264][T21283] ? __ia32_sys_clock_settime+0x230/0x230 [ 320.303980][T21283] __x64_sys_sendmsg+0x7f/0x90 [ 320.308756][T21283] do_syscall_64+0xc0/0x100 [ 320.313359][T21283] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 320.319254][T21283] RIP: 0033:0x45b399 [ 320.323143][T21283] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 320.342869][T21283] RSP: 002b:00007febf8229c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 320.351273][T21283] RAX: ffffffffffffffda RBX: 00007febf822a6d4 RCX: 000000000045b399 09:14:12 executing program 3 (fault-call:3 fault-nth:3): unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 320.359344][T21283] RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000003 [ 320.367296][T21283] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 320.375271][T21283] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 320.383244][T21283] R13: 00000000000009a6 R14: 00000000004cb100 R15: 0000000000000002 09:14:12 executing program 0: unshare(0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) socketpair(0x27, 0x3, 0x9, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000540)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x34, 0x1, 0x1, 0x301, 0x0, 0x0, {0xa, 0x0, 0x4}, [@CTA_PROTOINFO={0x20, 0x4, 0x0, 0x1, @CTA_PROTOINFO_DCCP={0x1c, 0x2, 0x0, 0x1, [@CTA_PROTOINFO_DCCP_STATE={0x5, 0x1, 0x3f}, @CTA_PROTOINFO_DCCP_STATE={0x5, 0x1, 0x33}, @CTA_PROTOINFO_DCCP_STATE={0x5, 0x1, 0x38}]}}]}, 0x34}}, 0x8001) [ 320.417013][T21288] net_ratelimit: 3 callbacks suppressed [ 320.417021][T21288] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 320.481165][T21292] FAULT_INJECTION: forcing a failure. [ 320.481165][T21292] name failslab, interval 1, probability 0, space 0, times 0 [ 320.493950][T21292] CPU: 1 PID: 21292 Comm: syz-executor.3 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 320.504106][T21292] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 320.514665][T21292] Call Trace: [ 320.517971][T21292] dump_stack+0x1b0/0x228 [ 320.522299][T21292] ? devkmsg_release+0x127/0x127 [ 320.527235][T21292] ? show_regs_print_info+0x18/0x18 [ 320.532431][T21292] ? __rcu_read_lock+0x50/0x50 [ 320.537207][T21292] should_fail+0x6fb/0x860 [ 320.541644][T21292] ? setup_fault_attr+0x2b0/0x2b0 [ 320.546667][T21292] ? is_bpf_text_address+0x2c8/0x2e0 [ 320.551958][T21292] ? stack_trace_save+0x1e0/0x1e0 [ 320.556979][T21292] __should_failslab+0x11a/0x160 [ 320.561925][T21292] ? tipc_udp_enable+0x173/0x17c0 [ 320.567061][T21292] should_failslab+0x9/0x20 [ 320.571654][T21292] kmem_cache_alloc_trace+0x3a/0x2f0 [ 320.576937][T21292] tipc_udp_enable+0x173/0x17c0 [ 320.581909][T21292] ? stack_trace_save+0x111/0x1e0 [ 320.586931][T21292] ? stack_trace_snprint+0x150/0x150 [ 320.592224][T21292] ? tipc_udp_send_msg+0x320/0x320 [ 320.597336][T21292] ? unwind_next_frame+0x415/0x870 [ 320.602439][T21292] ? __kasan_kmalloc+0x179/0x1b0 [ 320.607370][T21292] ? __kasan_kmalloc+0x117/0x1b0 [ 320.612305][T21292] ? kasan_kmalloc+0x9/0x10 [ 320.616812][T21292] ? kmem_cache_alloc_trace+0xe2/0x2f0 [ 320.622268][T21292] ? __tipc_nl_bearer_enable+0x8a3/0xeb0 [ 320.627921][T21292] ? tipc_nl_bearer_enable+0x22/0x30 [ 320.633205][T21292] ? genl_rcv_msg+0xe76/0x1330 [ 320.637965][T21292] ? netlink_rcv_skb+0x1f0/0x460 [ 320.642897][T21292] ? genl_rcv+0x28/0x40 [ 320.647058][T21292] ? netlink_unicast+0x87c/0xa20 [ 320.651999][T21292] ? netlink_sendmsg+0x9a7/0xd40 [ 320.657047][T21292] ? ____sys_sendmsg+0x56f/0x860 [ 320.662119][T21292] ? __sys_sendmsg+0x26a/0x350 [ 320.666890][T21292] ? __x64_sys_sendmsg+0x7f/0x90 [ 320.671936][T21292] ? do_syscall_64+0xc0/0x100 [ 320.676617][T21292] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 320.682689][T21292] ? __nla_validate_parse+0x18fd/0x2010 [ 320.688253][T21292] ? __should_failslab+0x11a/0x160 [ 320.693376][T21292] ? __tipc_nl_bearer_enable+0x8a3/0xeb0 [ 320.699011][T21292] ? kasan_kmalloc+0x9/0x10 [ 320.703630][T21292] ? kmem_cache_alloc_trace+0xe2/0x2f0 [ 320.709095][T21292] __tipc_nl_bearer_enable+0x92b/0xeb0 [ 320.714682][T21292] ? tipc_nl_bearer_disable+0x270/0x270 [ 320.720226][T21292] ? __nla_validate_parse+0x18fd/0x2010 [ 320.725778][T21292] ? __kasan_check_write+0x14/0x20 [ 320.731583][T21292] ? mutex_lock+0xa6/0x110 [ 320.735998][T21292] ? mutex_trylock+0xb0/0xb0 [ 320.740609][T21292] ? __kasan_check_write+0x14/0x20 [ 320.745717][T21292] ? mutex_lock+0xa6/0x110 [ 320.750135][T21292] ? mutex_trylock+0xb0/0xb0 [ 320.754725][T21292] tipc_nl_bearer_enable+0x22/0x30 [ 320.760529][T21292] genl_rcv_msg+0xe76/0x1330 [ 320.765129][T21292] ? genl_unbind+0x2b0/0x2b0 [ 320.769712][T21292] ? jhash+0x750/0x750 [ 320.773783][T21292] ? rht_key_hashfn+0x157/0x240 [ 320.778633][T21292] ? deferred_put_nlk_sk+0x200/0x200 [ 320.783911][T21292] ? __alloc_skb+0x109/0x540 [ 320.788925][T21292] ? jhash+0x750/0x750 [ 320.792994][T21292] ? netlink_hash+0xd0/0xd0 [ 320.797496][T21292] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 320.803556][T21292] ? _local_bh_enable+0x30/0x30 [ 320.808409][T21292] ? _raw_spin_lock_bh+0xa4/0x180 [ 320.813430][T21292] ? __rcu_read_lock+0x50/0x50 [ 320.818192][T21292] netlink_rcv_skb+0x1f0/0x460 [ 320.822956][T21292] ? genl_unbind+0x2b0/0x2b0 [ 320.827538][T21292] ? netlink_ack+0xa80/0xa80 [ 320.832122][T21292] ? __down_read+0xfc/0x240 [ 320.836646][T21292] ? __init_rwsem+0x120/0x120 [ 320.841315][T21292] ? __rcu_read_lock+0x50/0x50 [ 320.846068][T21292] ? selinux_vm_enough_memory+0x160/0x160 [ 320.851829][T21292] genl_rcv+0x28/0x40 [ 320.856103][T21292] netlink_unicast+0x87c/0xa20 [ 320.861009][T21292] ? netlink_detachskb+0x60/0x60 [ 320.865953][T21292] ? security_netlink_send+0xab/0xc0 [ 320.871230][T21292] netlink_sendmsg+0x9a7/0xd40 [ 320.876076][T21292] ? netlink_getsockopt+0x900/0x900 [ 320.881273][T21292] ? security_socket_sendmsg+0xad/0xc0 [ 320.886841][T21292] ? netlink_getsockopt+0x900/0x900 [ 320.892041][T21292] ____sys_sendmsg+0x56f/0x860 [ 320.896809][T21292] ? __sys_sendmsg_sock+0x2a0/0x2a0 [ 320.902044][T21292] ? __kasan_check_read+0x11/0x20 [ 320.907067][T21292] ? __fdget+0x156/0x200 [ 320.911303][T21292] __sys_sendmsg+0x26a/0x350 [ 320.915893][T21292] ? ____sys_sendmsg+0x860/0x860 [ 320.920914][T21292] ? __fsnotify_parent+0x300/0x300 [ 320.926021][T21292] ? security_file_permission+0x157/0x350 [ 320.931743][T21292] ? rw_verify_area+0x1c2/0x360 [ 320.936596][T21292] ? __sb_end_write+0xa8/0xf0 [ 320.941273][T21292] ? vfs_write+0x424/0x4e0 [ 320.945689][T21292] ? __kasan_check_read+0x11/0x20 [ 320.950712][T21292] ? __ia32_sys_clock_settime+0x230/0x230 [ 320.956477][T21292] __x64_sys_sendmsg+0x7f/0x90 [ 320.961246][T21292] do_syscall_64+0xc0/0x100 [ 320.965756][T21292] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 320.971642][T21292] RIP: 0033:0x45b399 [ 320.975531][T21292] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 320.995262][T21292] RSP: 002b:00007febf8229c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 321.003781][T21292] RAX: ffffffffffffffda RBX: 00007febf822a6d4 RCX: 000000000045b399 [ 321.012103][T21292] RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000003 [ 321.020075][T21292] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 321.028041][T21292] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 321.036013][T21292] R13: 00000000000009a6 R14: 00000000004cb100 R15: 0000000000000003 [ 321.045182][T21292] tipc: Enabling of bearer rejected, failed to enable media [ 321.094816][T21303] FAULT_INJECTION: forcing a failure. [ 321.094816][T21303] name failslab, interval 1, probability 0, space 0, times 0 [ 321.108128][T21303] CPU: 1 PID: 21303 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 321.118269][T21303] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 321.128464][T21303] Call Trace: [ 321.131779][T21303] dump_stack+0x1b0/0x228 [ 321.136102][T21303] ? devkmsg_release+0x127/0x127 [ 321.141017][T21303] ? __kasan_check_read+0x11/0x20 [ 321.146051][T21303] ? show_regs_print_info+0x18/0x18 [ 321.151228][T21303] should_fail+0x6fb/0x860 [ 321.155627][T21303] ? setup_fault_attr+0x2b0/0x2b0 [ 321.160646][T21303] ? current_time+0x2e0/0x2e0 [ 321.165300][T21303] __should_failslab+0x11a/0x160 [ 321.170270][T21303] ? kmalloc_array+0x32/0x60 [ 321.174847][T21303] should_failslab+0x9/0x20 [ 321.179344][T21303] __kmalloc+0x64/0x310 [ 321.183487][T21303] kmalloc_array+0x32/0x60 [ 321.187890][T21303] iter_file_splice_write+0x21d/0xf20 [ 321.193370][T21303] ? __sb_end_write+0xa8/0xf0 [ 321.198070][T21303] ? touch_atime+0x22e/0x270 [ 321.202632][T21303] ? current_time+0x2e0/0x2e0 [ 321.207291][T21303] ? fsnotify+0x1390/0x1450 [ 321.211774][T21303] ? splice_from_pipe+0x200/0x200 [ 321.216780][T21303] ? splice_shrink_spd+0xb0/0xb0 [ 321.221691][T21303] ? splice_from_pipe+0x200/0x200 [ 321.226696][T21303] direct_splice_actor+0xf7/0x130 [ 321.231784][T21303] splice_direct_to_actor+0x496/0xb00 [ 321.237150][T21303] ? do_splice_direct+0x3d0/0x3d0 [ 321.242157][T21303] ? pipe_to_sendpage+0x300/0x300 [ 321.247263][T21303] ? rw_verify_area+0x1c2/0x360 [ 321.252091][T21303] do_splice_direct+0x279/0x3d0 [ 321.256923][T21303] ? splice_direct_to_actor+0xb00/0xb00 [ 321.262489][T21303] ? security_file_permission+0x157/0x350 [ 321.268182][T21303] do_sendfile+0x89d/0x1110 [ 321.272662][T21303] ? compat_writev+0x390/0x390 [ 321.277576][T21303] ? __kasan_check_write+0x14/0x20 [ 321.282675][T21303] ? fput_many+0x47/0x1a0 [ 321.286978][T21303] __x64_sys_sendfile64+0x1ae/0x220 [ 321.292157][T21303] ? __ia32_sys_sendfile+0x240/0x240 [ 321.297422][T21303] ? syscall_return_slowpath+0x6f/0x500 [ 321.302943][T21303] do_syscall_64+0xc0/0x100 [ 321.307431][T21303] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 321.313301][T21303] RIP: 0033:0x45b399 [ 321.317172][T21303] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 321.336857][T21303] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 321.345307][T21303] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 321.353264][T21303] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 321.361220][T21303] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 321.369176][T21303] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 321.377131][T21303] R13: 00000000000008ca R14: 00000000004ca24d R15: 000000000000000a 09:14:13 executing program 5 (fault-call:10 fault-nth:11): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:13 executing program 0: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x140, 0x0) ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f0000000080)={0x34, 0x0, &(0x7f0000000040)}) unshare(0x44000600) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x240001) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, 0x0) 09:14:13 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x7, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:13 executing program 2: unshare(0x44000600) r0 = syz_open_dev$usbfs(0x0, 0x0, 0x680001) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0) fsetxattr$security_selinux(r0, &(0x7f0000000000)='security.selinux\x00', &(0x7f0000000080)='system_u:object_r:udev_var_run_t:s0\x00', 0x24, 0x2) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r2, 0x0, 0x0) lseek(r2, 0xe7, 0x0) ioctl$TIOCCBRK(r2, 0x5428) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r3, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$USBDEVFS_CLEAR_HALT(r3, 0x80045515, &(0x7f00000000c0)={0xd}) lseek(r1, 0x0, 0x0) 09:14:13 executing program 3 (fault-call:3 fault-nth:4): unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:13 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x40000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 321.498669][ T1959] attempt to access beyond end of device [ 321.504468][ T1959] loop5: rw=1, want=78, limit=63 [ 321.513106][ T1959] attempt to access beyond end of device [ 321.518752][ T1959] loop5: rw=1, want=79, limit=63 [ 321.519384][T21309] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 321.525897][ T1959] buffer_io_error: 27 callbacks suppressed [ 321.525905][ T1959] Buffer I/O error on dev loop5, logical block 78, lost async page write [ 321.554552][T21308] tipc: Started in network mode [ 321.554708][ T1959] attempt to access beyond end of device [ 321.565301][ T1959] loop5: rw=1, want=80, limit=63 [ 321.569258][T21308] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 321.571407][ T1959] Buffer I/O error on dev loop5, logical block 79, lost async page write [ 321.581358][T21308] FAULT_INJECTION: forcing a failure. [ 321.581358][T21308] name failslab, interval 1, probability 0, space 0, times 0 [ 321.589165][ T1959] attempt to access beyond end of device [ 321.589173][ T1959] loop5: rw=1, want=81, limit=63 [ 321.589186][ T1959] Buffer I/O error on dev loop5, logical block 80, lost async page write [ 321.602144][T21308] CPU: 1 PID: 21308 Comm: syz-executor.3 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 321.607597][ T1959] attempt to access beyond end of device [ 321.612438][T21308] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 321.612442][T21308] Call Trace: [ 321.612460][T21308] dump_stack+0x1b0/0x228 [ 321.612471][T21308] ? devkmsg_release+0x127/0x127 [ 321.612480][T21308] ? show_regs_print_info+0x18/0x18 [ 321.612487][T21308] ? vprintk_emit+0x450/0x450 [ 321.612496][T21308] should_fail+0x6fb/0x860 [ 321.612510][T21308] ? setup_fault_attr+0x2b0/0x2b0 [ 321.621060][ T1959] loop5: rw=1, want=130, limit=63 [ 321.631049][T21308] ? __kasan_check_write+0x14/0x20 [ 321.631057][T21308] ? tick_nohz_tick_stopped+0x44/0x60 [ 321.631066][T21308] __should_failslab+0x11a/0x160 [ 321.631075][T21308] ? sock_alloc_inode+0x1b/0xc0 [ 321.631082][T21308] should_failslab+0x9/0x20 [ 321.631089][T21308] kmem_cache_alloc+0x37/0x2b0 [ 321.631102][T21308] ? sockfs_init_fs_context+0xb0/0xb0 [ 321.636787][ T1959] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 321.646769][T21308] sock_alloc_inode+0x1b/0xc0 [ 321.646778][T21308] ? sockfs_init_fs_context+0xb0/0xb0 [ 321.646787][T21308] new_inode_pseudo+0x68/0x240 [ 321.646796][T21308] __sock_create+0x136/0x7b0 [ 321.646804][T21308] ? vprintk_default+0x28/0x30 [ 321.646811][T21308] sock_create_kern+0x3b/0x50 [ 321.646825][T21308] udp_sock_create6+0xe5/0x800 [ 321.650205][ T1959] attempt to access beyond end of device [ 321.654412][T21308] ? local_bh_enable+0x30/0x30 [ 321.654423][T21308] ? __rcu_read_lock+0x50/0x50 [ 321.654431][T21308] ? tipc_set_node_id+0x1b7/0x2e0 [ 321.654442][T21308] tipc_udp_enable+0xe21/0x17c0 [ 321.659417][ T1959] loop5: rw=1, want=131, limit=63 [ 321.664640][T21308] ? tipc_udp_send_msg+0x320/0x320 [ 321.664653][T21308] ? tipc_nl_bearer_enable+0x22/0x30 [ 321.664661][T21308] ? genl_rcv_msg+0xe76/0x1330 [ 321.664673][T21308] ? netlink_rcv_skb+0x1f0/0x460 [ 321.669452][ T1959] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 321.673765][T21308] ? genl_rcv+0x28/0x40 [ 321.673780][T21308] ? __nla_validate_parse+0x18fd/0x2010 [ 321.673793][T21308] ? __should_failslab+0x11a/0x160 [ 321.673808][T21308] ? __tipc_nl_bearer_enable+0x8a3/0xeb0 [ 321.678830][ T1959] attempt to access beyond end of device 09:14:13 executing program 3 (fault-call:3 fault-nth:5): unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 321.683816][T21308] ? kasan_kmalloc+0x9/0x10 [ 321.683825][T21308] ? kmem_cache_alloc_trace+0xe2/0x2f0 [ 321.683833][T21308] __tipc_nl_bearer_enable+0x92b/0xeb0 [ 321.683841][T21308] ? tipc_nl_bearer_disable+0x270/0x270 [ 321.683854][T21308] ? __nla_validate_parse+0x18fd/0x2010 [ 321.689039][ T1959] loop5: rw=1, want=132, limit=63 [ 321.694343][T21308] ? __mutex_lock_slowpath+0xe/0x10 [ 321.694350][T21308] ? mutex_lock+0x106/0x110 [ 321.694356][T21308] ? mutex_trylock+0xb0/0xb0 [ 321.694363][T21308] ? __kasan_check_write+0x14/0x20 09:14:13 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x101201) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r1, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) dup3(r0, r1, 0x80000) r2 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r2, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r3, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r4, 0x0, 0x0) lseek(r4, 0xe7, 0x0) pidfd_send_signal(r4, 0x37, &(0x7f0000000000)={0x16, 0x9}, 0x0) setsockopt$inet6_MRT6_DEL_MFC(r4, 0x29, 0xcd, &(0x7f0000000080)={{0xa, 0x4e20, 0x1, @loopback, 0x1ed4}, {0xa, 0x4e22, 0xffff, @dev={0xfe, 0x80, [], 0x2f}, 0x39}, 0x2, [0x8, 0x80000000, 0x46, 0xfffffff7, 0x87c, 0x7, 0x3a, 0x1000]}, 0x5c) [ 321.694370][T21308] ? mutex_lock+0xa6/0x110 [ 321.694377][T21308] ? mutex_trylock+0xb0/0xb0 [ 321.694385][T21308] tipc_nl_bearer_enable+0x22/0x30 [ 321.694399][T21308] genl_rcv_msg+0xe76/0x1330 [ 321.699426][ T1959] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 321.704175][T21308] ? genl_unbind+0x2b0/0x2b0 [ 321.704185][T21308] ? jhash+0x750/0x750 [ 321.704191][T21308] ? rht_key_hashfn+0x157/0x240 [ 321.704202][T21308] ? deferred_put_nlk_sk+0x200/0x200 [ 321.708702][ T1959] attempt to access beyond end of device 09:14:13 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x8, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 321.713433][T21308] ? __alloc_skb+0x109/0x540 [ 321.713441][T21308] ? jhash+0x750/0x750 [ 321.713447][T21308] ? netlink_hash+0xd0/0xd0 [ 321.713457][T21308] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 321.713472][T21308] ? _local_bh_enable+0x30/0x30 [ 321.718919][ T1959] loop5: rw=1, want=133, limit=63 [ 321.727331][T21308] ? _raw_spin_lock_bh+0xa4/0x180 [ 321.727347][T21308] ? __rcu_read_lock+0x50/0x50 [ 321.727356][T21308] netlink_rcv_skb+0x1f0/0x460 [ 321.727365][T21308] ? genl_unbind+0x2b0/0x2b0 [ 321.727372][T21308] ? netlink_ack+0xa80/0xa80 [ 321.727377][T21308] ? __down_read+0xfc/0x240 [ 321.727389][T21308] ? __init_rwsem+0x120/0x120 [ 321.732124][ T1959] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 321.737410][T21308] ? __rcu_read_lock+0x50/0x50 [ 321.737419][T21308] ? selinux_vm_enough_memory+0x160/0x160 [ 321.737429][T21308] genl_rcv+0x28/0x40 [ 321.737436][T21308] netlink_unicast+0x87c/0xa20 [ 321.737448][T21308] ? netlink_detachskb+0x60/0x60 [ 321.742300][ T1959] attempt to access beyond end of device [ 321.746791][T21308] ? security_netlink_send+0xab/0xc0 [ 321.746800][T21308] netlink_sendmsg+0x9a7/0xd40 [ 321.746813][T21308] ? netlink_getsockopt+0x900/0x900 [ 321.751615][ T1959] loop5: rw=1, want=142, limit=63 [ 321.756328][T21308] ? security_socket_sendmsg+0xad/0xc0 [ 321.756337][T21308] ? netlink_getsockopt+0x900/0x900 [ 321.756345][T21308] ____sys_sendmsg+0x56f/0x860 [ 321.756354][T21308] ? __sys_sendmsg_sock+0x2a0/0x2a0 [ 321.756367][T21308] ? __kasan_check_read+0x11/0x20 [ 321.761208][ T1959] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 321.766743][T21308] ? __fdget+0x156/0x200 [ 321.766752][T21308] __sys_sendmsg+0x26a/0x350 [ 321.766761][T21308] ? ____sys_sendmsg+0x860/0x860 [ 321.766775][T21308] ? __fsnotify_parent+0x300/0x300 [ 321.771605][ T1959] attempt to access beyond end of device [ 321.776261][T21308] ? security_file_permission+0x157/0x350 [ 321.776271][T21308] ? rw_verify_area+0x1c2/0x360 [ 321.776278][T21308] ? __sb_end_write+0xa8/0xf0 [ 321.776285][T21308] ? vfs_write+0x424/0x4e0 [ 321.776298][T21308] ? __kasan_check_read+0x11/0x20 [ 321.781388][ T1959] loop5: rw=1, want=143, limit=63 [ 321.786150][T21308] ? __ia32_sys_clock_settime+0x230/0x230 [ 321.786160][T21308] __x64_sys_sendmsg+0x7f/0x90 [ 321.786170][T21308] do_syscall_64+0xc0/0x100 [ 321.786186][T21308] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 321.791256][ T1959] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 321.796277][T21308] RIP: 0033:0x45b399 [ 321.796287][T21308] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 321.796291][T21308] RSP: 002b:00007febf8229c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 321.796299][T21308] RAX: ffffffffffffffda RBX: 00007febf822a6d4 RCX: 000000000045b399 [ 321.796303][T21308] RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000003 [ 321.796312][T21308] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 321.801706][ T1959] attempt to access beyond end of device [ 321.806365][T21308] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 [ 321.806370][T21308] R13: 00000000000009a6 R14: 00000000004cb100 R15: 0000000000000004 [ 321.809519][T21308] socket: no more sockets [ 321.811434][ T1959] loop5: rw=1, want=144, limit=63 [ 321.822650][T21308] tipc: Enabling of bearer rejected, failed to enable media [ 321.824088][ T1959] Buffer I/O error on dev loop5, logical block 143, lost async page write [ 321.829905][T21310] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 321.834892][ T1959] attempt to access beyond end of device [ 321.842019][T21310] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 321.846706][ T1959] loop5: rw=1, want=145, limit=63 [ 321.874186][T21319] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 321.880446][ T1959] attempt to access beyond end of device [ 321.943248][T21322] tipc: Started in network mode [ 321.944535][ T1959] loop5: rw=1, want=3697, limit=63 [ 321.966664][T21322] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 321.974908][ T1959] attempt to access beyond end of device [ 321.981904][T21322] FAULT_INJECTION: forcing a failure. [ 321.981904][T21322] name failslab, interval 1, probability 0, space 0, times 0 [ 321.984485][ T1959] loop5: rw=1, want=13153, limit=63 [ 321.990771][T21322] CPU: 1 PID: 21322 Comm: syz-executor.3 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 322.009434][ T1959] attempt to access beyond end of device [ 322.013527][T21322] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 322.013530][T21322] Call Trace: [ 322.013549][T21322] dump_stack+0x1b0/0x228 [ 322.013565][T21322] ? devkmsg_release+0x127/0x127 [ 322.022067][ T1959] loop5: rw=1, want=40721, limit=63 [ 322.026787][T21322] ? udp_sock_create6+0xe5/0x800 [ 322.045909][ T1959] attempt to access beyond end of device [ 322.046251][T21322] ? show_regs_print_info+0x18/0x18 [ 322.051875][ T1959] loop5: rw=1, want=59337, limit=63 [ 322.057151][T21322] ? genl_rcv_msg+0xe76/0x1330 [ 322.451419][T21322] ? genl_rcv+0x28/0x40 [ 322.455569][T21322] ? netlink_unicast+0x87c/0xa20 [ 322.460504][T21322] ? netlink_sendmsg+0x9a7/0xd40 [ 322.465435][T21322] ? __sys_sendmsg+0x26a/0x350 [ 322.470187][T21322] ? __x64_sys_sendmsg+0x7f/0x90 [ 322.475164][T21322] should_fail+0x6fb/0x860 [ 322.479570][T21322] ? setup_fault_attr+0x2b0/0x2b0 [ 322.484589][T21322] ? __kasan_check_read+0x11/0x20 [ 322.489599][T21322] ? should_fail+0x182/0x860 [ 322.494302][T21322] __should_failslab+0x11a/0x160 [ 322.499235][T21322] ? security_inode_alloc+0x36/0x1f0 [ 322.504694][T21322] should_failslab+0x9/0x20 [ 322.509215][T21322] kmem_cache_alloc+0x37/0x2b0 [ 322.514149][T21322] ? from_kuid_munged+0x3b0/0x3b0 [ 322.519165][T21322] security_inode_alloc+0x36/0x1f0 [ 322.524315][T21322] inode_init_always+0x39b/0x840 [ 322.529251][T21322] ? sockfs_init_fs_context+0xb0/0xb0 [ 322.534616][T21322] new_inode_pseudo+0x7f/0x240 [ 322.539532][T21322] __sock_create+0x136/0x7b0 [ 322.544581][T21322] ? __sched_text_start+0x8/0x8 [ 322.549420][T21322] sock_create_kern+0x3b/0x50 [ 322.554100][T21322] udp_sock_create6+0xe5/0x800 [ 322.558849][T21322] ? local_bh_enable+0x30/0x30 [ 322.563621][T21322] ? retint_kernel+0x1b/0x1b [ 322.568215][T21322] tipc_udp_enable+0xe21/0x17c0 [ 322.573062][T21322] ? tipc_udp_send_msg+0x320/0x320 [ 322.578154][T21322] ? unwind_next_frame+0x415/0x870 [ 322.583266][T21322] ? tipc_nl_bearer_enable+0x22/0x30 [ 322.588560][T21322] ? genl_rcv_msg+0xe76/0x1330 [ 322.593312][T21322] ? netlink_rcv_skb+0x1f0/0x460 [ 322.598253][T21322] ? genl_rcv+0x28/0x40 [ 322.602399][T21322] ? __nla_validate_parse+0x18fd/0x2010 [ 322.607932][T21322] ? __should_failslab+0x11a/0x160 [ 322.613042][T21322] ? __tipc_nl_bearer_enable+0x8a3/0xeb0 [ 322.618698][T21322] ? kasan_kmalloc+0x9/0x10 [ 322.623274][T21322] ? kmem_cache_alloc_trace+0xe2/0x2f0 [ 322.628726][T21322] __tipc_nl_bearer_enable+0x92b/0xeb0 [ 322.634215][T21322] ? tipc_nl_bearer_disable+0x270/0x270 [ 322.639757][T21322] ? __nla_validate_parse+0x18fd/0x2010 [ 322.645339][T21322] ? __kasan_check_write+0x14/0x20 [ 322.650447][T21322] ? mutex_lock+0xa6/0x110 [ 322.654860][T21322] ? mutex_trylock+0xb0/0xb0 [ 322.659545][T21322] ? __kasan_check_write+0x14/0x20 [ 322.664636][T21322] ? mutex_lock+0xa6/0x110 [ 322.669376][T21322] ? mutex_trylock+0xb0/0xb0 [ 322.673975][T21322] tipc_nl_bearer_enable+0x22/0x30 [ 322.679095][T21322] genl_rcv_msg+0xe76/0x1330 [ 322.683690][T21322] ? genl_unbind+0x2b0/0x2b0 [ 322.688271][T21322] ? jhash+0x750/0x750 [ 322.692327][T21322] ? rht_key_hashfn+0x157/0x240 [ 322.697168][T21322] ? deferred_put_nlk_sk+0x200/0x200 [ 322.702434][T21322] ? __alloc_skb+0x109/0x540 [ 322.707027][T21322] ? jhash+0x750/0x750 [ 322.711090][T21322] ? netlink_hash+0xd0/0xd0 [ 322.715687][T21322] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 322.721752][T21322] ? _local_bh_enable+0x30/0x30 [ 322.726607][T21322] ? _raw_spin_lock_bh+0xa4/0x180 [ 322.731727][T21322] ? __rcu_read_lock+0x50/0x50 [ 322.736475][T21322] netlink_rcv_skb+0x1f0/0x460 [ 322.741241][T21322] ? genl_unbind+0x2b0/0x2b0 [ 322.745905][T21322] ? netlink_ack+0xa80/0xa80 [ 322.750479][T21322] ? __down_read+0xfc/0x240 [ 322.754959][T21322] ? __init_rwsem+0x120/0x120 [ 322.759621][T21322] ? __rcu_read_lock+0x50/0x50 [ 322.764374][T21322] ? selinux_vm_enough_memory+0x160/0x160 [ 322.770082][T21322] genl_rcv+0x28/0x40 [ 322.774066][T21322] netlink_unicast+0x87c/0xa20 [ 322.778823][T21322] ? netlink_detachskb+0x60/0x60 [ 322.783751][T21322] ? security_netlink_send+0xab/0xc0 [ 322.789140][T21322] netlink_sendmsg+0x9a7/0xd40 [ 322.794001][T21322] ? netlink_getsockopt+0x900/0x900 [ 322.799299][T21322] ? security_socket_sendmsg+0xad/0xc0 [ 322.804754][T21322] ? netlink_getsockopt+0x900/0x900 [ 322.809938][T21322] ____sys_sendmsg+0x56f/0x860 [ 322.814693][T21322] ? __sys_sendmsg_sock+0x2a0/0x2a0 [ 322.819916][T21322] ? __kasan_check_read+0x11/0x20 [ 322.824933][T21322] ? __fdget+0x156/0x200 [ 322.829171][T21322] __sys_sendmsg+0x26a/0x350 [ 322.833752][T21322] ? ____sys_sendmsg+0x860/0x860 [ 322.838773][T21322] ? __fsnotify_parent+0x300/0x300 [ 322.843865][T21322] ? security_file_permission+0x157/0x350 [ 322.849569][T21322] ? rw_verify_area+0x1c2/0x360 [ 322.854410][T21322] ? __sb_end_write+0xa8/0xf0 [ 322.859076][T21322] ? vfs_write+0x424/0x4e0 [ 322.863471][T21322] ? __kasan_check_read+0x11/0x20 [ 322.868491][T21322] ? __ia32_sys_clock_settime+0x230/0x230 [ 322.874192][T21322] __x64_sys_sendmsg+0x7f/0x90 [ 322.878948][T21322] do_syscall_64+0xc0/0x100 [ 322.883445][T21322] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 322.889327][T21322] RIP: 0033:0x45b399 [ 322.893201][T21322] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 322.912898][T21322] RSP: 002b:00007febf8229c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 322.921288][T21322] RAX: ffffffffffffffda RBX: 00007febf822a6d4 RCX: 000000000045b399 [ 322.929246][T21322] RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000003 [ 322.937218][T21322] RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000 [ 322.945291][T21322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 09:14:14 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 322.953248][T21322] R13: 00000000000009a6 R14: 00000000004cb100 R15: 0000000000000005 [ 322.966624][T21322] socket: no more sockets [ 322.971589][T21322] tipc: Enabling of bearer rejected, failed to enable media [ 322.981949][T21328] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:14:15 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x46010000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 323.013427][T21328] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:14:15 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x9, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 323.102727][T21335] tipc: Started in network mode [ 323.107810][T21335] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 323.137421][T21339] FAULT_INJECTION: forcing a failure. [ 323.137421][T21339] name failslab, interval 1, probability 0, space 0, times 0 [ 323.167399][T21335] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 323.177278][T21339] CPU: 0 PID: 21339 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 323.187445][T21339] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 323.197499][T21339] Call Trace: [ 323.200798][T21339] dump_stack+0x1b0/0x228 [ 323.205124][T21339] ? devkmsg_release+0x127/0x127 [ 323.210064][T21339] ? __kasan_check_read+0x11/0x20 [ 323.215090][T21339] ? show_regs_print_info+0x18/0x18 [ 323.220425][T21339] should_fail+0x6fb/0x860 [ 323.224844][T21339] ? setup_fault_attr+0x2b0/0x2b0 [ 323.229868][T21339] ? current_time+0x2e0/0x2e0 [ 323.234687][T21339] __should_failslab+0x11a/0x160 [ 323.239622][T21339] ? kmalloc_array+0x32/0x60 [ 323.244215][T21339] should_failslab+0x9/0x20 [ 323.248719][T21339] __kmalloc+0x64/0x310 [ 323.252879][T21339] kmalloc_array+0x32/0x60 [ 323.257291][T21339] iter_file_splice_write+0x21d/0xf20 [ 323.262659][T21339] ? __sb_end_write+0xa8/0xf0 [ 323.267336][T21339] ? touch_atime+0x22e/0x270 [ 323.271918][T21339] ? current_time+0x2e0/0x2e0 [ 323.276713][T21339] ? fsnotify+0x1390/0x1450 [ 323.281216][T21339] ? splice_from_pipe+0x200/0x200 [ 323.286442][T21339] ? splice_shrink_spd+0xb0/0xb0 [ 323.291386][T21339] ? splice_from_pipe+0x200/0x200 [ 323.296414][T21339] direct_splice_actor+0xf7/0x130 [ 323.301797][T21339] splice_direct_to_actor+0x496/0xb00 [ 323.307184][T21339] ? do_splice_direct+0x3d0/0x3d0 [ 323.312198][T21339] ? pipe_to_sendpage+0x300/0x300 [ 323.317222][T21339] ? rw_verify_area+0x1c2/0x360 [ 323.322072][T21339] do_splice_direct+0x279/0x3d0 [ 323.326929][T21339] ? splice_direct_to_actor+0xb00/0xb00 [ 323.332471][T21339] ? security_file_permission+0x157/0x350 [ 323.338191][T21339] do_sendfile+0x89d/0x1110 [ 323.342695][T21339] ? compat_writev+0x390/0x390 [ 323.347677][T21339] ? __kasan_check_write+0x14/0x20 [ 323.352798][T21339] ? fput_many+0x47/0x1a0 [ 323.357124][T21339] __x64_sys_sendfile64+0x1ae/0x220 [ 323.362325][T21339] ? __ia32_sys_sendfile+0x240/0x240 [ 323.367613][T21339] ? syscall_return_slowpath+0x6f/0x500 [ 323.373277][T21339] do_syscall_64+0xc0/0x100 [ 323.377781][T21339] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 323.383780][T21339] RIP: 0033:0x45b399 [ 323.387672][T21339] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 323.407557][T21339] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 323.415976][T21339] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 323.424166][T21339] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 323.432255][T21339] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 323.440237][T21339] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 323.448242][T21339] R13: 00000000000008ca R14: 00000000004ca24d R15: 000000000000000b [ 323.462480][T21335] tipc: Enabled bearer , priority 10 [ 323.470542][T21337] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 323.478682][T21337] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 323.501604][T21344] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 323.594649][T21344] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:14:15 executing program 5 (fault-call:10 fault-nth:12): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:15 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:15 executing program 0: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r0, 0x0, 0x0) lseek(r0, 0xe7, 0x0) getsockopt$CAN_RAW_FD_FRAMES(r0, 0x65, 0x5, &(0x7f0000000280), &(0x7f00000002c0)=0x4) openat$selinux_access(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/access\x00', 0x2, 0x0) unshare(0x44000600) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r2, 0x0, 0x0) lseek(r2, 0xe7, 0x0) listen(r2, 0x43) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, 0x0) r3 = dup(0xffffffffffffffff) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r3, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB="84000000", @ANYRES16=r4, @ANYBLOB="395f35bd7000ffdbdf2509000000240002800800070040000000080003000100000008000800ff000000080003000200000008000600f9ffffff440002800800070000000000060002004e22000008000300010000000800040008000000080009005f0d00000800070001000080080006006b0500000800030004000000"], 0x84}}, 0x20000040) write$FUSE_GETXATTR(0xffffffffffffffff, &(0x7f00000000c0)={0x18, 0x0, 0x5, {0x8}}, 0x18) 09:14:15 executing program 2: unshare(0x44000600) r0 = syz_open_dev$usbfs(0x0, 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r2, 0x0, 0x0) lseek(r2, 0xe7, 0x0) write$P9_RWRITE(r2, &(0x7f0000000180)={0xb, 0x77, 0x1, 0x5}, 0xb) fcntl$getownex(r1, 0x10, &(0x7f0000000000)={0x0, 0x0}) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r4, 0x0, 0x0) lseek(r4, 0xe7, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x11, 0x800000003, 0x0) bind(r6, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r6, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r8 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) vmsplice(r0, &(0x7f0000000100)=[{&(0x7f0000000240)="5a42e56f0f1df233290411569706a89f0ada42351670b9d4df6b880ff30c17400903a67e9b130285ee81dc87a18e77f56d8d5ba5b235cd9abc28fa75234189b27eb90b6d34805f75fd71dcf46f3f079b4c4c1c7e0d4a4d042cb06380116b7db0f0a7b9f8a88e1867ac4d4a4db30a3921228cfdead62b89745563f80ff5508e1b74424dc5de4e782b23a255c77ca52ca48c268acb3df44017bb79f3d56c365092b28a24dc9df9c9b1380faec3", 0xac}], 0x1, 0x1) sendmsg$nl_route(r5, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r7}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0x14, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x8, 0x3, 0x8}, @IFLA_XDP_FD={0x8, 0x1, r8}]}]}, 0x3c}}, 0x0) setsockopt$inet6_IPV6_PKTINFO(r4, 0x29, 0x32, &(0x7f00000000c0)={@mcast2, r7}, 0x14) fcntl$setpipe(r1, 0x407, 0x6) ptrace$peek(0x1, r3, &(0x7f0000000080)) lseek(r1, 0xfffffffffffffc00, 0x5) 09:14:15 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x48000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:15 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xa, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 323.771616][T21332] FAT-fs (loop5): FAT read failed (blocknr 63) [ 323.787191][ T1959] attempt to access beyond end of device [ 323.802222][ T1959] loop5: rw=1, want=78, limit=63 [ 323.807215][ T1959] attempt to access beyond end of device [ 323.815163][T21352] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 323.816521][ T1959] loop5: rw=1, want=79, limit=63 [ 323.842370][ T1959] attempt to access beyond end of device [ 323.845627][T21355] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 323.848728][ T1959] loop5: rw=1, want=80, limit=63 [ 323.860499][ T1959] attempt to access beyond end of device [ 323.865025][T21355] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 323.866323][ T1959] loop5: rw=1, want=81, limit=63 [ 323.879001][ T1959] attempt to access beyond end of device [ 323.884680][ T1959] loop5: rw=1, want=130, limit=63 [ 323.891308][ T1959] attempt to access beyond end of device [ 323.897065][ T1959] loop5: rw=1, want=131, limit=63 [ 323.902302][ T1959] attempt to access beyond end of device [ 323.907979][ T1959] loop5: rw=1, want=132, limit=63 [ 323.913157][ T1959] attempt to access beyond end of device 09:14:15 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x2, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 323.919068][ T1959] loop5: rw=1, want=133, limit=63 [ 323.924233][ T1959] attempt to access beyond end of device [ 323.930133][ T1959] loop5: rw=1, want=142, limit=63 [ 323.936420][ T1959] attempt to access beyond end of device [ 323.942561][ T1959] loop5: rw=1, want=143, limit=63 [ 323.947680][ T1959] attempt to access beyond end of device [ 323.954791][T21366] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 323.959158][ T1959] loop5: rw=1, want=144, limit=63 09:14:15 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xb, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 323.963214][T21366] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 323.966787][ T1959] attempt to access beyond end of device [ 323.974393][T21365] tipc: Started in network mode [ 323.984853][T21365] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 323.989758][ T1959] loop5: rw=1, want=145, limit=63 [ 324.009765][ T1959] attempt to access beyond end of device [ 324.013015][T21365] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 324.015526][ T1959] loop5: rw=1, want=3657, limit=63 [ 324.021921][ T1959] attempt to access beyond end of device [ 324.023867][T21365] tipc: Enabled bearer , priority 10 [ 324.028803][ T1959] loop5: rw=1, want=11121, limit=63 09:14:16 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x3, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:16 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x4c000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 324.070732][ T1959] attempt to access beyond end of device [ 324.085849][ T1959] loop5: rw=1, want=35377, limit=63 [ 324.109083][T21373] tipc: Started in network mode [ 324.110564][ T1959] attempt to access beyond end of device 09:14:16 executing program 0: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r0, 0x0, 0x0) lseek(r0, 0xe7, 0x0) sendmsg$NFT_MSG_GETFLOWTABLE(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x17, 0xa, 0x3, 0x0, 0x0, {0x1db4d64d65f5003f, 0x0, 0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x2404c010) unshare(0x44000600) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, 0x0) 09:14:16 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xc, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 324.115505][T21373] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 324.128939][ T1959] loop5: rw=1, want=63513, limit=63 [ 324.139293][T21373] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 324.148087][T21373] tipc: Enabled bearer , priority 10 [ 324.154557][T21376] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 324.169053][T21376] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 324.261138][T21385] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 324.277191][T21385] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 324.593596][T16999] tipc: 32-bit node address hash set to fbff1eac [ 324.594266][T21391] FAULT_INJECTION: forcing a failure. [ 324.594266][T21391] name failslab, interval 1, probability 0, space 0, times 0 [ 324.612828][T21391] CPU: 1 PID: 21391 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 324.623136][T21391] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 324.633189][T21391] Call Trace: [ 324.636489][T21391] dump_stack+0x1b0/0x228 [ 324.640818][T21391] ? devkmsg_release+0x127/0x127 [ 324.645809][T21391] ? __kasan_check_read+0x11/0x20 [ 324.650856][T21391] ? show_regs_print_info+0x18/0x18 [ 324.656051][T21391] should_fail+0x6fb/0x860 [ 324.660478][T21391] ? setup_fault_attr+0x2b0/0x2b0 [ 324.665513][T21391] ? current_time+0x2e0/0x2e0 [ 324.670340][T21391] __should_failslab+0x11a/0x160 [ 324.675275][T21391] ? kmalloc_array+0x32/0x60 [ 324.680001][T21391] should_failslab+0x9/0x20 [ 324.684504][T21391] __kmalloc+0x64/0x310 [ 324.689011][T21391] kmalloc_array+0x32/0x60 [ 324.693426][T21391] iter_file_splice_write+0x21d/0xf20 [ 324.698922][T21391] ? __sb_end_write+0xa8/0xf0 [ 324.703725][T21391] ? touch_atime+0x22e/0x270 [ 324.708314][T21391] ? current_time+0x2e0/0x2e0 [ 324.713155][T21391] ? fsnotify+0x1390/0x1450 [ 324.717657][T21391] ? splice_from_pipe+0x200/0x200 [ 324.722683][T21391] ? splice_shrink_spd+0xb0/0xb0 [ 324.727627][T21391] ? splice_from_pipe+0x200/0x200 [ 324.732691][T21391] direct_splice_actor+0xf7/0x130 [ 324.737714][T21391] splice_direct_to_actor+0x496/0xb00 [ 324.743090][T21391] ? do_splice_direct+0x3d0/0x3d0 [ 324.748114][T21391] ? pipe_to_sendpage+0x300/0x300 [ 324.753134][T21391] ? rw_verify_area+0x1c2/0x360 [ 324.757990][T21391] do_splice_direct+0x279/0x3d0 [ 324.762847][T21391] ? splice_direct_to_actor+0xb00/0xb00 [ 324.768395][T21391] ? security_file_permission+0x157/0x350 [ 324.774129][T21391] do_sendfile+0x89d/0x1110 [ 324.778635][T21391] ? compat_writev+0x390/0x390 [ 324.783396][T21391] ? __kasan_check_write+0x14/0x20 [ 324.788651][T21391] ? fput_many+0x47/0x1a0 [ 324.792976][T21391] __x64_sys_sendfile64+0x1ae/0x220 [ 324.798169][T21391] ? __ia32_sys_sendfile+0x240/0x240 [ 324.803472][T21391] ? syscall_return_slowpath+0x6f/0x500 [ 324.809300][T21391] do_syscall_64+0xc0/0x100 [ 324.813806][T21391] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 324.819808][T21391] RIP: 0033:0x45b399 [ 324.823699][T21391] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 324.844013][T21391] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 324.852537][T21391] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 324.860510][T21391] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 324.868481][T21391] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 324.876451][T21391] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 324.884418][T21391] R13: 00000000000008ca R14: 00000000004ca24d R15: 000000000000000c [ 324.959621][ T1938] tipc: Failed to remove local publication {1,1,1}/2471734080 [ 325.029177][T20511] tipc: 32-bit node address hash set to fbff1eac 09:14:17 executing program 0: unshare(0x44000600) r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000000)) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r1, 0x300, 0x70bd27, 0x25dfdbfc, {{}, {}, {0x8, 0x2, 0xfffff800}}, ["", "", ""]}, 0x24}}, 0x8004) syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) 09:14:17 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x4, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:17 executing program 5 (fault-call:10 fault-nth:13): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:17 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xd, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:17 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x88001, 0x0) fsetxattr$trusted_overlay_upper(r1, &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f00000000c0)={0x0, 0xfb, 0xb1, 0x5, 0x9, "c44023836c0e840b2848df724e844a31", "8c2a50e8fb7a17a2b4affd6abc411d9d6b4cd5eb8ba6ddfb2e4dbd6c1165ad4691ecbfbda8cc96df32d30ea434202d7e43c041684518c0233b83ff1c4a0a867b8e84756b997c0bf56f653e379e86f860e24acde17ea4e165965ae229676bdfcce1d636ce87c4b0715ba15edb504251303169f217429d6cd8907c36fcdbd50e75226792c2162a2a90eecf7eaccff1ca1f9e1f38786dc6c85b5d049b13"}, 0xb1, 0x4) 09:14:17 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x60000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 325.168156][T21388] FAT-fs (loop5): FAT read failed (blocknr 63) [ 325.184122][ T1959] attempt to access beyond end of device [ 325.189951][ T1938] tipc: Disabling bearer [ 325.194741][ T1959] loop5: rw=1, want=78, limit=63 [ 325.195196][ T1938] tipc: Left network mode [ 325.200238][ T1959] attempt to access beyond end of device [ 325.218615][ T1959] loop5: rw=1, want=79, limit=63 [ 325.223639][ T1959] attempt to access beyond end of device [ 325.229725][ T1959] loop5: rw=1, want=80, limit=63 [ 325.234712][ T1959] attempt to access beyond end of device [ 325.240482][ T1959] loop5: rw=1, want=81, limit=63 [ 325.246804][ T1959] attempt to access beyond end of device [ 325.252755][ T1959] loop5: rw=1, want=130, limit=63 [ 325.258004][ T1959] attempt to access beyond end of device [ 325.258179][T21400] tipc: Started in network mode [ 325.263934][ T1959] loop5: rw=1, want=131, limit=63 [ 325.269696][T21400] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 325.273952][ T1959] attempt to access beyond end of device [ 325.283532][T21400] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 325.288979][ T1959] loop5: rw=1, want=132, limit=63 [ 325.300258][T21400] tipc: Enabled bearer , priority 10 [ 325.302293][ T1959] attempt to access beyond end of device 09:14:17 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x5, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 325.308779][T21396] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 325.314451][ T1959] loop5: rw=1, want=133, limit=63 [ 325.323232][T21396] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 325.326532][ T1959] attempt to access beyond end of device [ 325.339527][ T1959] loop5: rw=1, want=142, limit=63 [ 325.344596][ T1959] attempt to access beyond end of device [ 325.350481][ T1959] loop5: rw=1, want=143, limit=63 [ 325.355552][ T1959] attempt to access beyond end of device [ 325.361351][ T1959] loop5: rw=1, want=144, limit=63 09:14:17 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xe, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 325.367307][ T1959] attempt to access beyond end of device [ 325.373292][ T1959] loop5: rw=1, want=145, limit=63 [ 325.381175][ T1959] attempt to access beyond end of device [ 325.387488][ T1959] loop5: rw=1, want=3257, limit=63 [ 325.396753][ T1959] attempt to access beyond end of device [ 325.401377][ T1938] tipc: Disabling bearer [ 325.402577][ T1959] loop5: rw=1, want=8977, limit=63 [ 325.413266][ T1938] tipc: Left network mode [ 325.420371][T21413] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 325.423867][ T1959] attempt to access beyond end of device [ 325.428289][T21413] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 325.439193][ T1959] loop5: rw=1, want=29617, limit=63 [ 325.459514][ T1938] tipc: Disabling bearer [ 325.463802][ T1959] attempt to access beyond end of device [ 325.464819][ T1938] tipc: Left network mode [ 325.470637][ T1959] loop5: rw=1, want=62617, limit=63 [ 325.475398][T21410] tipc: Started in network mode [ 325.485172][T21410] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 325.485885][ T1959] attempt to access beyond end of device [ 325.496355][T21410] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 325.500139][ T1959] loop5: rw=1, want=63513, limit=63 [ 325.508560][T21410] tipc: Enabled bearer , priority 10 09:14:17 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x68000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:17 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x10, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:17 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x6, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 325.521358][T21415] net_ratelimit: 10 callbacks suppressed [ 325.521364][T21415] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 325.546746][ T1938] tipc: Left network mode [ 325.590322][T21418] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 325.600697][T21418] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 325.610256][T21421] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 325.637696][ T1938] tipc: Left network mode [ 325.657326][T21422] tipc: Started in network mode [ 325.662371][T21422] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 325.672514][T21422] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb 09:14:17 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x11, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 325.686856][T21422] tipc: Enabled bearer , priority 10 [ 325.694137][T21424] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 325.705918][T21424] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 325.713844][T21423] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 325.777958][T21429] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 325.840829][T21430] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 325.992606][T21436] FAULT_INJECTION: forcing a failure. [ 325.992606][T21436] name failslab, interval 1, probability 0, space 0, times 0 [ 326.006109][T21436] CPU: 0 PID: 21436 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 326.016257][T21436] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 326.026316][T21436] Call Trace: [ 326.029621][T21436] dump_stack+0x1b0/0x228 [ 326.034084][T21436] ? devkmsg_release+0x127/0x127 [ 326.039013][T21436] ? __kasan_check_read+0x11/0x20 [ 326.044038][T21436] ? show_regs_print_info+0x18/0x18 [ 326.049502][T21436] should_fail+0x6fb/0x860 [ 326.053915][T21436] ? setup_fault_attr+0x2b0/0x2b0 [ 326.058931][T21436] ? current_time+0x2e0/0x2e0 [ 326.063609][T21436] __should_failslab+0x11a/0x160 [ 326.068546][T21436] ? kmalloc_array+0x32/0x60 [ 326.073140][T21436] should_failslab+0x9/0x20 [ 326.077658][T21436] __kmalloc+0x64/0x310 [ 326.081928][T21436] kmalloc_array+0x32/0x60 [ 326.086343][T21436] iter_file_splice_write+0x21d/0xf20 [ 326.091712][T21436] ? __sb_end_write+0xa8/0xf0 [ 326.097005][T21436] ? touch_atime+0x22e/0x270 [ 326.101695][T21436] ? current_time+0x2e0/0x2e0 [ 326.106373][T21436] ? fsnotify+0x1390/0x1450 [ 326.110879][T21436] ? splice_from_pipe+0x200/0x200 [ 326.116330][T21436] ? splice_shrink_spd+0xb0/0xb0 [ 326.121291][T21436] ? splice_from_pipe+0x200/0x200 [ 326.126318][T21436] direct_splice_actor+0xf7/0x130 [ 326.131423][T21436] splice_direct_to_actor+0x496/0xb00 [ 326.136793][T21436] ? do_splice_direct+0x3d0/0x3d0 [ 326.141814][T21436] ? pipe_to_sendpage+0x300/0x300 [ 326.146831][T21436] ? rw_verify_area+0x1c2/0x360 [ 326.151680][T21436] do_splice_direct+0x279/0x3d0 [ 326.156880][T21436] ? splice_direct_to_actor+0xb00/0xb00 [ 326.164253][T21436] ? security_file_permission+0x157/0x350 [ 326.169978][T21436] do_sendfile+0x89d/0x1110 [ 326.174483][T21436] ? compat_writev+0x390/0x390 [ 326.179249][T21436] ? __kasan_check_write+0x14/0x20 [ 326.184362][T21436] ? fput_many+0x47/0x1a0 [ 326.188696][T21436] __x64_sys_sendfile64+0x1ae/0x220 [ 326.193904][T21436] ? __ia32_sys_sendfile+0x240/0x240 [ 326.199193][T21436] ? syscall_return_slowpath+0x6f/0x500 [ 326.204757][T21436] do_syscall_64+0xc0/0x100 [ 326.209356][T21436] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 326.215249][T21436] RIP: 0033:0x45b399 [ 326.219320][T21436] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 326.239176][T21436] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 326.247592][T21436] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 326.255572][T21436] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 326.263749][T21436] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 326.271720][T21436] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 326.279794][T21436] R13: 00000000000008ca R14: 00000000004ca24d R15: 000000000000000d [ 326.419235][T16999] tipc: 32-bit node address hash set to fbff1eac 09:14:18 executing program 5 (fault-call:10 fault-nth:14): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:18 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0x908, 0x3a242) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x1, 0x0) setsockopt$CAN_RAW_ERR_FILTER(r1, 0x65, 0x2, &(0x7f0000000040)=0x5, 0x4) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) 09:14:18 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x2, 0x9cc42) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) 09:14:18 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x7, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:18 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x6c000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:18 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x12, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 326.559287][T16999] tipc: 32-bit node address hash set to fbff1eac [ 326.569654][T21433] FAT-fs (loop5): FAT read failed (blocknr 63) [ 326.587926][ T1959] attempt to access beyond end of device [ 326.599202][ T1959] loop5: rw=1, want=78, limit=63 [ 326.604187][ T1959] buffer_io_error: 25 callbacks suppressed [ 326.604194][ T1959] Buffer I/O error on dev loop5, logical block 77, lost async page write [ 326.605922][T21444] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 326.619159][ T1959] attempt to access beyond end of device [ 326.642781][ T1959] loop5: rw=1, want=79, limit=63 [ 326.648651][ T1959] Buffer I/O error on dev loop5, logical block 78, lost async page write [ 326.658816][T21448] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 326.666124][ T1959] attempt to access beyond end of device [ 326.667008][T21448] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 326.674781][ T1959] loop5: rw=1, want=80, limit=63 [ 326.683025][T21445] tipc: Started in network mode [ 326.684359][ T1959] Buffer I/O error on dev loop5, logical block 79, lost async page write [ 326.688927][T21445] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 326.689003][T21445] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 326.697902][ T1959] attempt to access beyond end of device [ 326.709606][T21445] tipc: Enabled bearer , priority 10 [ 326.715478][T16999] tipc: 32-bit node address hash set to fbff1eac [ 326.733952][ T1959] loop5: rw=1, want=81, limit=63 [ 326.738904][ T1959] Buffer I/O error on dev loop5, logical block 80, lost async page write 09:14:18 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x8, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:18 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000180)=@urb_type_interrupt={0x1, {0xb, 0x1}, 0x6, 0x2, &(0x7f0000000000)="2667e68ccf0956dd9984cc21f8675cdbc19fc95fc6cce843e4e5533dad6ffb6278f384744ecdfac8c16883ea57be33858c4c848c9a251fbcd3b32fef9b86b2cda0a7d9e2bc3e68936960a31150af1c633699ae7f435180edffc55b08e9edd454450d9a66ab244e403157b2b994fe94289f92f8127ec2077ca6dd19d6de31a206188c92d990004c24c35c974c0b662e87f5a3d1a53084a203671bdbf0c8cc0fcd87cfa4610e276722a717f8dcc0c2a1e507b538d66ae7598813c68eb3d68ee89814331e0e7b159b0bc783a867dd93793965153bab11ccd847c3fbe1788565bb7254aff0bd8a7bb59635e242dae71acc8ff70979d1d43bd7", 0xf7, 0x2, 0x4, 0x0, 0x7f, 0x3f, &(0x7f0000000100)="ba5996a2f76fd340fbb987a37d4b7f659f199111be5cd244a07f9714d3b15780708d14eeac86fc5e3b82d50bcfc1875b6e48d3f1ab5cf0e0b1655bf844665aff4c9293acb3cff409652ae2e8268e82db6c8e80"}) 09:14:18 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x25, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 326.747439][T21451] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 326.763040][ T1959] attempt to access beyond end of device [ 326.768767][ T1959] loop5: rw=1, want=130, limit=63 [ 326.779169][ T1959] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 326.787723][ T1959] attempt to access beyond end of device [ 326.795091][ T1959] loop5: rw=1, want=131, limit=63 [ 326.800367][ T1959] Buffer I/O error on dev loop5, logical block 130, lost async page write 09:14:18 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0xa0000) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x7fc, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x2, 0x200000040259) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) r2 = openat$bsg(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/bsg\x00', 0xc0000, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(r2, 0x8905, &(0x7f0000000200)) ptrace$cont(0x20, r1, 0x0, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) write$FUSE_LK(0xffffffffffffffff, &(0x7f0000000180)={0x28, 0x0, 0x5, {{0x6, 0x6, 0x2}}}, 0x28) ioctl$USBDEVFS_SUBMITURB(r3, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$getownex(r3, 0x10, &(0x7f0000000000)={0x0, 0x0}) setpgid(r1, r4) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$FS_IOC_GETFSLABEL(r5, 0x81009431, &(0x7f0000000080)) lseek(r0, 0x0, 0x0) [ 326.808906][ T1959] attempt to access beyond end of device [ 326.814897][ T1959] loop5: rw=1, want=132, limit=63 [ 326.820159][ T1959] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 326.828815][ T1959] attempt to access beyond end of device [ 326.831727][T21461] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 326.834852][ T1959] loop5: rw=1, want=133, limit=63 [ 326.855067][ T1959] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 326.863930][ T1959] attempt to access beyond end of device [ 326.869765][ T1959] loop5: rw=1, want=142, limit=63 [ 326.874787][ T1959] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 326.882193][T21459] tipc: Started in network mode [ 326.883620][ T1959] attempt to access beyond end of device [ 326.888218][T21459] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 326.894113][ T1959] loop5: rw=1, want=143, limit=63 09:14:18 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x74000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 326.908666][ T1959] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 326.917422][ T1959] attempt to access beyond end of device [ 326.923344][ T1959] loop5: rw=1, want=144, limit=63 [ 326.928395][ T1959] attempt to access beyond end of device [ 326.934366][ T1959] loop5: rw=1, want=145, limit=63 [ 326.942014][ T1959] attempt to access beyond end of device [ 326.947760][ T1959] loop5: rw=1, want=4401, limit=63 [ 326.957689][T21459] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 326.957961][ T1959] attempt to access beyond end of device [ 326.972845][ T1959] loop5: rw=1, want=9057, limit=63 [ 326.984733][ T1959] attempt to access beyond end of device [ 326.990473][ T1959] loop5: rw=1, want=19841, limit=63 [ 326.999602][T21459] tipc: Enabled bearer , priority 10 09:14:19 executing program 2: unshare(0x44000600) r0 = syz_open_dev$usbfs(0x0, 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r1, 0x0, 0x0) fstat(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) newfstatat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}, 0xd100) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000200)={{{@in6=@empty, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@dev}}, &(0x7f0000000300)=0xe8) r5 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r6, 0x0) r7 = getgid() r8 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r9, 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000340)={{}, {}, [{0x2, 0x6, r2}, {0x2, 0x1, r3}, {0x2, 0x2, r4}, {0x2, 0x5, r6}], {0x4, 0x5}, [{0x8, 0x4, r7}, {0x8, 0x2, r9}], {0x10, 0x4}}, 0x54, 0x98b8876af6854822) [ 327.020907][ T1959] attempt to access beyond end of device [ 327.026577][ T1959] loop5: rw=1, want=46529, limit=63 [ 327.051055][ T1959] attempt to access beyond end of device [ 327.056765][ T1959] loop5: rw=1, want=63513, limit=63 [ 327.065862][T21469] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 327.083991][T21469] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 327.093049][T21470] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 327.171158][T21475] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 327.179191][T21475] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 327.412987][T21481] FAULT_INJECTION: forcing a failure. [ 327.412987][T21481] name failslab, interval 1, probability 0, space 0, times 0 [ 327.425950][T21481] CPU: 0 PID: 21481 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 327.436245][T21481] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 327.446306][T21481] Call Trace: [ 327.449608][T21481] dump_stack+0x1b0/0x228 [ 327.453945][T21481] ? devkmsg_release+0x127/0x127 [ 327.458890][T21481] ? __kasan_check_read+0x11/0x20 [ 327.464059][T21481] ? show_regs_print_info+0x18/0x18 [ 327.469256][T21481] should_fail+0x6fb/0x860 [ 327.473678][T21481] ? setup_fault_attr+0x2b0/0x2b0 [ 327.478786][T21481] ? current_time+0x2e0/0x2e0 [ 327.483463][T21481] __should_failslab+0x11a/0x160 [ 327.488414][T21481] ? kmalloc_array+0x32/0x60 [ 327.493018][T21481] should_failslab+0x9/0x20 [ 327.497659][T21481] __kmalloc+0x64/0x310 [ 327.501822][T21481] kmalloc_array+0x32/0x60 [ 327.506238][T21481] iter_file_splice_write+0x21d/0xf20 [ 327.511611][T21481] ? __sb_end_write+0xa8/0xf0 [ 327.516301][T21481] ? touch_atime+0x22e/0x270 [ 327.520885][T21481] ? current_time+0x2e0/0x2e0 [ 327.525560][T21481] ? fsnotify+0x1390/0x1450 [ 327.530075][T21481] ? splice_from_pipe+0x200/0x200 [ 327.535096][T21481] ? splice_shrink_spd+0xb0/0xb0 [ 327.540055][T21481] ? splice_from_pipe+0x200/0x200 [ 327.545083][T21481] direct_splice_actor+0xf7/0x130 [ 327.550107][T21481] splice_direct_to_actor+0x496/0xb00 [ 327.555481][T21481] ? do_splice_direct+0x3d0/0x3d0 [ 327.560630][T21481] ? pipe_to_sendpage+0x300/0x300 [ 327.565653][T21481] ? rw_verify_area+0x1c2/0x360 [ 327.570507][T21481] do_splice_direct+0x279/0x3d0 [ 327.575406][T21481] ? splice_direct_to_actor+0xb00/0xb00 [ 327.581078][T21481] ? security_file_permission+0x157/0x350 [ 327.586801][T21481] do_sendfile+0x89d/0x1110 [ 327.591301][T21481] ? compat_writev+0x390/0x390 [ 327.596143][T21481] ? __kasan_check_write+0x14/0x20 [ 327.601258][T21481] ? fput_many+0x47/0x1a0 [ 327.605599][T21481] __x64_sys_sendfile64+0x1ae/0x220 [ 327.610802][T21481] ? __ia32_sys_sendfile+0x240/0x240 [ 327.616081][T21481] ? syscall_return_slowpath+0x6f/0x500 [ 327.621626][T21481] do_syscall_64+0xc0/0x100 [ 327.626142][T21481] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 327.632033][T21481] RIP: 0033:0x45b399 [ 327.635926][T21481] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 327.655533][T21481] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 327.663950][T21481] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 327.671926][T21481] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 327.679987][T21481] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 327.687990][T21481] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 327.696059][T21481] R13: 00000000000008ca R14: 00000000004ca24d R15: 000000000000000e [ 327.729157][ T1938] tipc: Disabling bearer [ 327.734566][ T1938] tipc: Left network mode [ 327.807117][T20516] tipc: 32-bit node address hash set to fbff1eac 09:14:19 executing program 5 (fault-call:10 fault-nth:15): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:19 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x48, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:19 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r1, 0x0, 0x0) lseek(r1, 0xe7, 0x0) write$uinput_user_dev(r1, &(0x7f0000000080)={'syz1\x00', {0x5, 0x5, 0x8001, 0x6}, 0x26, [0x81, 0x0, 0xdf9, 0xfff, 0x5, 0x2, 0x1, 0x80, 0x20, 0x8, 0x8, 0x2, 0x140000, 0x800, 0x101, 0x4, 0xfffff775, 0x0, 0xa8, 0x1f, 0x3, 0x8, 0x1ff, 0x6f26, 0xa3, 0x5, 0x0, 0x200, 0x401, 0xb, 0x0, 0x4a, 0xfffffffe, 0xfffff801, 0x0, 0x1, 0x1, 0xcc6f, 0x0, 0x1, 0x3, 0x9, 0x7, 0x8, 0x3, 0x800, 0x1885f447, 0x4, 0x4, 0xb0f, 0x8, 0x0, 0x2, 0xffffffe0, 0x401, 0x5, 0x800, 0x1ff, 0x1, 0x7, 0xfffffffc, 0x7, 0x8b, 0xffffffff], [0x3, 0xffff, 0x7ff, 0x0, 0x9, 0x5, 0x3, 0x8, 0x0, 0x4, 0x1, 0xffff8000, 0xb5a, 0x5, 0x5, 0x2, 0x5, 0x3ff, 0x9, 0x5e404904, 0x5, 0x2, 0x6, 0x6, 0x0, 0x800, 0x671, 0x8, 0x8, 0x5, 0xdb, 0x1, 0x0, 0x3, 0x7, 0x9, 0x0, 0x0, 0x0, 0xbae, 0x1, 0x4, 0x1, 0x80000000, 0x0, 0x7ff, 0x0, 0x9, 0x1, 0x0, 0x8, 0x80000000, 0xe4, 0x100, 0x401, 0x2, 0xfffffffc, 0x5, 0x9, 0xffff8001, 0x6, 0xfffffc00, 0x5, 0x7fffffff], [0x5, 0x8, 0x6, 0x3, 0xffff, 0x7f, 0x2, 0x40, 0xfff, 0xffffffff, 0x3ff, 0x7575, 0x1, 0xfffffffd, 0x7ff, 0x8, 0xfffffffc, 0x8, 0xff, 0x2, 0x72d3, 0x3, 0x1f, 0x80000001, 0x9, 0x80000001, 0x6be, 0x80000000, 0x400, 0x3, 0x2, 0xfa85e8a4, 0x8, 0x7, 0x1, 0xfff, 0x4, 0x0, 0x9, 0xa8, 0x2, 0x1, 0x401, 0x6, 0x0, 0x2, 0xffffffff, 0x5, 0x5, 0x9, 0x3ff, 0x0, 0x5, 0x0, 0x41ea, 0x8001, 0x3, 0x2a6, 0x2397, 0x3, 0xd88, 0x5, 0x7, 0x4], [0x5, 0xa83e, 0x800, 0x20, 0x0, 0xe1, 0x0, 0x3800, 0x100, 0x2e3, 0xc, 0x2, 0x721a, 0x4, 0x7f, 0x8, 0x10001, 0x81, 0x9, 0x5, 0x1ff, 0xffff, 0x7f, 0x8, 0x4, 0x2, 0x101, 0x7, 0x8, 0xffffffc1, 0x2, 0x0, 0x8, 0x8, 0x7, 0x7fffffff, 0x4, 0xfffeffff, 0x1, 0x0, 0x10000, 0x53, 0x6, 0x0, 0x4, 0x3, 0x0, 0x7, 0x0, 0x8, 0xffff, 0x3, 0x46, 0x22efa603, 0x6c0, 0x1, 0x690, 0x80000001, 0x7fff, 0x80000001, 0xf7, 0x20, 0x5, 0x6]}, 0x45c) bind(r1, &(0x7f0000000500)=@alg={0x26, 'aead\x00', 0x0, 0x0, 'aegis128l\x00'}, 0x80) 09:14:19 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x9, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:19 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x7a000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:19 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x2, 0x14803) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) [ 328.012890][T21478] FAT-fs (loop5): FAT read failed (blocknr 63) [ 328.035534][ T1959] attempt to access beyond end of device [ 328.044027][ T1959] loop5: rw=1, want=78, limit=63 [ 328.052850][ T1959] attempt to access beyond end of device [ 328.058520][ T1959] loop5: rw=1, want=79, limit=63 [ 328.067858][ T1959] attempt to access beyond end of device [ 328.073666][ T1959] loop5: rw=1, want=80, limit=63 [ 328.078624][ T1959] attempt to access beyond end of device [ 328.087188][T21492] tipc: Enabling of bearer rejected, failed to enable media [ 328.095540][ T1959] loop5: rw=1, want=81, limit=63 [ 328.100871][T21488] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 328.102916][ T1959] attempt to access beyond end of device [ 328.111492][T21488] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 328.119225][ T1959] loop5: rw=1, want=130, limit=63 [ 328.128587][ T1959] attempt to access beyond end of device [ 328.134322][ T1959] loop5: rw=1, want=131, limit=63 [ 328.136062][T21490] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 328.141025][ T1959] attempt to access beyond end of device 09:14:20 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r1, 0x0, 0x0) write$P9_RGETLOCK(r0, &(0x7f0000000140)={0x36, 0x37, 0x1, {0x0, 0xf, 0x400, r1, 0x18, '/proc/bus/input/devices\x00'}}, 0x36) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r2, 0x0, 0x0) fgetxattr(r2, &(0x7f0000000000)=@random={'btrfs.', '*\x00'}, &(0x7f0000000080)=""/100, 0x64) [ 328.160742][ T1959] loop5: rw=1, want=132, limit=63 [ 328.165790][ T1959] attempt to access beyond end of device [ 328.171597][ T1959] loop5: rw=1, want=133, limit=63 [ 328.176761][ T1959] attempt to access beyond end of device [ 328.184986][ T1938] tipc: Disabling bearer [ 328.190514][ T1938] tipc: Left network mode [ 328.195279][ T1959] loop5: rw=1, want=142, limit=63 [ 328.201273][ T1938] tipc: Disabling bearer [ 328.206557][ T1959] attempt to access beyond end of device 09:14:20 executing program 2: unshare(0x44000600) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x180) syz_open_dev$usbfs(0x0, 0x1000000000000, 0x100) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) 09:14:20 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0xa, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 328.207214][ T1938] tipc: Left network mode [ 328.212211][ T1959] loop5: rw=1, want=143, limit=63 [ 328.212236][ T1959] attempt to access beyond end of device [ 328.212242][ T1959] loop5: rw=1, want=144, limit=63 [ 328.212255][ T1959] attempt to access beyond end of device [ 328.212260][ T1959] loop5: rw=1, want=145, limit=63 [ 328.214313][ T1959] attempt to access beyond end of device [ 328.248775][T21501] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 328.256820][T21501] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 328.263457][ T1959] loop5: rw=1, want=4297, limit=63 09:14:20 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x4c, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 328.286594][ T1959] attempt to access beyond end of device [ 328.292547][ T1959] loop5: rw=1, want=8409, limit=63 [ 328.295087][T21505] tipc: Started in network mode [ 328.304330][ T1959] attempt to access beyond end of device [ 328.304858][T21505] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 328.319190][ T1959] loop5: rw=1, want=17161, limit=63 [ 328.319510][T21505] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb 09:14:20 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x81000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 328.338658][ T1959] attempt to access beyond end of device [ 328.344685][ T1959] loop5: rw=1, want=41025, limit=63 [ 328.348633][T21505] tipc: Enabled bearer , priority 10 [ 328.356602][T21512] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 328.366198][ T1959] attempt to access beyond end of device [ 328.370354][T21512] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 328.371918][ T1959] loop5: rw=1, want=63513, limit=63 09:14:20 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x60, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 328.384701][ T1938] tipc: Disabling bearer [ 328.390299][ T1938] tipc: Left network mode [ 328.401853][ T1938] tipc: Disabling bearer [ 328.407776][ T1938] tipc: Left network mode [ 328.421671][T21505] tipc: Enabling of bearer rejected, already enabled [ 328.437648][T21517] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 328.448600][T21517] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 328.730140][T21526] FAULT_INJECTION: forcing a failure. [ 328.730140][T21526] name failslab, interval 1, probability 0, space 0, times 0 [ 328.742985][T21526] CPU: 0 PID: 21526 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 328.753141][T21526] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 328.763226][T21526] Call Trace: [ 328.766520][T21526] dump_stack+0x1b0/0x228 [ 328.770980][T21526] ? devkmsg_release+0x127/0x127 [ 328.775937][T21526] ? __kasan_check_read+0x11/0x20 [ 328.780964][T21526] ? show_regs_print_info+0x18/0x18 [ 328.786165][T21526] should_fail+0x6fb/0x860 [ 328.790601][T21526] ? setup_fault_attr+0x2b0/0x2b0 [ 328.795623][T21526] ? current_time+0x2e0/0x2e0 [ 328.800301][T21526] __should_failslab+0x11a/0x160 [ 328.805230][T21526] ? kmalloc_array+0x32/0x60 [ 328.810074][T21526] should_failslab+0x9/0x20 [ 328.814744][T21526] __kmalloc+0x64/0x310 [ 328.818903][T21526] kmalloc_array+0x32/0x60 [ 328.823315][T21526] iter_file_splice_write+0x21d/0xf20 [ 328.828693][T21526] ? __sb_end_write+0xa8/0xf0 [ 328.833367][T21526] ? touch_atime+0x22e/0x270 [ 328.837953][T21526] ? current_time+0x2e0/0x2e0 [ 328.842632][T21526] ? fsnotify+0x1390/0x1450 [ 328.847142][T21526] ? splice_from_pipe+0x200/0x200 [ 328.852209][T21526] ? splice_shrink_spd+0xb0/0xb0 [ 328.857147][T21526] ? splice_from_pipe+0x200/0x200 [ 328.862165][T21526] direct_splice_actor+0xf7/0x130 [ 328.867215][T21526] splice_direct_to_actor+0x496/0xb00 [ 328.872591][T21526] ? do_splice_direct+0x3d0/0x3d0 [ 328.877736][T21526] ? pipe_to_sendpage+0x300/0x300 [ 328.882767][T21526] ? rw_verify_area+0x1c2/0x360 [ 328.887872][T21526] do_splice_direct+0x279/0x3d0 [ 328.892717][T21526] ? splice_direct_to_actor+0xb00/0xb00 [ 328.898267][T21526] ? security_file_permission+0x157/0x350 [ 328.904698][T21526] do_sendfile+0x89d/0x1110 [ 328.909551][T21526] ? compat_writev+0x390/0x390 [ 328.914309][T21526] ? __kasan_check_write+0x14/0x20 [ 328.919421][T21526] ? fput_many+0x47/0x1a0 [ 328.923755][T21526] __x64_sys_sendfile64+0x1ae/0x220 [ 328.928953][T21526] ? __ia32_sys_sendfile+0x240/0x240 [ 328.934363][T21526] ? syscall_return_slowpath+0x6f/0x500 [ 328.939900][T21526] do_syscall_64+0xc0/0x100 [ 328.944569][T21526] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 328.950563][T21526] RIP: 0033:0x45b399 [ 328.954460][T21526] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 328.974151][T21526] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 328.982563][T21526] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 328.990639][T21526] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 328.998803][T21526] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 329.006775][T21526] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 329.014746][T21526] R13: 00000000000008ca R14: 00000000004ca24d R15: 000000000000000f 09:14:21 executing program 5 (fault-call:10 fault-nth:16): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:21 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0xb, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:21 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x81ffffff, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:21 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x68, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:21 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x90c, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) 09:14:21 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x80000001, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r1, 0x0, 0x0) lseek(r1, 0xe7, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0x14, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x8, 0x3, 0x8}, @IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x3c}}, 0x0) sendmsg$inet(r1, &(0x7f0000000480)={&(0x7f00000000c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x3a}}, 0x10, &(0x7f00000002c0)=[{&(0x7f0000000100)="583251ee108b8e7f26c41a01a55063d5d4c4ed4af74051e977f82c0eb5ab68b3aa176d2dee55297a6607a8532dfb25263857c6e1215884e44ae189273377b2941c387f15f79b5f9ccdf7e2083f8f6338a9930ee045ecfa0840e607765cff9514c4643afdb8", 0x65}, {&(0x7f0000000180)="c4df2bcd2a95dc927a5bd8bc98b07f432b8060c63c5114b5e4210687933f9ea075569f0fa341f241e6453134a83d4826f308b5821e4fe7056b6cb5ae7b83ad151f9c2c40116477619f5ec3c6bfa6698b28560680f55364f1cc1ca9944ac8ccc053c5e4ea418348ab2f8abf75b28d71dbde686c9cbadbf332958f97400048448a5b1ac6ca13dbd34aea7f0e1b10de7b6055deafb9161ba4b125e2f3cbbd823cd74fb467d771358edf44ee4edfdc795fed652d0053250dc888bef9a152dda827973ec6894b28e4b63bb71fa8ef816014a685fa", 0xd2}, {&(0x7f0000000280)="031401a29db207e899bdc7405af3cace215960016c6b6fddbb3b710ff5eb936bc62789acbace4331f521785f0fb9f1", 0x2f}], 0x3, &(0x7f0000000300)=[@ip_retopts={{0x30, 0x0, 0x7, {[@ssrr={0x89, 0x17, 0x7e, [@empty, @loopback, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, @local]}, @ssrr={0x89, 0x7, 0x3, [@local]}]}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x40}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x9}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2}}}, @ip_tos_int={{0x14}}, @ip_retopts={{0xac, 0x0, 0x7, {[@generic={0x0, 0x5, "90a031"}, @cipso={0x86, 0x37, 0x0, [{0x6, 0x2}, {0x2, 0x9, "2b04eeadeae012"}, {0x5, 0x9, "3b4904d060d70c"}, {0x7, 0xa, "18fce16f7323ef62"}, {0x7, 0x2}, {0x0, 0x11, "9ea170a0a5f07d7c55e2c4c5f7f073"}]}, @timestamp_prespec={0x44, 0x14, 0x5f, 0x3, 0x1, [{@broadcast, 0x7fffffff}, {@rand_addr=0x5, 0xd1}]}, @generic={0x0, 0x12, "e9570725fc6020eeae8560e094f809d9"}, @timestamp_addr={0x44, 0x2c, 0x37, 0x1, 0x5, [{@multicast1, 0x3}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x6}, {@remote, 0x3}, {@local, 0x7}, {@rand_addr=0x8, 0x40}]}, @ssrr={0x89, 0xb, 0x2e, [@remote, @dev={0xac, 0x14, 0x14, 0x32}]}]}}}], 0x148}, 0x4000010) r6 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) write$FUSE_NOTIFY_POLL(r6, &(0x7f0000000080)={0x18, 0x1, 0x0, {0x5}}, 0x18) lseek(r0, 0x0, 0x0) [ 329.327872][T21523] FAT-fs (loop5): FAT read failed (blocknr 63) [ 329.341970][ T1959] attempt to access beyond end of device [ 329.348069][ T1959] loop5: rw=1, want=78, limit=63 [ 329.356805][ T1959] attempt to access beyond end of device [ 329.365385][ T1959] loop5: rw=1, want=79, limit=63 [ 329.373983][ T1959] attempt to access beyond end of device [ 329.381051][ T1959] loop5: rw=1, want=80, limit=63 [ 329.386022][ T1959] attempt to access beyond end of device [ 329.392029][ T1959] loop5: rw=1, want=81, limit=63 [ 329.397180][ T1959] attempt to access beyond end of device [ 329.403324][ T1959] loop5: rw=1, want=130, limit=63 [ 329.408615][T21528] tipc: Started in network mode [ 329.408789][ T1959] attempt to access beyond end of device [ 329.416194][T21528] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 329.420033][ T1959] loop5: rw=1, want=131, limit=63 [ 329.429094][T21528] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 329.434352][ T1959] attempt to access beyond end of device [ 329.442214][T16999] tipc: 32-bit node address hash set to fbff1eac [ 329.448125][ T1959] loop5: rw=1, want=132, limit=63 [ 329.454421][T21528] tipc: Enabled bearer , priority 10 [ 329.459760][ T1959] attempt to access beyond end of device [ 329.471187][ T1959] loop5: rw=1, want=133, limit=63 [ 329.476218][ T1959] attempt to access beyond end of device [ 329.482052][ T1959] loop5: rw=1, want=142, limit=63 [ 329.483688][T21535] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 329.487363][ T1959] attempt to access beyond end of device [ 329.500163][ T1959] loop5: rw=1, want=143, limit=63 [ 329.503092][T21535] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 329.505202][ T1959] attempt to access beyond end of device [ 329.505215][ T1959] loop5: rw=1, want=144, limit=63 [ 329.523338][ T1959] attempt to access beyond end of device 09:14:21 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x6c, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 329.528964][ T1959] loop5: rw=1, want=145, limit=63 [ 329.536369][ T1959] attempt to access beyond end of device [ 329.542068][ T1959] loop5: rw=1, want=4425, limit=63 [ 329.551763][ T1959] attempt to access beyond end of device [ 329.557440][ T1959] loop5: rw=1, want=9697, limit=63 [ 329.572870][ T1959] attempt to access beyond end of device 09:14:21 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0xc, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 329.578530][ T1959] loop5: rw=1, want=21057, limit=63 [ 329.594794][T21546] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 329.599517][ T1959] attempt to access beyond end of device [ 329.607415][ T1959] loop5: rw=1, want=47585, limit=63 [ 329.614597][T21546] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:14:21 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0xa0343) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) [ 329.625110][ T1959] attempt to access beyond end of device [ 329.630814][ T1959] loop5: rw=1, want=63513, limit=63 09:14:21 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0xd, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 329.673718][T21552] tipc: Enabling of bearer rejected, failed to enable media 09:14:21 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x74, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:21 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x92010000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 329.796467][T21556] tipc: Started in network mode [ 329.830631][T21556] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 329.846952][T21556] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 329.855151][T21556] tipc: Enabled bearer , priority 10 [ 329.861478][T21561] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 329.872182][T21561] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 329.966725][T21563] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 329.977644][T21563] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 330.049414][ T1938] tipc: Disabling bearer [ 330.054704][ T1938] tipc: Left network mode [ 330.137292][T21569] FAULT_INJECTION: forcing a failure. [ 330.137292][T21569] name failslab, interval 1, probability 0, space 0, times 0 [ 330.150124][T21569] CPU: 0 PID: 21569 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 330.160270][T21569] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 330.170322][T21569] Call Trace: [ 330.173618][T21569] dump_stack+0x1b0/0x228 [ 330.177951][T21569] ? devkmsg_release+0x127/0x127 [ 330.182890][T21569] ? __kasan_check_read+0x11/0x20 [ 330.187911][T21569] ? show_regs_print_info+0x18/0x18 [ 330.193110][T21569] should_fail+0x6fb/0x860 [ 330.197528][T21569] ? setup_fault_attr+0x2b0/0x2b0 [ 330.202572][T21569] ? current_time+0x2e0/0x2e0 [ 330.207239][T21569] __should_failslab+0x11a/0x160 [ 330.212172][T21569] ? kmalloc_array+0x32/0x60 [ 330.216791][T21569] should_failslab+0x9/0x20 [ 330.221296][T21569] __kmalloc+0x64/0x310 [ 330.225447][T21569] kmalloc_array+0x32/0x60 [ 330.229852][T21569] iter_file_splice_write+0x21d/0xf20 [ 330.235356][T21569] ? __sb_end_write+0xa8/0xf0 [ 330.240041][T21569] ? touch_atime+0x22e/0x270 [ 330.244623][T21569] ? current_time+0x2e0/0x2e0 [ 330.249327][T21569] ? fsnotify+0x1390/0x1450 [ 330.253822][T21569] ? splice_from_pipe+0x200/0x200 [ 330.258965][T21569] ? splice_shrink_spd+0xb0/0xb0 [ 330.263894][T21569] ? splice_from_pipe+0x200/0x200 [ 330.269013][T21569] direct_splice_actor+0xf7/0x130 [ 330.274033][T21569] splice_direct_to_actor+0x496/0xb00 [ 330.279411][T21569] ? do_splice_direct+0x3d0/0x3d0 [ 330.284429][T21569] ? pipe_to_sendpage+0x300/0x300 [ 330.289457][T21569] ? rw_verify_area+0x1c2/0x360 [ 330.294337][T21569] do_splice_direct+0x279/0x3d0 [ 330.299183][T21569] ? splice_direct_to_actor+0xb00/0xb00 [ 330.304725][T21569] ? security_file_permission+0x157/0x350 [ 330.310927][T21569] do_sendfile+0x89d/0x1110 [ 330.315440][T21569] ? compat_writev+0x390/0x390 [ 330.320197][T21569] ? __kasan_check_write+0x14/0x20 [ 330.325306][T21569] ? fput_many+0x47/0x1a0 [ 330.329637][T21569] __x64_sys_sendfile64+0x1ae/0x220 [ 330.334832][T21569] ? __ia32_sys_sendfile+0x240/0x240 [ 330.340118][T21569] ? syscall_return_slowpath+0x6f/0x500 [ 330.346200][T21569] do_syscall_64+0xc0/0x100 [ 330.350709][T21569] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 330.356598][T21569] RIP: 0033:0x45b399 [ 330.360491][T21569] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 330.380093][T21569] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 330.388631][T21569] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 330.396605][T21569] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 330.404574][T21569] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 330.415112][T21569] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 330.423089][T21569] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000010 [ 330.569183][T21207] tipc: 32-bit node address hash set to fbff1eac 09:14:22 executing program 5 (fault-call:10 fault-nth:17): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:22 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x400, 0x0) sendmsg$NL80211_CMD_STOP_AP(r1, &(0x7f00000007c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="d4060000", @ANYRES16=0x0, @ANYBLOB="00022abd7000fbdbdf2510000000040005011e00340041295645debe3b7f1ce42a485af2bcf0e10ff5fb178d865b07140000f0055a803801030005000400010000003d0002004d44346df5b629561e9f5dd66b0302bfecbc14f8f6baff683a7ca684022dfbe729a1fe99172cd758d54437b19dca0f1b1772921d6e16c4242600000014000300050000f8ff0004000100feff080000023d0002005d0b1ac68a55a1e2ff810e80e388c8f8c5157bd8eb1007fae10f314b7d4624b8d4e0e4a39eff6cd6c59fcc090b21cd5bbcd1f6ce0f5f0a792b000000140003000800fb0a570005000700a1070008ff0013000100c78a214ef6380e3823cdad629d8e440019000200a3b1db03ccc55cc5ef6da128abb4c19a2600026b100000003200020068f5ab11016ff08e6b5a4b6fa3444ac5bbce35995eb22d53182b3a3000b7c431c96c7ce6b3e3bccf614e160bed740000130001006c89976512918e6175cf19c51ba77a000b0002000bc3d4046ea32b00b80003001400030020000002ff010300000003000001000005000400010000003c00020042531fbdce93ae9b985a9269378cd80a05aada2b74b0f2ae645d74e84d0f1b4c0736223b5cb24a3398bb1f279232840f0ced031f07c38fe41400030000080100010000048885520098009800050004000100000030000200805431dfa9d02ebc68bbb9ab32c64abecb2b105eefa390ec8f97481f5b4912b6eeba4d8cdcaffa4956bc562b0d000100293f6049cf8b0e4e5200000068000000220002002d73c8550ec694f02bb724f14383fd32c4e570a84fccdc1f4a34f0dd356e0000050004000200000010000100c0756e5a0246667bca407f5f0c0001001d16822685151ead1200020081690c59e725acb9dda61a4d784d00000500040002000000840001002f000200c324ab104813930b37992c651f3e3881662b7b63c4a665aea195cd97d205db8788b9037834d2da8a414d5400140003000800000105001e00a804fcff060005003c00020059e83b9daef9506c0dc2641e9612703d4f2c268c6ca83984a1876bf03db7b2c60fb3824599c52a037d2aaeab2942cb59338f32a0af3de2c3480000002300010099598b4fbe605082a371d7155eff16706013fda68bc60da4c0f13d1726d237001f0001008fbc267d58db81eb91a8db4be4069b0688e995488ccf5f072146fb00f40000001f000100102e2adb1a56ee346d23e5d550e3fd3dab7c19e3309aa4ba4b1aeb003d000200cc543bb987b15ca2a172d8c21c37cea1599a6287732eda23dd10ebf1c2a91a37549bd2c73b11161957592431e1de3d7987bbab9ff44781f0c900000041000200367a3b307c6f358278879f56a4bac66592b1783c9940607c7e0d1444fc7c00a49e79ba7432aee81002dee19d67ab997ae21c642ebeb1138db8338a7b47000000050004000000000014000300e8030600ffff09002000c07f0000ff0f14000300ff01040001ff07000600f40073047f00050004000100000014000300200009003f000800090005000100700030000200050004000000000021000100015c0154b06e565f8e67c36442b0b7f66ac94139d09e3236720b9715f4000000700002000500040002000000050004000000000014000300040002000900010103000000010004000a00020041e92c0ecf0500003b0002001fce7c74dad43c0c62182b7ff0ca3719376cd20e82502419dfed56539671ac93d3338a1af3f76c73ccc990ae06814a4656c39620ea99580054000200050004000000000036000200dbebac17322593f68998df3810c9800215c6cae90aac4e1992f45dc5673dc90b4a92a2507160cdb10097d80c54ec2a2c8a0400000d0002007b9b561f1e7508972c000000e00001001b00020082b3dc2331d86bfe2ddd775743e4db794464b8a7627f5b0035000200ea4d21b56fba2bd77dbec956cf3916809856aad4bf59e210a6ad3fdc2bdfcc0dc55fb43fff41d699e5bc8a9fef9a87a5140000001400030000040200080009000300d3000100010026000200c3ed4737bed6e58c83b4fe0d29e2cb37f0fd1d460db54fee49b2a9800184fd1b294e0000140003000000020006000004000004009d16909c060002005de00000090001002677cd6ebb00000007000100bb479d000500040000000000140003003e00c8ff0800ff7f361708000300090008000d0001000000040005010500a2000800000008000d00d400000090005a808c00000005000400020000001a000100d2304ee4444a50dd9490901fc72ff4db7699a8ec29ad00000400020014000300feff080003000700ff0309000100080005000400020000004100020012388c3dccd77e83e80bbc5a2cb5d92e7ec03872d76343f9b6f035e0532849482bc6083af4265d3ca81fc04bc3b339fb84c9538b674be22347d06dcd90000000"], 0x6d4}}, 0x40002004) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000980)='/selinux/checkreqprot\x00', 0xa0300, 0x0) setresgid(r3, 0x0, 0x0) setfsgid(r3) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r4, 0x0, 0x0) lseek(r4, 0xe7, 0x0) ioctl$EVIOCGID(r4, 0x80084502, &(0x7f00000009c0)=""/145) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r5, 0x0, 0x0) lseek(r5, 0xe7, 0x0) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000ac0)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r5, &(0x7f0000000c00)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b00)={0x9c, r6, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfffffffb}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e21}]}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x3f}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0x2}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x7fff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xfff}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}]}]}, 0x9c}, 0x1, 0x0, 0x0, 0x14008051}, 0x88d1) r7 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000800)='/dev/vga_arbiter\x00', 0x8002, 0x0) ioctl$PERF_EVENT_IOC_ID(r7, 0x80082407, &(0x7f0000000880)) getsockopt$IP_VS_SO_GET_SERVICE(r2, 0x0, 0x483, &(0x7f00000008c0), &(0x7f0000000940)=0x68) 09:14:22 executing program 2: unshare(0x44000600) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) finit_module(r0, &(0x7f0000000080)='/proc/bus/input/devices\x00', 0x0) syz_open_dev$usbfs(0x0, 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r1, 0x0, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock\x00', 0x20200, 0x0) ioctl$TIOCSSERIAL(r2, 0x541e, &(0x7f00000001c0)={0x3, 0x401, 0x3, 0x80, 0x6, 0x7eb, 0x39f, 0x3, 0x9, 0x0, 0x6, 0x101, 0xffff, 0x140, &(0x7f0000000240)=""/199, 0x1, 0x900000, 0x1ff}) 09:14:22 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0xe, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:22 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x7a, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:22 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x9effffff, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 330.717799][T21566] FAT-fs (loop5): FAT read failed (blocknr 63) [ 330.737595][ T1959] attempt to access beyond end of device [ 330.745569][ T1959] loop5: rw=1, want=78, limit=63 [ 330.750597][ T1959] attempt to access beyond end of device [ 330.764103][T21579] Unknown ioctl 21534 09:14:22 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/schedstat\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock\x00', 0x101500, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$getown(r3, 0x9) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vsock\x00', 0x0, 0x0) setsockopt$inet_opts(r4, 0x0, 0x0, &(0x7f0000000200)="f8e48098509421f77349738be391346ce6836a5cb0451f06356f176634dd972cc895975de0f69ed783ec769e464a2f212e09e3a92c9052f84b73c99e605920c495b5d5", 0x43) ioctl$BLKROGET(r2, 0x125e, &(0x7f0000000100)) ioctl$USBDEVFS_SUBMITURB(r1, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x6, 0x0}) ioctl$USBDEVFS_SETCONFIGURATION(r1, 0x80045505, &(0x7f0000000000)=0x4000000) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r5, 0x0, 0x0) lseek(r5, 0xe7, 0x0) setsockopt$inet_mreq(r5, 0x0, 0x20, &(0x7f0000000140)={@loopback, @multicast2}, 0x8) [ 330.767907][ T1959] loop5: rw=1, want=79, limit=63 [ 330.773324][ T1959] attempt to access beyond end of device [ 330.778951][ T1959] loop5: rw=1, want=80, limit=63 [ 330.793715][ T1959] attempt to access beyond end of device [ 330.799405][ T1959] loop5: rw=1, want=81, limit=63 [ 330.806591][T21581] net_ratelimit: 12 callbacks suppressed [ 330.806598][T21581] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 330.809396][ T1959] attempt to access beyond end of device [ 330.812977][T21583] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 330.827532][ T1959] loop5: rw=1, want=130, limit=63 [ 330.836837][T21583] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 330.840710][ T1959] attempt to access beyond end of device [ 330.848002][T21575] tipc: Started in network mode [ 330.859259][ T1959] loop5: rw=1, want=131, limit=63 [ 330.866321][T21588] Unknown ioctl 4702 [ 330.868824][ T1959] attempt to access beyond end of device [ 330.873165][T21575] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 330.878645][ T1959] loop5: rw=1, want=132, limit=63 [ 330.888596][T21588] usb usb2: usbfs: interface 0 claimed by hub while 'syz-executor.2' sets config #67108864 [ 330.893057][ T1959] attempt to access beyond end of device [ 330.908767][ T1959] loop5: rw=1, want=133, limit=63 [ 330.914332][ T1959] attempt to access beyond end of device [ 330.920179][T21575] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 330.920221][ T1959] loop5: rw=1, want=142, limit=63 [ 330.928420][T21575] tipc: Enabled bearer , priority 10 [ 330.933352][ T1959] attempt to access beyond end of device [ 330.945265][ T1938] tipc: Disabling bearer [ 330.950616][ T1938] tipc: Left network mode [ 330.954976][ T1959] loop5: rw=1, want=143, limit=63 [ 330.959966][T21583] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready 09:14:22 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x195, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:22 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r0, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$security_evm(r0, &(0x7f0000000000)='security.evm\x00', &(0x7f0000000040)=@md5={0x1, "86f07b733722d064cc1c366d2512ca3c"}, 0x11, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, 0x0) [ 330.962385][ T1959] attempt to access beyond end of device [ 330.975974][ T1959] loop5: rw=1, want=144, limit=63 [ 330.980740][T21583] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 330.984560][ T1959] attempt to access beyond end of device [ 330.994105][ T1959] loop5: rw=1, want=145, limit=63 [ 331.003873][ T1959] attempt to access beyond end of device [ 331.009683][ T1959] loop5: rw=1, want=3473, limit=63 [ 331.017038][ T1959] attempt to access beyond end of device [ 331.020539][ T1938] tipc: Disabling bearer [ 331.022773][ T1959] loop5: rw=1, want=6993, limit=63 [ 331.028002][ T1938] tipc: Left network mode [ 331.035479][T21595] Unknown ioctl 4702 [ 331.045227][T21594] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 331.045435][ T1959] attempt to access beyond end of device 09:14:23 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xc3ffffff, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:23 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$SIOCGIFMTU(r0, 0x8921, &(0x7f0000000080)) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r1, 0x0, 0x0) [ 331.066313][T21588] usb usb2: usbfs: interface 0 claimed by hub while 'syz-executor.2' sets config #67108864 [ 331.076546][ T1959] loop5: rw=1, want=13297, limit=63 [ 331.097039][ T1959] attempt to access beyond end of device [ 331.102961][ T1959] loop5: rw=1, want=30673, limit=63 09:14:23 executing program 0: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r0, 0x0, 0x0) lseek(r0, 0xe7, 0x0) unshare(0x2e010280) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) unshare(0x10000800) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x2, 0x0) signalfd4(r2, &(0x7f00000000c0)={[0x10000]}, 0x8, 0x80800) ioctl$USBDEVFS_RESETEP(r1, 0x80045503, &(0x7f0000000100)={0xe, 0x1}) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, 0x0) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000080)={0x60, 0x19, 0x800, 0x9, 0x1000, 0x100, &(0x7f0000000880)="a3acae4e0a064ce3c492f55390fdbc8f6c0272fb600bc3d6b4bc3287612bda607bb21ed601a8a87453b0f70c7a30f3a65a8d2c25737816f77c8eedde1a8848b21cb07ac45b3e75ab10a26ec7d18626ff012f6435d50cea9f466cc6f13a39255646ea171803d3791f15c289968f220c2925153478f5503b5570ad758e92af2d36c721b6bcf28a2464209c076687b401983d812362d0de7747d525716f294b2c7c24401afb3c71cfb3bf47c669245fa584206a5c269874c666038bea1c90b0e30d23715eb8d97c3c121c3359327b21345b8cb563a8a499bd417b8a4e544d8dbc45602c6d06ff0232acec647a2e2989e841caa771f4708540e51486ee51b8e2c996b7c730c8e29a25a08bd6313a7edcfd70bacc1cc81f60c9304350f71069d2889e6ab32de8bbaff831175bfb9bbc354f3bd9742971a69ca1cd4cefc2264e371f721076ed277ad72a33d1dc3d071decd47a0b00844bee07839bb0c314663b065ac3eb7947d3c53840577686a79fa597a33efa79987e24b436abe60686d3429ea9a7c2da0716c456f793aa3f98e258aade08177b6cf17cbc69795ca470e37589f1bdd3ffbeab3b060622b318a01fc163bf560a938d15a65a4ed532c1719c9ff5e844bcba3a2b066bd957a3b65cb1ac46f8885d660e614fa15a051186f5075e0fab5f0ecd96bba3c1f7a1ebe4acf1e9ce764235dc9fa429cf66fec922d2a040f3c56f3d2a5538475e9f728adf1b37c307457fa1fa52ba52c2cf47efe89f9f04a2bf1b19a6954cc194c58e8ce365b0cd69066dacb1b22521dea7d65cb6915645f938b423a7e96fc5b2a09367a1f09a0562cbc3729dab24a9b1e4ea07bc47276445ad7726b94e8f523beb482ea617a564f895c6c65d75a7de880ef413a80e08cb80f81ff019509926cc28895cde13010335450335ef007b8edb4e7322971eb26ba15cfbb99240c82ff2677a1bca6c416a9c89f3ed373493b726a54d8f7909da59e6b9054122ac90e920796397bc5801bfac1f0d5af0322f7b41c04a041844ef60da7dc0a9142201eb74067aa219ec7cbb5fa8e9e1322f67991b08ccc65c53d53c164a9a834fd7dc16f88325468f8bf700e677e6da9a51eead0dc5a2fd74fcabe7a61569f100b32c368ed5eb7a481a1ac138fe4cd17c4f3ae57ed64118da38b23d8aae669a19b8b227538b943ad6e4badf2e3b035b959b5af50597b41a56f3a97dcef9828ba3668dbecf526fc038f7c50461b5674443826eef1c6c2f9826b78077ec97007af4463057d7ba25500f44ca3e1abbd1931a8bf636c79a75781e04613823a8557922177b52b90f1f4f609e3c9e3f1b67fc3ede2ecfb38e183d3031a747c45f746c350af9cbf77d1cd43618af72fc24b47fd9a0d0451fcb606a1e8f9aa06853e2e86107f78672d56b899dfb9d993fe3953b16069fbd55ed631f13fc6106ad1d7be89fdd6b6da03ebce5677c1538fb6d542e10657d3765ceb6e6b82c2bece82b33a015c65759866469595926a8f2e02f73cf006102ce9194e671704f792a6d980d196838f2fbdd20c126c5cb2280b4cce4423abee2828d5255b70d7725ada59e782db0cde3b994772194358db6b0c24e9a7dde5db84f8e16415860d8fb68c47dce0dd98f4402b5aaf812fed684ea7e5a43b22d19670fffad17dbe1668ac376cfdf797d8950a8d75b011669b90ac404e61bf32446c02c36a316db978803814bb741214bcd3069bbfcbdbe55d596a0dd8b26d2e1dde982daec91c5e23ee42f6b1b15cdcf73c69d6ea9273e7d1f93d0e56b89d1e9dc95d2d5e6f802a84f663ef63a9c277bde359225cf092d8c5466fd8fa00bb31c33949213eecd35ef41d5fcf201ae76dba14f9eb1c965733fb9ebd70cf58524d34541991ad069819e4886836fa0d987f2014c76d40c37005eed0bd8d256793f49cfd10d04aae61e7a9a0738cb4f50341a16d5db05b399e44304770b258c79137e9e7bf07f37749690e1755dc62b409a310a9447247a9189737b9a3467104f4b5c1375c3d8f6c3d34bb0140e99e4f45d6adf41bb9a93e8eec09c45b8fe792a7415d87f56408b7557091337d8bd8772bf59b1058f7fa6644fd35d8c6537b2fb85a4b9bd4dd6ea95e375d54d8337dd061a181235c03dff3da009ac7cfeea3daf2f58c6aa8e37e3224643df58b6783be5abe8642f4fe1f43659a1e4eea6595e36da05aaaee9213d0d395f339c2b5d040c40bd16ff8c0f2fc2044e9eb4d121a6818817abe76e6911338402d959542beedee72bcacbb46f855a067d3ce2c56604dcef8e91bfa264372c4afdbff3b8f64d3f191cb43c724cc08f4d9a8fd303a5207e619a974e3aa9bc9a51116ef15f37582c8edad6f80155e891cebc39d4558d39fb40fc33d826dc0bec02d9eca507cc7429b7844f0e52e39a1c889e6d31c9db7d272f1b4d61cf0def4af565e54aeb5677a7db42f89113cd6120abe5c0c4f9275704501d120194a6c0ffc428cec651e306c0d414e8bb72f8cefc93bafabfcbdd7a8f33348021346e54da1f07936ff3cdc9b62db9a96e81e939fa8c004da35c9c942e09f2a99166f3f8d0cde2a4663a5d9b7f81a8361469e5defb620ff5d379b784d7ee1da699d979a1f4a44332cd20ed367451fbdd4956189150b1a495a93fc0b4bfc7c4c19da09b68880256e37ad800032c58cec324e4716d65b89f63bc835801005b4db146506019f67f8f6f8bc60554975903e935ff030f2fd90bfd46fd55bc7d00d31c7013d2bf6a301743bc44f666c1ed4149aaad33140b4aefe4c5775d46b37286565d12fcc9b89723a6a6fd182bb24146f0286783a7d48ef9dcf16f77d08b267abde9104b42f8b08d5a1d8a2567f2355ab259260e384a723fc2022d6132521de88aab9469bba14844cf0859b0d2d7fa13763bbcc857429abb4c4c6e6df83ecc0538ffae0d5f90039f372560e30e5388bbf839100d5747a32b6e0a9ded5820233b6584ea547bc271385c780b56bd9ff0015367d6d8b642fe50c031b85d9c65cd17a56b81393ad89390fc4c227aa560a82cf3107f95d1c129e7458ad43637de32037dad45217fa7c5ec3b8f1a886541be724c3d567f221d451d4441ad6d86dcae05ea589f10379332b3645171eb34a4a8ca9fd0e0992cc6e76cf9092348d2564f7f00eb0fe5605f0809e39cbbc59c60d027c3c8a9d38c165326f7aa4b1d968d4cd9942bd1231df9e6fcea3c28c8a45e65fc72be3ff8dc11b5ea61b0aac321a7ee6933d83631fa3a235ee5c9cfa18ae9d66cf6dc8e2e854440b67698e4d6d801f347744549ac134ca7800538a3e514d380c4964ccd102d0a76c463314cb8e85f709abd8ce0d10d1b6f72f1bfeda4ad2d350cf7d77cb9510e7c6cf8285685e6f0d4702287d62bb3d64992c0b3ff8213c91e76852755ba34c6d8e03459e8b7a9af5351bd5a0377669fa3ce4d7fe770b6b8866917e793241de2b6bbc0b4469e60545f650b26b7f874c66078eb642fe3e1d8d78c4e40703160e837c85da31126abfc686968406c48212e1ccbe6d20926752a2413a4e45d7c4a19fe6cc667f5bcc6f8ad816d1328c2ca0ca6c3b2bdb09fb4f090360f932fe053f704e343e892e445a432816d8690ff620c28f9a6a5a611840ee93714e00c4a3d442a07235d271655fd702cc909d958e71c68e75c73b010891a47e46fdcc9f081a146847175b073713a4d3daea6970f09de98d0e2ed57b4aa1eb922f3e39a191b7f5b32741e211ff6ca15bfb78c40375b99524b7451d8295de1034aacdf502d6d4e9196de2e20f8c0dfce57763434b54a38661006943cf70a316b4b8bce685bbf0aca12d8eb6d4090daf4ebed023b0ee68f1a1333cb0b033d5055b2cde2ff6d3a721720aaa4c1cb49afef7df8cf7aab09f37934147f1eb78753285c7ae7d53d0a4b166255bb084004a72da2c0e906dd24100539fce1ef5bfe856bfabfc4934ae00f29ea055f2a377c63f57a8fafa4667385aa6935b4d3c689ee6fd1524d1fbdc549792202caee7867d38de92323c56da9464e0da4df23c476252434f572dd666f3a435f91a891479dd6f4db0f4000e6ea679e31c1993d54d2d637c0fcee9f7421bfc8fa818cb1785b9987ecfb2a1595533ede41fc43c0ac09cc370c9c46bac67c9b4fc9e35928b12a50287890f58b647a15ce97ce821434cb41a465a3434562c0c1fcca41534d25577bcb28d86b9f75772f7cbcd2c58f1a6dc6e6ebc369bc8c1c63fb123c8a51f2f411c0783aa30db2448304d7d4aa27d595672575a44d89ae72e2d4ad8dfd36c767daa5e6b67e5f3cddae1964e13c2bbef98b114589530e23bfdbcbc6ee427f50af5eea762076bc07114188154e34420c0f53ef44bb00e0044fab4d070c47db7ec2f158d711be9641ebe2145ff40cf064a38be632ce80a01086a7b215759a9be9bd24a792481d35a77215fef51c414845372d0d036f3e2053ddee4ae119537e83f80458a4478ded018149b86fa0279d358744d19ccd087452da7e46029e235a16a97af90016759ea2e3e482ac3c9469b1cb7235985559e60c05c09a3f0d7ef5866f197e530b3b534e405892deb79907f843109ebf0b7384baf5d361f0dbf4e586e583869e7804a117266fae706415b3aed3f75c6c578bd07a00d519e306f4a2e8b564bf9ca9d903d4e6d8f2da42caf541f8d22630b41fda1e46a8c1f24f4f7cbc98ee77fe48c461f4b2daefff91f946bda00511b7581fe4f779286232ba10008bbbfed1e71435abeaf8c9e061872bfe62d1eb4ed2bfe7fca08c02446a1afc4df50cd12da61bd45dc4208ce1aff665f59a6f281f6657db6816b79cff03554778c4a92da89cb313a594d888578096ed19077168d5aaf1664ab24bfa6bbb398fa00509152ef4c093751d98288cebe1c1e8d13ccdaeee73f4dc0ddc27431454cedb0687bf4e44d85540d074a4f25bd94ad3c85da6da7b41abaf740d0952136b69116291cbfd99e92008d8f9d4145d349ba0ef531c9022e432cb1db2763892c98cc6defffb70ec62e2ef4a90cf6de8651b296e295ac962dfee3bc395e3a2332d90ef4cbcc3fafe9c5494514ec26494b8df69ea827fda3a6804517e57adec2b89e3ec3acf617d4b5b66d2287a7d0036dce1e595f3e17375359ee41ecccd776d5ebef2653d77d105511e23da4fa66626a645bb47801d17b7fa2af81da0ec52cff176b5a5f8599f40dc13e27a573fb24e37985388189871639c9418f440268f64c7716bdcf9c93fe76987a83694605a60c82af34491f047fc7560a3fbc54b3e01867daba6f6e360f60ca99b4e22da1d60559c14133494c3bd83f9a81ebfbf850cae57ceccccb54a21082ead31bec678f33a099f98a66267cba25d73e2573fd6b2818fb249694c1da69882d4af0135227527333d91513494c54648eff40b2a0f7a675ba19888a7add59d323d7c1b28c15acc3488335d5a830671210e8a24afb340889d654f6e091d523f091b77ed061e50403d91bf322bcdd4d62be1d3fe9461072b7fca9afab37d1d4e3872cbf7bea7b93854ffeb3763a886242b3d6a821099b57523015435f71c5f7b5c1eaaf78febe4c9383355aa0911f860c00a5ba3ba726c5e37230e86e9808598487e11be2088178fc6d43dc7479cffce66283438d8ca745d151fff16bf9762d1d325c488a6fa34667b181ace1549b7d175bf53ea22dd72a7ce60bd40dc3176d1288e81a6163f1bf9c85f3f34a2603c8853e1f92b2981b182db0ea8add457285e177b0c0be32bb8746a60ee17173b909a7490b1d6444976430239c5519f796d1a86196399fe86e8c53a23ff3e62"}) [ 331.116592][T21602] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 331.125473][T21602] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 331.135075][ T1959] attempt to access beyond end of device [ 331.140891][ T1959] loop5: rw=1, want=63513, limit=63 [ 331.177381][T21598] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 331.200599][T21611] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 331.208454][T21611] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 331.496389][T21617] FAULT_INJECTION: forcing a failure. [ 331.496389][T21617] name failslab, interval 1, probability 0, space 0, times 0 [ 331.509560][T21617] CPU: 0 PID: 21617 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 331.519729][T21617] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 331.529780][T21617] Call Trace: [ 331.533071][T21617] dump_stack+0x1b0/0x228 [ 331.537401][T21617] ? devkmsg_release+0x127/0x127 [ 331.542363][T21617] ? __kasan_check_read+0x11/0x20 [ 331.547392][T21617] ? show_regs_print_info+0x18/0x18 [ 331.552597][T21617] should_fail+0x6fb/0x860 [ 331.557128][T21617] ? setup_fault_attr+0x2b0/0x2b0 [ 331.562155][T21617] ? current_time+0x2e0/0x2e0 [ 331.566830][T21617] __should_failslab+0x11a/0x160 [ 331.571914][T21617] ? kmalloc_array+0x32/0x60 [ 331.576515][T21617] should_failslab+0x9/0x20 [ 331.581889][T21617] __kmalloc+0x64/0x310 [ 331.586040][T21617] kmalloc_array+0x32/0x60 [ 331.590456][T21617] iter_file_splice_write+0x21d/0xf20 [ 331.595819][T21617] ? __sb_end_write+0xa8/0xf0 [ 331.600487][T21617] ? touch_atime+0x22e/0x270 [ 331.605079][T21617] ? current_time+0x2e0/0x2e0 [ 331.610054][T21617] ? fsnotify+0x1390/0x1450 [ 331.614819][T21617] ? splice_from_pipe+0x200/0x200 [ 331.619841][T21617] ? splice_shrink_spd+0xb0/0xb0 [ 331.625028][T21617] ? splice_from_pipe+0x200/0x200 [ 331.630663][T21617] direct_splice_actor+0xf7/0x130 [ 331.635686][T21617] splice_direct_to_actor+0x496/0xb00 [ 331.641056][T21617] ? do_splice_direct+0x3d0/0x3d0 [ 331.646075][T21617] ? pipe_to_sendpage+0x300/0x300 [ 331.651102][T21617] ? rw_verify_area+0x1c2/0x360 [ 331.655971][T21617] do_splice_direct+0x279/0x3d0 [ 331.660833][T21617] ? splice_direct_to_actor+0xb00/0xb00 [ 331.666395][T21617] ? security_file_permission+0x157/0x350 [ 331.672113][T21617] do_sendfile+0x89d/0x1110 [ 331.676621][T21617] ? compat_writev+0x390/0x390 [ 331.681388][T21617] ? __kasan_check_write+0x14/0x20 [ 331.686496][T21617] ? fput_many+0x47/0x1a0 [ 331.691695][T21617] __x64_sys_sendfile64+0x1ae/0x220 [ 331.696892][T21617] ? __ia32_sys_sendfile+0x240/0x240 [ 331.702698][T21617] ? syscall_return_slowpath+0x6f/0x500 [ 331.708240][T21617] do_syscall_64+0xc0/0x100 [ 331.712906][T21617] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 331.718890][T21617] RIP: 0033:0x45b399 [ 331.722785][T21617] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 331.742627][T21617] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 331.751215][T21617] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 331.759214][T21617] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 331.767334][T21617] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 331.775501][T21617] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 331.783474][T21617] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000011 [ 332.025668][T20534] tipc: 32-bit node address hash set to fbff1eac 09:14:24 executing program 5 (fault-call:10 fault-nth:18): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:24 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000000)={'macsec0\x00', {0x2, 0x4e20, @empty}}) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r1, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) finit_module(r1, &(0x7f0000000040)='system\\selfppp0,\x00', 0x2) 09:14:24 executing program 2: unshare(0x44000600) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r0, 0x0, 0x0) lseek(r0, 0xe7, 0x0) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000000)=[{{0x3, 0x1, 0x1}, {0x4, 0x0, 0x1}}, {{0x0, 0x0, 0x1}, {0x2, 0x1, 0x1}}, {{0x4}, {0x2, 0x0, 0x0, 0x1}}, {{0x2}, {0x1}}, {{0x3, 0x0, 0x1}, {0x4, 0x1, 0x1, 0x1}}], 0x28) syz_open_dev$usbfs(0x0, 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r1, 0x0, 0x0) 09:14:24 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x300, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:24 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xe0ffffff, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:24 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x10, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 332.086501][T21614] FAT-fs (loop5): FAT read failed (blocknr 63) [ 332.109756][ T1959] attempt to access beyond end of device [ 332.115494][ T1959] loop5: rw=1, want=78, limit=63 [ 332.120762][ T1959] buffer_io_error: 38 callbacks suppressed [ 332.120768][ T1959] Buffer I/O error on dev loop5, logical block 77, lost async page write [ 332.135180][ T1959] attempt to access beyond end of device [ 332.145451][ T1959] loop5: rw=1, want=79, limit=63 [ 332.150690][ T1959] Buffer I/O error on dev loop5, logical block 78, lost async page write [ 332.159376][ T1959] attempt to access beyond end of device [ 332.160739][T21623] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 332.168122][ T1959] loop5: rw=1, want=80, limit=63 [ 332.186342][ T1959] Buffer I/O error on dev loop5, logical block 79, lost async page write [ 332.189215][T21629] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 332.194999][ T1959] attempt to access beyond end of device [ 332.204110][T21629] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 332.208815][ T1959] loop5: rw=1, want=81, limit=63 [ 332.216420][T21627] tipc: Started in network mode [ 332.222276][ T1959] Buffer I/O error on dev loop5, logical block 80, lost async page write [ 332.228449][T21627] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 332.234484][ T1959] attempt to access beyond end of device [ 332.234495][ T1959] loop5: rw=1, want=130, limit=63 [ 332.244062][T21627] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 332.259335][ T1959] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 332.263948][T21627] tipc: Enabled bearer , priority 10 [ 332.271592][ T1959] attempt to access beyond end of device [ 332.287280][ T1959] loop5: rw=1, want=131, limit=63 [ 332.292375][ T1959] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 332.300996][T21632] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 332.301743][ T1959] attempt to access beyond end of device [ 332.322386][ T1959] loop5: rw=1, want=132, limit=63 [ 332.326057][T21629] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready 09:14:24 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x500, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:24 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x11, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 332.327435][ T1959] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 332.343356][ T1959] attempt to access beyond end of device [ 332.345042][T21629] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 332.349027][ T1959] loop5: rw=1, want=133, limit=63 [ 332.349040][ T1959] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 332.370970][ T1959] attempt to access beyond end of device [ 332.376637][ T1959] loop5: rw=1, want=142, limit=63 09:14:24 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x50cd, 0x202200) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x48800, 0x0) io_uring_register$IORING_REGISTER_EVENTFD(r1, 0x4, &(0x7f0000000080)=r0, 0x1) 09:14:24 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xeaffffff, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 332.382868][ T1959] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 332.391771][ T1959] attempt to access beyond end of device [ 332.397409][ T1959] loop5: rw=1, want=143, limit=63 [ 332.402742][ T1959] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 332.411306][ T1959] attempt to access beyond end of device [ 332.417076][ T1959] loop5: rw=1, want=144, limit=63 [ 332.422326][ T1959] attempt to access beyond end of device [ 332.427979][ T1959] loop5: rw=1, want=145, limit=63 [ 332.434362][ T1959] attempt to access beyond end of device [ 332.435613][T21640] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 332.440391][ T1959] loop5: rw=1, want=2409, limit=63 [ 332.442908][ T1959] attempt to access beyond end of device [ 332.467111][ T1959] loop5: rw=1, want=6521, limit=63 [ 332.477926][ T1959] attempt to access beyond end of device [ 332.484254][ T1959] loop5: rw=1, want=14073, limit=63 [ 332.501960][T21644] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 332.502352][ T1959] attempt to access beyond end of device [ 332.515240][ T1959] loop5: rw=1, want=35577, limit=63 [ 332.533177][T21644] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 332.538245][ T1959] attempt to access beyond end of device [ 332.546110][ T1959] loop5: rw=1, want=63513, limit=63 [ 332.556539][T21645] tipc: Enabling of bearer rejected, failed to enable media [ 332.574830][T21648] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:14:24 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x12, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:24 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x600, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 332.682028][T21652] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 332.719406][T21654] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 332.728082][T21654] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 332.773815][T21655] tipc: Enabling of bearer rejected, failed to enable media [ 332.870839][ T1938] tipc: Disabling bearer [ 332.876173][ T1938] tipc: Left network mode [ 333.023491][T21663] FAULT_INJECTION: forcing a failure. [ 333.023491][T21663] name failslab, interval 1, probability 0, space 0, times 0 [ 333.036297][T21663] CPU: 0 PID: 21663 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 333.046887][T21663] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 333.056938][T21663] Call Trace: [ 333.060227][T21663] dump_stack+0x1b0/0x228 [ 333.064553][T21663] ? devkmsg_release+0x127/0x127 [ 333.069486][T21663] ? __kasan_check_read+0x11/0x20 [ 333.074505][T21663] ? show_regs_print_info+0x18/0x18 [ 333.079694][T21663] should_fail+0x6fb/0x860 [ 333.084105][T21663] ? setup_fault_attr+0x2b0/0x2b0 [ 333.089300][T21663] ? current_time+0x2e0/0x2e0 [ 333.093980][T21663] __should_failslab+0x11a/0x160 [ 333.098926][T21663] ? kmalloc_array+0x32/0x60 [ 333.103513][T21663] should_failslab+0x9/0x20 [ 333.108015][T21663] __kmalloc+0x64/0x310 [ 333.112178][T21663] kmalloc_array+0x32/0x60 [ 333.116588][T21663] iter_file_splice_write+0x21d/0xf20 [ 333.122104][T21663] ? __sb_end_write+0xa8/0xf0 [ 333.126776][T21663] ? touch_atime+0x22e/0x270 [ 333.131383][T21663] ? current_time+0x2e0/0x2e0 [ 333.136164][T21663] ? fsnotify+0x1390/0x1450 [ 333.140668][T21663] ? splice_from_pipe+0x200/0x200 [ 333.145692][T21663] ? splice_shrink_spd+0xb0/0xb0 [ 333.150635][T21663] ? splice_from_pipe+0x200/0x200 [ 333.155652][T21663] direct_splice_actor+0xf7/0x130 [ 333.160795][T21663] splice_direct_to_actor+0x496/0xb00 [ 333.167294][T21663] ? do_splice_direct+0x3d0/0x3d0 [ 333.172313][T21663] ? pipe_to_sendpage+0x300/0x300 [ 333.177339][T21663] ? rw_verify_area+0x1c2/0x360 [ 333.182194][T21663] do_splice_direct+0x279/0x3d0 [ 333.187054][T21663] ? splice_direct_to_actor+0xb00/0xb00 [ 333.192626][T21663] ? security_file_permission+0x157/0x350 [ 333.198347][T21663] do_sendfile+0x89d/0x1110 [ 333.202966][T21663] ? compat_writev+0x390/0x390 [ 333.207755][T21663] ? __kasan_check_write+0x14/0x20 [ 333.212864][T21663] ? fput_many+0x47/0x1a0 [ 333.217194][T21663] __x64_sys_sendfile64+0x1ae/0x220 [ 333.222393][T21663] ? __ia32_sys_sendfile+0x240/0x240 [ 333.227683][T21663] ? syscall_return_slowpath+0x6f/0x500 [ 333.233267][T21663] do_syscall_64+0xc0/0x100 [ 333.237788][T21663] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 333.243790][T21663] RIP: 0033:0x45b399 [ 333.247687][T21663] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 333.267526][T21663] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 333.276070][T21663] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 333.284045][T21663] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 333.292547][T21663] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 333.300530][T21663] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 333.308501][T21663] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000012 09:14:25 executing program 5 (fault-call:10 fault-nth:19): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:25 executing program 0: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r0, 0x0, 0x0) lseek(r0, 0xe7, 0x0) write$selinux_create(r0, &(0x7f0000000180)=@objname={'system_u:object_r:modules_object_t:s0', 0x20, 'unconfined_u:system_r:insmod_t:s0-s0:c0.c1023', 0x20, 0x9, 0x20, './file0\x00'}, 0x71) unshare(0x44000600) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r2, 0x0, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r3, 0x0, 0x0) lseek(r3, 0xe7, 0x0) setsockopt$inet6_tcp_buf(r3, 0x6, 0xb, &(0x7f0000000200)="c18a611e50692f3d1045d51c5d89472753f2c0b3d4babeb880a76e6653b9850c3b87a0fffb2cc7c1b08c6b6f7b42e6b3bb96ee06cad45a6fb7e5fc5c8b4de5e5c9250092795de9bbc0d496dbb70e8f748584c23a3da344b6f55603067eba5d9e632df785879b18bec409ec607367420ffcfc18d896ca48bbc463a4957d01b8b8b14176c39d2f", 0x86) lseek(r2, 0xe7, 0x0) sendmsg$NFT_MSG_GETCHAIN(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)={0xa4, 0x4, 0xa, 0x801, 0x0, 0x0, {0xc, 0x0, 0x1}, [@NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xffffffffffffffff}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_HOOK={0x7c, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x524ea7cc}, @NFTA_HOOK_DEV={0x14, 0x3, 'macsec0\x00'}, @NFTA_HOOK_DEV={0x14, 0x3, 'macvlan1\x00'}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x673107b2}, @NFTA_HOOK_DEV={0x14, 0x3, 'veth1_to_bridge\x00'}, @NFTA_HOOK_DEV={0x14, 0x3, 'nr0\x00'}, @NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x4}, 0x40000) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, 0x0) 09:14:25 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x13, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:25 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x700, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:25 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xefffffff, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:25 executing program 2: unshare(0x44000600) r0 = syz_open_dev$usbfs(0x0, 0x0, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x60000, 0x0) openat$cgroup(r1, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r2, 0x0, 0x0) lseek(r2, 0xe7, 0x0) sendmsg$NLBL_CALIPSO_C_LIST(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8440c8cdb2071ac2}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x3c, 0x0, 0x100, 0x70bd2c, 0x25dfdbfe, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x40) r3 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/policy\x00', 0x0, 0x0) getsockopt$inet6_mtu(r3, 0x29, 0x17, &(0x7f0000000100), &(0x7f0000000140)=0x4) [ 333.598503][T21660] FAT-fs (loop5): FAT read failed (blocknr 63) [ 333.621433][ T1959] attempt to access beyond end of device [ 333.627174][T21669] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 333.627221][ T1959] loop5: rw=1, want=78, limit=63 [ 333.648127][ T1938] tipc: Disabling bearer [ 333.653489][ T1938] tipc: Left network mode [ 333.660297][ T1959] attempt to access beyond end of device [ 333.670334][ T1959] loop5: rw=1, want=79, limit=63 [ 333.675323][ T1959] attempt to access beyond end of device [ 333.680605][T21670] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 333.681229][ T1959] loop5: rw=1, want=80, limit=63 [ 333.693350][ T1959] attempt to access beyond end of device 09:14:25 executing program 0: unshare(0x44000600) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.controllers\x00', 0x275a, 0x0) prlimit64(0x0, 0xe, &(0x7f00000005c0)={0x0, 0xff}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) eventfd(0x40000) recvmmsg(r1, &(0x7f0000008880), 0x400000000000249, 0x0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_create1(0x0) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x2d8d29c4) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b1}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) unshare(0x8000100) r5 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x90c, 0x404040) ioctl$USBDEVFS_REAPURBNDELAY(r5, 0x4008550d, 0x0) [ 333.694070][T21670] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 333.699063][ T1959] loop5: rw=1, want=81, limit=63 [ 333.708982][T21675] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 333.716049][ T1959] attempt to access beyond end of device [ 333.736060][ T1959] loop5: rw=1, want=130, limit=63 [ 333.741175][ T1959] attempt to access beyond end of device 09:14:25 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x900, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 333.751388][ T1959] loop5: rw=1, want=131, limit=63 [ 333.756457][ T1959] attempt to access beyond end of device [ 333.760554][T21676] tipc: Enabling of bearer rejected, failed to enable media [ 333.771119][ T1959] loop5: rw=1, want=132, limit=63 [ 333.776181][ T1959] attempt to access beyond end of device [ 333.782211][ T1959] loop5: rw=1, want=133, limit=63 [ 333.787251][ T1959] attempt to access beyond end of device 09:14:25 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x14, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 333.797729][ T1959] loop5: rw=1, want=142, limit=63 [ 333.802834][ T1959] attempt to access beyond end of device [ 333.809154][ T1959] loop5: rw=1, want=143, limit=63 [ 333.814200][ T1959] attempt to access beyond end of device [ 333.827057][ T1959] loop5: rw=1, want=144, limit=63 [ 333.832335][ T1959] attempt to access beyond end of device [ 333.838130][ T1959] loop5: rw=1, want=145, limit=63 [ 333.838641][T21684] tipc: Started in network mode [ 333.845874][ T1959] attempt to access beyond end of device [ 333.850075][T21684] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 333.859181][ T1959] loop5: rw=1, want=5145, limit=63 [ 333.864033][T21684] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 333.871600][ T1959] attempt to access beyond end of device [ 333.886890][ T1959] loop5: rw=1, want=10121, limit=63 [ 333.899087][ T1959] attempt to access beyond end of device [ 333.904950][ T1959] loop5: rw=1, want=21257, limit=63 [ 333.909605][T21684] tipc: Enabled bearer , priority 10 [ 333.923280][T21685] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 333.932986][ T1959] attempt to access beyond end of device [ 333.938812][ T1959] loop5: rw=1, want=47873, limit=63 09:14:25 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xf0ffffff, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:25 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x25, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 333.956868][ T1959] attempt to access beyond end of device [ 333.963755][T21685] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 333.970513][ T1959] loop5: rw=1, want=63513, limit=63 09:14:25 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xa00, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 334.015871][T21693] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 334.030229][T21693] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 334.068256][T21696] tipc: Started in network mode [ 334.078871][T21696] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 334.099548][T21696] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 334.116557][T21696] tipc: Enabled bearer , priority 10 [ 334.129840][T21698] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 334.150369][T21698] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 334.721632][T21711] FAULT_INJECTION: forcing a failure. [ 334.721632][T21711] name failslab, interval 1, probability 0, space 0, times 0 [ 334.742920][T21711] CPU: 1 PID: 21711 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 334.753187][T21711] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 334.763346][T21711] Call Trace: [ 334.767190][T21711] dump_stack+0x1b0/0x228 [ 334.771519][T21711] ? devkmsg_release+0x127/0x127 [ 334.783056][T21711] ? __kasan_check_read+0x11/0x20 [ 334.788291][T21711] ? show_regs_print_info+0x18/0x18 [ 334.793844][T21711] should_fail+0x6fb/0x860 [ 334.802089][T21711] ? setup_fault_attr+0x2b0/0x2b0 [ 334.807314][T21711] ? current_time+0x2e0/0x2e0 [ 334.812103][T21711] __should_failslab+0x11a/0x160 [ 334.817040][T21711] ? kmalloc_array+0x32/0x60 [ 334.821770][T21711] should_failslab+0x9/0x20 [ 334.826273][T21711] __kmalloc+0x64/0x310 [ 334.830430][T21711] kmalloc_array+0x32/0x60 [ 334.835459][T21711] iter_file_splice_write+0x21d/0xf20 [ 334.841346][T21711] ? __sb_end_write+0xa8/0xf0 [ 334.846030][T21711] ? touch_atime+0x22e/0x270 [ 334.850672][T21711] ? current_time+0x2e0/0x2e0 [ 334.855473][T21711] ? fsnotify+0x1390/0x1450 [ 334.859976][T21711] ? splice_from_pipe+0x200/0x200 [ 334.864993][T21711] ? splice_shrink_spd+0xb0/0xb0 [ 334.869929][T21711] ? splice_from_pipe+0x200/0x200 [ 334.874952][T21711] direct_splice_actor+0xf7/0x130 [ 334.880093][T21711] splice_direct_to_actor+0x496/0xb00 [ 334.885466][T21711] ? do_splice_direct+0x3d0/0x3d0 [ 334.890497][T21711] ? pipe_to_sendpage+0x300/0x300 [ 334.895609][T21711] ? rw_verify_area+0x1c2/0x360 [ 334.900458][T21711] do_splice_direct+0x279/0x3d0 [ 334.905310][T21711] ? splice_direct_to_actor+0xb00/0xb00 [ 334.910855][T21711] ? security_file_permission+0x157/0x350 [ 334.916582][T21711] do_sendfile+0x89d/0x1110 [ 334.921111][T21711] ? compat_writev+0x390/0x390 [ 334.925870][T21711] ? __kasan_check_write+0x14/0x20 [ 334.930992][T21711] ? fput_many+0x47/0x1a0 [ 334.935320][T21711] __x64_sys_sendfile64+0x1ae/0x220 [ 334.940600][T21711] ? __ia32_sys_sendfile+0x240/0x240 [ 334.946180][T21711] ? syscall_return_slowpath+0x6f/0x500 [ 334.951740][T21711] do_syscall_64+0xc0/0x100 [ 334.956246][T21711] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 334.962131][T21711] RIP: 0033:0x45b399 [ 334.966046][T21711] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 334.985648][T21711] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 334.994060][T21711] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 335.002054][T21711] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 335.010812][T21711] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 335.018900][T21711] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 335.026883][T21711] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000013 [ 335.035949][T20541] tipc: 32-bit node address hash set to fbff1eac [ 335.169209][T20541] tipc: 32-bit node address hash set to fbff1eac 09:14:27 executing program 5 (fault-call:10 fault-nth:20): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:27 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x2c, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:27 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xfc000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:27 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xb00, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:27 executing program 0: unshare(0x44000600) syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r0, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x4, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, 0x0) prctl$PR_GET_KEEPCAPS(0x7) 09:14:27 executing program 2: unshare(0x44000600) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r0, 0x0, 0x0) lseek(r0, 0xe7, 0x0) epoll_pwait(r0, &(0x7f0000000000)=[{}, {}, {}, {}, {}], 0x5, 0x6, &(0x7f0000000080)={[0x5]}, 0x8) syz_open_dev$usbfs(0x0, 0x0, 0x2080) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r1, 0x0, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r2, 0x0, 0x0) lseek(r2, 0xe7, 0x0) r3 = socket(0x10, 0x4000000000000002, 0xc) write(r3, &(0x7f0000000000)="1f0000000104ff00fd4354c007110000f30503000a000100010423dcffdf00", 0x23c) r4 = syz_genetlink_get_family_id$netlbl_mgmt(0x0) sendmsg$NLBL_MGMT_C_REMOVE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, r4, 0x100, 0x70bd26, 0x25dfdbfb, {}, [@NLBL_MGMT_A_DOMAIN={0x5, 0x1, '\x00'}, @NLBL_MGMT_A_DOMAIN={0x6, 0x1, 'X\x00'}]}, 0x24}}, 0x20000004) sendmsg$NLBL_MGMT_C_REMOVE(r2, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x38, r4, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x7}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x4044850) [ 335.456322][ T1959] attempt to access beyond end of device [ 335.464739][ T1959] loop5: rw=1, want=78, limit=63 [ 335.469863][ T1959] attempt to access beyond end of device [ 335.475585][ T1959] loop5: rw=1, want=79, limit=63 [ 335.497447][ T1959] attempt to access beyond end of device [ 335.500678][T21721] tipc: Started in network mode [ 335.517670][T21721] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 335.527000][ T1959] loop5: rw=1, want=80, limit=63 [ 335.527738][T21721] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 335.532089][ T1959] attempt to access beyond end of device [ 335.540457][T21721] tipc: Enabled bearer , priority 10 [ 335.552090][ T1959] loop5: rw=1, want=81, limit=63 [ 335.557283][ T1959] attempt to access beyond end of device [ 335.565863][ T1959] loop5: rw=1, want=130, limit=63 [ 335.580601][ T1959] attempt to access beyond end of device [ 335.580661][T21720] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready 09:14:27 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x2d, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 335.586261][ T1959] loop5: rw=1, want=131, limit=63 [ 335.586290][ T1959] attempt to access beyond end of device [ 335.599797][T21720] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 335.619396][ T1959] loop5: rw=1, want=132, limit=63 [ 335.624466][ T1959] attempt to access beyond end of device [ 335.633761][ T1959] loop5: rw=1, want=133, limit=63 [ 335.638830][ T1959] attempt to access beyond end of device 09:14:27 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x101001) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r2, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$binfmt_aout(r2, &(0x7f0000001200)=ANY=[@ANYBLOB="08010320520200003d02000009000000d3010000030000000000000000000000bb498438df2722e1118431ba2f7ecdb0994a96d409fe5b3069dd786e9cc8603c0e6cdf6464686dcce8a938ef4bf015293c58d1f89dfdae56702f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007636b461396ecd875907"], 0x95a) fcntl$notify(r1, 0x402, 0x1) read(r1, 0x0, 0x0) ioctl$FITRIM(0xffffffffffffffff, 0xc0185879, &(0x7f00000000c0)={0x6e67, 0x10001, 0x9}) lseek(r1, 0xe7, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCSBRK(r3, 0x5427) setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, &(0x7f0000000000)={0x1, 'ip6erspan0\x00', 0x2}, 0x18) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) 09:14:27 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xc00, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 335.647233][ T1959] loop5: rw=1, want=142, limit=63 [ 335.652824][ T1959] attempt to access beyond end of device [ 335.661938][ T1959] loop5: rw=1, want=143, limit=63 [ 335.666997][ T1959] attempt to access beyond end of device [ 335.675479][ T1959] loop5: rw=1, want=144, limit=63 [ 335.683978][ T1959] attempt to access beyond end of device [ 335.692527][ T1959] loop5: rw=1, want=145, limit=63 [ 335.725108][ T1959] attempt to access beyond end of device [ 335.739284][ T1959] loop5: rw=1, want=35225, limit=63 [ 335.750345][T21732] tipc: Started in network mode [ 335.769207][T21732] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 335.780893][ T1959] attempt to access beyond end of device [ 335.781591][T21732] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 335.786661][ T1959] loop5: rw=1, want=60833, limit=63 [ 335.801465][T21732] tipc: Enabled bearer , priority 10 [ 335.814576][T21737] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready 09:14:27 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xd00, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:27 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xfc020000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 335.831649][T21737] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:14:27 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) utimes(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)={{r1, r2/1000+30000}, {0x0, 0x7530}}) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) [ 335.891400][T21743] net_ratelimit: 7 callbacks suppressed [ 335.891406][T21743] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 335.932062][T21746] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 335.940279][T21746] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 335.953000][ T1938] tipc: Disabling bearer [ 335.958340][ T1938] tipc: Left network mode [ 335.959557][T21748] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 336.028773][T21751] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 336.036610][T21751] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 336.222085][T21757] FAULT_INJECTION: forcing a failure. [ 336.222085][T21757] name failslab, interval 1, probability 0, space 0, times 0 [ 336.234881][T21757] CPU: 1 PID: 21757 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 336.245031][T21757] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 336.255083][T21757] Call Trace: [ 336.258386][T21757] dump_stack+0x1b0/0x228 [ 336.262716][T21757] ? devkmsg_release+0x127/0x127 [ 336.267660][T21757] ? __kasan_check_read+0x11/0x20 [ 336.272785][T21757] ? show_regs_print_info+0x18/0x18 [ 336.277994][T21757] should_fail+0x6fb/0x860 [ 336.282424][T21757] ? setup_fault_attr+0x2b0/0x2b0 [ 336.287447][T21757] ? current_time+0x2e0/0x2e0 [ 336.292126][T21757] __should_failslab+0x11a/0x160 [ 336.297075][T21757] ? kmalloc_array+0x32/0x60 [ 336.301664][T21757] should_failslab+0x9/0x20 [ 336.306184][T21757] __kmalloc+0x64/0x310 [ 336.310355][T21757] kmalloc_array+0x32/0x60 [ 336.314861][T21757] iter_file_splice_write+0x21d/0xf20 [ 336.320347][T21757] ? __sb_end_write+0xa8/0xf0 [ 336.325021][T21757] ? touch_atime+0x22e/0x270 [ 336.329625][T21757] ? current_time+0x2e0/0x2e0 [ 336.334333][T21757] ? fsnotify+0x1390/0x1450 [ 336.338839][T21757] ? splice_from_pipe+0x200/0x200 [ 336.343871][T21757] ? splice_shrink_spd+0xb0/0xb0 [ 336.348817][T21757] ? splice_from_pipe+0x200/0x200 [ 336.353973][T21757] direct_splice_actor+0xf7/0x130 [ 336.359014][T21757] splice_direct_to_actor+0x496/0xb00 [ 336.364509][T21757] ? do_splice_direct+0x3d0/0x3d0 [ 336.369546][T21757] ? pipe_to_sendpage+0x300/0x300 [ 336.374581][T21757] ? rw_verify_area+0x1c2/0x360 [ 336.379431][T21757] do_splice_direct+0x279/0x3d0 [ 336.384295][T21757] ? splice_direct_to_actor+0xb00/0xb00 [ 336.390024][T21757] ? security_file_permission+0x157/0x350 [ 336.395748][T21757] do_sendfile+0x89d/0x1110 [ 336.400251][T21757] ? compat_writev+0x390/0x390 [ 336.405396][T21757] ? __kasan_check_write+0x14/0x20 [ 336.410552][T21757] ? fput_many+0x47/0x1a0 [ 336.414886][T21757] __x64_sys_sendfile64+0x1ae/0x220 [ 336.420083][T21757] ? __ia32_sys_sendfile+0x240/0x240 [ 336.425375][T21757] ? syscall_return_slowpath+0x6f/0x500 [ 336.430923][T21757] do_syscall_64+0xc0/0x100 [ 336.435461][T21757] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 336.441360][T21757] RIP: 0033:0x45b399 [ 336.445256][T21757] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 336.464861][T21757] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 336.473275][T21757] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 336.481253][T21757] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 336.489227][T21757] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 336.497203][T21757] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 336.505180][T21757] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000014 [ 336.666930][T21207] tipc: 32-bit node address hash set to fbff1eac 09:14:28 executing program 5 (fault-call:10 fault-nth:21): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:28 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) timerfd_gettime(r1, &(0x7f0000000080)) setsockopt$inet_tcp_int(r1, 0x6, 0x22, &(0x7f00000000c0)=0x40, 0x4) lseek(r0, 0x0, 0x0) 09:14:28 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xfcffffff, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:28 executing program 0: unshare(0x44000600) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r0, 0x0, 0x0) lseek(r0, 0xe7, 0x0) getsockopt$TIPC_DEST_DROPPABLE(r0, 0x10f, 0x81, &(0x7f0000000000), &(0x7f0000000040)=0x4) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x90c, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, 0x0) 09:14:28 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x2e, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:28 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xe00, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 336.816066][T21754] FAT-fs (loop5): FAT read failed (blocknr 63) [ 336.830982][ T1959] attempt to access beyond end of device [ 336.836623][ T1959] loop5: rw=1, want=78, limit=63 [ 336.844976][ T1959] attempt to access beyond end of device [ 336.853205][ T1959] loop5: rw=1, want=79, limit=63 [ 336.858225][ T1959] attempt to access beyond end of device [ 336.864029][ T1959] loop5: rw=1, want=80, limit=63 [ 336.869086][ T1959] attempt to access beyond end of device [ 336.874875][ T1959] loop5: rw=1, want=81, limit=63 [ 336.879452][T21764] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 336.880083][ T1959] attempt to access beyond end of device [ 336.901226][ T1959] loop5: rw=1, want=130, limit=63 [ 336.906301][ T1959] attempt to access beyond end of device [ 336.909218][T21765] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 336.912113][ T1959] loop5: rw=1, want=131, limit=63 [ 336.924411][ T1959] attempt to access beyond end of device [ 336.931463][ T1959] loop5: rw=1, want=132, limit=63 [ 336.932358][T21765] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 336.936523][ T1959] attempt to access beyond end of device [ 336.944026][ T1938] tipc: Disabling bearer [ 336.949715][ T1959] loop5: rw=1, want=133, limit=63 [ 336.955131][ T1938] tipc: Left network mode [ 336.960125][ T1959] attempt to access beyond end of device [ 336.970180][ T1959] loop5: rw=1, want=142, limit=63 [ 336.975607][ T1959] attempt to access beyond end of device [ 336.981390][ T1959] loop5: rw=1, want=143, limit=63 [ 336.986461][ T1959] attempt to access beyond end of device [ 336.990501][T21770] tipc: Enabling of bearer rejected, failed to enable media [ 336.992235][ T1959] loop5: rw=1, want=144, limit=63 [ 337.006089][ T1959] attempt to access beyond end of device [ 337.011894][ T1959] loop5: rw=1, want=145, limit=63 09:14:29 executing program 2: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/checkreqprot\x00', 0x62140, 0x0) r1 = getgid() fchownat(r0, &(0x7f00000000c0)='./file0\x00', 0xee00, r1, 0x100) unshare(0x7f72acea3662fcd3) ioctl$PIO_SCRNMAP(0xffffffffffffffff, 0x4b41, &(0x7f0000000000)="66802e2330f10b9f01ca1fa67f9b38c2c1b660af7cc76d50c9bdd67fdfe3921919ca74476429aa805706abcb65f0c8599bc06d1b3954903c2a77d04dca") r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r2, 0x0, 0x0) 09:14:29 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x3a, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 337.015823][T21771] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 337.022646][ T1959] attempt to access beyond end of device [ 337.038092][ T1959] loop5: rw=1, want=11929, limit=63 09:14:29 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x1100, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:29 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xfe80ffff, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 337.067533][ T1938] tipc: Disabling bearer [ 337.072837][ T1959] attempt to access beyond end of device [ 337.073150][ T1938] tipc: Left network mode [ 337.078508][ T1959] loop5: rw=1, want=63513, limit=63 [ 337.089496][ T1938] tipc: Disabling bearer [ 337.095327][ T1938] tipc: Left network mode 09:14:29 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, 0xffffffffffffffff) r1 = accept$unix(r0, &(0x7f0000000080)=@abs, &(0x7f0000000000)=0x6e) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x41, &(0x7f0000000100)=0x8, 0x4) lseek(r0, 0x0, 0x0) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/hash_stats\x00', 0x0, 0x0) getrlimit(0x1, &(0x7f0000000200)) getsockopt$inet_mreqsrc(r2, 0x0, 0x28, &(0x7f0000000180)={@remote, @broadcast, @dev}, &(0x7f00000001c0)=0xc) [ 337.120895][T21781] tipc: Enabling of bearer rejected, failed to enable media [ 337.141484][T21785] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 337.154645][T21785] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:14:29 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x48, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 337.172778][T21786] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 337.228145][T21791] tipc: Started in network mode [ 337.233083][T21791] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 337.244377][T21791] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 337.252797][T21791] tipc: Enabled bearer , priority 10 [ 337.259039][T21794] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 337.270186][T21794] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 337.517072][T21802] FAULT_INJECTION: forcing a failure. [ 337.517072][T21802] name failslab, interval 1, probability 0, space 0, times 0 [ 337.530420][T21802] CPU: 1 PID: 21802 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 337.540684][T21802] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 337.550739][T21802] Call Trace: [ 337.554052][T21802] dump_stack+0x1b0/0x228 [ 337.558379][T21802] ? devkmsg_release+0x127/0x127 [ 337.563340][T21802] ? __kasan_check_read+0x11/0x20 [ 337.568357][T21802] ? show_regs_print_info+0x18/0x18 [ 337.573561][T21802] should_fail+0x6fb/0x860 [ 337.577976][T21802] ? setup_fault_attr+0x2b0/0x2b0 [ 337.583202][T21802] ? current_time+0x2e0/0x2e0 [ 337.587972][T21802] __should_failslab+0x11a/0x160 [ 337.592997][T21802] ? kmalloc_array+0x32/0x60 [ 337.597583][T21802] should_failslab+0x9/0x20 [ 337.602355][T21802] __kmalloc+0x64/0x310 [ 337.606520][T21802] kmalloc_array+0x32/0x60 [ 337.610936][T21802] iter_file_splice_write+0x21d/0xf20 [ 337.616301][T21802] ? __sb_end_write+0xa8/0xf0 [ 337.620985][T21802] ? touch_atime+0x22e/0x270 [ 337.625575][T21802] ? current_time+0x2e0/0x2e0 [ 337.630244][T21802] ? fsnotify+0x1390/0x1450 [ 337.634852][T21802] ? splice_from_pipe+0x200/0x200 [ 337.639908][T21802] ? splice_shrink_spd+0xb0/0xb0 [ 337.644841][T21802] ? splice_from_pipe+0x200/0x200 [ 337.649872][T21802] direct_splice_actor+0xf7/0x130 [ 337.654899][T21802] splice_direct_to_actor+0x496/0xb00 [ 337.660278][T21802] ? do_splice_direct+0x3d0/0x3d0 [ 337.665309][T21802] ? pipe_to_sendpage+0x300/0x300 [ 337.670338][T21802] ? rw_verify_area+0x1c2/0x360 [ 337.675186][T21802] do_splice_direct+0x279/0x3d0 [ 337.680057][T21802] ? splice_direct_to_actor+0xb00/0xb00 [ 337.685687][T21802] ? security_file_permission+0x157/0x350 [ 337.691407][T21802] do_sendfile+0x89d/0x1110 [ 337.695913][T21802] ? compat_writev+0x390/0x390 [ 337.700702][T21802] ? __kasan_check_write+0x14/0x20 [ 337.705808][T21802] ? fput_many+0x47/0x1a0 [ 337.710128][T21802] __x64_sys_sendfile64+0x1ae/0x220 [ 337.715448][T21802] ? __ia32_sys_sendfile+0x240/0x240 [ 337.720739][T21802] ? syscall_return_slowpath+0x6f/0x500 [ 337.726286][T21802] do_syscall_64+0xc0/0x100 [ 337.730787][T21802] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 337.736672][T21802] RIP: 0033:0x45b399 [ 337.740569][T21802] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 337.762255][T21802] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 337.770667][T21802] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 337.778640][T21802] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 337.786738][T21802] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 337.794705][T21802] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 337.802969][T21802] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000015 09:14:30 executing program 5 (fault-call:10 fault-nth:22): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:30 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) 09:14:30 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x4c, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:30 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xfec0ffff, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:30 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x1200, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:30 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/rt_cache\x00') sendmsg$IPVS_CMD_ZERO(r1, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000080)={0x168, 0x0, 0x666105dd242d0e0c, 0x70bd2c, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0x28, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@loopback}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x25}]}, @IPVS_CMD_ATTR_SERVICE={0x4c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@loopback}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x6b}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x34}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'fo\x00'}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x4, 0x9}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0xc}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x33}]}, @IPVS_CMD_ATTR_DEST={0x60, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x400}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xfffffffa}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x2dc}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x525}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x7}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@multicast1}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x9}]}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x4}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x6}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x6, 0xb, 0xa}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e21}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xffffffff}, @IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x74}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e24}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e21}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x4}]}, 0x168}, 0x1, 0x0, 0x0, 0x4000090}, 0x20000004) [ 338.122646][T21799] FAT-fs (loop5): FAT read failed (blocknr 63) [ 338.137324][ T1959] attempt to access beyond end of device [ 338.148214][ T1959] loop5: rw=1, want=78, limit=63 [ 338.161306][ T1959] buffer_io_error: 38 callbacks suppressed [ 338.161314][ T1959] Buffer I/O error on dev loop5, logical block 77, lost async page write [ 338.175965][ T1959] attempt to access beyond end of device [ 338.182870][ T1959] loop5: rw=1, want=79, limit=63 [ 338.187858][ T1959] Buffer I/O error on dev loop5, logical block 78, lost async page write [ 338.196627][ T1959] attempt to access beyond end of device [ 338.201370][T21810] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 338.202822][ T1959] loop5: rw=1, want=80, limit=63 [ 338.214030][T21810] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 338.215039][ T1959] Buffer I/O error on dev loop5, logical block 79, lost async page write [ 338.230586][ T1959] attempt to access beyond end of device [ 338.237473][ T1959] loop5: rw=1, want=81, limit=63 [ 338.239330][T21814] tipc: Enabling of bearer rejected, failed to enable media [ 338.243319][ T1959] Buffer I/O error on dev loop5, logical block 80, lost async page write [ 338.255173][T21812] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 338.259948][ T1959] attempt to access beyond end of device [ 338.281064][ T1959] loop5: rw=1, want=130, limit=63 [ 338.286118][ T1959] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 338.295641][ T1959] attempt to access beyond end of device [ 338.301909][ T1959] loop5: rw=1, want=131, limit=63 [ 338.307068][ T1959] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 338.315922][ T1959] attempt to access beyond end of device 09:14:30 executing program 0: unshare(0x1e000c00) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) [ 338.325085][ T1959] loop5: rw=1, want=132, limit=63 [ 338.331305][ T1959] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 338.343837][ T1959] attempt to access beyond end of device [ 338.350495][ T1959] loop5: rw=1, want=133, limit=63 [ 338.355932][T21821] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 338.363212][ T1959] Buffer I/O error on dev loop5, logical block 132, lost async page write 09:14:30 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x5f, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 338.372070][ T1959] attempt to access beyond end of device [ 338.377701][ T1959] loop5: rw=1, want=142, limit=63 [ 338.379177][ T4586] tipc: 32-bit node address hash set to fbff1eac [ 338.387806][T21821] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 338.396921][ T1959] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 338.405753][ T1959] attempt to access beyond end of device [ 338.412590][ T1959] loop5: rw=1, want=143, limit=63 09:14:30 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) ioctl$USBDEVFS_RESET(r0, 0x5514) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r1, 0x0, 0x0) lseek(r1, 0xe7, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000280)={0x0, r1, 0x6}, 0x10) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) ioctl$USBDEVFS_CLAIMINTERFACE(r0, 0x8004550f, &(0x7f0000000380)=0xff) read(r2, 0x0, 0x0) lseek(r2, 0xe7, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r2, &(0x7f0000000340)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000300)={0x0}, 0x1, 0x0, 0x0, 0x40000000}, 0x20080845) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x200000, 0x0) sendmsg$NFNL_MSG_CTHELPER_NEW(r3, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="58010000000901040000000000000000050000084000020014000180080001000000000708000200ac1414bb060003400000000006000340000200000c00028005000100840000000c000280050001003a0000000800064000000001080005400000001f440002002c00018014000300f2000000000000000000ffffac14142414000400fe88000000000000000000000000000114000180080001007f000001080002007f000001880002000c00028005000100840000001400018008000100000001ff08000200ac1414aa060003400004000006000340000300002c000180140003000000000000000000000000000000000014000400ff010000000000000000000000000001060003400002000006000340000000000600034000040000060003400002000006000340000100000c00048008000140000000000900010073797a310000000008000640000000000800064000000001"], 0x158}, 0x1, 0x0, 0x0, 0x24}, 0x8080) openat$cgroup_procs(r2, &(0x7f00000003c0)='tasks\x00', 0x2, 0x0) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) [ 338.422049][ T1959] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 338.435375][ T1959] attempt to access beyond end of device [ 338.443825][T21819] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 338.459463][ T1959] loop5: rw=1, want=144, limit=63 [ 338.464529][ T1959] attempt to access beyond end of device [ 338.470471][ T1959] loop5: rw=1, want=145, limit=63 [ 338.478743][ T1959] attempt to access beyond end of device [ 338.484979][ T1959] loop5: rw=1, want=5921, limit=63 09:14:30 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x2000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:30 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xfeffffff, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 338.523778][ T1959] attempt to access beyond end of device [ 338.530907][ T1959] loop5: rw=1, want=46529, limit=63 [ 338.555589][ T1959] attempt to access beyond end of device [ 338.561336][ T1959] loop5: rw=1, want=63513, limit=63 [ 338.571435][T21828] tipc: Started in network mode [ 338.578691][T21828] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 338.593184][T21828] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 338.602262][T21828] tipc: Enabled bearer , priority 10 [ 338.608626][T21833] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 338.617123][T21833] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:14:30 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x60, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 338.631743][T21832] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 338.694634][T21839] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 338.703674][T21839] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 338.714058][ T1938] tipc: Disabling bearer [ 338.719600][ T1938] tipc: Left network mode [ 338.726701][T21837] tipc: Started in network mode [ 338.736131][T21837] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 338.745546][T21837] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 338.753723][T21837] tipc: Enabled bearer , priority 10 [ 338.760733][ T1938] tipc: Disabling bearer [ 338.766145][ T1938] tipc: Left network mode [ 338.988307][T21846] FAULT_INJECTION: forcing a failure. [ 338.988307][T21846] name failslab, interval 1, probability 0, space 0, times 0 [ 339.001432][T21846] CPU: 0 PID: 21846 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 339.011712][T21846] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 339.021764][T21846] Call Trace: [ 339.025054][T21846] dump_stack+0x1b0/0x228 [ 339.029382][T21846] ? devkmsg_release+0x127/0x127 [ 339.034452][T21846] ? __kasan_check_read+0x11/0x20 [ 339.039486][T21846] ? show_regs_print_info+0x18/0x18 [ 339.044689][T21846] should_fail+0x6fb/0x860 [ 339.049105][T21846] ? setup_fault_attr+0x2b0/0x2b0 [ 339.054116][T21846] ? current_time+0x2e0/0x2e0 [ 339.058789][T21846] __should_failslab+0x11a/0x160 [ 339.063727][T21846] ? kmalloc_array+0x32/0x60 [ 339.068312][T21846] should_failslab+0x9/0x20 [ 339.073416][T21846] __kmalloc+0x64/0x310 [ 339.077650][T21846] kmalloc_array+0x32/0x60 [ 339.082164][T21846] iter_file_splice_write+0x21d/0xf20 [ 339.087975][T21846] ? __sb_end_write+0xa8/0xf0 [ 339.092793][T21846] ? touch_atime+0x22e/0x270 [ 339.097381][T21846] ? current_time+0x2e0/0x2e0 [ 339.102139][T21846] ? fsnotify+0x1390/0x1450 [ 339.106642][T21846] ? splice_from_pipe+0x200/0x200 [ 339.111672][T21846] ? splice_shrink_spd+0xb0/0xb0 [ 339.116605][T21846] ? splice_from_pipe+0x200/0x200 [ 339.121723][T21846] direct_splice_actor+0xf7/0x130 [ 339.126743][T21846] splice_direct_to_actor+0x496/0xb00 [ 339.132107][T21846] ? do_splice_direct+0x3d0/0x3d0 [ 339.137126][T21846] ? pipe_to_sendpage+0x300/0x300 [ 339.142151][T21846] ? rw_verify_area+0x1c2/0x360 [ 339.147002][T21846] do_splice_direct+0x279/0x3d0 [ 339.151865][T21846] ? splice_direct_to_actor+0xb00/0xb00 [ 339.157419][T21846] ? security_file_permission+0x157/0x350 [ 339.163336][T21846] do_sendfile+0x89d/0x1110 [ 339.167927][T21846] ? compat_writev+0x390/0x390 [ 339.172789][T21846] ? __kasan_check_write+0x14/0x20 [ 339.177896][T21846] ? fput_many+0x47/0x1a0 [ 339.182229][T21846] __x64_sys_sendfile64+0x1ae/0x220 [ 339.187427][T21846] ? __ia32_sys_sendfile+0x240/0x240 [ 339.192892][T21846] ? syscall_return_slowpath+0x6f/0x500 [ 339.198453][T21846] do_syscall_64+0xc0/0x100 [ 339.202963][T21846] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 339.208858][T21846] RIP: 0033:0x45b399 [ 339.212754][T21846] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 339.232498][T21846] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 339.240944][T21846] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 339.249498][T21846] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 339.257476][T21846] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 339.265450][T21846] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 339.273607][T21846] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000016 09:14:31 executing program 5 (fault-call:10 fault-nth:23): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:31 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x2500, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:31 executing program 2: unshare(0x44000600) ioctl$BLKTRACETEARDOWN(0xffffffffffffffff, 0x1276, 0x0) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000080)={0x41}, 0x10) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x40000, 0x0) fcntl$setstatus(r1, 0x4, 0x4400) 09:14:31 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xff000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:31 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x68, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:31 executing program 0: r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x3, 0x5, 0x11, "4bc842769a78b830052a3fc5105f1cb64a40492a162c6d89acf28c01c315e88dd5b21ca1ecf419ef8a4838ec7e1653724c15b35cbeda7415379f7cd6a10f86aa", "c48c86fd7678eae2b489394ceffca9217485d48a41077c2616464865986810ec44d95683bca8d4dd077f63cda01d346a6b2d83941355d3783639913a76112350", "c84762d65dd08c14d7e9eb9d676d9b15278e53bc712ebf76d9ec8de0e7508c00", [0x400000000000000, 0x7]}) unshare(0x44000600) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, 0x0) [ 339.571464][T21843] FAT-fs (loop5): FAT read failed (blocknr 63) [ 339.586558][ T1959] attempt to access beyond end of device [ 339.593536][ T1959] loop5: rw=1, want=78, limit=63 [ 339.599511][ T1959] attempt to access beyond end of device [ 339.605174][ T1959] loop5: rw=1, want=79, limit=63 [ 339.610289][ T1959] attempt to access beyond end of device [ 339.615946][ T1959] loop5: rw=1, want=80, limit=63 [ 339.621069][ T1959] attempt to access beyond end of device [ 339.626948][ T1959] loop5: rw=1, want=81, limit=63 [ 339.632162][ T1959] attempt to access beyond end of device [ 339.632615][T21848] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 339.637842][ T1959] loop5: rw=1, want=130, limit=63 [ 339.658475][ T1959] attempt to access beyond end of device [ 339.660290][T21854] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 339.664261][ T1959] loop5: rw=1, want=131, limit=63 [ 339.673295][T21854] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 339.676147][ T1959] attempt to access beyond end of device [ 339.676165][ T1959] loop5: rw=1, want=132, limit=63 [ 339.689252][T21858] tipc: Enabling of bearer rejected, failed to enable media [ 339.694137][ T1959] attempt to access beyond end of device [ 339.708084][ T1959] loop5: rw=1, want=133, limit=63 [ 339.713184][ T1959] attempt to access beyond end of device [ 339.718962][ T1959] loop5: rw=1, want=142, limit=63 [ 339.724075][ T1959] attempt to access beyond end of device [ 339.730049][ T1959] loop5: rw=1, want=143, limit=63 [ 339.735279][ T1959] attempt to access beyond end of device [ 339.741127][ T1959] loop5: rw=1, want=144, limit=63 [ 339.746223][ T1959] attempt to access beyond end of device [ 339.751969][ T1959] loop5: rw=1, want=145, limit=63 [ 339.756159][T21860] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:14:31 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/vmstat\x00', 0x0, 0x0) lseek(r0, 0x0, 0x2) 09:14:31 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x6c, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 339.759734][ T1959] attempt to access beyond end of device [ 339.778375][ T1959] loop5: rw=1, want=4961, limit=63 [ 339.803367][T21862] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 339.809796][ T1959] attempt to access beyond end of device 09:14:31 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x4000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:31 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xff040000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 339.813609][T21862] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 339.815970][ T1959] loop5: rw=1, want=52601, limit=63 [ 339.828961][ T1959] attempt to access beyond end of device [ 339.834631][ T1959] loop5: rw=1, want=63513, limit=63 [ 339.849227][T17009] tipc: 32-bit node address hash set to fbff1eac [ 339.858507][T21869] tipc: Enabling of bearer rejected, failed to enable media 09:14:31 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x74, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:31 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r1, 0x0, 0x0) lseek(r1, 0xe7, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00') sendmsg$NL80211_CMD_STOP_SCHED_SCAN(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xc0, r2, 0x2, 0x70bd2d, 0x25dfdbfc, {}, [@NL80211_ATTR_BSSID={0xa, 0xf5, @local}, @NL80211_ATTR_SCHED_SCAN_DELAY={0x8, 0xdc, 0xc705}, @NL80211_ATTR_SCHED_SCAN_MATCH={0x2c, 0x84, 0x0, 0x1, [@NL80211_SCHED_SCAN_MATCH_ATTR_RSSI={0x8, 0x2, 0x81}, @NL80211_SCHED_SCAN_MATCH_ATTR_BSSID={0xa, 0x5, @local}, @NL80211_SCHED_SCAN_MATCH_ATTR_RSSI={0x8, 0x2, 0x3f}, @NL80211_SCHED_SCAN_MATCH_ATTR_BSSID={0xa, 0x5, @remote}]}, @NL80211_ATTR_SCAN_FREQUENCIES={0x3c, 0x2c, 0x0, 0x1, [{0x8}, {0x8, 0x0, 0x191}, {0x8, 0x0, 0x20}, {0x8, 0x0, 0x81}, {0x8, 0x0, 0x8}, {0x8, 0x0, 0xe8d5}, {0x8, 0x0, 0x81}]}, @NL80211_ATTR_SCHED_SCAN_MATCH={0x10, 0x84, 0x0, 0x1, [@NL80211_SCHED_SCAN_MATCH_ATTR_BSSID={0xa, 0x5, @broadcast}]}, @NL80211_ATTR_BSSID={0xa, 0xf5, @broadcast}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x3}, @NL80211_ATTR_SCHED_SCAN_MULTI={0x4}, @NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI={0x5, 0xf6, 0xfc}]}, 0xc0}, 0x1, 0x0, 0x0, 0x800}, 0x8000) [ 339.910301][T21873] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 339.918101][T21873] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 339.937627][T21875] tipc: Started in network mode [ 339.948672][T21875] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 339.970429][T21875] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 339.981359][T21875] tipc: Enabled bearer , priority 10 [ 340.025096][T21881] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 340.039673][T21881] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 340.049021][T21875] tipc: Enabling of bearer rejected, already enabled [ 340.298620][T21889] FAULT_INJECTION: forcing a failure. [ 340.298620][T21889] name failslab, interval 1, probability 0, space 0, times 0 [ 340.311655][T21889] CPU: 1 PID: 21889 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 340.321824][T21889] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 340.331909][T21889] Call Trace: [ 340.335211][T21889] dump_stack+0x1b0/0x228 [ 340.339555][T21889] ? devkmsg_release+0x127/0x127 [ 340.344502][T21889] ? __kasan_check_read+0x11/0x20 [ 340.349536][T21889] ? show_regs_print_info+0x18/0x18 [ 340.354738][T21889] should_fail+0x6fb/0x860 [ 340.359184][T21889] ? setup_fault_attr+0x2b0/0x2b0 [ 340.365085][T21889] ? current_time+0x2e0/0x2e0 [ 340.369908][T21889] __should_failslab+0x11a/0x160 [ 340.374906][T21889] ? kmalloc_array+0x32/0x60 [ 340.379531][T21889] should_failslab+0x9/0x20 [ 340.384052][T21889] __kmalloc+0x64/0x310 [ 340.388263][T21889] kmalloc_array+0x32/0x60 [ 340.392694][T21889] iter_file_splice_write+0x21d/0xf20 [ 340.398164][T21889] ? __sb_end_write+0xa8/0xf0 [ 340.402846][T21889] ? touch_atime+0x22e/0x270 [ 340.407544][T21889] ? current_time+0x2e0/0x2e0 [ 340.412220][T21889] ? fsnotify+0x1390/0x1450 [ 340.416771][T21889] ? splice_from_pipe+0x200/0x200 [ 340.421790][T21889] ? splice_shrink_spd+0xb0/0xb0 [ 340.426731][T21889] ? splice_from_pipe+0x200/0x200 [ 340.431763][T21889] direct_splice_actor+0xf7/0x130 [ 340.436787][T21889] splice_direct_to_actor+0x496/0xb00 [ 340.442182][T21889] ? do_splice_direct+0x3d0/0x3d0 [ 340.447201][T21889] ? pipe_to_sendpage+0x300/0x300 [ 340.452226][T21889] ? rw_verify_area+0x1c2/0x360 [ 340.457080][T21889] do_splice_direct+0x279/0x3d0 [ 340.461926][T21889] ? splice_direct_to_actor+0xb00/0xb00 [ 340.467590][T21889] ? security_file_permission+0x157/0x350 [ 340.473423][T21889] do_sendfile+0x89d/0x1110 [ 340.477922][T21889] ? compat_writev+0x390/0x390 [ 340.482698][T21889] ? __kasan_check_write+0x14/0x20 [ 340.487811][T21889] ? fput_many+0x47/0x1a0 [ 340.492150][T21889] __x64_sys_sendfile64+0x1ae/0x220 [ 340.497349][T21889] ? __ia32_sys_sendfile+0x240/0x240 [ 340.502811][T21889] ? syscall_return_slowpath+0x6f/0x500 [ 340.508369][T21889] do_syscall_64+0xc0/0x100 [ 340.512880][T21889] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 340.518805][T21889] RIP: 0033:0x45b399 [ 340.522859][T21889] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 340.542597][T21889] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 340.551012][T21889] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 340.559268][T21889] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 340.567518][T21889] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 340.575754][T21889] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 340.583870][T21889] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000017 09:14:32 executing program 5 (fault-call:10 fault-nth:24): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:32 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x4800, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:32 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xffff0000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:32 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x7a, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:32 executing program 0: r0 = accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0x0, 0x2711}, 0x10, 0x80800) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000040)={'veth0_macvtap\x00', {0x2, 0x4e23, @multicast2}}) unshare(0x44000600) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, 0x0) 09:14:32 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x100, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r0, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r2, 0x0, 0x0) lseek(r2, 0xe7, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000004c0)={{{@in=@initdev, @in6=@ipv4={[], [], @remote}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@multicast1}}, &(0x7f00000005c0)=0xe8) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000080)='./file0\x00', 0xffffffffffffd260, 0x6, &(0x7f0000000400)=[{&(0x7f0000000880)="44da0066898c150ac8d3313387d84ce4c04c51ea7d78fe728b83cb21e4de48af264338e19fca21d71dddb65eeafbaf84f8cf4b470f3e7e72ae9db31dbf14dc146a6140f326c0dcc48452ee1d36c28e33ade8130da031a6caaf9504e6ceb3349262a58df81d22be381f7a02a5aea430df4b90ac4485bac812cf2d4659100ad23ab8176a62f6e176b745094997456bd1de904c1f6b4f380f6004e4bfc4a31253fe914ce01bd7a83686f9c63390a4cbc234475a2e95768b3ea5d2703353cc2cc45a57911421a60ab20a4e08b58c0979997ed376b0f5a63adee04669a5353b6245c1c8ea405a490d6bbc0b428f23eb4f6d88b9d4d098265468ea2b63e52340681501832f2033215affaf8e9d8d545b25832eb30162072b8f9dca45433e86bfe9e5fad0733672176905c82930c8642744caaf69cb99ddd36f0041af61e6fc50f33fbd8c4e894c12866b5e7c11ec4d78c2093bf7de7e09c86bb79936fd3424af4e12e33a882a54c81ae9350e417dd0afa1e118dc0049596a6131d14414685a41866cf286a68610462e061c8999ae741a5543dd4583f625291a0c131be232df81e427726e6067742b7adec460ab4e57ff98e643af7dc1b5ffbb572c2894f9636729e233ba1e60567d3f1f01c7b48765fcc38f76faf4e4333d53ba9bbc5b545f89ec7d88a8fff0f4a7c4f529c114f1cd76bffd2b179942a1761d24156c7be31f1f28977321b46ccb418ddda95b77dd0486b560f41ea96e086aa9ba93cc2bde468c5e38da1de372af6aec9cd5f683c9caf03c5d761327cae0b31435a7f15f1b2c3199732253bd892da6cbd4dfff5341e83353bae1d53058cd84098cafe4663dd35f4a124d15f7450896de76806c6831bbfdfb33d32f8c73a8cdc78d75b8da6361aff850085b15e1e8248c384eaffa725356f00a65c1d1ed954ec5a0b4b93db76d88f669ad3e86761de505df9066090068a11017d55b816e07a5d1458e5a65921d0a332a49e93d76ded7bdf377a72a3aa80798082ec36762e6104651ee2f0d0e9870cefd478d6457db15b30a00a505f399cb5acb0dd4c76b402cb625fa0e80d895e0cabe8f78f7b5194aada41ddb9f0b88eae25ddfce5049e2577f33af1a8ecaaa304b0fb88632ca14121cb4099c81b7e8bf26dc0b51ced818e949cce23e9cb9042d36fd2561548114ee1ed140ea8083077b9f212cf72456b0820eb6ff43e576815049553d10f664792784b91b4c71bb98f9e279c64e78ff719734a8bbc3abeef1a5e2f6034766ff8a11d38fb7a5813e8aa67aa8b9d3f5f2b45725cde8b095f7c34695ad97b34b1d001bba231dc6a58b2f309132618cbd8f3e889c9e168e9a2eafb7b4f3515d85d636228e0654cfd73542beec4c07493396e040088f378c0f857b2e738a8fd54a77a8141662db87dd8128edb3ac43ca848980f621c725e3d7e4747df2cd396e3b3b96ba0b7b85a65cd8d72dc60e6d0c3aacb5d5a2daccb2d50373b1cd1618fd2fa6c7217781fb63a2f4c76dbfc20aac6a660767ccb87065f0e141d53dae850b42c280dddf728ef630692fc42a6115bfa3f5f83112343dbbce9fa330131343e163f0973d5fb8117721e9fd37b13e73e77efece23e21785462bb848f731bd96aac1276a5d33099e3e8c75df2d0358092a1247b29f477b8016c1ad7024199cfb775d2299802b05cd3bf17e2b17017683c70c18a20aa86908830379ea7943df4858d2c5261dfe1c0b7ec0562baaea8822ddd02da4fdaf03be2f3339e53a0ff4a71c2b1cba6c79573f32ff62db6b39d84c60c2e0c66db5cb1c183e4b0a1f5761eac941a16e86d5b22d2fe340858494c728bbdc43e067ff99d5ea3879e30b580ff7aa82188472c81981f6ec7d0a0bbafcda7f5f15b60e7365b008723a64966b074f6e04467bbb72cd5e765889ac9ba04b834d7682ef3703da810ecfc549f982b9da0d75bd3fa5d5300fddc75689858df2e1932a464717710ed3a041cb1a484669c4a6b19310ebd8ecb406fe14776ed33d0f6582da11b32a16483bf791a2152b28b95dab2635d1708765019ac8280f4546931fcd0da4a7362b48b2b273ce746c3f87792c864026c3c3b67a3f9c72cdf20a2dc058435c5ac5b9dfb66cb1fb0ea1eecf89dc5b3f778d66a83f6ebde05fe2c9c89c0fe074e03a6107d429c3a97019d18c977ec3fb8091d291c2a36e7b9c51b8eea859802a0b25eb41c85e92f83a78e625ae9112656f6d5469ad207a38cf575f592a4063598c0200a5907b67ab7d9649d124f60829cd714eed8d8a9a281842afd2d3f8843c9d8398b0355acd079e68dab9bf880d3cfbb28980dde7a6f31007f0c614ba2a92e17fa2e2e4e03a07579ba6f01039f268be986c7275940939d90b51162f0db9fbdda44851a4e83fe9b51c5948512702b8f126b80d79a42755cc7740e75d53a3584705ad4234a13df83b228827f70f654b046047a2699cb0aa80b2e0260577faaa223e4909e2328793a48b89b4eee8c2a1906364f86c2c4cdefe67ab18e1d08efa86f30e7d69ecdee2fafbde4026bfa8609fe5089cf95355daabe69d9898af20cea4ea9956953c8ee7be7b9911c16d7f9d29273069011e893de3c29bc3f5dc351014732b839ce705b547c4ff7c8447fbd0d2e44133a5f357d3e556e2aa9404bd75df988d672cd895ba7f7a2c781375670a1150b1c89476e0529b669195950269743c958874b957cab14b1fff9a482d3e9c5bfb0098ce62ea46c15376254f26f000db244875e4aff99fa5e15abf1a7588756daa02bea92e94db8a00a0a6bfd3173abbcba7c7dc3fee21d886514e5d1b93482d77148a0a8a2ac3862e041c523d577cbc1233e8e435b6f9f1e97786d89988e6820ff25008f6aaf567e19aee37c8fa75cca7ab9ff0fdce6209272108c308065f6a0e5910173215ee27418ffd0e34645096cb2dba4f6c21c946ea6d16c51eef469268a0149531ae5bdac9a85a6904c9d963e307e7d6b21a98dfd19124a0511cad9e7b1c6af15ac86497108d9c8c64bbdb0a33ec165d689dc7ecb6e2792857003e07b129500a9a54310c3869d5d293a07230fd917926276e1aca828b3f26a867d9e190ff369533909a09ab792adbac86cb9f5ca19114350e68dc0a249a1c5850bd712912d5ff7fd812e154b32eb89eb126f9065b38197635334464b95f2fcc1012ec454b85ae8232fe28c84c660887ae75c8cf59f96a4591815f2c1e155645a616152985a87ced6f8f0442ffa6949294658aca60963847df5f12c029ec163a80eb9c85b4244417529bd94a0f7f5c67604d6518518db1552b5110b068870d738068b0de6e9756ff17a17c2611738ebfc81284db7183461cc553e7637d97432ba65a3dc7db7313239119ff8ae973f42f4ba3a0acf88557d03cc2607551b35b35c45bc012d0e569b24248ae894f7a294926a528a107bf8c998213aca5492a425130c99a60679298af6552dc6545811b5cb87c4c0d149b1e9ae9d85e0828fd71d77c59b0e08f46846c08f3bebfb4b89fdace2f56ff903fae9539588c0ecdc7a420a9c376aacef0aefac8d199d5fa4f6199404ca875b905dd79347d1e2863959347240a71c868285c558b53d5d5526e3b4645813b5d9e6a58758d15715e021a1b1c0802108d8909c4cc226a5fb266e9bf2d743cb6434d916333382b212b986c9aefb08ec57aa35b17db19b28015ccbbc465f03c7be4c653cd0df8088bf3adea0c16a64a21762b7979f1122c348152b4603da17301e867cb71e1859b402093ad7cfb8eb6b1f9bc10b86dbe6403ef735fe8bf855b26eecd1f528a7c88331ca014991990b80dc9b59cf03bf55cdc5500b32f0c2b93ada2483e45b24844236e89e5d2380a57f7687805f6e6ff80e8eca4b4612cb2878c9cf6edaf2233f5aaa039dd10a018d5e0804f9bd902c64590f5e39f5a4592dac00824f4171d149253251521f7c87222dda7ac4e386d133d2997523e411a13c36612597d5d6abd685ef9706fc78b04b7ab4e339ee930886e6a258dbab8cd4301086cc5a280f9ff67ce191195b5d040618102c9fc14963161f36e92a1f44865785e1f740ea0a95d78de9e2a23006b7c0566008c43413d9dfc4b8b9a417da17c3015820d63c1585024ed5e6d69efe1283df9b60dace3c47d5fe54f9fef15dc48f4cf02876d66e3becf156c7681d3682836399586241f692cf8af44902ed4612c15947e4cfcb9b68edcc05aec43dfd566685b88155b61d7cb47ce0ce27e151edbab03f0eed0d532a960f63aa0ffe9268873995c825f9ff16ae17ff91b622636454077e83fdb345c1573ebda2025f18b0f2d3a289bbca47d6ff1f898a7317db045bf30f142cae9224572465194c416be73c3a3f659dee9665e7c2712b10f4995ba5bb63b8de2332288147c38ec32db6290baacd65c739d48cb993cc868732ef61ce8d63b07a77548144f89570325e81853d641c747d0632cfc324e310d656946ecb863046be5b9ce520e5b4da5b65e85a38cbd9e8bd230e4c2b0d753472d97631ddf81464771df1cef9f8b7ebc3adfc56b0e6e725d9e497f953ee4e2283be7c4a5a31a00e853311772b8ec5c2f9d457aac4e8cc0f8c5edcbe2c25d130f4d8180496851c354863de7720b6861ba5e79a4d58ca5c001a63d9397ac506a9a88bf6f81af62677cd4ea1c7a9efe1f0db47bb6ef520a2c8430162ab9f2c8eb8e4f311c1fbccf8366e16fecc19260817e796988073c27a8f739b1e9a22e5eea06f6f1c945005f99e308011d5c081d60f0c2af616b9adb06d767e5f968190a60d747776d3c51c2d1ca7490b1db1ebf52e95f3ca118fa90828a401488863de7dc954540fbdcb9e99b45a53b21945a2cbea0d5f06efe970697a25415413dbd33e9085e83a187abf982410bcb304b91c9e9e9fdfed7c49fe14b435b07117de30d1d1fb083443eca2ee281fe47a7f874dd0e0528a663ca0ba4a7432a90ce14bd44879dac3ec2abc1d09924ba1e3df0cf21cb7cfe2ea9be431e5e70384bba47585b0851cf3bc298a58f2c2e678afb62ac19c6ec6df0e8a5bb44e88c9b3e171429e38e4ee116a7cb84d156293ee6a5067a4cb42f6d2598857b45e5dec8b83a33909f4200939844330a2d1678cc6c5a499968feeaf01c793cdf5de1f983fa6bffdb0239c316f9f4a2e2821ae10cc3fa6c53f42a85c9d3869b77795e8e6ef100a3d3b76683670f816049ebd24d73625afacc8f7ca1ac04b4bf7fb042792f0c9a9ebb6ddeceea6aabc9b4d3937ad5779e56b9f5201be3c1145c348256f6de5496ca885a315c18f31bc09bdae9f2b8a41c60073a114308c8d61b809175b3e52a44da47a6eb746f6f931c2e0f0f8cfcf8e3dd700ae93dfb32e24e68605b6b549ee1edc82369f914614c89408966d04f543a59d2d717423195a7d10617edca78e7203a478e4102d331958cc0bb2d3bbdb3b1cf0185122b945cc2f55744ca1c160ac968648d5b01b0ee6e00d63e996c1caf2a469cf25aa17a376ed1d9cb2ebdb660030799040387aa5f9d289f46d9b6e39f740afdfb10ed3fcde846ac0f074bf8367ced353f827ab7e6f3426bfae03ffd5bb392045536e0ecf016be88f1e20cfe5d058959b79672927549b41e19944b7a4c68a3bb1c5da07d4bd545a4bbabfa5fcfe0b86119cd689251fd661f054cca87902fb589da449199b90c15501e642907412b5948e4d0578304a48f041bd71bee07be9e060546c064dd6d2b22c5b164a23e36a010591348c19db98e48eba2673785ea73b7b10d66f7eb25eb6a8ccdc1d860d21d67f0f7c7c576d471ffe999eb1220e0951755936aa9", 0x1000, 0x9}, {&(0x7f00000000c0)="cc8cc76e138923bf6a560784c6f168843b54fb99892f0a59305aadb11f35afd1b7d7f783a1a44329dc3cd0136005fa9648b1c3af2060f070779205586d87d275f5fab49eed8c4af204e6996d18033846319e3cf639e96ff0", 0x58, 0x80010000000000}, {&(0x7f0000000140)="43324755c979312321eb9f6aaf7859a79ef258a1868f0cb1281100131845e64c44a5f5df749972edb8c8bf9cb7be5a3c33ac8c9f963b19ec75e07d94bbbc8734036cef5daba01a1a5501236bd88c623cf7e9c4857c5b38c324404695062788a57a0be5d3302a10a722ffb54087dc4094ef963174f609d6f9ed109ee281bbce4f72cde90e265912acc1c6547e8565", 0x8e, 0x81}, {&(0x7f0000000200)="915403749c7e1656fa273b02ca02d93d532aaf41f3fb50b0693779fdc61ef14ca570e5215cbd221d42c3bdf2291eba7ce3ed3b8505fe26f131c95ab9e674bf830dd72b4dd0727d68eb0b3e6163c3a20c1ec5149bc39028a6cab623ffb7de4ec7dcf1b1e21f4f51fb06a08494eb20de0e5142ad21bcf658227e2a358ce8cf01e702fced1a5c20107b6041a3f5df4ce62c35506febb7f6b8baf04a3fb5", 0x9c, 0xdf0dd32}, {&(0x7f00000002c0)="3a4771732f06577c2e5c5770c0bc91166f1a3858a2d04a9cb7d8a347e42f6a3691eb95af803718f1a4ece23ed4920f53902b61976985517c00554cddaab09f56bcf9f50963990747063d18f35d686911eb83d84d127aa7e06528fcdf2b7d85c7914e0abe27cfb703352b956fda8f8b85d5f5012c82c22ee0476875f061a5963a87517a918d4588bcaadaed5b878894420d90f975ca59210ae0674e790847de5ff80e98b95180acea93f50cc0c438e2925efd0360d2cb0dfb9ead4f2c13f3901cf015dd3f46be2234554ba2e21a665ba44c9490d08fee1b7a8bbf70775cf374cd4fa520cf79b6c40cd2fa6202e7b0", 0xee, 0x8}, {&(0x7f00000003c0), 0x0, 0x7}], 0x40000, &(0x7f0000000600)={[{@shortname_mixed='shortname=mixed'}, {@shortname_winnt='shortname=winnt'}, {@numtail='nonumtail=0'}, {@fat=@discard='discard'}], [{@smackfsfloor={'smackfsfloor'}}, {@euid_gt={'euid>', r3}}, {@pcr={'pcr', 0x3d, 0x10}}]}) ioctl$USBDEVFS_SUBMITURB(r1, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0xa5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0}) lseek(0xffffffffffffffff, 0x20003ff, 0x0) [ 340.892676][T21886] FAT-fs (loop5): FAT read failed (blocknr 63) [ 340.908054][ T1959] attempt to access beyond end of device [ 340.915506][ T1959] loop5: rw=1, want=78, limit=63 [ 340.926729][ T1959] attempt to access beyond end of device [ 340.932518][ T1959] loop5: rw=1, want=79, limit=63 [ 340.937561][ T1959] attempt to access beyond end of device [ 340.943375][ T1959] loop5: rw=1, want=80, limit=63 [ 340.948429][ T1959] attempt to access beyond end of device [ 340.952294][T21891] net_ratelimit: 2 callbacks suppressed [ 340.952300][T21891] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 340.954176][ T1959] loop5: rw=1, want=81, limit=63 [ 340.980161][ T1959] attempt to access beyond end of device [ 340.983261][T21897] tipc: Started in network mode [ 340.985825][ T1959] loop5: rw=1, want=130, limit=63 [ 340.995760][ T1959] attempt to access beyond end of device [ 340.996445][T21897] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 341.001428][ T1959] loop5: rw=1, want=131, limit=63 [ 341.001458][ T1959] attempt to access beyond end of device [ 341.001464][ T1959] loop5: rw=1, want=132, limit=63 [ 341.001479][ T1959] attempt to access beyond end of device [ 341.001484][ T1959] loop5: rw=1, want=133, limit=63 [ 341.001503][ T1959] attempt to access beyond end of device [ 341.011905][T21897] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 341.015755][ T1959] loop5: rw=1, want=142, limit=63 [ 341.015790][ T1959] attempt to access beyond end of device [ 341.021937][T21897] tipc: Enabled bearer , priority 10 [ 341.026563][ T1959] loop5: rw=1, want=143, limit=63 [ 341.026593][ T1959] attempt to access beyond end of device [ 341.026599][ T1959] loop5: rw=1, want=144, limit=63 [ 341.026613][ T1959] attempt to access beyond end of device [ 341.035195][T21900] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 341.037289][ T1959] loop5: rw=1, want=145, limit=63 [ 341.038821][ T1959] attempt to access beyond end of device [ 341.044317][T21900] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 341.051020][ T1959] loop5: rw=1, want=3033, limit=63 [ 341.064368][ T1959] attempt to access beyond end of device [ 341.090282][T21906] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:14:33 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x9a, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:33 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x4c00, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 341.096374][ T1959] loop5: rw=1, want=28889, limit=63 [ 341.117652][ T1959] attempt to access beyond end of device [ 341.151355][ T137] tipc: 32-bit node address hash set to fbff1eac [ 341.152982][ T1959] loop5: rw=1, want=63513, limit=63 [ 341.185517][T21912] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:14:33 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0xb0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:33 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xffff80fe, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:33 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x6000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 341.308228][T21917] tipc: Started in network mode [ 341.318860][T21917] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 341.361918][T21917] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 341.379591][T21917] tipc: Enabled bearer , priority 10 [ 341.392947][T21920] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 341.401329][T21920] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:14:33 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0xbc, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 341.420546][T21921] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 341.447355][T21922] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 341.492653][T21927] tipc: Started in network mode [ 341.497681][T21927] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 341.507446][T21927] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 341.516143][T21927] tipc: Enabled bearer , priority 10 [ 341.540901][T21928] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 341.551537][T21928] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 341.735028][T21935] FAULT_INJECTION: forcing a failure. [ 341.735028][T21935] name failslab, interval 1, probability 0, space 0, times 0 [ 341.747894][T21935] CPU: 0 PID: 21935 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 341.758043][T21935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 341.768098][T21935] Call Trace: [ 341.771533][T21935] dump_stack+0x1b0/0x228 [ 341.776048][T21935] ? devkmsg_release+0x127/0x127 [ 341.780989][T21935] ? __kasan_check_read+0x11/0x20 [ 341.786018][T21935] ? show_regs_print_info+0x18/0x18 [ 341.791366][T21935] should_fail+0x6fb/0x860 [ 341.795798][T21935] ? setup_fault_attr+0x2b0/0x2b0 [ 341.801265][T21935] ? current_time+0x2e0/0x2e0 [ 341.805946][T21935] __should_failslab+0x11a/0x160 [ 341.810972][T21935] ? kmalloc_array+0x32/0x60 [ 341.815563][T21935] should_failslab+0x9/0x20 [ 341.820062][T21935] __kmalloc+0x64/0x310 [ 341.824284][T21935] kmalloc_array+0x32/0x60 [ 341.828825][T21935] iter_file_splice_write+0x21d/0xf20 [ 341.834199][T21935] ? __sb_end_write+0xa8/0xf0 [ 341.838874][T21935] ? touch_atime+0x22e/0x270 [ 341.843853][T21935] ? current_time+0x2e0/0x2e0 [ 341.848529][T21935] ? fsnotify+0x1390/0x1450 [ 341.853039][T21935] ? splice_from_pipe+0x200/0x200 [ 341.858068][T21935] ? splice_shrink_spd+0xb0/0xb0 [ 341.863007][T21935] ? splice_from_pipe+0x200/0x200 [ 341.868067][T21935] direct_splice_actor+0xf7/0x130 [ 341.873096][T21935] splice_direct_to_actor+0x496/0xb00 [ 341.878477][T21935] ? do_splice_direct+0x3d0/0x3d0 [ 341.883526][T21935] ? pipe_to_sendpage+0x300/0x300 [ 341.888661][T21935] ? rw_verify_area+0x1c2/0x360 [ 341.893528][T21935] do_splice_direct+0x279/0x3d0 [ 341.898590][T21935] ? splice_direct_to_actor+0xb00/0xb00 [ 341.904148][T21935] ? security_file_permission+0x157/0x350 [ 341.909866][T21935] do_sendfile+0x89d/0x1110 [ 341.914379][T21935] ? compat_writev+0x390/0x390 [ 341.919141][T21935] ? __kasan_check_write+0x14/0x20 [ 341.924252][T21935] ? fput_many+0x47/0x1a0 [ 341.928584][T21935] __x64_sys_sendfile64+0x1ae/0x220 [ 341.933784][T21935] ? __ia32_sys_sendfile+0x240/0x240 [ 341.939068][T21935] ? syscall_return_slowpath+0x6f/0x500 [ 341.944615][T21935] do_syscall_64+0xc0/0x100 [ 341.949119][T21935] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 341.955145][T21935] RIP: 0033:0x45b399 [ 341.959048][T21935] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 341.978902][T21935] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 341.987317][T21935] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 341.995727][T21935] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 342.003853][T21935] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 342.011831][T21935] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 342.019799][T21935] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000018 [ 342.089163][ T1938] tipc: Disabling bearer [ 342.094614][ T1938] tipc: Left network mode [ 342.110648][T20527] tipc: 32-bit node address hash set to fbff1eac 09:14:34 executing program 5 (fault-call:10 fault-nth:25): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:34 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) r1 = gettid() ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x3c) ptrace$cont(0x18, r1, 0x0, 0x0) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r1, 0x0, 0x0) ptrace$peeksig(0x4209, r1, &(0x7f0000000000)={0xfffffffffffffffc, 0x1, 0x2}, &(0x7f0000000040)=[{}, {}]) 09:14:34 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x6800, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:34 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) r1 = openat(r0, &(0x7f0000000000)='./file0\x00', 0x20000, 0x123) write$cgroup_pid(r1, &(0x7f0000000080), 0x12) lseek(r0, 0x0, 0x0) 09:14:34 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xffffc0fe, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:34 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0xd6, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 342.308842][T21932] FAT-fs (loop5): FAT read failed (blocknr 63) [ 342.325077][ T1959] attempt to access beyond end of device [ 342.333518][ T1959] loop5: rw=1, want=78, limit=63 [ 342.342108][ T1959] attempt to access beyond end of device [ 342.347760][ T1959] loop5: rw=1, want=79, limit=63 [ 342.358889][ T1959] attempt to access beyond end of device [ 342.362113][T21943] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 342.364918][ T1959] loop5: rw=1, want=80, limit=63 [ 342.388622][ T1938] tipc: Disabling bearer [ 342.388675][ T1959] attempt to access beyond end of device [ 342.394000][ T1938] tipc: Left network mode [ 342.402154][ T1959] loop5: rw=1, want=81, limit=63 09:14:34 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x1, 0x2101) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) ioctl$PIO_CMAP(r0, 0x4b71, &(0x7f0000000000)={0xfdc8, 0x8ee5, 0x0, 0x7, 0x7, 0x3}) lseek(r0, 0x0, 0x0) [ 342.408872][ T1959] attempt to access beyond end of device [ 342.414938][ T1959] loop5: rw=1, want=130, limit=63 [ 342.420486][ T1959] attempt to access beyond end of device [ 342.422149][ T1938] tipc: Disabling bearer [ 342.426147][ T1959] loop5: rw=1, want=131, limit=63 [ 342.426175][ T1959] attempt to access beyond end of device [ 342.436343][ T1938] tipc: Left network mode [ 342.437122][ T1959] loop5: rw=1, want=132, limit=63 [ 342.443781][T21948] tipc: Enabling of bearer rejected, failed to enable media [ 342.447260][ T1959] attempt to access beyond end of device [ 342.466090][ T1959] loop5: rw=1, want=133, limit=63 [ 342.471469][ T1959] attempt to access beyond end of device [ 342.476339][T21946] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 342.477176][ T1959] loop5: rw=1, want=142, limit=63 [ 342.489414][ T1959] attempt to access beyond end of device [ 342.492135][T21946] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 342.495077][ T1959] loop5: rw=1, want=143, limit=63 [ 342.495105][ T1959] attempt to access beyond end of device [ 342.495110][ T1959] loop5: rw=1, want=144, limit=63 [ 342.495122][ T1959] attempt to access beyond end of device [ 342.515187][T21953] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 342.518273][ T1959] loop5: rw=1, want=145, limit=63 [ 342.548475][ T1938] tipc: Disabling bearer [ 342.548551][ T1959] attempt to access beyond end of device 09:14:34 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x6c00, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 342.553911][ T1938] tipc: Left network mode [ 342.559536][ T1959] loop5: rw=1, want=7521, limit=63 [ 342.579178][ T137] tipc: 32-bit node address hash set to fbff1eac [ 342.601423][ T1959] attempt to access beyond end of device 09:14:34 executing program 2: unshare(0x44000600) syz_open_dev$usbfs(0x0, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r1, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lseek(r1, 0x80, 0x0) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff}, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) lseek(r0, 0x0, 0x0) 09:14:34 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xffffff7f, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 342.607099][ T1959] loop5: rw=1, want=58441, limit=63 [ 342.615537][T21958] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 342.629661][ T1959] attempt to access beyond end of device [ 342.636296][ T1959] loop5: rw=1, want=63513, limit=63 09:14:34 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x7400, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 342.683586][T21962] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 342.715412][T21963] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 342.729927][T21963] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:14:34 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0xe0, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 342.772022][T21968] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 342.810321][T21969] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 342.834204][T21969] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 342.887061][T21971] tipc: Started in network mode [ 342.892162][T21971] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 342.927241][T21971] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 342.939738][T21971] tipc: Enabled bearer , priority 10 [ 343.412808][T21980] FAULT_INJECTION: forcing a failure. [ 343.412808][T21980] name failslab, interval 1, probability 0, space 0, times 0 [ 343.438616][T21980] CPU: 0 PID: 21980 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 343.448797][T21980] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 343.458861][T21980] Call Trace: [ 343.462184][T21980] dump_stack+0x1b0/0x228 [ 343.466521][T21980] ? devkmsg_release+0x127/0x127 [ 343.471583][T21980] ? __kasan_check_read+0x11/0x20 [ 343.476621][T21980] ? show_regs_print_info+0x18/0x18 [ 343.481845][T21980] should_fail+0x6fb/0x860 [ 343.486442][T21980] ? setup_fault_attr+0x2b0/0x2b0 [ 343.491600][T21980] ? current_time+0x2e0/0x2e0 [ 343.496282][T21980] __should_failslab+0x11a/0x160 [ 343.501227][T21980] ? kmalloc_array+0x32/0x60 [ 343.505907][T21980] should_failslab+0x9/0x20 [ 343.510447][T21980] __kmalloc+0x64/0x310 [ 343.514628][T21980] kmalloc_array+0x32/0x60 [ 343.519045][T21980] iter_file_splice_write+0x21d/0xf20 [ 343.524417][T21980] ? __sb_end_write+0xa8/0xf0 [ 343.529099][T21980] ? touch_atime+0x22e/0x270 [ 343.533688][T21980] ? current_time+0x2e0/0x2e0 [ 343.538362][T21980] ? fsnotify+0x1390/0x1450 [ 343.542863][T21980] ? splice_from_pipe+0x200/0x200 [ 343.547993][T21980] ? splice_shrink_spd+0xb0/0xb0 [ 343.552940][T21980] ? splice_from_pipe+0x200/0x200 [ 343.558119][T21980] direct_splice_actor+0xf7/0x130 [ 343.563147][T21980] splice_direct_to_actor+0x496/0xb00 [ 343.568516][T21980] ? do_splice_direct+0x3d0/0x3d0 [ 343.573547][T21980] ? pipe_to_sendpage+0x300/0x300 [ 343.578570][T21980] ? rw_verify_area+0x1c2/0x360 [ 343.583538][T21980] do_splice_direct+0x279/0x3d0 [ 343.588398][T21980] ? splice_direct_to_actor+0xb00/0xb00 [ 343.593960][T21980] ? security_file_permission+0x157/0x350 [ 343.600119][T21980] do_sendfile+0x89d/0x1110 [ 343.604764][T21980] ? compat_writev+0x390/0x390 [ 343.609537][T21980] ? __kasan_check_write+0x14/0x20 [ 343.614650][T21980] ? fput_many+0x47/0x1a0 [ 343.618976][T21980] __x64_sys_sendfile64+0x1ae/0x220 [ 343.624176][T21980] ? __ia32_sys_sendfile+0x240/0x240 [ 343.629466][T21980] ? syscall_return_slowpath+0x6f/0x500 [ 343.635012][T21980] do_syscall_64+0xc0/0x100 [ 343.639514][T21980] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 343.645555][T21980] RIP: 0033:0x45b399 [ 343.649484][T21980] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 343.669213][T21980] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 343.677626][T21980] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 343.685620][T21980] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 343.693593][T21980] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 343.701585][T21980] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 343.709780][T21980] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000019 09:14:35 executing program 5 (fault-call:10 fault-nth:26): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:35 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xffffff81, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:35 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x7a00, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:35 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0xfc, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:35 executing program 2: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xfec0ffff, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 344.007271][T20511] tipc: 32-bit node address hash set to fbff1eac [ 344.026627][ T1959] attempt to access beyond end of device [ 344.036622][ T1959] loop5: rw=1, want=78, limit=63 [ 344.043823][ T1959] buffer_io_error: 38 callbacks suppressed [ 344.043829][ T1959] Buffer I/O error on dev loop5, logical block 77, lost async page write [ 344.058108][ T1959] attempt to access beyond end of device [ 344.071772][ T1959] loop5: rw=1, want=79, limit=63 [ 344.077677][ T1959] Buffer I/O error on dev loop5, logical block 78, lost async page write [ 344.088457][T21991] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 344.095560][ T1959] attempt to access beyond end of device [ 344.104490][T21991] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 344.111900][ T1959] loop5: rw=1, want=80, limit=63 [ 344.117064][ T1959] Buffer I/O error on dev loop5, logical block 79, lost async page write [ 344.126028][T21989] tipc: Started in network mode [ 344.128218][ T1959] attempt to access beyond end of device [ 344.131934][T21989] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 344.136967][ T1959] loop5: rw=1, want=81, limit=63 [ 344.151141][ T1959] Buffer I/O error on dev loop5, logical block 80, lost async page write [ 344.160354][ T1959] attempt to access beyond end of device [ 344.165993][ T1959] loop5: rw=1, want=130, limit=63 [ 344.171106][ T1959] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 344.180158][ T1959] attempt to access beyond end of device [ 344.185836][ T1959] loop5: rw=1, want=131, limit=63 [ 344.191146][ T1959] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 344.191542][T21989] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 344.201871][ T1959] attempt to access beyond end of device [ 344.220400][T21989] tipc: Enabled bearer , priority 10 [ 344.229166][ T1959] loop5: rw=1, want=132, limit=63 [ 344.235381][T21990] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 344.249190][ T1959] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 344.257921][ T1959] attempt to access beyond end of device [ 344.279952][T21990] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 344.287479][ T1959] loop5: rw=1, want=133, limit=63 [ 344.299152][ T1959] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 344.299303][T21991] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 344.307696][ T1959] attempt to access beyond end of device [ 344.307706][ T1959] loop5: rw=1, want=142, limit=63 [ 344.307714][ T1959] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 344.307727][ T1959] attempt to access beyond end of device [ 344.327169][T21991] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:14:36 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xffffff9e, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 344.383558][ T1959] loop5: rw=1, want=143, limit=63 [ 344.388617][ T1959] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 344.406386][ T1959] attempt to access beyond end of device [ 344.414580][ T1959] loop5: rw=1, want=144, limit=63 [ 344.425912][ T1959] attempt to access beyond end of device 09:14:36 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x8100, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:36 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x102, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 344.435393][ T1959] loop5: rw=1, want=145, limit=63 09:14:36 executing program 2: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xefffffff, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 344.495478][ T1959] attempt to access beyond end of device [ 344.509388][ T1959] loop5: rw=1, want=56721, limit=63 [ 344.535946][T21997] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 344.557327][T21997] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:14:36 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xffffffc3, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 344.581517][T22003] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 344.601433][T22003] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 344.608939][T22004] tipc: Enabling of bearer rejected, failed to enable media 09:14:36 executing program 2: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x11, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:36 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x9501, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 344.673293][T22007] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 344.692252][T22007] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 344.719856][ T1938] tipc: Disabling bearer [ 344.725258][ T1938] tipc: Left network mode [ 344.734446][ T1938] tipc: Disabling bearer [ 344.740087][ T1938] tipc: Left network mode [ 344.758690][T22013] tipc: Started in network mode [ 344.764131][T22013] tipc: Own node identity 00000000000000000000ffffac1e0003, cluster identity 4711 [ 344.798171][T22013] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 344.816339][T22013] tipc: Enabled bearer , priority 10 [ 344.829202][ T1938] tipc: Disabling bearer [ 344.834722][ T1938] tipc: Left network mode [ 345.360755][T22020] FAULT_INJECTION: forcing a failure. [ 345.360755][T22020] name failslab, interval 1, probability 0, space 0, times 0 [ 345.373547][T22020] CPU: 1 PID: 22020 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 345.383994][T22020] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 345.394310][T22020] Call Trace: [ 345.397606][T22020] dump_stack+0x1b0/0x228 [ 345.402113][T22020] ? devkmsg_release+0x127/0x127 [ 345.407055][T22020] ? __kasan_check_read+0x11/0x20 [ 345.412088][T22020] ? show_regs_print_info+0x18/0x18 [ 345.417290][T22020] should_fail+0x6fb/0x860 [ 345.421790][T22020] ? setup_fault_attr+0x2b0/0x2b0 [ 345.426826][T22020] ? current_time+0x2e0/0x2e0 [ 345.431504][T22020] __should_failslab+0x11a/0x160 [ 345.436444][T22020] ? kmalloc_array+0x32/0x60 [ 345.441033][T22020] should_failslab+0x9/0x20 [ 345.445532][T22020] __kmalloc+0x64/0x310 [ 345.449689][T22020] kmalloc_array+0x32/0x60 [ 345.454103][T22020] iter_file_splice_write+0x21d/0xf20 [ 345.459616][T22020] ? __sb_end_write+0xa8/0xf0 [ 345.464288][T22020] ? touch_atime+0x22e/0x270 [ 345.469308][T22020] ? current_time+0x2e0/0x2e0 [ 345.473984][T22020] ? fsnotify+0x1390/0x1450 [ 345.478507][T22020] ? splice_from_pipe+0x200/0x200 [ 345.483543][T22020] ? splice_shrink_spd+0xb0/0xb0 [ 345.489788][T22020] ? splice_from_pipe+0x200/0x200 [ 345.494980][T22020] direct_splice_actor+0xf7/0x130 [ 345.500007][T22020] splice_direct_to_actor+0x496/0xb00 [ 345.505391][T22020] ? do_splice_direct+0x3d0/0x3d0 [ 345.510407][T22020] ? pipe_to_sendpage+0x300/0x300 [ 345.515422][T22020] ? rw_verify_area+0x1c2/0x360 [ 345.520399][T22020] do_splice_direct+0x279/0x3d0 [ 345.525350][T22020] ? splice_direct_to_actor+0xb00/0xb00 [ 345.530900][T22020] ? security_file_permission+0x157/0x350 [ 345.536628][T22020] do_sendfile+0x89d/0x1110 [ 345.541137][T22020] ? compat_writev+0x390/0x390 [ 345.546005][T22020] ? __kasan_check_write+0x14/0x20 [ 345.551115][T22020] ? fput_many+0x47/0x1a0 [ 345.555450][T22020] __x64_sys_sendfile64+0x1ae/0x220 [ 345.560672][T22020] ? __ia32_sys_sendfile+0x240/0x240 [ 345.565956][T22020] ? syscall_return_slowpath+0x6f/0x500 [ 345.571497][T22020] do_syscall_64+0xc0/0x100 [ 345.576005][T22020] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 345.581894][T22020] RIP: 0033:0x45b399 [ 345.585909][T22020] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 345.605512][T22020] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 345.613936][T22020] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 345.621911][T22020] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 345.629897][T22020] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 345.637867][T22020] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 345.645848][T22020] R13: 00000000000008ca R14: 00000000004ca24d R15: 000000000000001a 09:14:37 executing program 5 (fault-call:10 fault-nth:27): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:37 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x34000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:37 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x1ba, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:37 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xffffffe0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:37 executing program 2: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x2, 0x14803) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) 09:14:37 executing program 0: r0 = ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x0) ioctl$VT_RESIZEX(r0, 0x560a, &(0x7f0000000200)={0x0, 0x4, 0x6, 0x0, 0x2a, 0xd4d}) ioctl$TIOCSISO7816(r0, 0xc0285443, &(0x7f0000000000)={0x1ff6, 0x3, 0x6, 0x80000001, 0x7}) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r2 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000100)='wireguard\x00') sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x28, r2, 0x4, 0x70bd2d, 0x25dfdbfb, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wireguard1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x24000000) unshare(0x44000600) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$TIOCSIG(r0, 0x40045436, 0x12) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) ioctl$RTC_WKALM_RD(r1, 0x80287010, &(0x7f0000000240)) read(r4, 0x0, 0x0) lseek(r4, 0xe7, 0x0) ioctl$PIO_FONTRESET(r4, 0x4b6d, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(r3, 0x4008550d, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000040)={0x100, 0x5}, 0xc) [ 345.889491][T22017] FAT-fs (loop5): FAT read failed (blocknr 63) [ 345.907419][ T1959] attempt to access beyond end of device [ 345.915743][ T1959] loop5: rw=1, want=78, limit=63 [ 345.924580][ T1959] attempt to access beyond end of device [ 345.933502][T22025] tipc: Started in network mode [ 345.933560][ T1959] loop5: rw=1, want=79, limit=63 [ 345.938554][T22025] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 345.949256][ T1959] attempt to access beyond end of device [ 345.953422][T21981] tipc: 32-bit node address hash set to fcff1eac [ 345.958436][ T1959] loop5: rw=1, want=80, limit=63 [ 345.970004][T22025] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 345.978015][T22025] tipc: Enabled bearer , priority 10 [ 345.984434][ T1959] attempt to access beyond end of device [ 345.990203][ T1959] loop5: rw=1, want=81, limit=63 [ 345.995228][ T1959] attempt to access beyond end of device [ 346.001002][ T1959] loop5: rw=1, want=130, limit=63 [ 346.006293][ T1959] attempt to access beyond end of device [ 346.011560][T22030] net_ratelimit: 7 callbacks suppressed [ 346.011566][T22030] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 346.019150][ T1959] loop5: rw=1, want=131, limit=63 [ 346.038023][ T1959] attempt to access beyond end of device [ 346.043862][ T1959] loop5: rw=1, want=132, limit=63 [ 346.051049][ T1959] attempt to access beyond end of device [ 346.054371][T22029] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 346.064690][T22029] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 346.069149][ T1959] loop5: rw=1, want=133, limit=63 [ 346.081353][ T1959] attempt to access beyond end of device 09:14:38 executing program 2: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x74000000, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:38 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x1f8, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 346.089163][ T1959] loop5: rw=1, want=142, limit=63 [ 346.092399][T22035] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 346.100790][ T1959] attempt to access beyond end of device [ 346.132299][ T1959] loop5: rw=1, want=143, limit=63 09:14:38 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x400300, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 346.139778][ T1959] attempt to access beyond end of device [ 346.145618][ T1959] loop5: rw=1, want=144, limit=63 [ 346.150419][T22039] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 346.150725][ T1959] attempt to access beyond end of device [ 346.167813][ T1959] loop5: rw=1, want=145, limit=63 [ 346.184812][ T1959] attempt to access beyond end of device 09:14:38 executing program 0: unshare(0x44000600) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r0, 0x0, 0x0) lseek(r0, 0xe7, 0x0) write$P9_RFLUSH(r0, &(0x7f0000000000)={0x7, 0x6d, 0x2}, 0x7) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, 0x0) [ 346.196704][ T1959] loop5: rw=1, want=17769, limit=63 [ 346.203955][T22039] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 346.236350][ T1959] attempt to access beyond end of device [ 346.242118][ T1959] loop5: rw=1, want=63513, limit=63 09:14:38 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xffffffea, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 346.249737][T22040] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 346.260163][T22040] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 346.275965][T22044] tipc: Enabling of bearer rejected, failed to enable media [ 346.293699][T22043] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:14:38 executing program 2: pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_MSG_GETOBJ_RESET(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000140)={&(0x7f0000000380)={0x44, 0x15, 0xa, 0x5, 0x0, 0x0, {0xa, 0x0, 0x7}, [@NFTA_OBJ_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x4}]}, 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4800) splice(r0, 0x0, r2, 0x0, 0x1420000a77, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="d000002c00ffecff7f00000090f5fc6d0000a600", @ANYRES32, @ANYBLOB="e6ffffffffffffff"], 0x3}}, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)={@mcast2}, 0x2d4) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c58110308d9123127ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000200)=0x14) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = fcntl$dupfd(r6, 0x0, r5) ioctl$PERF_EVENT_IOC_ENABLE(r7, 0x8912, 0x400200) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(0xffffffffffffffff, 0x10e, 0x8, &(0x7f0000000240)=0xfff, 0x4) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="d00800002600ffac8d311f49335aa97b3dcf322a", @ANYRES32=r4], 0x2}}, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, 0x0) write$binfmt_elf64(r1, &(0x7f0000000000)=ANY=[], 0xfffffd88) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f0000000400)={0x53, 0xac6, 0x1, {0x6}, {0x100, 0x4}, @cond=[{0x200, 0x8001, 0x8000, 0x81, 0x8, 0x144b}, {0x8, 0x1, 0x7, 0x80, 0x7, 0x80}]}) [ 346.331463][T22050] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 346.366787][T22049] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 346.375166][T22049] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 346.421779][T22055] selinux_nlmsg_perm: 4084 callbacks suppressed [ 346.421788][T22055] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=22055 comm=syz-executor.2 [ 346.441984][T22055] netlink: 2220 bytes leftover after parsing attributes in process `syz-executor.2'. [ 346.452632][T22055] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=22055 comm=syz-executor.2 [ 346.465985][T22055] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=22055 comm=syz-executor.2 [ 346.479369][T22055] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=22055 comm=syz-executor.2 [ 346.494049][T22055] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=22055 comm=syz-executor.2 [ 346.507261][T22055] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=22055 comm=syz-executor.2 [ 346.507330][T22058] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 346.520347][T22055] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=22055 comm=syz-executor.2 [ 346.540115][T22055] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=22055 comm=syz-executor.2 [ 346.550633][T22058] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 346.560255][T22055] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=22055 comm=syz-executor.2 [ 346.574942][T22055] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=22055 comm=syz-executor.2 [ 346.699165][ T1938] tipc: Disabling bearer [ 346.705602][ T1938] tipc: Left network mode [ 346.797161][T22064] FAULT_INJECTION: forcing a failure. [ 346.797161][T22064] name failslab, interval 1, probability 0, space 0, times 0 [ 346.818530][T22064] CPU: 0 PID: 22064 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 346.828920][T22064] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 346.838992][T22064] Call Trace: [ 346.842290][T22064] dump_stack+0x1b0/0x228 [ 346.846617][T22064] ? devkmsg_release+0x127/0x127 [ 346.851565][T22064] ? __kasan_check_read+0x11/0x20 [ 346.856621][T22064] ? show_regs_print_info+0x18/0x18 [ 346.861827][T22064] should_fail+0x6fb/0x860 [ 346.866251][T22064] ? setup_fault_attr+0x2b0/0x2b0 [ 346.871384][T22064] ? current_time+0x2e0/0x2e0 [ 346.876066][T22064] __should_failslab+0x11a/0x160 [ 346.881018][T22064] ? kmalloc_array+0x32/0x60 [ 346.885605][T22064] should_failslab+0x9/0x20 [ 346.890998][T22064] __kmalloc+0x64/0x310 [ 346.895165][T22064] kmalloc_array+0x32/0x60 [ 346.899843][T22064] iter_file_splice_write+0x21d/0xf20 [ 346.905255][T22064] ? __sb_end_write+0xa8/0xf0 [ 346.910479][T22064] ? touch_atime+0x22e/0x270 [ 346.915101][T22064] ? current_time+0x2e0/0x2e0 [ 346.919917][T22064] ? fsnotify+0x1390/0x1450 [ 346.924429][T22064] ? splice_from_pipe+0x200/0x200 [ 346.929451][T22064] ? splice_shrink_spd+0xb0/0xb0 [ 346.934383][T22064] ? splice_from_pipe+0x200/0x200 [ 346.939402][T22064] direct_splice_actor+0xf7/0x130 [ 346.944427][T22064] splice_direct_to_actor+0x496/0xb00 [ 346.949803][T22064] ? do_splice_direct+0x3d0/0x3d0 [ 346.954824][T22064] ? pipe_to_sendpage+0x300/0x300 [ 346.960121][T22064] ? rw_verify_area+0x1c2/0x360 [ 346.964974][T22064] do_splice_direct+0x279/0x3d0 [ 346.969828][T22064] ? splice_direct_to_actor+0xb00/0xb00 [ 346.975435][T22064] ? security_file_permission+0x157/0x350 [ 346.981792][T22064] do_sendfile+0x89d/0x1110 [ 346.986306][T22064] ? compat_writev+0x390/0x390 [ 346.991068][T22064] ? __kasan_check_write+0x14/0x20 [ 346.996185][T22064] ? fput_many+0x47/0x1a0 [ 347.000512][T22064] __x64_sys_sendfile64+0x1ae/0x220 [ 347.005719][T22064] ? __ia32_sys_sendfile+0x240/0x240 [ 347.011035][T22064] ? syscall_return_slowpath+0x6f/0x500 [ 347.016578][T22064] do_syscall_64+0xc0/0x100 [ 347.021080][T22064] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 347.026968][T22064] RIP: 0033:0x45b399 [ 347.031003][T22064] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 347.050716][T22064] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 347.059137][T22064] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 347.071806][T22064] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 347.079778][T22064] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 347.087853][T22064] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 347.095829][T22064] R13: 00000000000008ca R14: 00000000004ca24d R15: 000000000000001b 09:14:39 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xffffffef, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:39 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x1000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:39 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x201, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:39 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x220102) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r1, 0x0, 0x0) lseek(r1, 0xe7, 0x0) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, &(0x7f0000000000)={{0xa, 0x4e20, 0x2, @mcast1, 0xfffffffe}, {0xa, 0x4e22, 0x3, @rand_addr="4d43042d613e28169d0cb4eb4a4a06e1", 0x8}, 0x7f77, [0x7, 0xfffffffd, 0x8, 0x6, 0x200, 0x4, 0x41b, 0x2]}, 0x5c) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) write$P9_RSETATTR(r1, &(0x7f0000000080)={0x7, 0x1b, 0x1}, 0x7) 09:14:39 executing program 2: openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/consoles\x00', 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = syz_open_procfs(0x0, &(0x7f0000000080)='fd\x00') fchdir(r1) r2 = memfd_create(&(0x7f0000000780)='\x00', 0x0) write(r2, &(0x7f00000000c0)="6963e64243ea486da3a74e3deec6fc5bb9650b5de56946c568f95d22467190ba406d59a5958d6f156c9c8a2ac4677b00000000000000000000200000f8bf54da33", 0x41) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x11, r2, 0x0) r3 = inotify_init1(0x0) inotify_add_watch(r3, &(0x7f0000000040)='./control\x00', 0xa4000960) open(&(0x7f0000000040)='./file1\x00', 0x0, 0x0) munlockall() 09:14:39 executing program 5 (fault-call:10 fault-nth:28): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) [ 347.418208][T22061] FAT-fs (loop5): FAT read failed (blocknr 63) [ 347.433465][ T7] attempt to access beyond end of device [ 347.439290][ T7] loop5: rw=1, want=78, limit=63 [ 347.444247][ T7] attempt to access beyond end of device [ 347.454289][ T7] loop5: rw=1, want=79, limit=63 [ 347.459502][ T7] attempt to access beyond end of device [ 347.463195][ T22] audit: type=1400 audit(1580980479.414:55): avc: denied { watch } for pid=22067 comm="syz-executor.2" path="/proc/consoles" dev="proc" ino=4026532028 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:proc_t:s0 tclass=file permissive=1 [ 347.465175][ T7] loop5: rw=1, want=80, limit=63 [ 347.498047][ T7] attempt to access beyond end of device [ 347.506916][ T7] loop5: rw=1, want=81, limit=63 [ 347.513563][ T7] attempt to access beyond end of device 09:14:39 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) creat(0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f000004a000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x4434c000) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000100)={0x3, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffc10, 0x0, @perf_bp={0x0, 0xa}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) fcntl$setpipe(r0, 0x407, 0x80000000) creat(&(0x7f0000000040)='./bus\x00', 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/tcp\x00') preadv(r1, &(0x7f00000017c0), 0x3da, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r2, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x220007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) r3 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$TIOCGRS485(r3, 0x542e, &(0x7f0000000000)) sendto$inet(r2, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x170) [ 347.516830][T22073] tipc: Enabling of bearer rejected, failed to enable media [ 347.519641][ T7] loop5: rw=1, want=130, limit=63 [ 347.528162][T22075] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 347.533009][ T7] attempt to access beyond end of device [ 347.554020][ T7] loop5: rw=1, want=131, limit=63 [ 347.559099][ T7] attempt to access beyond end of device [ 347.565165][ T7] loop5: rw=1, want=132, limit=63 [ 347.570482][ T7] attempt to access beyond end of device [ 347.570682][ T1938] tipc: Disabling bearer [ 347.576409][ T7] loop5: rw=1, want=133, limit=63 [ 347.587547][ T1938] tipc: Left network mode [ 347.588849][ T7] attempt to access beyond end of device [ 347.592232][T22076] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 347.597669][ T7] loop5: rw=1, want=142, limit=63 [ 347.609666][ T7] attempt to access beyond end of device 09:14:39 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x0) creat(0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f000004a000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x4434c000) bpf$PROG_LOAD(0x5, 0x0, 0x0) perf_event_open(&(0x7f0000000100)={0x3, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffc10, 0x0, @perf_bp={0x0, 0xa}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) fcntl$setpipe(r0, 0x407, 0x80000000) creat(&(0x7f0000000040)='./bus\x00', 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/tcp\x00') preadv(r1, &(0x7f00000017c0), 0x3da, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x2000000000000074, 0x25d) bind$inet(r2, &(0x7f0000000280)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x220007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) r3 = syz_open_dev$ptys(0xc, 0x3, 0x1) ioctl$TIOCGRS485(r3, 0x542e, &(0x7f0000000000)) sendto$inet(r2, &(0x7f00000012c0)="0c268a927f1f6588b967481241ba7860f46ef65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95c25a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0xfe6a, 0x11, 0x0, 0x170) [ 347.615492][ T7] loop5: rw=1, want=143, limit=63 [ 347.620750][ T7] attempt to access beyond end of device [ 347.625565][T22076] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 347.626377][ T7] loop5: rw=1, want=144, limit=63 [ 347.626405][ T7] attempt to access beyond end of device [ 347.645933][T22081] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 347.647427][ T7] loop5: rw=1, want=145, limit=63 [ 347.671084][ T7] attempt to access beyond end of device [ 347.676852][ T7] loop5: rw=1, want=6689, limit=63 09:14:39 executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_EDIT(r0, 0x0, 0x483, &(0x7f0000000100)={0x33, @rand_addr=0x40, 0x4e24, 0x1, 'sed\x00', 0x1a, 0x1f, 0x4b}, 0x2c) read(r3, 0x0, 0x0) lseek(r3, 0xe7, 0x0) ioctl$KDGKBMETA(r3, 0x4b62, &(0x7f00000000c0)) ioctl$USBDEVFS_SUBMITURB(r2, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) dup2(r2, 0xffffffffffffffff) r4 = dup(0xffffffffffffffff) epoll_ctl$EPOLL_CTL_MOD(r4, 0x3, r1, &(0x7f0000000140)={0x10000000}) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r5, 0x0, 0x0) lseek(r5, 0xe7, 0x0) r6 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r6, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendfile(r0, r6, &(0x7f0000000080)=0x1, 0x6) setsockopt$packet_rx_ring(r5, 0x107, 0xe, 0x0, 0xfffffffffffffef7) 09:14:39 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x2000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 347.711571][ T7] attempt to access beyond end of device [ 347.717235][ T7] loop5: rw=1, want=63513, limit=63 09:14:39 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xfffffff0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 347.752732][T22089] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:14:39 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/stat\x00', 0x0, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000140)=ANY=[@ANYBLOB="66696c746572000000000000000000000000000000000000000000000000000007000000040000003804000050030000100100002002000050030000500300005003000004000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000ff0000000000000000"], @ANYBLOB="ffffffff00000000000000ffffffff00000caaaaaaaaaabb00000000000000000000ff00ffff00ff0000000000000000000000000000000000000000000000000000ffff0000000000000000000000000000161a0070000904000000800176657468315f766c616e0000000000006272696467655f736c6176655f3000000000000000000000000000000000000000000000000000000000000000000000000024000000c000100100000000000000000000000000000000000000000000000050006d616e676c650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ac1414aa000000060800000000000000ac1e0101e0000002ffffff00ffffff000a010180c200000300000000000000000000ffff0000ff000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000670800a20001000200050008766c616e30000000000000000000000076657468315f6d6163767461700000000000000000000000000000000000000000000000000000000000000000000000000010000000c000100100000000000000000000000000000000000000000000000050006d616e676c650000000000000000000000000000000000000000000000000180c200000e000000000000000000000000000000000000000000000000000000000000ac1e010100000000ffffffffac1414190000000000000000000000ff04050180c200000100000000000000000000000000ffff000000000000000000000000000000000000000000000000000000feffffffffff0000000000000000000000dc0008000200000020ff7f626174616476300000000000000000006d61637365633000000000000000000000000000000000000000000000000000ff000000000000000000000000000000000084000000c000300100000000000000000000000000000000000000000000000070004e464c4f47000000000000000000000000000000000000000000000000003f000000439001040000000021e99ecd957822e0ea91942d67f8e6fa63440d7670c6b1aa3d6777c01929589e617257fdf42f842ff52568c782523833d5e2a7c45cb81a5dc6eb042b30b843fa000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c000e8000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff00000000"], 0x488) r1 = socket$netlink(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=@newlink={0x58, 0x10, 0x705, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @bond={{0x9, 0x1, 'bond\x00'}, {0x28, 0x2, 0x0, 0x1, [@IFLA_BOND_LP_INTERVAL={0x8, 0x13, 0xd0}, @IFLA_BOND_NUM_PEER_NOTIF={0x5, 0x10, 0x3}, @IFLA_BOND_RESEND_IGMP={0x8, 0xf, 0x1}, @IFLA_BOND_ARP_IP_TARGET={0xc, 0x8, 0x0, 0x1, [@loopback, @rand_addr=0x800]}]}}}]}, 0x58}}, 0x0) [ 347.816599][T22093] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 347.827270][T22093] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 347.950753][T22100] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 347.958835][T22100] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 348.087053][T22106] FAULT_INJECTION: forcing a failure. [ 348.087053][T22106] name failslab, interval 1, probability 0, space 0, times 0 [ 348.100239][T22106] CPU: 1 PID: 22106 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 348.110399][T22106] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 348.120452][T22106] Call Trace: [ 348.123872][T22106] dump_stack+0x1b0/0x228 [ 348.128202][T22106] ? devkmsg_release+0x127/0x127 [ 348.134206][T22106] ? __kasan_check_read+0x11/0x20 [ 348.139311][T22106] ? show_regs_print_info+0x18/0x18 [ 348.144749][T22106] should_fail+0x6fb/0x860 [ 348.149169][T22106] ? setup_fault_attr+0x2b0/0x2b0 [ 348.154193][T22106] ? current_time+0x2e0/0x2e0 [ 348.158875][T22106] __should_failslab+0x11a/0x160 [ 348.163812][T22106] ? kmalloc_array+0x32/0x60 [ 348.168393][T22106] should_failslab+0x9/0x20 [ 348.172897][T22106] __kmalloc+0x64/0x310 [ 348.177063][T22106] kmalloc_array+0x32/0x60 [ 348.181494][T22106] iter_file_splice_write+0x21d/0xf20 [ 348.186881][T22106] ? __sb_end_write+0xa8/0xf0 [ 348.191585][T22106] ? touch_atime+0x22e/0x270 [ 348.196176][T22106] ? current_time+0x2e0/0x2e0 [ 348.200850][T22106] ? fsnotify+0x1390/0x1450 [ 348.205348][T22106] ? splice_from_pipe+0x200/0x200 [ 348.210375][T22106] ? splice_shrink_spd+0xb0/0xb0 [ 348.215315][T22106] ? splice_from_pipe+0x200/0x200 [ 348.220343][T22106] direct_splice_actor+0xf7/0x130 [ 348.225384][T22106] splice_direct_to_actor+0x496/0xb00 [ 348.230843][T22106] ? do_splice_direct+0x3d0/0x3d0 [ 348.235884][T22106] ? pipe_to_sendpage+0x300/0x300 [ 348.241010][T22106] ? rw_verify_area+0x1c2/0x360 [ 348.245862][T22106] do_splice_direct+0x279/0x3d0 [ 348.250707][T22106] ? splice_direct_to_actor+0xb00/0xb00 [ 348.256251][T22106] ? security_file_permission+0x157/0x350 [ 348.261967][T22106] do_sendfile+0x89d/0x1110 [ 348.266470][T22106] ? compat_writev+0x390/0x390 [ 348.271236][T22106] ? __kasan_check_write+0x14/0x20 [ 348.276347][T22106] ? fput_many+0x47/0x1a0 [ 348.280680][T22106] __x64_sys_sendfile64+0x1ae/0x220 [ 348.286006][T22106] ? __ia32_sys_sendfile+0x240/0x240 [ 348.291303][T22106] ? syscall_return_slowpath+0x6f/0x500 [ 348.296970][T22106] do_syscall_64+0xc0/0x100 [ 348.301484][T22106] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 348.307376][T22106] RIP: 0033:0x45b399 [ 348.311385][T22106] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 348.330990][T22106] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 348.339401][T22106] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 348.347379][T22106] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 348.355448][T22106] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 348.363418][T22106] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 348.371492][T22106] R13: 00000000000008ca R14: 00000000004ca24d R15: 000000000000001c 09:14:40 executing program 5 (fault-call:10 fault-nth:29): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:40 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r0, 0x0, 0x0) lseek(r0, 0xe7, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='setgroups\x00') r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000004000)='nl80211\x00') sendmsg$NL80211_CMD_DEL_KEY(r2, &(0x7f00000041c0)={0x0, 0x0, &(0x7f0000004040)={&(0x7f00000001c0)={0x34, r3, 0xd21, 0x70bd2a, 0x0, {}, [@NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_MAC={0xa, 0x6, @random="3ccab02c27be"}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x2}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}]}, 0x34}}, 0x0) sendmsg$NL80211_CMD_DEL_INTERFACE(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)={0x58, r3, 0x0, 0x70bd2d, 0x25dfdbfc, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x3, 0x4}}, @NL80211_ATTR_IFINDEX={0x8}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0x3}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'hsr0\x00'}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'erspan0\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x20000000}, 0x40) sendmsg$NL80211_CMD_GET_MPATH(r0, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x20, r3, 0x10, 0x70bd2d, 0x25dfdbfc, {}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x0, 0x2}}]}, 0x20}}, 0x20000000) r4 = socket$pptp(0x18, 0x1, 0x2) io_setup(0x1ff, &(0x7f00000004c0)=0x0) prctl$PR_GET_TID_ADDRESS(0x28, &(0x7f0000000000)) io_submit(r5, 0x1, &(0x7f0000000200)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, r4, &(0x7f0000000080)="14", 0x1}]) 09:14:40 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x3000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:40 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xfffffffc, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:40 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x22a, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:40 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r1, 0x0, 0x0) lseek(r1, 0xe7, 0x3) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r2, 0x0, 0x0) lseek(r2, 0xe7, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f00000001c0)={'batadv_slave_0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000200)={'team_slave_0\x00', r3}) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r4, 0x0, 0x0) lseek(r4, 0xe7, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r4, 0x8982, &(0x7f00000000c0)) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) syz_genetlink_get_family_id$wireguard(&(0x7f0000000080)='wireguard\x00') read(r0, &(0x7f0000000000)=""/28, 0x1c) [ 348.662016][T22103] FAT-fs (loop5): FAT read failed (blocknr 63) [ 348.676820][ T7] attempt to access beyond end of device [ 348.686087][ T7] loop5: rw=1, want=78, limit=63 [ 348.696072][ T7] attempt to access beyond end of device [ 348.697483][T22113] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 348.704631][ T7] loop5: rw=1, want=79, limit=63 [ 348.709814][T22113] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 348.719231][ T7] attempt to access beyond end of device [ 348.729013][ T7] loop5: rw=1, want=80, limit=63 [ 348.737287][ T7] attempt to access beyond end of device [ 348.746396][T22115] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 348.761567][ T7] loop5: rw=1, want=81, limit=63 [ 348.766530][ T7] attempt to access beyond end of device [ 348.772546][ T7] loop5: rw=1, want=130, limit=63 [ 348.777588][ T7] attempt to access beyond end of device [ 348.783509][ T7] loop5: rw=1, want=131, limit=63 [ 348.789756][ T7] attempt to access beyond end of device [ 348.795556][ T7] loop5: rw=1, want=132, limit=63 [ 348.800699][ T7] attempt to access beyond end of device [ 348.801787][T22116] tipc: Started in network mode [ 348.806357][ T7] loop5: rw=1, want=133, limit=63 [ 348.811785][T22116] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 348.816312][ T7] attempt to access beyond end of device [ 348.825857][T22116] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 348.831176][ T7] loop5: rw=1, want=142, limit=63 [ 348.831201][ T7] attempt to access beyond end of device [ 348.831205][ T7] loop5: rw=1, want=143, limit=63 [ 348.831219][ T7] attempt to access beyond end of device [ 348.831225][ T7] loop5: rw=1, want=144, limit=63 [ 348.831238][ T7] attempt to access beyond end of device [ 348.831243][ T7] loop5: rw=1, want=145, limit=63 [ 348.833168][ T7] attempt to access beyond end of device [ 348.842938][T22116] tipc: Enabled bearer , priority 10 [ 348.849132][ T7] loop5: rw=1, want=3849, limit=63 [ 348.858938][T22120] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:14:40 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000008000), 0x88) writev(0xffffffffffffffff, &(0x7f0000000400)=[{&(0x7f0000000080)="94ca49a986498acde8914b58b42845a197de3bc4de4d2ecd19f5df84b543d68e76a1ecf08c680d6ee8ca3b35ada12247a6a77971a1f8353618faf1e489d7c6d9428fede1835369fe1c5087", 0x4b}, {&(0x7f0000000100)="909f16bb5c3778fdaab858f0825b8e617a278950bd6a715f0af1269caf4a46f871cbd7a2240d13ba259f83f0b39f5fdfb31eb47c0211662dc2aae30457b55f2566e8f515977b429c31b6987879d8f3b26f1340b801e09ec36605d69d272f3de69155c0f9fb68500645", 0x69}, {&(0x7f0000000180)="d4549eeb18353d4cc4ed2434d66ea8417edb806293d01fb7447b0934a0dfba11a1c91220adf90a9c43024dadcd2c16bdf7453f9b0fb2ff65306743f0e6a83307be0b17e6e9185795d8ace45472765e784812a7521db1e47942f70ed8c7e3199108eaec817d2fe3513935925c7f2c6d3c275b3cf837e40cc66fb88a8139d82cfb76f93e1a21301e2eaec8c5e2333ab4fcef156a7a0b46bd8eb47435527a517ba87d66ab851a276aae6ee29c7221", 0xad}, {&(0x7f0000000240)="e632c19127d7e18eeb3a7bcba184646501f5c2f958fa7823af4f086ab73aa36e920d901836825786e7d8e2c1f1a6385ea5deecceb5c6e66792ea7dacd7be2f02aaaef0dc2110cfcd7ea9087c46c9ec218e6d524a956ed0cea6dc281ee2aa9136fc05d8d5f04aa1d2bb6a57171c40d751b18be81bb724794ae9d73c36ae737eb6e0511bbbfb669711d63aab", 0x8b}, {&(0x7f0000000300)="52cd72d9609c23ff76e7a2fa176f17a42545", 0x12}, {&(0x7f0000000340)="7dd2edef55b8b19895a8e7d3ede48b47c5a43f7bb2ed2b17b25ad9c30eb445405ff851eb3d91b51c1aa5abbb76ff9e5bbf3d5cb64cf42f2a7a1142f3cf7bf481fe9b41892307efe89f4c2d464a3f49624bc6", 0x52}, {&(0x7f00000003c0)="373abec02063", 0x6}], 0x7) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x113240, 0x11) ioctl$FS_IOC_GET_ENCRYPTION_POLICY_EX(r1, 0xc0096616, &(0x7f0000000040)={0x4, [0x0, 0x0, 0x0, 0x0]}) getsockopt$inet_buf(r0, 0x0, 0x30, &(0x7f0000008000)=""/144, &(0x7f0000012ffc)=0x90) 09:14:40 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x4000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:40 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0xfffffffe, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 348.890192][ T7] attempt to access beyond end of device [ 348.905848][T22119] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 348.912192][ T7] loop5: rw=1, want=63513, limit=63 [ 348.916447][T22119] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:14:40 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x10003, 0x240a00) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/avc/hash_stats\x00', 0x0, 0x0) bind$vsock_stream(r1, &(0x7f00000003c0)={0x28, 0x0, 0x2710}, 0x10) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) r2 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r2, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) splice(r2, &(0x7f0000000000), 0xffffffffffffffff, &(0x7f0000000080)=0x100, 0x4, 0x0) 09:14:41 executing program 2: ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000580)=0x0) ptrace$getregset(0x4204, r0, 0x202, &(0x7f0000000680)={&(0x7f0000000640)=""/19, 0x13}) r1 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x8, 0x0, 0xfcf}, 0x1c) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) r2 = socket(0x11, 0x800000003, 0x0) bind(r2, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r3, 0x0, 0x0) lseek(r3, 0xe7, 0x0) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r4, 0x0, 0x0) lseek(r4, 0xe7, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(r4, 0x0, 0x486, &(0x7f0000000380), &(0x7f00000003c0)=0xc) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000280)={@local, 0x0}, &(0x7f00000002c0)=0x14) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000300)={@ipv4={[], [], @rand_addr=0x9}, @local, @rand_addr="7d7842e79e2ea0569a64246f2af14ad0", 0x0, 0x81, 0x3ff, 0x400, 0x7fff, 0x2000000, r5}) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r6, 0x0, 0x0) lseek(r6, 0xe7, 0x0) r7 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r7, 0xc0105502, &(0x7f0000000980)=@urb_type_iso={0x0, {0x6, 0x1}, 0x3, 0x42, &(0x7f00000006c0)="6287b822eea39a96bfb83f59f751cfdf591997c0dcdc1801696adc3d315f8ccba4b061a348d4cd6db8f62f3cd9723b109ba9ad53e2ac5049becfa42d55c23d0f8dad04d06cd44beffdd6bd74cb3563b997ede9892eedecf419fb6cfcf4eb80d4fa27c170788592469ccb5b9224a1910bafaf25a2c7c805cff8d2d390bf93c6d31bc7288499a5a60ec2a2ccb02dd14f339afe2335395b4da0524c680c632e9f0306cb9988c7948e9fb3d3a5721375ba300f608974112ea88fc35ade2618144d51412de9182fddd981f661eb0251450e55f11069935b9a093ab4e1fcc580ffbf0f01e7a8329339d7752c080ebe60df43", 0xef, 0xfb, 0xffffda8f, 0x4e, 0x9, 0xc2c, &(0x7f0000000880)="a98ffef8acf39880ef01e3eef145316733723892aabdcd309dcea5fd109003e53ba507e1f453ab8e219c95d86c4919f1e442f799970791c6c760cfdadd47d80df55ee5590dcc1bf3a292b3af697077d2eedbd9649ae3879dab6d7f0c81dda0330195fe551c052e8186ec5502ebfa9c2870fa0a3408c4b0d976724da1718f65951291b8fd3910fde693df22794fe55c94ce7a5a5243037aeb7006b77b83a0c3a1d57461f85b8cc15540c424b861516cbaa5141863803d416ddff3c592be44360fb1603a75198a125bda73b6000d66415e462c01b9910d89ec04da1581adeaa43b16287280aec4090116c53840abfcf737cfaa1ae8", [{0x9, 0x9, 0x7}, {0x5, 0x7, 0x1}, {0x6, 0x100, 0x20}, {0x6, 0xc3, 0xfffffeff}, {0x3, 0x3, 0x6}, {0x9, 0x2, 0x8}, {0x5dc3, 0x2, 0x4}, {0x0, 0x80000001, 0x9}, {0x1f, 0x8, 0x1a}, {0x1000000, 0x1, 0x6d1}, {0x8, 0x1, 0x37}, {0xd02b, 0x10000, 0x521b}, {0x12, 0x3, 0x4}, {0x800, 0xfffffeff, 0x9}, {0x9ef, 0x8}, {0x0, 0xf5, 0x401}, {0x1428, 0x1, 0x5}, {0xe518, 0xffffffff, 0x6}, {0x81, 0x2, 0x457d}, {0xe91e, 0x5, 0x1}, {0x9, 0x73a, 0x5956}, {0x8, 0x704, 0x2}, {0x6, 0x2, 0xffffffff}, {0x3, 0x1f, 0x3ff}, {0xfff, 0x2, 0x1f}, {0x3f, 0x70b, 0x3f}, {0x8ef6, 0xa3, 0xffffffff}, {0x4, 0x3}, {0x2, 0x192, 0x2}, {0x4, 0x1f, 0x9a}, {0x1, 0x9, 0x9}, {0x5, 0x0, 0x81}, {0xffffff87, 0x7, 0x8}, {0x401, 0x8000, 0x4}, {0x3, 0x7, 0x56a6}, {0x5, 0x9, 0x20}, {0x10001, 0x2, 0x13}, {0x3, 0x10001, 0xfc}, {0x4, 0x3, 0x800}, {0x6, 0x1, 0x8}, {0x20, 0x5, 0xfffffff8}, {0x7, 0x0, 0xffff5239}, {0xbe07, 0xcbe5, 0x5}, {0xfffffffa, 0xb0, 0x9}, {0x8, 0x7, 0xf1}, {0xffffff7e, 0x0, 0x2}, {0x400, 0x7, 0xb7b}, {0xff, 0x10000, 0x3}, {0x0, 0x20, 0x6}, {0x400, 0x6, 0x4}, {0x8000, 0x3f, 0xfffffffc}, {0x400, 0x1, 0x3}, {0x6, 0x0, 0x9}, {0x2, 0x9, 0x253}, {0x8, 0x9, 0x800000}, {0x100, 0x9, 0xfffffffb}, {0x1f, 0x2, 0x8}, {0x4, 0x2, 0x1}, {0x3, 0x200}, {0x81, 0x5, 0x3f}, {0x596, 0x7, 0x819}, {0x7, 0x8, 0x1b}, {0x1, 0x101, 0x1}, {0xd08, 0x7, 0x3}, {0x6, 0x8, 0xffff}, {0xf45f, 0x80000001, 0x5}, {0x10000, 0x1f, 0x94}, {0xfffffffc, 0x7, 0xfffeffff}, {0x6, 0x9, 0x3}, {0x9, 0x5637, 0x8}, {0x7, 0x1, 0xfff}, {0x10000, 0x8, 0xe5}, {0x6, 0x7, 0x7fff}, {0x5, 0xff, 0x5}, {0x1, 0x9, 0xffffffff}, {0x80, 0x1, 0x7}, {0x2, 0x401, 0x76}, {0x2, 0x7, 0xffff8001}]}) fcntl$F_GET_RW_HINT(r7, 0x40b, &(0x7f0000000100)) getsockname$inet6(r6, &(0x7f0000000400)={0xa, 0x0, 0x0, @ipv4={[], [], @broadcast}}, &(0x7f0000000440)=0x1c) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r8, 0x0, 0x0) lseek(r8, 0xe7, 0x0) ioctl$TCXONC(r8, 0x540a, 0x1) getsockname$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r10 = accept4(r6, &(0x7f0000000200)=@l2tp6={0xa, 0x0, 0x0, @ipv4={[], [], @local}}, &(0x7f0000000540)=0x80, 0x800) setsockopt$sock_void(r10, 0x1, 0x24, 0x0, 0x0) sendmmsg(r1, &(0x7f0000000800)=[{{&(0x7f00000004c0)=@ll={0x11, 0x0, r9, 0x1, 0x0, 0x6, @link_local}, 0x80, 0x0}}, {{&(0x7f0000000180)=@in6={0xa, 0x0, 0x0, @dev}, 0x80, 0x0}}], 0x2, 0x0) [ 348.969947][T22127] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 348.994389][T22131] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 349.007640][T22131] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:14:41 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) r2 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r2, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$dupfd(r2, 0x406, r1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) [ 349.071341][T22140] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 349.082749][T22140] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 349.364242][T22149] FAULT_INJECTION: forcing a failure. [ 349.364242][T22149] name failslab, interval 1, probability 0, space 0, times 0 [ 349.376957][T22149] CPU: 0 PID: 22149 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 349.390678][T22149] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 349.400739][T22149] Call Trace: [ 349.404029][T22149] dump_stack+0x1b0/0x228 [ 349.408354][T22149] ? devkmsg_release+0x127/0x127 [ 349.413285][T22149] ? __kasan_check_read+0x11/0x20 [ 349.418305][T22149] ? show_regs_print_info+0x18/0x18 [ 349.423503][T22149] should_fail+0x6fb/0x860 [ 349.427919][T22149] ? setup_fault_attr+0x2b0/0x2b0 [ 349.432966][T22149] ? current_time+0x2e0/0x2e0 [ 349.437656][T22149] __should_failslab+0x11a/0x160 [ 349.442588][T22149] ? kmalloc_array+0x32/0x60 [ 349.447169][T22149] should_failslab+0x9/0x20 [ 349.451667][T22149] __kmalloc+0x64/0x310 [ 349.455834][T22149] kmalloc_array+0x32/0x60 [ 349.460250][T22149] iter_file_splice_write+0x21d/0xf20 [ 349.465625][T22149] ? __sb_end_write+0xa8/0xf0 [ 349.470304][T22149] ? touch_atime+0x22e/0x270 [ 349.474892][T22149] ? current_time+0x2e0/0x2e0 [ 349.479584][T22149] ? fsnotify+0x1390/0x1450 [ 349.484259][T22149] ? splice_from_pipe+0x200/0x200 [ 349.489307][T22149] ? splice_shrink_spd+0xb0/0xb0 [ 349.494357][T22149] ? splice_from_pipe+0x200/0x200 [ 349.499474][T22149] direct_splice_actor+0xf7/0x130 [ 349.504507][T22149] splice_direct_to_actor+0x496/0xb00 [ 349.509902][T22149] ? do_splice_direct+0x3d0/0x3d0 [ 349.514961][T22149] ? pipe_to_sendpage+0x300/0x300 [ 349.519988][T22149] ? rw_verify_area+0x1c2/0x360 [ 349.524843][T22149] do_splice_direct+0x279/0x3d0 [ 349.529705][T22149] ? splice_direct_to_actor+0xb00/0xb00 [ 349.535273][T22149] ? security_file_permission+0x157/0x350 [ 349.541003][T22149] do_sendfile+0x89d/0x1110 [ 349.545533][T22149] ? compat_writev+0x390/0x390 [ 349.550421][T22149] ? __kasan_check_write+0x14/0x20 [ 349.555557][T22149] ? fput_many+0x47/0x1a0 [ 349.559894][T22149] __x64_sys_sendfile64+0x1ae/0x220 [ 349.565090][T22149] ? __ia32_sys_sendfile+0x240/0x240 [ 349.570380][T22149] ? syscall_return_slowpath+0x6f/0x500 [ 349.575921][T22149] do_syscall_64+0xc0/0x100 [ 349.580579][T22149] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 349.586569][T22149] RIP: 0033:0x45b399 [ 349.590468][T22149] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 349.613293][T22149] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 349.621711][T22149] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 349.629775][T22149] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 349.637749][T22149] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 349.645848][T22149] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 349.653824][T22149] R13: 00000000000008ca R14: 00000000004ca24d R15: 000000000000001d 09:14:41 executing program 5 (fault-call:10 fault-nth:30): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) [ 349.939168][T21211] tipc: 32-bit node address hash set to fbff1eac [ 349.967564][T22146] FAT-fs (loop5): FAT read failed (blocknr 63) [ 349.981629][ T27] attempt to access beyond end of device 09:14:41 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x5000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:41 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r1, 0x0, 0x0) lseek(r1, 0xe7, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x6000) r3 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r2, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB="d8f50a80", @ANYRES16=r3, @ANYBLOB="200029bd7000fbdbdf25040000001400060076657468305f766972745f77696669000500010001000000"], 0x30}, 0x1, 0x0, 0x0, 0x810}, 0x8080) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r4, 0x0, 0x0) lseek(r4, 0xe7, 0x0) sendmsg$TIPC_NL_MON_PEER_GET(r4, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x800, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x401}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xc858}, 0x40000) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)={0xe0, r3, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_SECCTX={0x2c, 0x7, 'system_u:object_r:load_policy_exec_t:s0\x00'}, @NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:syslogd_initrc_exec_t:s0\x00'}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'virt_wifi0\x00'}, @NLBL_UNLABEL_A_SECCTX={0x26, 0x7, 'system_u:object_r:mail_spool_t:s0\x00'}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'ipvlan1\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x22}}]}, 0xe0}, 0x1, 0x0, 0x0, 0x4004801}, 0x20008801) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) 09:14:41 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0xa, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:41 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x25a, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:41 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) socket$inet6(0xa, 0x2, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x2, 0x21, 0x0, 0x3, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0) mount$bpf(0x20000000, &(0x7f0000000140)='./bus\x00', 0x0, 0x2001801, 0x0) socket$packet(0x11, 0x0, 0x300) accept4(0xffffffffffffffff, &(0x7f00000002c0)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) r3 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(r3, 0x800) lseek(0xffffffffffffffff, 0x80, 0x2) r4 = open(&(0x7f0000001840)='./bus\x00', 0x84002, 0x0) sendfile(r3, r1, 0x0, 0x8400fffffffa) sendfile(r3, r4, 0x0, 0x280900) dup(0xffffffffffffffff) syz_genetlink_get_family_id$nbd(&(0x7f00000004c0)='nbd\x00') r5 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x800) sendfile(r5, 0xffffffffffffffff, 0x0, 0x0) sendfile(r5, 0xffffffffffffffff, 0x0, 0x280900) r6 = creat(&(0x7f0000000680)='./bus\x00', 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ftruncate(r6, 0x8) lseek(r6, 0x0, 0x0) sendfile(r6, 0xffffffffffffffff, 0x0, 0x280900) r7 = creat(0x0, 0x0) ftruncate(r7, 0x800) r8 = open(0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, r8, 0x0, 0x8400fffffffa) sendfile(r7, 0xffffffffffffffff, 0x0, 0x280900) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x4010) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) pipe2(&(0x7f00000001c0), 0x0) pivot_root(&(0x7f0000000380)='./file0\x00', &(0x7f0000000340)='./file0\x00') [ 349.987287][ T27] loop5: rw=1, want=78, limit=63 [ 349.999167][ T27] buffer_io_error: 38 callbacks suppressed [ 349.999175][ T27] Buffer I/O error on dev loop5, logical block 77, lost async page write [ 350.016101][ T27] attempt to access beyond end of device [ 350.021904][ T27] loop5: rw=1, want=79, limit=63 [ 350.026979][ T27] Buffer I/O error on dev loop5, logical block 78, lost async page write [ 350.035536][T22157] tipc: Started in network mode [ 350.036001][ T27] attempt to access beyond end of device [ 350.041021][T22157] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 350.047860][ T27] loop5: rw=1, want=80, limit=63 [ 350.063702][T22157] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 350.065934][ T27] Buffer I/O error on dev loop5, logical block 79, lost async page write [ 350.072117][T22157] tipc: Enabled bearer , priority 10 [ 350.090511][ T27] attempt to access beyond end of device [ 350.096163][ T27] loop5: rw=1, want=81, limit=63 [ 350.108335][ T27] Buffer I/O error on dev loop5, logical block 80, lost async page write [ 350.122540][ T27] attempt to access beyond end of device [ 350.128197][ T27] loop5: rw=1, want=130, limit=63 09:14:42 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x2bc, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:42 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x6000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 350.139586][ T27] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 350.151230][ T27] attempt to access beyond end of device [ 350.161950][ T27] loop5: rw=1, want=131, limit=63 [ 350.166997][ T27] Buffer I/O error on dev loop5, logical block 130, lost async page write 09:14:42 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x10, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 350.185564][ T27] attempt to access beyond end of device [ 350.195283][ T27] loop5: rw=1, want=132, limit=63 [ 350.200612][ T27] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 350.209846][ T27] attempt to access beyond end of device [ 350.215849][ T27] loop5: rw=1, want=133, limit=63 [ 350.221955][ T27] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 350.223957][ T1938] tipc: Disabling bearer 09:14:42 executing program 0: r0 = socket$tipc(0x1e, 0x5, 0x0) r1 = geteuid() fstat(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) statx(0xffffffffffffffff, &(0x7f0000000480)='./file1\x00', 0x4000, 0x8, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r5, 0x0, 0x0) r6 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r7, 0x0, 0x0) fsetxattr$system_posix_acl(r0, &(0x7f00000001c0)='system.posix_acl_access\x00', &(0x7f00000003c0)={{}, {0x1, 0x7}, [{0x2, 0x2, r1}, {0x2, 0x5, r2}, {0x2, 0x4, r3}], {0x4, 0x5}, [{0x8, 0x4, r5}, {0x8, 0x0, r7}], {0x10, 0x3}, {0x20, 0xe}}, 0x4c, 0x2) unshare(0x44000600) clone(0x1010000, &(0x7f0000000000)="aa9b41d5e89946eac1e5b3f86108f51a50969f135fd941d63ec8caf7bed245258283006c62aa440a1469bcb871bd4941ad95c2c6f1c5f177cfe7674b719491736cff76e5fbbad80752703e479f654ff7702f769841332fac0a03e928fa76c80e5a3cde53ebdc55869f182596cd87b6bb6643e06ce7d854ed7471e5c6814a3933db164f6384ee82e05f4eb4e3a58f8507842c7642943df1c40f30b2e32b2a97a2bba191379ce3afcb99b17a7e4aa5f359dee9809fee0e725ec67e06db4318421f98ed87d8c56f48", &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)="015087e0dadeb983a83e") r8 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r8, 0x4008550d, 0x0) [ 350.232320][ T27] attempt to access beyond end of device [ 350.240362][ T1938] tipc: Left network mode [ 350.241978][ T27] loop5: rw=1, want=142, limit=63 [ 350.251654][ T27] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 350.258731][T22176] tipc: Enabling of bearer rejected, failed to enable media [ 350.261810][ T27] attempt to access beyond end of device [ 350.277534][ T27] loop5: rw=1, want=143, limit=63 09:14:42 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x7000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:42 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x2e8, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 350.284132][ T27] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 350.294865][ T27] attempt to access beyond end of device [ 350.300573][ T27] loop5: rw=1, want=144, limit=63 [ 350.305623][ T27] attempt to access beyond end of device [ 350.316202][ T27] loop5: rw=1, want=145, limit=63 [ 350.323620][ T27] attempt to access beyond end of device [ 350.332727][ T27] loop5: rw=1, want=5273, limit=63 [ 350.376205][T22183] tipc: Started in network mode [ 350.378978][ T27] attempt to access beyond end of device [ 350.381307][T22183] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 350.386830][ T27] loop5: rw=1, want=63513, limit=63 [ 350.396731][T22183] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 350.410887][T22183] tipc: Enabled bearer , priority 10 [ 350.473332][T22183] tipc: Enabling of bearer rejected, already enabled [ 350.757758][T22198] FAULT_INJECTION: forcing a failure. [ 350.757758][T22198] name failslab, interval 1, probability 0, space 0, times 0 [ 350.770787][T22198] CPU: 1 PID: 22198 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 350.780939][T22198] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 350.791025][T22198] Call Trace: [ 350.794322][T22198] dump_stack+0x1b0/0x228 [ 350.798782][T22198] ? devkmsg_release+0x127/0x127 [ 350.803718][T22198] ? __kasan_check_read+0x11/0x20 [ 350.808771][T22198] ? show_regs_print_info+0x18/0x18 [ 350.814003][T22198] should_fail+0x6fb/0x860 [ 350.818524][T22198] ? setup_fault_attr+0x2b0/0x2b0 [ 350.823549][T22198] ? current_time+0x2e0/0x2e0 [ 350.828239][T22198] __should_failslab+0x11a/0x160 [ 350.833197][T22198] ? kmalloc_array+0x32/0x60 [ 350.837790][T22198] should_failslab+0x9/0x20 [ 350.842289][T22198] __kmalloc+0x64/0x310 [ 350.846434][T22198] kmalloc_array+0x32/0x60 [ 350.850861][T22198] iter_file_splice_write+0x21d/0xf20 [ 350.856281][T22198] ? __sb_end_write+0xa8/0xf0 [ 350.860967][T22198] ? touch_atime+0x22e/0x270 [ 350.865645][T22198] ? current_time+0x2e0/0x2e0 [ 350.870342][T22198] ? fsnotify+0x1390/0x1450 [ 350.874950][T22198] ? splice_from_pipe+0x200/0x200 [ 350.879977][T22198] ? splice_shrink_spd+0xb0/0xb0 [ 350.884922][T22198] ? splice_from_pipe+0x200/0x200 [ 350.889947][T22198] direct_splice_actor+0xf7/0x130 [ 350.894980][T22198] splice_direct_to_actor+0x496/0xb00 [ 350.900354][T22198] ? do_splice_direct+0x3d0/0x3d0 [ 350.905376][T22198] ? pipe_to_sendpage+0x300/0x300 [ 350.910401][T22198] ? rw_verify_area+0x1c2/0x360 [ 350.915256][T22198] do_splice_direct+0x279/0x3d0 [ 350.920111][T22198] ? splice_direct_to_actor+0xb00/0xb00 [ 350.925658][T22198] ? security_file_permission+0x157/0x350 [ 350.931465][T22198] do_sendfile+0x89d/0x1110 [ 350.935976][T22198] ? compat_writev+0x390/0x390 [ 350.941002][T22198] ? __kasan_check_write+0x14/0x20 [ 350.946118][T22198] ? fput_many+0x47/0x1a0 [ 350.950561][T22198] __x64_sys_sendfile64+0x1ae/0x220 [ 350.955761][T22198] ? __ia32_sys_sendfile+0x240/0x240 [ 350.961058][T22198] ? syscall_return_slowpath+0x6f/0x500 [ 350.967387][T22198] do_syscall_64+0xc0/0x100 [ 350.971895][T22198] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 350.977779][T22198] RIP: 0033:0x45b399 [ 350.981707][T22198] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 351.001430][T22198] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 351.009947][T22198] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 351.017921][T22198] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 351.025897][T22198] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 351.033873][T22198] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 351.041949][T22198] R13: 00000000000008ca R14: 00000000004ca24d R15: 000000000000001e [ 351.189242][T20536] tipc: 32-bit node address hash set to fbff1eac 09:14:43 executing program 5 (fault-call:10 fault-nth:31): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:43 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x25, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:43 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x8000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:43 executing program 2: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r1, 0x0, 0x0) lseek(r1, 0xe7, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x6000) r3 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180)='NLBL_UNLBL\x00') sendmsg$NLBL_UNLABEL_C_STATICREMOVE(r2, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)=ANY=[@ANYBLOB="d8f50a80", @ANYRES16=r3, @ANYBLOB="200029bd7000fbdbdf25040000001400060076657468305f766972745f77696669000500010001000000"], 0x30}, 0x1, 0x0, 0x0, 0x810}, 0x8080) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r4, 0x0, 0x0) lseek(r4, 0xe7, 0x0) sendmsg$TIPC_NL_MON_PEER_GET(r4, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x28, 0x0, 0x800, 0x70bd25, 0x25dfdbff, {}, [@TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x401}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x1}]}]}, 0x28}, 0x1, 0x0, 0x0, 0xc858}, 0x40000) sendmsg$NLBL_UNLABEL_C_STATICADDDEF(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000040)={0xe0, r3, 0x2, 0x70bd2c, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_SECCTX={0x2c, 0x7, 'system_u:object_r:load_policy_exec_t:s0\x00'}, @NLBL_UNLABEL_A_SECCTX={0x2f, 0x7, 'system_u:object_r:syslogd_initrc_exec_t:s0\x00'}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'virt_wifi0\x00'}, @NLBL_UNLABEL_A_SECCTX={0x26, 0x7, 'system_u:object_r:mail_spool_t:s0\x00'}, @NLBL_UNLABEL_A_ACPTFLG={0x5}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'ipvlan1\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x22}}]}, 0xe0}, 0x1, 0x0, 0x0, 0x4004801}, 0x20008801) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) 09:14:43 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x2f8, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:43 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x68542, 0x80) fsmount(r1, 0x1, 0x70) r2 = dup2(0xffffffffffffffff, r0) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r3, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl(r3, 0x4, &(0x7f0000000880)="7152c151265a93805e88b612d4a6a807cc3c48d0addf6eab94b2dd10d477cbc3c9f5ce272c702986a2cb2f4349ad00467757858884f81b12692927ec301c14724c6ebfaa65fbabdcdd5bc1d9491320c4ed8de46398961c8c3bdb906c3495ac37558ef02d39ef6ab67de4bb5b8b074b7838fcb3670cfb4193d2167cfca5385f54c4daa523f9f0d07b6bf03deb331cbfa39dc1ad4a5255f0666ce1d185ef7e23b7fd9e7e32b5142b70ee48f67b500f61e9d487ea42e2d1b2737dd125a1e86f842f46b93c4bc86c5a04c26461e5fd322e5a713340558a07d5d512f4f1ceb936e6675b0790abb906e47a25ebb67d41b2b1ccb486efe386e637fd6ccbd8aa4707a4fcece97bcf6a36b5abd89ac4ae7bba260d19770f17472d7bda6066a570be9be4c38e82ba60cfa22a3668c3ba1ad127158f61cbef7b72938d3919d13c534ec8e031d19a529d19d1b5f32fb68af050ef739a70e6aa3431e0bbfc88eea944abc2ef8f032db70159dffa6b41c8948ca3a71a625c55ba2d5daaa7e86d920e29d5c1a44ef253712897ae3ee2ef12947c8095cf1e2459933e69c06b983b410d694cee678d3e78fe3c5b7df1a79bec553ba289ea4ae1e97277774303138f3905acb6652b92d5aa7158e5dbaadb6f8dad3a42e476224d6543f845e5c1c6ea6e8aaea6eb4fb98cfb45392b0822e64f516a1ecd3a3e1f4e8add6370a90d4b9c6d8687d30ad87fa6306e7181b365e60c3daa2c3aefe0c5bc480bf6f52fc113f0a3e36f62ec7de66417265bf77639a4706be33d1326ab8a1a4910bd91a5d57fa8c63883896930e2a2fa17dde1a545b1242038d55af60463f959dba327eecc555da665068134d5e5ed3237d08fc56019843e007dea53cabbcb4bfe65e0c78b8e1e1ed869036f6be3572b7de69e873049b39dd558d7d6081ba577dbf621b3c0a80c16ffc59994071b8ce303f839159d48f4fc1b577d6db2541b22db97d378092d832c598ad04fc13fd9d217ac66e2fa80f74b9491b302dd638f88117e53266e7cf2eb8a5273a2383afdf2883de815612db7275abdca668eed7b3946988f1c6f8fc821d7599cf1f13bbdcdbc93789b1afc9393e9d69635f4ad06917350423326e3b831df939bbf1e267ef893d363503384785188e0a29047ee1aa46db062cd4b4b9962399c74fa8e0692aaf5c9c47620fa6a5e4379363a36e56892dd9ec419a2b17cfdca80dcfef2f04c742846dadc99a4f02155e0c1a741ef5cfc497ffd0aa0c17f2aaebe19cf17583e86accd070afdf452d839aa9019ffcdaf47a7f0792cc14a1bf0f12420b707dab6f814f4c8d7a6f05e96074fb50c2f7802361735d9f41125369d40c61a6cfdb681d2233477cde44bf518b8fc31eab11e95930075560ecb681206756a525850cfb601b1a92d92085e8f86670ae842c05c949031f2fe53ae9c6fc590a6ac31f4cc657a76a21580c30b7c1e5c79e3863cd325304434d67baeaa35993f9f3bc1c8ca5878e9582bed0f9670656c217711e16c8cc2f1d8b824171ef202ff2fccf14ad3ea5fde98b985b49b9d038007d6b219dd916f0e6573d1c2bc68f1e617830fb9dc15d6035e512a00aeef2729056fbcc3af39586a1e759bf08a48d390b7cc3e8ea506835841f637af102c6268c2e4c45a31a24e433e73dd8aa6ba8a5cc213c1fba1c7c7258995bfdde66a54c54b1a241b0033929c3ce3942d0497c39d88838af11caa3906a6fa3a0d9564371b2b1ae427c9017f3704fc035c0269ce81bc6c9dce0949137a9efc87587f06e85f4c405b73f64792f7d35ced3a14748e4c019ef05d4d3f98896b079c9ca3988a1c0e145f860fef4111491a1fae4737d5a82dc9a5c615a63ddcab17d1fca6f5c92af2a21925575369f73d7f9a6a0281fab7dfc4b04cde5e1500daee1a52ce454dc0ca965adec50d30f76db429147dbc755d1cf8c8eed7aa4e0286008dce555051c77d4c78bdc06d88264592780db8e0cebbc5c48ee342a7cd2bce6ea82068dbd1b43247132da84a7334bb0e4282487365fedcbd73cbeddc971708b493d8f505fd0393fc49a66333a565eaa238705ae335d5a14a0d1568755cd876197d391d25eca45e30c5794e19f4b904b19afb8dc013f535fb313c664fad4d3f0efaf7afdba37812d56b6a7d50f003f4cabdd1736ff70c7f0447352aef5b87c0ab03de99ab7cde010dce695f8357cd625f18c1d241d950367a111508e112768917fe6ba360f0d2da177ac35ca9a6b232b9e3390fad6a337d4af3e8dc58051324cf87f8f988e905a021850de16f9007fe2e9db6c193d6f36dfb8a27443f84d20dee7834919b19ef41a3349c1407ef82d902ae3803ef8ff1033f1442153957e15232a20e7e1d4cf033d7a6fa700498a6e4f286c7126bdb01802492e71708280ced40c2dd204bf36cd58fd7505d5ceafc8bda765040e6eb1587a3b626bc393704b614a2e660820d3a445e0ebc4ec0e07a4d12090781f1b6a3719cbe6a80d17135b03b60ab27f028d6dafa5663deb492ecc01c99a0b23938658cd4d10d3244767999b3a8a33cc8344327a4204868bd8b986a55d807765d4804618bfeeb13998afec89d6dae260a5d056b1aa2da17871916738c7401d572e2ac3f77e6830d6f2345afba116240f70cb774d8bee9306e50d870120a9c6d88d4eaa4907fd24d79f9fb0f9aca404f4bb0e408cc8299168651cded2d9cc06c664346b8e66a4a4351e39a9aabff542dcd1982941c656c967f319460ed9da49079d52bb4e323845985057394fe45550c5f2ca597db0257f5480095c117553f9a95a910659e7eaefaab5f71fc18a8cca092ae6961ff60769444607c962f225ac62f3dd2ffd34251641bebaee9f63272e353a6e9eb84c967b4f3052c44f2bea81e8def04934dc6433f76cc9ba054f48ea5af3dcb61d67b3541d7a9601cd1240287719dd58e34b988bdc59601b1e78ef62d6201a63526054c0408538faf6398fb6e3aff92019c570829c5d558256d8423dc78eaf482aae263d4fe7317106d8b85d237048bbcbb0ee9d88bf5118474f1a448e966d6f772f9df56a4475c5b275c9d81289ce65e19e18a7b29fcdae4eb983f205d391d5e32aac6f3e90416537de50e02980197cd870541c59b935664e8e6962d797e754d39f004f4e98d03a131b406e9e35399a121024797791b0e833a4ce6dab384eab39a3b92b5ea2e3974ab50abbc2f84b1a9764275b0eb25b3af393da178131f70a9a5cdb255fcc2d0a16fbd44ddbe54260d7d6ce170dc00f36d06cfdef412fac5946a9d23a02a72577517a4357491c5c46f18fd376e78db6075beb7848594ace2339cf008499d3fe413bbef10e8e3067243f491851d763e03ca100ec0ec9610da8c570036bdbcb19675be0d365d15dd77c854b814a74a780ccbb911c84d067b2b2fdc0476a7642460665d7c670191eec861f65d0d79e1a310f9c8d683a7de2e080101f3f812943f706759ec6db10309789544b6b836172fb4d065e025060e50756f8c7135b0157403686f85531f02642306cc0c3e7eede59c9e6b71045299c75c6523bb19cde946083b1ffbb94d1efa3cd11ee47ee49984c8e473007e79d5b218ce0ee2d9f4e18085a04ddecd1a4d3ed454cd2a26385a7056cee6c4caa40a64eb0110d561297072c20ac2466a749e225f63121998ce009b6f701de445c723fa26c4cf8e917bcff5728f98197eb4c266acb575ed5424354b29da452dd2638ecdf1f70c5b467823a382f589b92d4ddb9ba428529b3fac8a5751ea694cb3e69ae13f4e4389f9eb51ab94deefbc9839ebdc095fe965c13c3d65d548f554a9ca023824ee66436216cc70537391c444bda7702fa558091dbee7ed65ddeb7cc9e69cf78c2277a78bb7a92f40215ceab25d0a990c317d754ac1a527f8785a13cd3d85d85c9500ab62e2c54940c4fb08f32cef80267547ae3642cac42bf3d45f1c16863c586f7ce4d868e9afd846c98202177a6d7f9fd34fa7748737e46e87e30c4799c38b0e44d21e10c55e118883edadadf8a3050c04576dda447ef6fc57a9201ef888d6fa9ea5ce82fc39101ac1c9a0754bd5a49c07443f7da183a4abcd399191d333105183284351e605ec98988a0b91b7b5db6e63eecc2279161089c568ad3f47a02f0fc6763b691ee1cd698f9ec144ab5e50574b7bf871c6b220539674412ce6ce10a650f1ae5f7b21799037053c8dd0747b1880eb61d855d03b638251b0dbce81fd87a58ec6d96f7d6223eb22d9dec314c0e0da8b4fd52fb6faf9322438b8d835c9e935f41caee5058d56f4c2145f2c4d3952f20e244386d542099a7eb0d15bf781276940c0ca823a2b84e042111f20fed19c26351aef979d803e26ef881067efdc0b100900bde98ba054f3da030eabbcca571a83500cf562fd7cfa87404775550829c71d2556214cba16f710f63f18355af4df1c8a6707c51e831a4043762763a4b27ee03920fd2724f28a9b54ded0a887dd7ca9609ec13dd3d35d632f15f5a3b7eb44c5173d953b21d3cf30dc4b62a70442285e443c058e52eb4dd466e53fd1231fe6dcf7c7663842b96c1428049393838693a515e4aba4fcbebe0a69cb5bc16b8874c664847bd7c6c41cb09f8c7672a95022e43a5031c168cb709e0874bf02620469d476a181c494e9b5cb5e2495e295b24ef7305913ba4d82aa9e8c1697503ca0955425f1b3d949d4cddf3b57428b9cd93186fea7b8e7171701aa28ae17ac204844b1ecc41ed7bedd29d84c93aa74205a805acaa5e4e203fa67c11888e60852ca037c6516563526f885eeb42fc79cca4fd7fe5fef1a4d408f7514267c7b70a5d7d9b8847317e00be8061c57bde3a60377022555c157e295abd696e2eea25bb6ccb09bba26fdd3c557c00b1128b8fbafbb43b1a05cbb8b38787cf04ed5d438a2a2e7f7e1417515a814b5ee49b1bae36e2a64255a984a0be40ff2fea6fc37a3e506aed7f7fbe9983d9449c99b21803630cf7640e9de9a8c618b2ccaefe62ca68270c65e4e5932fe2af86a32e2b4d30f5aad7f61453d54a2172a5ef7f745f2a588e5a4fd57ac7b8c4b8588e62c5c8b1268bd8cf62d7ac1ee3ccb267eba0ad940124167f75f6d251a0b023adb88ebc2d78dfbd494861b7a19d1f102619125c8735d564f9d08b0ab7138f8bc7b2044d6205a45d928c0ecec983ec17636bf0f2748c4338f97c9e12946d220d18733477a4c0dcb0cf4a71c11981f32d78f2cbfadc0b1138102e33e4cf8368986d9a48eab6cb3d04f00a8b088fa4fc0de0053877dc12477d96908c1a876a12f88732f660a2f2d81bf725fe9069499c254f86470155e96ed0b9d4658c06ffd6faa47dc76a4be8161b00f75b938bd6b9bf878df91c4372274948e7d7e19bc5f31bb0915528e30e8aacf0b9a53e785ea78ccd0182285f62f408a7629ab76965b843f86fb8bd8752b1b8bb9e10251774b098ff2b2871ef79bdc83f17ba85288b3587bc50a317d83903526a248912e8ee57ba1424f48ee24dcf7cf4a3608e00f0387bc608527075d26ab4d80f71c6af9f4e2974992b79513c1f09afe1973c5356d0ca0b28d029ac421f5b98d3f81c9415ed3cafa354af39b95517cf8b8c6f4d075480b2422d733ce1a326e4ba8c72050f29e4a9e628b96fd36b64db517fee5aef2d5ae92301a234811fb763858220ee9051744afefabd6af06063944e576ca127d9fdfacb5471718d69813605e9d3a561ad3058d357fd25a8a31fd6a35728cfe142ca709a1988c74f3652634ea390a5134dc2109deea8b30d3d0a1b04c10688f999f661681d205f4219366e40f74") unshare(0x44000600) syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x10800000903, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(r2, 0x4008550d, 0x0) [ 351.368801][T22195] FAT-fs (loop5): FAT read failed (blocknr 63) [ 351.383672][ T27] attempt to access beyond end of device [ 351.395285][ T27] loop5: rw=1, want=78, limit=63 [ 351.401837][T22203] net_ratelimit: 7 callbacks suppressed 09:14:43 executing program 2: bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000004540)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x2, [@enum={0x0, 0x0, 0x0, 0x5}, @restrict={0x0, 0x0, 0x0, 0x6, 0x1}, @struct={0x0, 0x1, 0x0, 0x4, 0x1, 0x0, [{0x0, 0x2, 0x1000000}]}]}}, &(0x7f0000004600)=""/210, 0x4a, 0xd2, 0x8}, 0x20) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r0, 0x0, 0x0) lseek(r0, 0xe7, 0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000040)=0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r2, 0x0, 0x0) lseek(r2, 0xe7, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000002c0)={0xffffffffffffffff, 0xc0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=0xfffffffffffffff7, 0x0, 0x0, 0x0, &(0x7f0000000100)={0x3, 0x4}, 0x0, 0x0, &(0x7f0000000140)={0x5, 0x1, 0x4, 0x7}, &(0x7f0000000180)=0xfffffffffffffe19, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=0x7}}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000300)={r1, r2, 0x0, 0xb, &(0x7f0000000080)='security{/\x00', r3}, 0x30) [ 351.401844][T22203] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 351.403186][ T27] attempt to access beyond end of device [ 351.430876][ T27] loop5: rw=1, want=79, limit=63 [ 351.439235][ T27] attempt to access beyond end of device [ 351.444913][ T27] loop5: rw=1, want=80, limit=63 [ 351.449965][ T27] attempt to access beyond end of device [ 351.455878][ T27] loop5: rw=1, want=81, limit=63 09:14:43 executing program 2: socket$vsock_dgram(0x28, 0x2, 0x0) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) sched_setattr(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000100)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="00032bbdd07fa7969671fd0972358da825254f7000fedbdf250b000000ffff2e000100000008003900320000000000050038000000000005002e00000009000800320008000000066589b2951f0a8027d610a9f0cf126368be7a290757000000000000"], 0x54}, 0x1, 0x0, 0x0, 0x4000854}, 0x4) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) unshare(0x40000000) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x24, 0x0, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r0, 0x0, 0x0) lseek(r0, 0xe7, 0x0) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00', r0}, 0x10) [ 351.458904][T22206] netlink: 5 bytes leftover after parsing attributes in process `syz-executor.1'. [ 351.461351][ T27] attempt to access beyond end of device [ 351.482811][ T27] loop5: rw=1, want=130, limit=63 [ 351.487922][ T27] attempt to access beyond end of device [ 351.491697][T22210] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:14:43 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x9000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 351.515416][ T27] loop5: rw=1, want=131, limit=63 [ 351.517147][ T1938] tipc: Disabling bearer [ 351.520679][ T27] attempt to access beyond end of device [ 351.530004][ T1938] tipc: Left network mode [ 351.535952][ T27] loop5: rw=1, want=132, limit=63 [ 351.541441][ T27] attempt to access beyond end of device [ 351.547670][T22213] tipc: Enabling of bearer rejected, failed to enable media [ 351.556191][ T27] loop5: rw=1, want=133, limit=63 [ 351.561293][ T27] attempt to access beyond end of device [ 351.566925][ T27] loop5: rw=1, want=142, limit=63 [ 351.572253][ T27] attempt to access beyond end of device [ 351.577971][ T27] loop5: rw=1, want=143, limit=63 [ 351.583200][ T27] attempt to access beyond end of device [ 351.588829][ T27] loop5: rw=1, want=144, limit=63 [ 351.594035][ T27] attempt to access beyond end of device [ 351.601103][ T27] loop5: rw=1, want=145, limit=63 [ 351.603153][T22216] netlink: 5 bytes leftover after parsing attributes in process `syz-executor.1'. 09:14:43 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0xc0, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 351.608672][ T27] attempt to access beyond end of device [ 351.624341][ T27] loop5: rw=1, want=5257, limit=63 [ 351.629144][ T1938] tipc: Disabling bearer [ 351.635347][ T1938] tipc: Left network mode [ 351.639828][T22221] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 351.645360][ T27] attempt to access beyond end of device [ 351.660975][ T27] loop5: rw=1, want=35377, limit=63 [ 351.686870][ T27] attempt to access beyond end of device [ 351.692800][ T27] loop5: rw=1, want=63513, limit=63 09:14:43 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x6c0, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:43 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0xec0, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 351.964002][T22221] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 352.299295][T22241] FAULT_INJECTION: forcing a failure. [ 352.299295][T22241] name failslab, interval 1, probability 0, space 0, times 0 [ 352.326933][T22241] CPU: 0 PID: 22241 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 352.337135][T22241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 352.354469][T22241] Call Trace: [ 352.357765][T22241] dump_stack+0x1b0/0x228 [ 352.362131][T22241] ? devkmsg_release+0x127/0x127 [ 352.367074][T22241] ? __kasan_check_read+0x11/0x20 [ 352.372102][T22241] ? show_regs_print_info+0x18/0x18 [ 352.377456][T22241] should_fail+0x6fb/0x860 [ 352.381984][T22241] ? setup_fault_attr+0x2b0/0x2b0 [ 352.387100][T22241] ? current_time+0x2e0/0x2e0 [ 352.391790][T22241] __should_failslab+0x11a/0x160 [ 352.397162][T22241] ? kmalloc_array+0x32/0x60 [ 352.402619][T22241] should_failslab+0x9/0x20 [ 352.407268][T22241] __kmalloc+0x64/0x310 [ 352.411434][T22241] kmalloc_array+0x32/0x60 [ 352.415862][T22241] iter_file_splice_write+0x21d/0xf20 [ 352.421235][T22241] ? __sb_end_write+0xa8/0xf0 [ 352.425915][T22241] ? touch_atime+0x22e/0x270 [ 352.430512][T22241] ? current_time+0x2e0/0x2e0 [ 352.435202][T22241] ? fsnotify+0x1390/0x1450 [ 352.439724][T22241] ? splice_from_pipe+0x200/0x200 [ 352.444857][T22241] ? splice_shrink_spd+0xb0/0xb0 [ 352.449802][T22241] ? splice_from_pipe+0x200/0x200 [ 352.454830][T22241] direct_splice_actor+0xf7/0x130 [ 352.459870][T22241] splice_direct_to_actor+0x496/0xb00 [ 352.465241][T22241] ? do_splice_direct+0x3d0/0x3d0 [ 352.470269][T22241] ? pipe_to_sendpage+0x300/0x300 [ 352.475333][T22241] ? rw_verify_area+0x1c2/0x360 [ 352.480188][T22241] do_splice_direct+0x279/0x3d0 [ 352.485134][T22241] ? splice_direct_to_actor+0xb00/0xb00 [ 352.490954][T22241] ? security_file_permission+0x157/0x350 [ 352.496677][T22241] do_sendfile+0x89d/0x1110 [ 352.501566][T22241] ? compat_writev+0x390/0x390 [ 352.506342][T22241] ? __kasan_check_write+0x14/0x20 [ 352.511458][T22241] ? fput_many+0x47/0x1a0 [ 352.515801][T22241] __x64_sys_sendfile64+0x1ae/0x220 [ 352.521005][T22241] ? __ia32_sys_sendfile+0x240/0x240 [ 352.526297][T22241] ? syscall_return_slowpath+0x6f/0x500 [ 352.531982][T22241] do_syscall_64+0xc0/0x100 [ 352.536489][T22241] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 352.542477][T22241] RIP: 0033:0x45b399 [ 352.546376][T22241] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 352.566090][T22241] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 352.574615][T22241] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 352.582592][T22241] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 352.590577][T22241] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 352.598552][T22241] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 352.606631][T22241] R13: 00000000000008ca R14: 00000000004ca24d R15: 000000000000001f 09:14:44 executing program 5 (fault-call:10 fault-nth:32): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:44 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xa000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:44 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x300, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:45 executing program 0: unshare(0x44000600) uname(&(0x7f0000000080)=""/2) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x200000, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r1, 0x0, 0x0) lseek(r1, 0xe7, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) write$input_event(r1, &(0x7f0000000140)={{r2, r3/1000+30000}, 0x5, 0x1}, 0x18) ioctl$TIOCCONS(0xffffffffffffffff, 0x541d) r4 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000180)=0xa4) getsockopt$ARPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x63, &(0x7f0000000000)={'icmp6\x00'}, &(0x7f0000000040)=0x1e) ioctl$USBDEVFS_REAPURBNDELAY(r4, 0x4008550d, 0x0) 09:14:45 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x33fe0, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 353.001167][ T27] attempt to access beyond end of device [ 353.006864][ T27] loop5: rw=1, want=78, limit=63 [ 353.019226][ T27] attempt to access beyond end of device [ 353.029324][ T27] loop5: rw=1, want=79, limit=63 [ 353.034306][ T27] attempt to access beyond end of device [ 353.047927][ T27] loop5: rw=1, want=80, limit=63 [ 353.053112][ T27] attempt to access beyond end of device [ 353.058755][ T27] loop5: rw=1, want=81, limit=63 [ 353.067420][T22244] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 353.074902][ T27] attempt to access beyond end of device [ 353.090385][ T27] loop5: rw=1, want=130, limit=63 [ 353.096300][ T27] attempt to access beyond end of device [ 353.102089][ T27] loop5: rw=1, want=131, limit=63 [ 353.107228][ T27] attempt to access beyond end of device [ 353.112998][ T27] loop5: rw=1, want=132, limit=63 [ 353.130323][ T27] attempt to access beyond end of device [ 353.136875][T22250] tipc: Enabling of bearer rejected, failed to enable media [ 353.145553][ T27] loop5: rw=1, want=133, limit=63 [ 353.150623][ T27] attempt to access beyond end of device [ 353.156359][ T27] loop5: rw=1, want=142, limit=63 [ 353.163326][ T27] attempt to access beyond end of device [ 353.169180][ T27] loop5: rw=1, want=143, limit=63 [ 353.173494][T22253] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 353.174224][ T27] attempt to access beyond end of device [ 353.196517][ T27] loop5: rw=1, want=144, limit=63 [ 353.201899][ T27] attempt to access beyond end of device [ 353.208124][ T27] loop5: rw=1, want=145, limit=63 [ 353.215087][ T27] attempt to access beyond end of device [ 353.221284][ T27] loop5: rw=1, want=3761, limit=63 09:14:45 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xb000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:45 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x200000a8, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 353.246881][ T27] attempt to access beyond end of device [ 353.253129][ T27] loop5: rw=1, want=43641, limit=63 [ 353.273528][ T27] attempt to access beyond end of device [ 353.279463][ T27] loop5: rw=1, want=59553, limit=63 09:14:45 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x33a, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 353.309934][T22257] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 353.374620][T22262] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:14:45 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xc000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 353.421534][T22261] tipc: Started in network mode [ 353.426539][T22261] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 353.452443][T22261] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb 09:14:45 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x7ffff000, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:45 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x33c, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 353.469711][T22261] tipc: Enabled bearer , priority 10 [ 353.488129][T22265] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 353.555081][T22270] tipc: Started in network mode [ 353.568912][T22270] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 353.589244][T22270] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 353.597483][T22270] tipc: Enabled bearer , priority 10 09:14:45 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x342, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 353.619326][T22273] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 353.713617][T22276] tipc: Started in network mode [ 353.718720][T22276] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 353.739790][T22276] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 353.756769][T22276] tipc: Enabled bearer , priority 10 [ 353.800182][T22276] tipc: Enabling of bearer rejected, already enabled [ 353.933608][T22283] FAULT_INJECTION: forcing a failure. [ 353.933608][T22283] name failslab, interval 1, probability 0, space 0, times 0 [ 353.946532][T22283] CPU: 1 PID: 22283 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 353.956776][T22283] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 353.966832][T22283] Call Trace: [ 353.970134][T22283] dump_stack+0x1b0/0x228 [ 353.974909][T22283] ? devkmsg_release+0x127/0x127 [ 353.979848][T22283] ? __kasan_check_read+0x11/0x20 [ 353.984994][T22283] ? show_regs_print_info+0x18/0x18 [ 353.990320][T22283] should_fail+0x6fb/0x860 [ 353.994745][T22283] ? setup_fault_attr+0x2b0/0x2b0 [ 353.999923][T22283] ? current_time+0x2e0/0x2e0 [ 354.004612][T22283] __should_failslab+0x11a/0x160 [ 354.009546][T22283] ? kmalloc_array+0x32/0x60 [ 354.014271][T22283] should_failslab+0x9/0x20 [ 354.018782][T22283] __kmalloc+0x64/0x310 [ 354.023114][T22283] kmalloc_array+0x32/0x60 [ 354.027525][T22283] iter_file_splice_write+0x21d/0xf20 [ 354.032898][T22283] ? __sb_end_write+0xa8/0xf0 [ 354.037569][T22283] ? touch_atime+0x22e/0x270 [ 354.042152][T22283] ? current_time+0x2e0/0x2e0 [ 354.046825][T22283] ? fsnotify+0x1390/0x1450 [ 354.052635][T22283] ? splice_from_pipe+0x200/0x200 [ 354.057772][T22283] ? splice_shrink_spd+0xb0/0xb0 [ 354.062722][T22283] ? splice_from_pipe+0x200/0x200 [ 354.067905][T22283] direct_splice_actor+0xf7/0x130 [ 354.072928][T22283] splice_direct_to_actor+0x496/0xb00 [ 354.078297][T22283] ? do_splice_direct+0x3d0/0x3d0 [ 354.083448][T22283] ? pipe_to_sendpage+0x300/0x300 [ 354.088480][T22283] ? rw_verify_area+0x1c2/0x360 [ 354.093339][T22283] do_splice_direct+0x279/0x3d0 [ 354.098190][T22283] ? splice_direct_to_actor+0xb00/0xb00 [ 354.104382][T22283] ? security_file_permission+0x157/0x350 [ 354.110281][T22283] do_sendfile+0x89d/0x1110 [ 354.114793][T22283] ? compat_writev+0x390/0x390 [ 354.119900][T22283] ? __kasan_check_write+0x14/0x20 [ 354.125155][T22283] ? fput_many+0x47/0x1a0 [ 354.129488][T22283] __x64_sys_sendfile64+0x1ae/0x220 [ 354.134691][T22283] ? __ia32_sys_sendfile+0x240/0x240 [ 354.139986][T22283] ? syscall_return_slowpath+0x6f/0x500 [ 354.145541][T22283] do_syscall_64+0xc0/0x100 [ 354.150049][T22283] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 354.155944][T22283] RIP: 0033:0x45b399 [ 354.159842][T22283] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 354.179582][T22283] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 354.187995][T22283] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 354.195972][T22283] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 354.204732][T22283] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 354.212708][T22283] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 354.220685][T22283] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000020 [ 354.499222][T19952] tipc: 32-bit node address hash set to fbff1eac 09:14:46 executing program 5 (fault-call:10 fault-nth:33): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:46 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xd000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:46 executing program 2: r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r0, 0x0, 0x0) lseek(r0, 0xe7, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x234000, 0x0) r2 = socket(0x11, 0x800000003, 0x0) bind(r2, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba72e2aba000000012e0b3836005404b0e0301a0800000003ff5f163ee340b7679d0015795027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c000100000000000000497400000000000000065ecc326d3a09ffc2c6540000000000000000000000000000000000008eff00"}, 0x80) getsockname$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000300)=0x14) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000340)='ethtool\x00') accept4$packet(r1, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000003c0)=0x14, 0x800) r5 = socket(0x11, 0x800000003, 0x0) bind(r5, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba72e2aba000000012e0b3836005404b0e0301a0800000003ff5f163ee340b7679d0015795027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c000100000000000000497400000000000000065ecc326d3a09ffc2c6540000000000000000000000000000000000008eff00"}, 0x80) getsockname$packet(r5, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000300)=0x14) r7 = socket(0x11, 0x800000003, 0x0) getsockname$packet(r7, &(0x7f00000004c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000300)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="240000002a00798bc387000000008009000000df", @ANYRES32=r8], 0x2}}, 0x0) r9 = socket(0x11, 0x800000003, 0x0) bind(r9, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba72e2aba000000012e0b3836005404b0e0301a0800000003ff5f163ee340b7679d0015795027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c000100000000000000497400000000000000065ecc326d3a09ffc2c6540000000000000000000000000000000000008eff00"}, 0x80) getsockname$packet(r9, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000300)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="240000002a00798bc387000000008009000000df", @ANYRES32=r10], 0x2}}, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r12, &(0x7f0000000400)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xa}, {&(0x7f0000000440)="5628f9a4613a6fff4db48678448afce4dd3ff37095596b16ced0aeaf57bcf421471939c017e3498abb2ef1f3505bb1f68c9ef5cc3f8349f421776303e8d23e3dda6d0ba04aa92d8fc47a92e3a561d254bc684a0b2b1cf5080cc5a4aff3cad9ece0e14c3939399ffd5700", 0x6a}, {&(0x7f0000000980)="d8b1c5342039b5478a7d600b820652e4ee62b97c72f897e972a1b6018c2b4301476ae94edc7d73be4c5b3bf1904f12082d5b9e4dc23fd6de9851ea6962ee655354ce5052a858d212cf07fe72bf2f7f07bea188c00bdd20493e4b27fcd819c9e03ad0192c319ef43004320838fb0c80d298d8e08a87a2ab9aa4505bf10a9ac9deca2b33366ac8bf09206db6cf35181cdac648833d402f61ecab02cdc77e3828975ad207af5c3c12fd595bafc45165f57786785e1f5088dca2900cc00d2754430ab0b92c469a18e27d029e3d578712e07061c37621fd095724bebd18edf82b5b4bf357cf01a8ad72e0fef7210db6d8d28894b9f048b7d151e58037ce3f7907d3d981cbdef7c57b53e0a155688c13815c225415323bcaa3cfc69441e52a5ae9f8490acd79fd0950b48c16f249a4646d151b479a9981594e13203942ead44b7c925a5461dcb026ab0a6f05d720e02f743c1311e42ea1ed1edca49df4a375ef08fffdeb13c3d481f4951946b1f0854993b249133e7309188462992285018651eb845da7739bfc676c9ab227d69bd2e867767b9065d39766c109c7742680b29eb4889dddca76355f944aaf4616974d401d01d3358714b00c04b2c32a3b490f11325997cf1b69cf0f620aa9ad9be06c3151867c301904ddcf202a89f2c32ba259e2df666799dcfd869b26f6864dd027529060fd80fa323469fed66c845f32910d048c5801d944ed2c953c90d8f1cc28aa8fd6a48730239aece7c26d1a626c4cd69e74ac7d060cbfdac0700e49dd3507a1bdece01b490b536a15f0fe3544820e1ef651ba7c19ef55e9a45a3e3c2e4bf699ef2c85242e4ebd9173e444a8a5d57780533714c4d7194fdba3666722fd00267c41eced60a59036cd19dd07bafdb27cb18c94fab4fc8d4f878b42aff55d7792d663f4b1b846c05e3b3e4b32031240fdc04dbacb49e0b87cef38d3d8ce73983fe11ebc463e658a81127fdd88fb6d136f660afd3ba34eb4464e0035b7f63273441b9104f26fafa6f071bafcaff9098dea06fb3050a7634f6fa58e2a4bf7a89261ba76bda5afebd61d2de887d2f953154e607b28bad087a98e707bfb2fc7342483f6037c13d15ff894760937cc9d99fef47ced9a865db376beb3cf65c50b57b9f35eb60fd66ff32709c932e52ecb62cb2e32fd09e038eb4bb301ddf5eff6575238e6f07fe5746d61a6273b89da760a6ec5fe6dc9ad5102261438e554869a1032e9f9dc768c2af713e4f2ab69faa808285a10748bf7bbd9a29a8681a5f4fa04a117eac6a7dc954d7de69d9bab7cf2df31c20e68bd491395f7e70946ad500a23f26f72fd60ccaf7882a69accdd70cd71e98848e01ca75a02390c75a7982439ebf35c031953107a1658cccab199573df8b9c4309feeab660aac0d5d0c6c248694db75527d76c0b67bfbb630ae559f71785b311642149a70252036b17798cee890a0556b614e5d41e537b693233f266b104335b6509a4b2f3a2f07f780b2e5687e053046036acba0619146dedd59578837f913d63d1d766f4cf1aea5f0286b7c9c8a1ebf93fb89db6a1fb4b1d7497a4f29e8603d734980beb85b8e3c63cb62cb43331855d41151de749c12fbfb526ee9065d08886d88f39236b6eda462b9b3d8de0fca17fc54a640c62d0daf7780db387c12c00d3b8123f584a3678bf7d9e8ab3ed5cbb23beee2786252895bee8b56f6df9b72c3a91225a4c8c85e490134ff6ecd9865c934ce7c4deb38072553af5321ec68a4e89813080d0866df570d608eb5b48a8f282551a7f12669e84ca83e7036c6929cc20d48c0a16ff7eaee048724120ab83c4fd28953fffaa633b58e00933bfc000760699df1abf52c86b6c8da3658de555fc7ba420afbd62ba1c2f330aceef5690b2b7654112fefd137d4092851001b99b48993e3cc6245691f972cc222be91eaea99e74dcb1084f99030ad0711af74addf63b9871ae0b64dd197743069fbca38b006ef5b6e05553250e161c05ec6a2fabbbf9743f7e7ba407f1f89918516a40c42c721dd8d928c792feba56676328bb5f9b18d21f591572bcaa214d250f21903d4397be93fe49e768a6eaf74256728c9944f39363c1cb7acbb09b3fcdc089727a8d9542b8a55ef85be88ca47a958c303536b8f74a8558bee047a0389536de77699f8e66f643ce90e722ef9f948932935049922d9f839241692b6cb755496fc92001d6b7ae45539061cdb4eb33a7e2e580320b47a180803c2f7375020172e12a385feb665a814a7e389ad2f17b641c96abb89a2360a8d2aa502e52aa89ac95b4caff79d2e53f1827c1a962ffbabb25fe7564ce7448fb1483a8db36fd37322f2a9632ffe05b65410be45524a5998e701fa7eb370bbfbd0969b112d3ab94896c0b6d1f9dc0eb344d969e57048f50e22a0c2cbd5c2aab8f7b2412b073520b5a01bebf26cfa0ddfaeece5672e6e769e94263158a84accc7b481b07285c11d5d2cc4315102d72dc973d2a5511dc367d5ba17613fa52efb6c5083fd353609a680266a83118eecb3692df9f379fb54eb359143b329d4e7c8e7c68e726960ba50ef282e9cf9aeac487dc001825f93eacbe4212e615c35ece8c7cf8d402c6f8aa2d426e7d3409b34bc88206fe31a0498ded6cbb8a2cbab505e57cf7d902f31ec9f4e7cd3662dc8d162d87a841494066d4ebba481989c8280f12d4e98b532a996c236a7b26647c0ead9f085ddcff1568da52c517751711d7208008c80b1813882f7478e500c25f50782eaeba2cd6f1a568bb9642f743f64dca870f9adf80012326bb3a00d8b5cb3228ebb3df04371d80f46cf294dfb4fabf315ee96fcbd7ddb5ed87268ccd6374804b9d21ce6d192d3451fe3002780f0e946cf1484b352c5dbaf497d79c75a286082bb8ef8cab2e8da9c80d80cdb64359eb0e245c158c4968ecea5de4e9417eca4be26ad853d19e018d5e0b718f2c2eb32e5e864356dbc8c138fc7d47b49d63bb060763eb7544cc9f7b734fa972a3a3ed00fdd12130f735e1d8eeb4cbd42519ab21ab49a40def0be292b353377b2d80050a2c99bfc9016cb607cc1e5b73682b608fc64466755b491805cd04165ffb687fb3b02e2f447d5064176a5d43ef4fd5028831b1ca870095fb050383811f80c95c72c120f1591a4b39ac2f15515b1df6bdd92309af375c88e2f0dde1e128763d744f8b24004787df6e1ab8268c1d3b02a4db0aa69fe55410fc835f7c073624a89a804008a68b8f7ffcd8c8eb6a3b6f879ccf7f913eded98c30ed0be6b1e3c932feb0b3ab3403af6ba1dfa5220f4f7cdd02fac909031a6c0f304056c390480edc0377185da2f36af9fa136330c7c4943c4c260ae5b37dabfda507a6482ebdc887b6aaccdc7c1b48982d29d385a651b3bc92b84790b0b06896fb309c37c90706b26827a017b29b3475079791b5d6113ab87ac98208a9d7ff0aab62b60e3131892b7a3f0c434d4a882241b2331f728394051bbb8c32351d761d99f204c708ce0c0a8a086dbeb9a38a03b4b509eb40c7826d4672a048d932a25ab20e97d95d7ae4d61eccec07f32a9a77225f24485d079cf24c21de8371dd369d38487d7d3df1345cd9d55b136eab0d67a92bf7d851080883f912aeeeb2d362712565946f3e518f65d567567f2c1e5edaaf579845e78a998465279c677a483accec964ca7c6def4679c4449a268cef249c52dd77d405dbb835c5f043a2c101c882e5c1193434fc392c0b9174320f8aa09a8a9af8de4a4505e9fd253bc692749d641f53754436c950da790dc93a63d09c173d58e81211a75d10e4a92887b8439360265931335024fede6c95fc55f8590c03397dffdb2cea5443181a2f7c88217179dc501dc9226277116199cad632c4367f688a6d0ab3de7b72c355211cc98bf7ca6680831667e578767631c6011daaf58527e2ce35cc5964565e511527d5e73a28cef633aa858600cb5fc500dc7ef2d9ab4a295b16c8dd646d50b97259a7f31086cacaf88f7e1d16506ba439047dd1eac2d547ae5ba4c584d4f0870f5a6789741db8d39797e6dc81dc3f04b9caef217a8d7a4bcc8c501d1993296eae997bcefeedd1499deb3750646039c57bac5ab900960f7477bdea2c75062304a5621fa74dae6a4806171add75f0f538d97b00882ebb5f72736a3b049a8086099dfae124c3a11ca992ec92fe6894826a8457bd67e235965966ad7d93e9c13e1af13330b7345d7e9e00ebb8b565bef0e5e1f03112a4441614ab83e45e2ca395daa4d6ddbb33e9882c07fd7b1f05feedc5d04acf11db704482dee52a126c250e97bb63800e55abb188c5e24e5f1007472385eacf570c564b00ed5ce3c6d8bc8322e851b4e0cc79cb979ae8f7898605f32ca40c92482f5bd7697f0507a4f17e7b7031cd2ea37d0aac53dd8509f22670a3b00642030efb990ffc596810b60144fa273bd79d59f5ff14511fac9f95ebb7e8daa5994a524890ad4ecfae6bc090f68a28b1a8e382cc56ef55675dd5e18acc7c8bf666480d524327efa77fc1b324c76abbaf7dffac57f71f29eee059827d5ec520302ae906c0167f947e97c84a342d85c60d455986eac7f6b08d9aa9b6c0f453b34d00bdd051bef7777c4a31bd9f63e42bab7465ce77c4978c58e14d3538a5b05e1408a67ad37142703f19a5d82feaa7164c888d627102ca75b62e0928f1d9bb0aecb3bd8c128e29b163f1cca2a32821769f0e0b41d0e8a669c910bf5bd739564ef91b16ea5f350439a14ec773fb495a15486e978a1296dc5a80e6eb801a68af41714f782429a4ec7a88a9df6e4985c2b9d8db2a3d37ca9043a6dfef10816009fb04baca770440297068e88904023c705a344c8c5ad9135ba6dd4ecb8211fc9ac42d2e7acd45a19e9eb10b225ab67a538ce65df0bc2a0b16be868d5b439063cb23869f9f7a3ad142ebb53efe7315a6cc74baacf9e8f3915f1c7fb6e72dab6ef3007267ff591cf93b6e6e78c71fbde4f8f8156ca80a7ebc07fd8e9727a6ad949bbda7acfd9389d6360bf693e6e7b5beaf4e59f62c6a1bf01bd45dd1180e6cb2542b6e0af07098085b302333c2f2ea30f4ac3e1d6bf1ea902d299d1ca63161930e0367d021b086e7fc52ecae6eebfe6c13fb24d6d74ad4e7620c371c6dcc71e90f2b60177f73fa5618bb3faaf958a529006aa5f25dcdd0db2db15cd609f07690a847a3a832369482cb7e9f8aa5c7cd0583f14cb89a97f0d0d7c4595f711009f6681567c794bbb6b07ddaabe4f2bd008c6ccb925bd1f7d7f1f57b24bbfe49ca592a5aceea6cec563a07702797435d878a8b07fb24f894794f23629855d3e92afe81710d04fe4279a0df2fcaeb7678233597a4a956eacbb00c4fa2cb445a51ec396fef5f5d7afb4da6acae7c4f4a4c6e17504b3ba758548ba8ff24eb501563457adfdf7943fcec809b849a6b251c4c3bf1786170c790da378fb8e9cbccea82e73de341adfceebcb0e107aa73ced9469546bfb978cc9f98741e73543439e3a691afcb2803cb51aabb1658a125dcf49cb618ff5cb3ee7af076c5cbceea49d3ea316134ec1e627f6f5cf98c91a32979ac1998064856afea031f3aeb948e5ee57c0123547c0c63a2f9cdf509791220d36d5a630cb083ff51a652930bfec196650d26afcdde1a0b7ffb9cc46b7d25042947ce8d130236f928a3b7e67dae4f16a7c5bd90858fc2c69cfdd5a3bf8c4a2159d6259b59b6be9a5fd755d446bd7d966d8874bdfac4d223232f6c4fab00aeee9e10cb40c5564d501aa5066465323bd892dab03a3bd7eada219326ce94b463eac32b0a12ef998b73", 0x1000}], 0x3, 0x1) close(r12) splice(r11, 0x0, r12, 0x0, 0x100000000, 0x0) getsockopt$inet_pktinfo(r12, 0x0, 0x8, &(0x7f0000000540)={0x0, @dev, @empty}, &(0x7f00000006c0)=0xc) r14 = socket$nl_route(0x10, 0x3, 0x0) r15 = socket(0x11, 0x800000003, 0x0) bind(r15, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r15, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r17 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r14, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=ANY=[@ANYBLOB="3c00000600"/20, @ANYRES32=r16, @ANYBLOB="000000000000000008000400", @ANYRES32=0x0, @ANYBLOB="14002b80080003000800000008000100", @ANYRES32=r17, @ANYBLOB], 0x3c}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000280)=0x14) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r2, &(0x7f0000000940)={&(0x7f0000000300), 0xc, &(0x7f0000000900)={&(0x7f0000001b00)={0x168, r3, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@ETHTOOL_A_LINKINFO_HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'xfrm0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_DEV_NAME={0x14}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_virt_wifi\x00'}]}, @ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}]}, @ETHTOOL_A_LINKINFO_HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvtap0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_LINKINFO_HEADER={0x7c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r16}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r13}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r18}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @ETHTOOL_A_LINKINFO_HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macsec0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}]}]}, 0x168}, 0x1, 0x0, 0x0, 0x4040000}, 0x40800) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r2, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000040)={&(0x7f0000000140)={0x14, r3, 0x4, 0x70bd27, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r19 = timerfd_create(0x0, 0x0) timerfd_settime(r19, 0x0, &(0x7f0000000100)={{0x77359400}, {0x0, 0x5}}, 0x0) timerfd_gettime(r19, &(0x7f0000000080)) 09:14:46 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0xfffffdef, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:46 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x352, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:46 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r2, 0x0) r3 = getuid() setreuid(r2, r3) [ 354.542095][T22280] FAT-fs (loop5): FAT read failed (blocknr 63) [ 354.557324][ T27] attempt to access beyond end of device [ 354.565322][ T27] loop5: rw=1, want=78, limit=63 [ 354.571889][ T27] attempt to access beyond end of device [ 354.577548][ T27] loop5: rw=1, want=79, limit=63 [ 354.582829][ T27] attempt to access beyond end of device [ 354.588626][ T27] loop5: rw=1, want=80, limit=63 [ 354.593753][ T27] attempt to access beyond end of device [ 354.595522][T22286] selinux_nlmsg_perm: 4086 callbacks suppressed [ 354.595530][T22286] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=22286 comm=syz-executor.2 [ 354.599490][ T27] loop5: rw=1, want=81, limit=63 [ 354.599531][ T27] attempt to access beyond end of device [ 354.629503][ T27] loop5: rw=1, want=130, limit=63 [ 354.630251][T22290] tipc: Started in network mode [ 354.634570][ T27] attempt to access beyond end of device [ 354.634579][ T27] loop5: rw=1, want=131, limit=63 [ 354.634595][ T27] attempt to access beyond end of device [ 354.641948][T22290] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 354.645288][ T27] loop5: rw=1, want=132, limit=63 [ 354.645322][ T27] attempt to access beyond end of device [ 354.651720][T22290] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 354.656654][ T27] loop5: rw=1, want=133, limit=63 09:14:46 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x360, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 354.678328][T22290] tipc: Enabled bearer , priority 10 [ 354.684257][ T27] attempt to access beyond end of device [ 354.701408][ T27] loop5: rw=1, want=142, limit=63 [ 354.706470][ T27] attempt to access beyond end of device [ 354.712170][T21197] tipc: 32-bit node address hash set to fbff1eac [ 354.718689][ T27] loop5: rw=1, want=143, limit=63 [ 354.723774][ T27] attempt to access beyond end of device [ 354.729524][ T27] loop5: rw=1, want=144, limit=63 [ 354.734668][ T27] attempt to access beyond end of device [ 354.736817][T22302] tipc: Started in network mode [ 354.740336][ T27] loop5: rw=1, want=145, limit=63 [ 354.742470][ T27] attempt to access beyond end of device [ 354.745915][T22302] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 354.750797][ T27] loop5: rw=1, want=4345, limit=63 [ 354.757750][ T27] attempt to access beyond end of device [ 354.766423][T22302] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 354.770852][ T27] loop5: rw=1, want=16921, limit=63 09:14:46 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x7, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:46 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xe000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 354.790732][T20543] tipc: 32-bit node address hash set to fbff1eac [ 354.795822][ T27] attempt to access beyond end of device [ 354.797332][T22302] tipc: Enabled bearer , priority 10 [ 354.802737][ T27] loop5: rw=1, want=63513, limit=63 [ 354.828017][ T1938] tipc: Disabling bearer [ 354.833387][ T1938] tipc: Left network mode 09:14:46 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x37c, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 354.854885][T22308] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=7 sclass=netlink_route_socket pig=22308 comm=syz-executor.1 [ 354.898562][T22286] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=22286 comm=syz-executor.2 [ 354.920244][T22313] tipc: Started in network mode [ 354.925187][T22313] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 09:14:46 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x10000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:46 executing program 2: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x33c, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 354.935971][T22315] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=7 sclass=netlink_route_socket pig=22315 comm=syz-executor.1 [ 354.955884][T22313] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 354.972910][T22313] tipc: Enabled bearer , priority 10 [ 354.982865][ T1938] tipc: Disabling bearer [ 354.988363][ T1938] tipc: Left network mode [ 355.001005][ T1938] tipc: Disabling bearer [ 355.006350][ T1938] tipc: Left network mode [ 355.056600][T22319] tipc: Started in network mode [ 355.061573][T22319] tipc: Own node identity 00000000000000000000ffffac1e0003, cluster identity 4711 [ 355.071606][T22319] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 355.085185][T22319] tipc: Enabled bearer , priority 10 [ 355.280267][T22327] FAULT_INJECTION: forcing a failure. [ 355.280267][T22327] name failslab, interval 1, probability 0, space 0, times 0 [ 355.293037][T22327] CPU: 0 PID: 22327 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 355.303188][T22327] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 355.313357][T22327] Call Trace: [ 355.316651][T22327] dump_stack+0x1b0/0x228 [ 355.321004][T22327] ? devkmsg_release+0x127/0x127 [ 355.325944][T22327] ? __kasan_check_read+0x11/0x20 [ 355.330979][T22327] ? show_regs_print_info+0x18/0x18 [ 355.336193][T22327] should_fail+0x6fb/0x860 [ 355.340644][T22327] ? setup_fault_attr+0x2b0/0x2b0 [ 355.345670][T22327] ? current_time+0x2e0/0x2e0 [ 355.350344][T22327] __should_failslab+0x11a/0x160 [ 355.355288][T22327] ? kmalloc_array+0x32/0x60 [ 355.359933][T22327] should_failslab+0x9/0x20 [ 355.364439][T22327] __kmalloc+0x64/0x310 [ 355.368589][T22327] kmalloc_array+0x32/0x60 [ 355.373148][T22327] iter_file_splice_write+0x21d/0xf20 [ 355.378552][T22327] ? __sb_end_write+0xa8/0xf0 [ 355.383238][T22327] ? touch_atime+0x22e/0x270 [ 355.387837][T22327] ? current_time+0x2e0/0x2e0 [ 355.392513][T22327] ? fsnotify+0x1390/0x1450 [ 355.397017][T22327] ? splice_from_pipe+0x200/0x200 [ 355.402040][T22327] ? splice_shrink_spd+0xb0/0xb0 [ 355.406998][T22327] ? splice_from_pipe+0x200/0x200 [ 355.412022][T22327] direct_splice_actor+0xf7/0x130 [ 355.417362][T22327] splice_direct_to_actor+0x496/0xb00 [ 355.422743][T22327] ? do_splice_direct+0x3d0/0x3d0 [ 355.427770][T22327] ? pipe_to_sendpage+0x300/0x300 [ 355.432793][T22327] ? rw_verify_area+0x1c2/0x360 [ 355.437751][T22327] do_splice_direct+0x279/0x3d0 [ 355.442601][T22327] ? splice_direct_to_actor+0xb00/0xb00 [ 355.448163][T22327] ? security_file_permission+0x157/0x350 [ 355.453881][T22327] do_sendfile+0x89d/0x1110 [ 355.458420][T22327] ? compat_writev+0x390/0x390 [ 355.463182][T22327] ? __kasan_check_write+0x14/0x20 [ 355.468295][T22327] ? fput_many+0x47/0x1a0 [ 355.472720][T22327] __x64_sys_sendfile64+0x1ae/0x220 [ 355.477919][T22327] ? __ia32_sys_sendfile+0x240/0x240 [ 355.483205][T22327] ? syscall_return_slowpath+0x6f/0x500 [ 355.488748][T22327] do_syscall_64+0xc0/0x100 [ 355.493623][T22327] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 355.499609][T22327] RIP: 0033:0x45b399 [ 355.503503][T22327] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 355.523245][T22327] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 355.531663][T22327] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 355.539653][T22327] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 355.547992][T22327] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 355.555979][T22327] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 355.563951][T22327] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000021 [ 355.796039][T20518] tipc: 32-bit node address hash set to fbff1eac 09:14:47 executing program 5 (fault-call:10 fault-nth:34): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:47 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x11000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:47 executing program 2: syz_open_procfs(0x0, &(0x7f0000000000)='net/rt6_stats\x00') r0 = socket(0xa, 0x6, 0x1) sendfile(r0, r0, 0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0x16, 0x1c, &(0x7f0000000100)=ANY=[@ANYBLOB="e29271967a465bdebedfd60fd8ce5f392df39efdd67a2e6adf27703e35d0935b984bbe3fd0050b258aac672b9fa049665b9b02f2e42458478d2a1bb56659e37acf0847145d3398b67bbf95aea383818950cf1f0991b950bcbf54d6fce0b6424238ea138d36c8abb1416428a883663e8763aef89f9aa8e6bfccc388ff2e0af566cb77d278353e2ad272a29937e9ca4832b9d1d8c3194faa17931c06515ef626e10983bae1716a6b6872be89fac18224d1871e11fb0bbcd08ecb3822aa2139f47882a464f9784d13a53699aba9f3c90aebdafcbc97645588c045cbff2731b3f1ee3eae445e2f4d4b"], &(0x7f0000014ff5)='GPL\x00', 0x2, 0x1000, &(0x7f0000014000)=""/4096, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x5}, 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x78) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r1, 0x0, 0x0) lseek(r1, 0xe7, 0x0) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000000c0)={r2, 0xc0, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000400)={r3}, 0xc) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) r5 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vsock\x00', 0x313100, 0x0) ioctl$TIOCSIG(r5, 0x40045436, 0x40) read(r4, 0x0, 0x0) lseek(r4, 0xe7, 0x0) sendmsg$IPVS_CMD_ZERO(r4, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0x4a, &(0x7f0000000280)={&(0x7f00000004c0)={0x94, 0x0, 0x2, 0x70bd2d, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffffffff}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x400}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_L_THRESH={0x8}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e21}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x6}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x9}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xfffffff9}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x0, 0x3, @ipv4=@multicast1}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e23}, @IPVS_SVC_ATTR_TIMEOUT={0x8}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x4008000}, 0x20000000) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000040)={r3}, 0xc) 09:14:47 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x1000, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) 09:14:47 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0xf, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:47 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x384, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 355.883776][T22324] FAT-fs (loop5): FAT read failed (blocknr 63) [ 355.899142][ T27] attempt to access beyond end of device [ 355.904798][ T27] loop5: rw=1, want=78, limit=63 [ 355.911000][ T27] buffer_io_error: 38 callbacks suppressed [ 355.911009][ T27] Buffer I/O error on dev loop5, logical block 77, lost async page write [ 355.925947][T20518] tipc: 32-bit node address hash set to fbff1eac [ 355.932448][ T27] attempt to access beyond end of device [ 355.938216][ T27] loop5: rw=1, want=79, limit=63 [ 355.943726][ T27] Buffer I/O error on dev loop5, logical block 78, lost async page write [ 355.952473][ T27] attempt to access beyond end of device [ 355.958111][ T27] loop5: rw=1, want=80, limit=63 [ 355.963362][ T27] Buffer I/O error on dev loop5, logical block 79, lost async page write [ 355.979172][ T27] attempt to access beyond end of device [ 355.982292][T22336] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=15 sclass=netlink_route_socket pig=22336 comm=syz-executor.1 [ 355.984999][ T27] loop5: rw=1, want=81, limit=63 [ 355.985010][ T27] Buffer I/O error on dev loop5, logical block 80, lost async page write [ 355.985051][ T27] attempt to access beyond end of device [ 356.017473][ T27] loop5: rw=1, want=130, limit=63 [ 356.022870][ T27] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 356.032049][ T27] attempt to access beyond end of device [ 356.037698][ T27] loop5: rw=1, want=131, limit=63 [ 356.044123][T22334] tipc: Started in network mode [ 356.049005][ T27] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 356.049028][ T27] attempt to access beyond end of device [ 356.063716][ T27] loop5: rw=1, want=132, limit=63 [ 356.068776][ T27] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 356.077690][ T27] attempt to access beyond end of device 09:14:48 executing program 2: socketpair(0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)=@gettaction={0x7c, 0x32, 0x100, 0x70bd29, 0x25dfdbfd, {}, [@action_gd=@TCA_ACT_TAB={0x60, 0x1, [{0x10, 0x13, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}, {0x10, 0x1b, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'csum\x00'}}, {0xc, 0x5, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8000}}, {0x10, 0x1a, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0x14, 0x20, 0x0, 0x0, @TCA_ACT_KIND={0xd, 0x1, 'connmark\x00'}}, {0xc, 0x3, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'bpf\x00'}}]}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x80}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4000804}, 0x90) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000040)='./bus\x00', 0x8001141042, 0x0) ftruncate(r1, 0x2008002) r2 = open(&(0x7f0000000780)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x605300, 0x7ffffe, 0x4002012, r2, 0x100000) r3 = memfd_create(&(0x7f0000003380)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>\x9b\x94a\xac\xf8R?\x1c\xe2\xb5!\xfa\xcb\xd4\xb6\xe1_\xb4d>\xf6\xb7h\xb9Uql\b0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x12000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:48 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r1, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000100)=@urb_type_control={0x2, {0xd, 0x1}, 0x0, 0x2, &(0x7f0000000000)={0x0, 0xf, 0x3, 0x8, 0xc95}, 0x8, 0x9, 0x957, 0x0, 0x7, 0x6, &(0x7f0000000040)="4df4123e30214bd695cc6a9c4e78ed573447ffbddd495eb1d1d2104baaa1c6ef8559f53e3b15dc991a3a7e5c32f673616a8f494f8d5c05ed61f88b1ccc7d83867360a516342de0b75abb6a0830fb8a32498e8c169ebf9886cc2fce7b739f78e82629304a9e8235cda371e070a502f05e152ad56a65110e8d389dbe234e86ab6fbddecfb94092380e94cc876a732679585505e46718f999e52c62e1a9598ccfc39dddaf6e219f2cfa30773282632007a17a016af6e108c7a876af"}) [ 356.107116][T20518] tipc: 32-bit node address hash set to fbff1eac [ 356.112831][T22334] tipc: Enabled bearer , priority 10 [ 356.124946][ T27] attempt to access beyond end of device [ 356.152764][T22349] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=15 sclass=netlink_route_socket pig=22349 comm=syz-executor.1 [ 356.167353][ T27] loop5: rw=1, want=143, limit=63 [ 356.172422][ T27] Buffer I/O error on dev loop5, logical block 142, lost async page write 09:14:48 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x39c, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 356.181233][ T27] attempt to access beyond end of device [ 356.186858][ T27] loop5: rw=1, want=144, limit=63 [ 356.192205][ T27] attempt to access beyond end of device [ 356.197838][ T27] loop5: rw=1, want=145, limit=63 [ 356.202962][T20518] tipc: 32-bit node address hash set to fcff1eac [ 356.211493][ T27] attempt to access beyond end of device [ 356.217148][ T27] loop5: rw=1, want=3473, limit=63 09:14:48 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x29, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 356.235237][ T27] attempt to access beyond end of device [ 356.241097][ T27] loop5: rw=1, want=26609, limit=63 [ 356.269516][ T27] attempt to access beyond end of device [ 356.275377][ T27] loop5: rw=1, want=63513, limit=63 09:14:48 executing program 0: unshare(0x46000e80) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x6, 0x1) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x260c00, 0x0) sendmsg$NFT_MSG_GETRULE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000180)={0x68, 0x7, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x9}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_RULE_COMPAT={0x34, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x2f}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x8808}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x3b}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x6004}]}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x4}, @NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}, 0x68}, 0x1, 0x0, 0x0, 0xc000000}, 0x800) r1 = fcntl$dupfd(r0, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) r2 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) readlink(&(0x7f0000000140)='./file0\x00', &(0x7f0000000880)=""/4096, 0x1000) ioctl$USBDEVFS_REAPURBNDELAY(r2, 0x4008550d, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r3, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) finit_module(r3, &(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x0) [ 356.283196][T22359] tipc: Started in network mode [ 356.295671][T22359] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 356.323514][T22359] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 356.332075][T22359] tipc: Enabled bearer , priority 10 [ 356.349251][T22363] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.1'. [ 356.358758][ T1938] tipc: Disabling bearer [ 356.364581][ T1938] tipc: Left network mode [ 356.442152][T22368] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.1'. [ 356.676566][T22374] FAULT_INJECTION: forcing a failure. [ 356.676566][T22374] name failslab, interval 1, probability 0, space 0, times 0 [ 356.694370][T22374] CPU: 1 PID: 22374 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 356.704523][T22374] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 356.714679][T22374] Call Trace: [ 356.717969][T22374] dump_stack+0x1b0/0x228 [ 356.722302][T22374] ? devkmsg_release+0x127/0x127 [ 356.727253][T22374] ? __kasan_check_read+0x11/0x20 [ 356.732320][T22374] ? show_regs_print_info+0x18/0x18 [ 356.737529][T22374] should_fail+0x6fb/0x860 [ 356.741951][T22374] ? setup_fault_attr+0x2b0/0x2b0 [ 356.747148][T22374] ? current_time+0x2e0/0x2e0 [ 356.751842][T22374] __should_failslab+0x11a/0x160 [ 356.756777][T22374] ? kmalloc_array+0x32/0x60 [ 356.761373][T22374] should_failslab+0x9/0x20 [ 356.765905][T22374] __kmalloc+0x64/0x310 [ 356.770057][T22374] kmalloc_array+0x32/0x60 [ 356.774477][T22374] iter_file_splice_write+0x21d/0xf20 [ 356.779855][T22374] ? __sb_end_write+0xa8/0xf0 [ 356.784537][T22374] ? touch_atime+0x22e/0x270 [ 356.789122][T22374] ? current_time+0x2e0/0x2e0 [ 356.793791][T22374] ? fsnotify+0x1390/0x1450 [ 356.798300][T22374] ? splice_from_pipe+0x200/0x200 [ 356.803334][T22374] ? splice_shrink_spd+0xb0/0xb0 [ 356.808393][T22374] ? splice_from_pipe+0x200/0x200 [ 356.813427][T22374] direct_splice_actor+0xf7/0x130 [ 356.818563][T22374] splice_direct_to_actor+0x496/0xb00 [ 356.823949][T22374] ? do_splice_direct+0x3d0/0x3d0 [ 356.829009][T22374] ? pipe_to_sendpage+0x300/0x300 [ 356.834296][T22374] ? rw_verify_area+0x1c2/0x360 [ 356.839360][T22374] do_splice_direct+0x279/0x3d0 [ 356.844346][T22374] ? splice_direct_to_actor+0xb00/0xb00 [ 356.849904][T22374] ? security_file_permission+0x157/0x350 [ 356.855627][T22374] do_sendfile+0x89d/0x1110 [ 356.860141][T22374] ? compat_writev+0x390/0x390 [ 356.864914][T22374] ? __kasan_check_write+0x14/0x20 [ 356.870290][T22374] ? fput_many+0x47/0x1a0 [ 356.874648][T22374] __x64_sys_sendfile64+0x1ae/0x220 [ 356.880023][T22374] ? __ia32_sys_sendfile+0x240/0x240 [ 356.885420][T22374] ? syscall_return_slowpath+0x6f/0x500 [ 356.890978][T22374] do_syscall_64+0xc0/0x100 [ 356.895488][T22374] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 356.901378][T22374] RIP: 0033:0x45b399 [ 356.905397][T22374] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 356.925008][T22374] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 356.933534][T22374] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 356.941618][T22374] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 356.949593][T22374] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 356.957657][T22374] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 356.965633][T22374] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000022 09:14:49 executing program 5 (fault-call:10 fault-nth:35): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:49 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x20000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:49 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) lseek(r0, 0x7, 0x1) 09:14:49 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) ioctl$FS_IOC_GETFLAGS(r3, 0x80086601, 0x0) ioctl$EVIOCGBITSND(r3, 0x80404532, &(0x7f00000003c0)=""/160) pipe(&(0x7f0000000000)) r4 = syz_open_procfs(0x0, &(0x7f0000dec000)='smaps\x00') bind$unix(0xffffffffffffffff, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=@ipv4_newaddr={0x28, 0x14, 0x1, 0x0, 0x0, {}, [@IFA_ADDRESS={0x8, 0x8, @dev}, @IFA_ADDRESS={0x8, 0x4, @multicast2}]}, 0x28}}, 0x0) getpeername$packet(r4, &(0x7f0000000500)={0x11, 0x0, 0x0}, &(0x7f0000000540)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'batadv0\x00', r7}) sendmsg$TIPC_NL_BEARER_ENABLE(r2, 0x0, 0x4) remap_file_pages(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) r8 = socket$inet_udplite(0x2, 0x2, 0x88) r9 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r9, 0x6611) fcntl$dupfd(r8, 0x0, r9) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, r10) r11 = socket$nl_route(0x10, 0x3, 0x0) r12 = socket(0x11, 0x800000003, 0x0) bind(r12, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r13 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r13, 0x0, 0x0) lseek(r13, 0xe7, 0x0) r14 = openat(r13, &(0x7f0000000100)='./file0\x00', 0x2200, 0x90) getsockname$packet(r14, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000580)=0xfffffffffffffd42) socket(0x0, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000780)=ANY=[@ANYBLOB="30000000d52bb8cbd71aca750000000000000000c719ecb4e7fd6591375f1e04ccee3a265b88578005febf3b095d25e15e194ea5f01abe023837016ac8fa6b5300"/79, @ANYRES32=r15, @ANYBLOB="000000000080000008000400", @ANYRES32=0x0, @ANYBLOB="b666aaff176d155d7808f7ceea5cca5337fbc83b1ff7fa2235cf2a0653f6bed4f044d5d946", @ANYRES32=0x0, @ANYBLOB="71f72dc582c032770b831acdf60c8b07e715e078b910a19847206ab656b86e65edcde638f0282e82f0e9be7cba054131c42d8379d5331cbd9ca325c3f8825f528dd688b02be30301ddf6f26793d4ca090fe252c684b62f36fa821b04b330a1410b751f2d61f7a14b5ca04ed86c0eb89b63d9b8d9d0f3b5c650635b002bd7343ee1d97f66735ce02661e8328c1f047c4af05fb7bf6979822456a0a33ddfc8437dbcf6ed6c5121b830c2b93f047e760ca13a4d10315bd3ab1374993dea10c568907a839231bfb813c9c1aba6a0380520e61588f26be99992"], 0x30}}, 0x0) sendmsg$nl_route(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000005200000026bd7000fcdbdf251c08000100", @ANYRES32=r15, @ANYBLOB="0800060006000000080001075039bd3d652e69619cdcd5dff600", @ANYRES32=0x0, @ANYBLOB="08000600ffffff7f0800060000000000000000"], 0x3c}}, 0x21dbf90800faa7b6) pivot_root(&(0x7f0000000380)='./file0\x00', &(0x7f0000000340)='./file0\x00') 09:14:49 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x3b2, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:49 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x6b, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 357.258603][T22371] FAT-fs (loop5): FAT read failed (blocknr 63) [ 357.284086][ T27] attempt to access beyond end of device [ 357.292666][ T27] loop5: rw=1, want=78, limit=63 [ 357.297652][ T27] attempt to access beyond end of device [ 357.307217][T22377] net_ratelimit: 10 callbacks suppressed [ 357.307223][T22377] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 357.318819][ T27] loop5: rw=1, want=79, limit=63 [ 357.329768][T22385] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=107 sclass=netlink_route_socket pig=22385 comm=syz-executor.1 [ 357.333448][ T27] attempt to access beyond end of device [ 357.353436][ T1938] tipc: Disabling bearer [ 357.358699][ T27] loop5: rw=1, want=80, limit=63 [ 357.359457][ T1938] tipc: Left network mode [ 357.369179][ T27] attempt to access beyond end of device [ 357.374834][ T27] loop5: rw=1, want=81, limit=63 [ 357.379852][ T27] attempt to access beyond end of device [ 357.385598][ T27] loop5: rw=1, want=130, limit=63 [ 357.386474][T22389] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:14:49 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x3bc, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:49 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x25000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 357.390687][ T27] attempt to access beyond end of device [ 357.390696][ T27] loop5: rw=1, want=131, limit=63 [ 357.390711][ T27] attempt to access beyond end of device [ 357.390721][ T27] loop5: rw=1, want=132, limit=63 [ 357.406751][T22386] tipc: Enabling of bearer rejected, failed to enable media [ 357.411945][ T27] attempt to access beyond end of device [ 357.444495][ T27] loop5: rw=1, want=133, limit=63 [ 357.449707][ T27] attempt to access beyond end of device [ 357.455910][ T27] loop5: rw=1, want=142, limit=63 [ 357.461284][T21205] tipc: 32-bit node address hash set to fbff1eac [ 357.464991][T22385] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=107 sclass=netlink_route_socket pig=22385 comm=syz-executor.1 [ 357.468003][ T27] attempt to access beyond end of device [ 357.486973][ T27] loop5: rw=1, want=143, limit=63 [ 357.492273][ T27] attempt to access beyond end of device [ 357.498054][ T27] loop5: rw=1, want=144, limit=63 [ 357.503576][ T27] attempt to access beyond end of device [ 357.508355][ T1938] tipc: Disabling bearer [ 357.509948][ T27] loop5: rw=1, want=145, limit=63 [ 357.515293][ T1938] tipc: Left network mode [ 357.522479][ T27] attempt to access beyond end of device [ 357.525906][T22395] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 357.530167][ T27] loop5: rw=1, want=3713, limit=63 [ 357.538892][ T27] attempt to access beyond end of device 09:14:49 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0xe2c, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 357.553010][T22396] tipc: Enabling of bearer rejected, failed to enable media [ 357.556359][ T27] loop5: rw=1, want=20097, limit=63 [ 357.589056][ T1938] tipc: Disabling bearer [ 357.595259][ T1938] tipc: Left network mode [ 357.612228][T22397] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 357.620393][ T27] attempt to access beyond end of device [ 357.633148][ T27] loop5: rw=1, want=63513, limit=63 [ 357.635258][T22399] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=3628 sclass=netlink_route_socket pig=22399 comm=syz-executor.1 09:14:49 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x40000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 357.651795][T22394] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=11221 sclass=netlink_route_socket pig=22394 comm=syz-executor.2 [ 357.666338][ T1938] tipc: Disabling bearer [ 357.672381][ T1938] tipc: Left network mode 09:14:49 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x3f2, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 357.739942][T22403] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:14:49 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x48000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 357.845271][T22406] tipc: Started in network mode [ 357.850299][T22406] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 357.860713][T22406] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 357.868921][T22406] tipc: Enabled bearer , priority 10 [ 357.904637][T22410] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 357.948943][T22414] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 358.210780][T22420] FAULT_INJECTION: forcing a failure. [ 358.210780][T22420] name failslab, interval 1, probability 0, space 0, times 0 [ 358.223500][T22420] CPU: 0 PID: 22420 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 358.233748][T22420] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 358.244019][T22420] Call Trace: [ 358.247317][T22420] dump_stack+0x1b0/0x228 [ 358.251684][T22420] ? devkmsg_release+0x127/0x127 [ 358.256625][T22420] ? __kasan_check_read+0x11/0x20 [ 358.262002][T22420] ? show_regs_print_info+0x18/0x18 [ 358.267209][T22420] should_fail+0x6fb/0x860 [ 358.271759][T22420] ? setup_fault_attr+0x2b0/0x2b0 [ 358.276983][T22420] ? current_time+0x2e0/0x2e0 [ 358.281664][T22420] __should_failslab+0x11a/0x160 [ 358.286626][T22420] ? kmalloc_array+0x32/0x60 [ 358.291237][T22420] should_failslab+0x9/0x20 [ 358.296003][T22420] __kmalloc+0x64/0x310 [ 358.300164][T22420] kmalloc_array+0x32/0x60 [ 358.304586][T22420] iter_file_splice_write+0x21d/0xf20 [ 358.310233][T22420] ? __sb_end_write+0xa8/0xf0 [ 358.314912][T22420] ? touch_atime+0x22e/0x270 [ 358.319508][T22420] ? current_time+0x2e0/0x2e0 [ 358.324187][T22420] ? fsnotify+0x1390/0x1450 [ 358.328700][T22420] ? splice_from_pipe+0x200/0x200 [ 358.333734][T22420] ? splice_shrink_spd+0xb0/0xb0 [ 358.338692][T22420] ? splice_from_pipe+0x200/0x200 [ 358.343726][T22420] direct_splice_actor+0xf7/0x130 [ 358.348758][T22420] splice_direct_to_actor+0x496/0xb00 [ 358.354170][T22420] ? do_splice_direct+0x3d0/0x3d0 [ 358.359195][T22420] ? pipe_to_sendpage+0x300/0x300 [ 358.364222][T22420] ? rw_verify_area+0x1c2/0x360 [ 358.369070][T22420] do_splice_direct+0x279/0x3d0 [ 358.373917][T22420] ? splice_direct_to_actor+0xb00/0xb00 [ 358.379681][T22420] ? security_file_permission+0x157/0x350 [ 358.385530][T22420] do_sendfile+0x89d/0x1110 [ 358.390044][T22420] ? compat_writev+0x390/0x390 [ 358.394888][T22420] ? __kasan_check_write+0x14/0x20 [ 358.400095][T22420] ? fput_many+0x47/0x1a0 [ 358.404430][T22420] __x64_sys_sendfile64+0x1ae/0x220 [ 358.409632][T22420] ? __ia32_sys_sendfile+0x240/0x240 [ 358.415019][T22420] ? syscall_return_slowpath+0x6f/0x500 [ 358.420580][T22420] do_syscall_64+0xc0/0x100 [ 358.425093][T22420] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 358.430990][T22420] RIP: 0033:0x45b399 [ 358.435007][T22420] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 358.455135][T22420] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 358.463664][T22420] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 358.471646][T22420] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 358.479631][T22420] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 358.487615][T22420] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 358.496901][T22420] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000023 09:14:50 executing program 5 (fault-call:10 fault-nth:36): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:50 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0xea0, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:50 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x500, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:50 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x4c000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:50 executing program 0: unshare(0x44000600) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r2, 0x0, 0x0) lseek(r2, 0xe7, 0x0) ioctl$TIOCGPKT(r2, 0x80045438, &(0x7f00000000c0)) ioctl$USBDEVFS_SUBMITURB(r1, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$selinux_user(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB='system\a\x00\x00\x00\x00\x00\x00\x00d_r:dmesg_exec_t:s0 root\x00'], 0x27) socket$vsock_stream(0x28, 0x1, 0x0) eventfd2(0x9, 0x801) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x30) read(r3, 0x0, 0x0) lseek(r0, 0xe7, 0x0) setsockopt$CAN_RAW_FILTER(r0, 0x65, 0x1, &(0x7f0000000000)=[{{0x0, 0x0, 0x1, 0x1}, {0x2, 0x1, 0x1}}], 0x8) r4 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x2, 0x41) ioctl$USBDEVFS_REAPURBNDELAY(r4, 0x4008550d, 0x0) 09:14:50 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x5}, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) ioctl$FS_IOC_GETFLAGS(r3, 0x80086601, 0x0) ioctl$EVIOCGBITSND(r3, 0x80404532, &(0x7f00000003c0)=""/160) pipe(&(0x7f0000000000)) r4 = syz_open_procfs(0x0, &(0x7f0000dec000)='smaps\x00') bind$unix(0xffffffffffffffff, 0x0, 0x0) socket$packet(0x11, 0x0, 0x300) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=@ipv4_newaddr={0x28, 0x14, 0x1, 0x0, 0x0, {}, [@IFA_ADDRESS={0x8, 0x8, @dev}, @IFA_ADDRESS={0x8, 0x4, @multicast2}]}, 0x28}}, 0x0) getpeername$packet(r4, &(0x7f0000000500)={0x11, 0x0, 0x0}, &(0x7f0000000540)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'batadv0\x00', r7}) sendmsg$TIPC_NL_BEARER_ENABLE(r2, 0x0, 0x4) remap_file_pages(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x0, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0) r8 = socket$inet_udplite(0x2, 0x2, 0x88) r9 = creat(&(0x7f0000000280)='./bus\x00', 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r9, 0x6611) fcntl$dupfd(r8, 0x0, r9) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, r10) r11 = socket$nl_route(0x10, 0x3, 0x0) r12 = socket(0x11, 0x800000003, 0x0) bind(r12, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r13 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r13, 0x0, 0x0) lseek(r13, 0xe7, 0x0) r14 = openat(r13, &(0x7f0000000100)='./file0\x00', 0x2200, 0x90) getsockname$packet(r14, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000580)=0xfffffffffffffd42) socket(0x0, 0x803, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(r11, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000780)=ANY=[@ANYBLOB="30000000d52bb8cbd71aca750000000000000000c719ecb4e7fd6591375f1e04ccee3a265b88578005febf3b095d25e15e194ea5f01abe023837016ac8fa6b5300"/79, @ANYRES32=r15, @ANYBLOB="000000000080000008000400", @ANYRES32=0x0, @ANYBLOB="b666aaff176d155d7808f7ceea5cca5337fbc83b1ff7fa2235cf2a0653f6bed4f044d5d946", @ANYRES32=0x0, @ANYBLOB="71f72dc582c032770b831acdf60c8b07e715e078b910a19847206ab656b86e65edcde638f0282e82f0e9be7cba054131c42d8379d5331cbd9ca325c3f8825f528dd688b02be30301ddf6f26793d4ca090fe252c684b62f36fa821b04b330a1410b751f2d61f7a14b5ca04ed86c0eb89b63d9b8d9d0f3b5c650635b002bd7343ee1d97f66735ce02661e8328c1f047c4af05fb7bf6979822456a0a33ddfc8437dbcf6ed6c5121b830c2b93f047e760ca13a4d10315bd3ab1374993dea10c568907a839231bfb813c9c1aba6a0380520e61588f26be99992"], 0x30}}, 0x0) sendmsg$nl_route(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c0000005200000026bd7000fcdbdf251c08000100", @ANYRES32=r15, @ANYBLOB="0800060006000000080001075039bd3d652e69619cdcd5dff600", @ANYRES32=0x0, @ANYBLOB="08000600ffffff7f0800060000000000000000"], 0x3c}}, 0x21dbf90800faa7b6) pivot_root(&(0x7f0000000380)='./file0\x00', &(0x7f0000000340)='./file0\x00') [ 358.804742][T22417] FAT-fs (loop5): FAT read failed (blocknr 63) [ 358.820892][ T27] attempt to access beyond end of device [ 358.826553][ T27] loop5: rw=1, want=78, limit=63 [ 358.839721][ T27] attempt to access beyond end of device [ 358.849540][ T27] loop5: rw=1, want=79, limit=63 [ 358.858929][ T27] attempt to access beyond end of device [ 358.882327][T22426] tipc: Started in network mode [ 358.883447][ T27] loop5: rw=1, want=80, limit=63 [ 358.887262][T22426] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 358.897002][ T27] attempt to access beyond end of device [ 358.907454][ T27] loop5: rw=1, want=81, limit=63 [ 358.919163][ T4585] tipc: 32-bit node address hash set to fbff1eac [ 358.927375][ T27] attempt to access beyond end of device [ 358.937891][ T27] loop5: rw=1, want=130, limit=63 [ 358.947318][ T27] attempt to access beyond end of device [ 358.955561][T22426] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 358.963859][ T27] loop5: rw=1, want=131, limit=63 [ 358.968941][ T27] attempt to access beyond end of device [ 358.974959][ T27] loop5: rw=1, want=132, limit=63 [ 358.985372][T22426] tipc: Enabled bearer , priority 10 [ 358.985796][ T27] attempt to access beyond end of device [ 358.991704][T22425] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 359.000873][ T27] loop5: rw=1, want=133, limit=63 [ 359.027528][ T27] attempt to access beyond end of device [ 359.033429][ T27] loop5: rw=1, want=142, limit=63 [ 359.038471][ T27] attempt to access beyond end of device [ 359.045191][ T27] loop5: rw=1, want=143, limit=63 [ 359.055310][ T27] attempt to access beyond end of device [ 359.061394][ T27] loop5: rw=1, want=144, limit=63 [ 359.066432][ T27] attempt to access beyond end of device [ 359.078147][ T27] loop5: rw=1, want=145, limit=63 [ 359.083933][T22432] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 359.084616][ T27] attempt to access beyond end of device 09:14:51 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x600, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:51 executing program 0: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x80a81, 0x0) setsockopt$TIPC_IMPORTANCE(r0, 0x10f, 0x7f, &(0x7f0000000040)=0xa, 0x4) unshare(0x44000600) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40086607, &(0x7f0000000080)=0x1e9) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r2, 0x0, 0x0) lseek(r2, 0xe7, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f00000000c0)='bic\x00', 0x4) [ 359.105366][ T27] loop5: rw=1, want=2417, limit=63 [ 359.114802][ T27] attempt to access beyond end of device [ 359.120872][ T27] loop5: rw=1, want=9217, limit=63 [ 359.147980][ T27] attempt to access beyond end of device [ 359.153796][ T27] loop5: rw=1, want=45465, limit=63 09:14:51 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x802, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 359.164486][ T1938] tipc: Disabling bearer [ 359.169858][ T1938] tipc: Left network mode [ 359.174440][ T27] attempt to access beyond end of device [ 359.180260][ T27] loop5: rw=1, want=63513, limit=63 09:14:51 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x60000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 359.213836][T22435] tipc: Started in network mode [ 359.218725][T22435] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 359.241594][T22435] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 359.258557][T22435] tipc: Enabled bearer , priority 10 [ 359.273784][ T1938] tipc: Disabling bearer [ 359.279175][ T1938] tipc: Left network mode [ 359.294291][T22442] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:14:51 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x803, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 359.334513][ T1938] tipc: Disabling bearer [ 359.339915][ T1938] tipc: Left network mode 09:14:51 executing program 0: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse\x00', 0x2, 0x0) write$FUSE_LSEEK(r0, &(0x7f0000000080)={0x18, 0x0, 0x3, {0x7}}, 0x18) prctl$PR_SET_FPEXC(0xc, 0x100000) write$P9_RAUTH(0xffffffffffffffff, &(0x7f0000000000)={0x14, 0x67, 0x2, {0x90, 0x4, 0x6}}, 0x14) unshare(0x44000600) syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r1, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, 0x0) [ 359.380231][T22447] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 359.399575][T22447] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 359.489888][T22452] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 359.509685][T22452] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 359.852792][T22458] FAULT_INJECTION: forcing a failure. [ 359.852792][T22458] name failslab, interval 1, probability 0, space 0, times 0 [ 359.865993][T22458] CPU: 0 PID: 22458 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 359.876143][T22458] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 359.886432][T22458] Call Trace: [ 359.889724][T22458] dump_stack+0x1b0/0x228 [ 359.894055][T22458] ? devkmsg_release+0x127/0x127 [ 359.899430][T22458] ? __kasan_check_read+0x11/0x20 [ 359.904554][T22458] ? show_regs_print_info+0x18/0x18 [ 359.909756][T22458] should_fail+0x6fb/0x860 [ 359.914179][T22458] ? setup_fault_attr+0x2b0/0x2b0 [ 359.919485][T22458] ? current_time+0x2e0/0x2e0 [ 359.924172][T22458] __should_failslab+0x11a/0x160 [ 359.929142][T22458] ? kmalloc_array+0x32/0x60 [ 359.933732][T22458] should_failslab+0x9/0x20 [ 359.938233][T22458] __kmalloc+0x64/0x310 [ 359.942541][T22458] kmalloc_array+0x32/0x60 [ 359.946978][T22458] iter_file_splice_write+0x21d/0xf20 [ 359.952359][T22458] ? __sb_end_write+0xa8/0xf0 [ 359.957136][T22458] ? touch_atime+0x22e/0x270 [ 359.961867][T22458] ? current_time+0x2e0/0x2e0 [ 359.966546][T22458] ? fsnotify+0x1390/0x1450 [ 359.971050][T22458] ? splice_from_pipe+0x200/0x200 [ 359.976078][T22458] ? splice_shrink_spd+0xb0/0xb0 [ 359.981016][T22458] ? splice_from_pipe+0x200/0x200 [ 359.986036][T22458] direct_splice_actor+0xf7/0x130 [ 359.991090][T22458] splice_direct_to_actor+0x496/0xb00 [ 359.996509][T22458] ? do_splice_direct+0x3d0/0x3d0 [ 360.001636][T22458] ? pipe_to_sendpage+0x300/0x300 [ 360.006689][T22458] ? rw_verify_area+0x1c2/0x360 [ 360.011550][T22458] do_splice_direct+0x279/0x3d0 [ 360.016412][T22458] ? splice_direct_to_actor+0xb00/0xb00 [ 360.022116][T22458] ? security_file_permission+0x157/0x350 [ 360.027844][T22458] do_sendfile+0x89d/0x1110 [ 360.032347][T22458] ? compat_writev+0x390/0x390 [ 360.037109][T22458] ? __kasan_check_write+0x14/0x20 [ 360.042224][T22458] ? fput_many+0x47/0x1a0 [ 360.046674][T22458] __x64_sys_sendfile64+0x1ae/0x220 [ 360.051909][T22458] ? __ia32_sys_sendfile+0x240/0x240 [ 360.057187][T22458] ? syscall_return_slowpath+0x6f/0x500 [ 360.062726][T22458] do_syscall_64+0xc0/0x100 [ 360.067243][T22458] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 360.073129][T22458] RIP: 0033:0x45b399 [ 360.077020][T22458] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 360.096899][T22458] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 360.105489][T22458] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 360.113461][T22458] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 360.121432][T22458] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 360.129487][T22458] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 360.137460][T22458] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000024 [ 360.279208][ T4585] tipc: 32-bit node address hash set to fbff1eac 09:14:52 executing program 5 (fault-call:10 fault-nth:37): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:52 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x68000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:52 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x880401) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ttyS3\x00', 0x100, 0x0) ioctl$TCXONC(r2, 0x540a, 0x1) ioctl$USBDEVFS_SUBMITURB(r1, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = dup3(r0, r1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000100)=@security={'security\x00', 0xe, 0x4, 0x448, 0xd0, 0x0, 0x0, 0x1e8, 0xd0, 0x378, 0x378, 0x378, 0x378, 0x378, 0x4, &(0x7f00000000c0), {[{{@uncond, 0x0, 0xa8, 0xd0}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0x20}}}, {{@uncond, 0x0, 0xf0, 0x118, 0x0, {}, [@common=@unspec=@ipvs={{0x48, 'ipvs\x00'}, {@ipv6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, [0xff000000, 0x0, 0xffffffff, 0xff], 0x4e24, 0x0, 0x4, 0x4e22, 0x8, 0x8}}]}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0x400}}}, {{@ipv6={@mcast1, @loopback, [0x0, 0x0, 0xff000000, 0xff], [0xff000000, 0xffffffff, 0xff, 0xff], 'netdevsim0\x00', 'lo\x00', {0xff}, {}, 0x88, 0x7d, 0x7, 0x64}, 0x0, 0x168, 0x190, 0x0, {}, [@common=@srh={{0x30, 'srh\x00'}, {0x3a, 0xc0, 0x7, 0x2, 0xd88, 0x2201, 0xa10}}, @common=@srh1={{0x90, 'srh\x00'}, {0x32, 0x6, 0x93, 0x0, 0x8, @mcast1, @loopback, @dev={0xfe, 0x80, [], 0x28}, [0xff, 0xffffffff, 0xff, 0xffffff00], [0xff, 0xff000000, 0x0, 0xff000000], [0xff000000, 0xffffffff, 0xff000000, 0xffffff00], 0x10, 0x400}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x1000, 0x458, 0x1}}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4a8) [ 360.451524][T22455] FAT-fs (loop5): FAT read failed (blocknr 63) [ 360.469021][ T27] attempt to access beyond end of device [ 360.477692][ T27] loop5: rw=1, want=78, limit=63 [ 360.482790][ T27] attempt to access beyond end of device [ 360.488598][ T27] loop5: rw=1, want=79, limit=63 [ 360.493754][ T27] attempt to access beyond end of device [ 360.499471][ T27] loop5: rw=1, want=80, limit=63 [ 360.504491][ T27] attempt to access beyond end of device [ 360.510347][ T27] loop5: rw=1, want=81, limit=63 [ 360.515405][ T27] attempt to access beyond end of device [ 360.521261][ T27] loop5: rw=1, want=130, limit=63 [ 360.526331][ T27] attempt to access beyond end of device [ 360.532021][ T27] loop5: rw=1, want=131, limit=63 [ 360.537067][ T27] attempt to access beyond end of device [ 360.542898][ T27] loop5: rw=1, want=132, limit=63 [ 360.548112][ T27] attempt to access beyond end of device [ 360.553981][ T27] loop5: rw=1, want=133, limit=63 [ 360.559484][ T27] attempt to access beyond end of device [ 360.565139][ T27] loop5: rw=1, want=142, limit=63 [ 360.570294][ T27] attempt to access beyond end of device [ 360.576048][ T27] loop5: rw=1, want=143, limit=63 [ 360.581248][ T27] attempt to access beyond end of device [ 360.586987][ T27] loop5: rw=1, want=144, limit=63 [ 360.592054][ T27] attempt to access beyond end of device [ 360.597673][ T27] loop5: rw=1, want=145, limit=63 [ 360.604142][ T27] attempt to access beyond end of device [ 360.609982][ T27] loop5: rw=1, want=3697, limit=63 [ 360.616374][ T27] attempt to access beyond end of device [ 360.622041][ T27] loop5: rw=1, want=5753, limit=63 [ 360.628220][ T27] attempt to access beyond end of device [ 360.634019][ T27] loop5: rw=1, want=7801, limit=63 [ 360.640234][ T27] attempt to access beyond end of device [ 360.645858][ T27] loop5: rw=1, want=9849, limit=63 [ 360.652126][ T27] attempt to access beyond end of device [ 360.657765][ T27] loop5: rw=1, want=11897, limit=63 [ 360.664036][ T27] attempt to access beyond end of device [ 360.669687][ T27] loop5: rw=1, want=13945, limit=63 [ 360.675793][ T27] attempt to access beyond end of device [ 360.682244][ T27] loop5: rw=1, want=15993, limit=63 [ 360.688338][ T27] attempt to access beyond end of device [ 360.694090][ T27] loop5: rw=1, want=18041, limit=63 [ 360.700233][ T27] attempt to access beyond end of device [ 360.705891][ T27] loop5: rw=1, want=20097, limit=63 [ 360.712163][ T27] attempt to access beyond end of device [ 360.717796][ T27] loop5: rw=1, want=22145, limit=63 [ 360.725037][ T27] attempt to access beyond end of device [ 360.730725][ T27] loop5: rw=1, want=24217, limit=63 [ 360.737554][ T27] attempt to access beyond end of device [ 360.743240][ T27] loop5: rw=1, want=26497, limit=63 [ 360.751121][ T27] attempt to access beyond end of device [ 360.757259][ T27] loop5: rw=1, want=30593, limit=63 [ 360.765171][ T27] attempt to access beyond end of device [ 360.769730][T22467] cgroup1: Unknown subsys name 'perf_event' [ 360.770890][ T27] loop5: rw=1, want=34689, limit=63 [ 360.777013][T22467] cgroup1: Unknown subsys name 'net_cls' [ 360.784724][ T27] attempt to access beyond end of device [ 360.793352][ T27] loop5: rw=1, want=38785, limit=63 [ 360.801515][ T27] attempt to access beyond end of device [ 360.807163][ T27] loop5: rw=1, want=42889, limit=63 [ 360.815449][ T27] attempt to access beyond end of device [ 360.821140][ T27] loop5: rw=1, want=46985, limit=63 [ 360.829360][ T27] attempt to access beyond end of device [ 360.835373][ T27] loop5: rw=1, want=50961, limit=63 [ 360.843460][ T27] attempt to access beyond end of device [ 360.849143][ T27] loop5: rw=1, want=55057, limit=63 [ 360.857411][ T27] attempt to access beyond end of device [ 360.863121][ T27] loop5: rw=1, want=59145, limit=63 [ 360.871395][ T27] attempt to access beyond end of device [ 360.877046][ T27] loop5: rw=1, want=63257, limit=63 [ 360.883134][ T27] attempt to access beyond end of device [ 360.888780][ T27] loop5: rw=1, want=63513, limit=63 [ 361.511844][T22664] FAULT_INJECTION: forcing a failure. [ 361.511844][T22664] name failslab, interval 1, probability 0, space 0, times 0 [ 361.524573][T22664] CPU: 0 PID: 22664 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 361.534720][T22664] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 361.544949][T22664] Call Trace: [ 361.548244][T22664] dump_stack+0x1b0/0x228 [ 361.552576][T22664] ? devkmsg_release+0x127/0x127 [ 361.557512][T22664] ? __kasan_check_read+0x11/0x20 [ 361.562538][T22664] ? show_regs_print_info+0x18/0x18 [ 361.567743][T22664] should_fail+0x6fb/0x860 [ 361.572160][T22664] ? setup_fault_attr+0x2b0/0x2b0 [ 361.577180][T22664] ? current_time+0x2e0/0x2e0 [ 361.581942][T22664] __should_failslab+0x11a/0x160 [ 361.587165][T22664] ? kmalloc_array+0x32/0x60 [ 361.591752][T22664] should_failslab+0x9/0x20 [ 361.596283][T22664] __kmalloc+0x64/0x310 [ 361.600436][T22664] kmalloc_array+0x32/0x60 [ 361.604846][T22664] iter_file_splice_write+0x21d/0xf20 [ 361.610210][T22664] ? __sb_end_write+0xa8/0xf0 [ 361.614882][T22664] ? touch_atime+0x22e/0x270 [ 361.619599][T22664] ? current_time+0x2e0/0x2e0 [ 361.624269][T22664] ? fsnotify+0x1390/0x1450 [ 361.628771][T22664] ? splice_from_pipe+0x200/0x200 [ 361.633793][T22664] ? splice_shrink_spd+0xb0/0xb0 [ 361.638725][T22664] ? splice_from_pipe+0x200/0x200 [ 361.643741][T22664] direct_splice_actor+0xf7/0x130 [ 361.648771][T22664] splice_direct_to_actor+0x496/0xb00 [ 361.654148][T22664] ? do_splice_direct+0x3d0/0x3d0 [ 361.659304][T22664] ? pipe_to_sendpage+0x300/0x300 [ 361.664330][T22664] ? rw_verify_area+0x1c2/0x360 [ 361.669175][T22664] do_splice_direct+0x279/0x3d0 [ 361.674159][T22664] ? splice_direct_to_actor+0xb00/0xb00 [ 361.679889][T22664] ? security_file_permission+0x157/0x350 [ 361.685635][T22664] do_sendfile+0x89d/0x1110 [ 361.690142][T22664] ? compat_writev+0x390/0x390 [ 361.694918][T22664] ? __schedule+0xea0/0x1700 [ 361.699555][T22664] __x64_sys_sendfile64+0x1ae/0x220 [ 361.704763][T22664] ? __ia32_sys_sendfile+0x240/0x240 [ 361.710138][T22664] do_syscall_64+0xc0/0x100 [ 361.714642][T22664] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 361.720523][T22664] RIP: 0033:0x45b399 [ 361.724510][T22664] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 361.744133][T22664] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 361.752565][T22664] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 361.760539][T22664] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 361.768522][T22664] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 361.776608][T22664] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 361.784581][T22664] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000025 [ 362.009258][ T1938] tipc: Disabling bearer [ 362.014761][ T1938] tipc: Left network mode [ 362.155268][ T1959] attempt to access beyond end of device [ 362.161202][ T1959] loop5: rw=1, want=78, limit=63 [ 362.166126][ T1959] buffer_io_error: 38 callbacks suppressed [ 362.166131][ T1959] Buffer I/O error on dev loop5, logical block 77, lost async page write [ 362.180739][ T1959] attempt to access beyond end of device [ 362.186399][ T1959] loop5: rw=1, want=79, limit=63 [ 362.191842][ T1959] Buffer I/O error on dev loop5, logical block 78, lost async page write [ 362.200547][ T1959] attempt to access beyond end of device [ 362.206187][ T1959] loop5: rw=1, want=80, limit=63 [ 362.211471][ T1959] Buffer I/O error on dev loop5, logical block 79, lost async page write [ 362.220152][ T1959] attempt to access beyond end of device [ 362.225786][ T1959] loop5: rw=1, want=81, limit=63 [ 362.231183][ T1959] Buffer I/O error on dev loop5, logical block 80, lost async page write [ 362.239884][ T1959] attempt to access beyond end of device [ 362.245550][ T1959] loop5: rw=1, want=130, limit=63 [ 362.251067][ T1959] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 362.259794][ T1959] attempt to access beyond end of device [ 362.265509][ T1959] loop5: rw=1, want=131, limit=63 [ 362.270854][ T1959] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 362.279583][ T1959] attempt to access beyond end of device [ 362.285217][ T1959] loop5: rw=1, want=132, limit=63 [ 362.290601][ T1959] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 362.299387][ T1959] attempt to access beyond end of device [ 362.305134][ T1959] loop5: rw=1, want=133, limit=63 [ 362.310461][ T1959] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 362.319084][ T1959] attempt to access beyond end of device [ 362.325026][ T1959] loop5: rw=1, want=142, limit=63 [ 362.330327][ T1959] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 362.338863][ T1959] attempt to access beyond end of device [ 362.344812][ T1959] loop5: rw=1, want=143, limit=63 [ 362.350209][ T1959] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 362.358721][ T1959] attempt to access beyond end of device [ 362.364716][ T1959] loop5: rw=1, want=144, limit=63 [ 362.370014][ T1959] attempt to access beyond end of device [ 362.375653][ T1959] loop5: rw=1, want=145, limit=63 [ 362.382691][ T1959] attempt to access beyond end of device [ 362.391669][ T1959] loop5: rw=1, want=3153, limit=63 [ 362.398509][ T1959] attempt to access beyond end of device [ 362.404513][ T1959] loop5: rw=1, want=5225, limit=63 [ 362.411620][ T1959] attempt to access beyond end of device [ 362.417412][ T1959] loop5: rw=1, want=7273, limit=63 [ 362.424349][ T1959] attempt to access beyond end of device [ 362.430215][ T1959] loop5: rw=1, want=9329, limit=63 [ 362.436868][ T1959] attempt to access beyond end of device [ 362.443038][ T1959] loop5: rw=1, want=11377, limit=63 [ 362.450045][ T1959] attempt to access beyond end of device [ 362.455700][ T1959] loop5: rw=1, want=13425, limit=63 [ 362.462834][ T1959] attempt to access beyond end of device [ 362.468551][ T1959] loop5: rw=1, want=15473, limit=63 [ 362.475609][ T1959] attempt to access beyond end of device [ 362.481541][ T1959] loop5: rw=1, want=17521, limit=63 [ 362.488272][ T1959] attempt to access beyond end of device [ 362.494384][ T1959] loop5: rw=1, want=19569, limit=63 [ 362.501401][ T1959] attempt to access beyond end of device [ 362.507061][ T1959] loop5: rw=1, want=21617, limit=63 [ 362.514019][ T1959] attempt to access beyond end of device [ 362.519887][ T1959] loop5: rw=1, want=23673, limit=63 [ 362.526896][ T1959] attempt to access beyond end of device [ 362.532770][ T1959] loop5: rw=1, want=26161, limit=63 [ 362.540923][ T1959] attempt to access beyond end of device [ 362.546586][ T1959] loop5: rw=1, want=30257, limit=63 [ 362.553940][ T1959] attempt to access beyond end of device [ 362.559622][ T1959] loop5: rw=1, want=34353, limit=63 [ 362.566650][ T1959] attempt to access beyond end of device [ 362.572340][ T1959] loop5: rw=1, want=38449, limit=63 [ 362.579313][ T1959] attempt to access beyond end of device [ 362.584943][ T1959] loop5: rw=1, want=42537, limit=63 [ 362.592013][ T1959] attempt to access beyond end of device [ 362.597946][ T1959] loop5: rw=1, want=46633, limit=63 [ 362.609389][ T1959] attempt to access beyond end of device [ 362.615119][ T1959] loop5: rw=1, want=50721, limit=63 [ 362.626791][ T1959] attempt to access beyond end of device [ 362.632503][ T1959] loop5: rw=1, want=54833, limit=63 [ 362.644970][ T1959] attempt to access beyond end of device [ 362.650719][ T1959] loop5: rw=1, want=58553, limit=63 [ 362.673032][ T1959] attempt to access beyond end of device [ 362.678833][ T1959] loop5: rw=1, want=60701, limit=63 [ 362.695318][T22883] selinux_nlmsg_perm: 3 callbacks suppressed [ 362.701432][T22883] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=11221 sclass=netlink_route_socket pig=22883 comm=syz-executor.2 09:14:54 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x700, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:54 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x808, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:54 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x2003) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) 09:14:54 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x6c000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:54 executing program 5 (fault-call:10 fault-nth:38): prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:54 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280), 0x0) sched_setattr(0x0, 0x0, 0x0) r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/hash_stats\x00', 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000000c0)={0x0, r0, 0x4}, 0x10) pipe(&(0x7f0000000300)={0xffffffffffffffff}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/net/tun\x00', 0x0, 0x0) write(r2, &(0x7f0000000200)="65b7a00672a27ebd7f8a785c2c28d67d6f2825c8739e66333e9b69ce00671b40657ced24b5f8876757840e75d5284661643c4c65885f358896b1f37ca37f48cdeebb9dd084ff0c4ab68f497c586738488534876a522a60ce9f4cd288b3e78f3d5184", 0x62) sched_getaffinity(0x0, 0x0, 0x0) r3 = gettid() ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x3c) ptrace$cont(0x18, r3, 0x0, 0x0) ptrace$setregs(0xd, r3, 0xffffffffffffffff, &(0x7f0000000080)) ptrace$cont(0x20, r3, 0x0, 0x0) r4 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff7, 0x8118e, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0), 0x1}}, r3, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xfffffdffffffffff, r4, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/commit_pending_bools\x00', 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) madvise(&(0x7f0000495000/0x400000)=nil, 0x404000, 0x15) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', 0x0, 0x0, 0x0, 0x0) inotify_init1(0x0) r5 = inotify_add_watch(0xffffffffffffffff, 0x0, 0x0) inotify_rm_watch(0xffffffffffffffff, 0x0) r6 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r6, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$binfmt_misc(r6, &(0x7f0000000340)=ANY=[@ANYBLOB="73797a3031b00a07ecb4cd31ad853d85cb032bb4142dfc8619d206a612a4070000000000000089db5bb29018f101eb587fc1a8a5268ac1f156cd9243376d6c73ba80566cce342851762a34ac2f33a6214428d0e482407857c9801f9400000000"], 0x59) inotify_rm_watch(0xffffffffffffffff, r5) ioctl$EVIOCGPROP(0xffffffffffffffff, 0xc004743e, &(0x7f00000018c0)=""/246) [ 362.909443][T22889] net_ratelimit: 3 callbacks suppressed [ 362.909450][T22889] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:14:54 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x74000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 362.954267][T22893] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 362.971644][T22892] tipc: Started in network mode [ 362.976584][T22892] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 362.991833][T22892] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb 09:14:54 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x4000000000008d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, &(0x7f0000008880), 0x62a, 0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_config_ext}, 0x0, 0xdfffffffffffffff, 0xffffffffffffffff, 0x0) r3 = creat(&(0x7f0000000680)='./bus\x00', 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='mountinfo\x00') preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) ftruncate(r3, 0x800) lseek(r3, 0x0, 0x2) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x11, 0x800000003, 0x0) bind(r5, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r5, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r7 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=ANY=[@ANYBLOB="3c0000001000010800"/20, @ANYRES32=r6, @ANYBLOB="00000001000000000b310400", @ANYRES32=0x0, @ANYBLOB="14002b80080003000800000008000100", @ANYRES32=r7, @ANYBLOB], 0x3c}}, 0x0) bind$packet(r2, &(0x7f0000000000)={0x11, 0x1c, r6, 0x1, 0xc0}, 0x14) r8 = open(&(0x7f0000001840)='./bus\x00', 0x84442, 0x0) sendfile(r3, r8, 0x0, 0x8400fffffffa) r9 = open(&(0x7f00000000c0)='./bus\x00', 0x800000141042, 0x0) ftruncate(r9, 0x200006) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0xfffd, @multicast1}, 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ff9000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f00000003c0)="7077b04e504f4cd225a37f618d14bdd3ffad6c7799a2fa8f282ed1ee0d908148d94cd55023e80728de3d9092a438ef2f01fb20ac8af5b8fb41c93196ca2d0086e95ebc3b95c54736e4d7da7b4794a19d2925a05e2e774aed4b06fee702bd69e71a58eab63f0c21de9c43ed3b9e5d60e9fbf520c6784c3a364d04e061f2b1f1bea2a8b10578eb36871fd3590f7e230818d9491c53b406823c0ee93454c57faa6ff6dbe71d9146ee2e4e63da73baf9bd3bbe8082f535d5e89836737b18c11cbfa70278d4e4e9ecb2533be890", 0xcb}, 0x68) 09:14:54 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x900, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 363.003240][T22892] tipc: Enabled bearer , priority 10 09:14:55 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x7e, 0x0, 0x20, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={&(0x7f0000000100), 0x2}, 0x0, 0xab06, 0x0, 0x1}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x2400, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x100000000, 0x100080000000}, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, r0, 0x2) r2 = open(&(0x7f0000000080)='./file0\x00', 0x1070c5, 0x0) ioctl$KDDELIO(0xffffffffffffffff, 0x4b35, 0x6) socket$nl_route(0x10, 0x3, 0x0) inotify_init() inotify_add_watch(0xffffffffffffffff, 0x0, 0x80000000) open(0x0, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000880)={{{@in=@empty, @in6=@mcast2}}, {{@in6=@mcast1}, 0x0, @in=@initdev}}, 0x0) open(&(0x7f0000000280)='./file0/../file0\x00', 0x224003, 0x142) connect$netlink(0xffffffffffffffff, &(0x7f00000014c0)=@proc, 0xc) r3 = open(&(0x7f00000004c0)='./bus\x00', 0x2, 0x0) write$P9_RATTACH(r3, &(0x7f0000000000)={0x14}, 0x14) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r4, 0x4, 0x46802) r5 = open(&(0x7f00000004c0)='./bus\x00', 0x2, 0x0) write$P9_RATTACH(r5, &(0x7f0000000000)={0x14}, 0x14) sendmsg$OSF_MSG_REMOVE(r5, &(0x7f0000000240)={&(0x7f00000001c0), 0xc, &(0x7f0000000200)={&(0x7f0000001500)=ANY=[@ANYBLOB="64090000010501020000000000000000010000035402010001000000fbffffff0c0700000101190073797a31000000000000000000000000000000000000000000000000000000009ccd1ce57c6f664c7c6ef7d6e886ecad596589fef8e9811ed25f0399ed691ead74da3c02e1c6b1d05c7a6d280b6f8e2f1a53621ae21fb9cf676141fdc117e70aff0700000000000006000000060002000000000001000000050001040300000005390000000406000200000007000000030008000100000081000000ff7fffff0100000008000000eaaaaadb9b2d8c7607000000ff0300040000000002000000a50c020001000000080000000600dd000000000003000000018004000000000081000000ff00fcff03000000607bffff4495060000000000367200000008090002000000030000000000000003000000070000000000060001000000fcffffff0900ca0003000000f7ffffffff0701000000000001000000023205000100000000000000020004000300000000000000a507050000000000040000000300ff0f020000000000000007000400010000000700000005000300000000000900000001fe0700030000000300000005007f00010000001a0100000500800000000000450000000800008219f21600040000000180000200000000040000000010820402000000fcffffffb0b90c2803000000020000000100500003000000090000000600010401000000030000000100400000000000080000000000ff0300000000080000000500030003000000070000000700ff00030000000600000002000400020000005d0a00000400070001000000010001001f00030001000000bb000000540201000200000003000000802c000805000b0073797a30000000000000000000000000000000000000000000000000000000007c8e868aae36f817d807b5828163c3f86fe75882d440bf18abc20cad751fc5d499f28f2677acec15c8850360ecaa75a3783cfccb243ad77ad308952d6c384ab807000100001c8655c250de96060000000400000000000004020000000000b4b80700010001000000010001000800800201000000ff07000057f00400010000001f0000000400001002000000060000000000800000000000080000000004090000000000ff7f0000000005000200000009000000b60ecfa0010000003f0000002000040002000000008000000100ff000300000000080000f7ff060001000000ff7f000003000600655f4500e7000000faae40000200000005000000ff7f0600010000000400000001003f0003000000008000000900ff0100000000010000000300800002000000dc030000ff01010002000000f70e0000010000010300000001010000070025060300000005000000060000080000000003000000021eec0500000000af96000008000700000000001f000000080000000100000009000000c0ff08000000000006000000b30597000300000002000000000037000300000000020000ff00000003000000800000000104020000000000090000000100ff7f02000000679bffff0800080003000000070000000500030001000000010000000700060001000000000000800101070000000000070000000100ff0103000000010001000900010000000000040000000800030002000000310300000500400003000000030000005402010001000000c9d000000805040020001c0073797a3000000000000000000000000000000000000000000000000000000000246f230caf36151aa05134c6f7b95f38fabf01ef509cf7c4c8a4d063fa3c0bbc4024cf50188ea09c0c24c890554bca3fe79adadc4d95f3b873fe4568396788d6050000000200000086f400000300795400000000010000003f00f60003000000080000000800200000000000000100000000000003000000070000000600ff0000000000a90300000200ff00060000000400000009000500010000005f0d0000000074050200000004000000010001000100000000000000ed6006000000000000000000cd080104020000000080000001001f000100000002000000ba080104030000000800000009001d780000000006000000ff01200003000000000000804a000200000000000700000003000900000000000900000024000300b470500009000000010007000200000007000000f7ff089bda9b077e050000000080090002000000080000000300070002000000ff0100000101070001000000ffff00003f008000000000000000000000802aa102000000000000000500570000000000ff070000bc000900030000000500000061eb0600030000003c0000001f001f00000000000180000003000300000000000000008005000000000000000400000009000100000000003f00000000005c0a03000000000000000700ffff00000000090000000100d90003000000040000000800018000000000050000000300070602000000090000000900080002000000030000000300457e0200000000000080540201000200000009000000000781000700230073797a31000000000000000000000000000000000000000000000000000000000cf411f782fca5beb58e0146f8fef9bde523f7f0fae82fcd204773f331f65119c3bc99d6e363b8d93a781485d852fcfe8142bcd3cb5c30de9f9e7115aa51acfb0700060003000000080000000001060003000000000000004000ff0f00000000010000000300ff07010000000700000000fe0900000000000800000000000800000000000500000003000300010000001f00000006008100000000000300000004000c000100000000020000050000000100000000000000090004000300000011000000090000000100000005000000ffff060000000000463c00000900810003000000010000000000080001000000050000000100b103030000000600000000001f0000000000010001000000ff00010000000200000000040000020000000000040000000010010000001f0000008b09000001000000d309d300f8ff0200020000000000000009002000889daa04050000000300ff9a01000000008000000200070002000000010000000300fdcd0000000008000000040040000100000000000000ff070400030000000000000001040002020000000008000000f005000200000003000000040009004943484040000000030005000100000007000000f9ff9b00040000003f000000050009000200000001000000453dffff0200000000000080baf0080003000000070000000600de000100000004000000a5000100030000002700000000000080000000003f0000000700000000000000000000004f9833145a62e1f409baaac246a6ec826e16c2ba429d6c7660269a83baf65d03ca5b8f7b64c370ad074cc95c033a64217592c399e23efd090a48d9b9e433e090fce9ff2bcfdb925705bf2242e697482a74d1cb673f91e95df059b6a21c88123d471c8c21594da314e570276cb0b99f8c8bfb"], 0x964}}, 0x0) io_setup(0x100000000000c333, &(0x7f0000000180)=0x0) ftruncate(r4, 0x48280) io_submit(r6, 0x20000000000001cb, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7}]) sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="6c7190561cfd5a87a9b8d0566e0000b7", @ANYRES16, @ANYBLOB="00002abd667a5d81272784faf80048000500030011003480038008000500ff00ff000000f82bf56698f11b02945a75be77000024000000000000000115000600fe80000000000003800800010000000000080000000000000000000010e963e6043a228a4c47eef766b931fb06877cf7316308c20d0000000012099da662c9de3d706a0000000000"], 0x6c}}, 0x20000010) r7 = open(&(0x7f00000004c0)='./bus\x00', 0x2, 0x0) write$P9_RATTACH(r7, &(0x7f0000000000)={0x14}, 0x14) sendfile(r2, 0xffffffffffffffff, 0x0, 0x1c500) ioctl$TUNGETFILTER(0xffffffffffffffff, 0x801054db, &(0x7f00000002c0)=""/246) [ 363.040760][T22897] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:14:55 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x80a, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 363.096512][T22901] tipc: Started in network mode [ 363.101733][T22901] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 363.112457][T22901] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 363.129388][T22901] tipc: Enabled bearer , priority 10 [ 363.136314][T22902] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:14:55 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x7a000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:55 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0xa00, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 363.216743][T22909] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:14:55 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x814, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 363.258602][T22912] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 363.301417][T22910] tipc: Started in network mode 09:14:55 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x81000000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 363.325277][T22910] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 363.348206][T22910] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 363.357050][T22910] tipc: Enabled bearer , priority 10 09:14:55 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x81c, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 363.443333][T22921] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 363.479410][T22924] FAULT_INJECTION: forcing a failure. [ 363.479410][T22924] name failslab, interval 1, probability 0, space 0, times 0 [ 363.522313][T22924] CPU: 1 PID: 22924 Comm: syz-executor.5 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 363.532491][T22924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 363.542548][T22924] Call Trace: [ 363.545863][T22924] dump_stack+0x1b0/0x228 [ 363.550193][T22924] ? devkmsg_release+0x127/0x127 [ 363.555136][T22924] ? __kasan_check_read+0x11/0x20 [ 363.560160][T22924] ? show_regs_print_info+0x18/0x18 [ 363.565364][T22924] should_fail+0x6fb/0x860 [ 363.569781][T22924] ? setup_fault_attr+0x2b0/0x2b0 [ 363.574800][T22924] ? current_time+0x2e0/0x2e0 [ 363.579473][T22924] __should_failslab+0x11a/0x160 [ 363.584403][T22924] ? kmalloc_array+0x32/0x60 [ 363.588998][T22924] should_failslab+0x9/0x20 [ 363.593504][T22924] __kmalloc+0x64/0x310 [ 363.597657][T22924] kmalloc_array+0x32/0x60 [ 363.602084][T22924] iter_file_splice_write+0x21d/0xf20 [ 363.607455][T22924] ? __sb_end_write+0xa8/0xf0 [ 363.612136][T22924] ? touch_atime+0x22e/0x270 [ 363.616722][T22924] ? current_time+0x2e0/0x2e0 [ 363.621390][T22924] ? fsnotify+0x1390/0x1450 [ 363.625892][T22924] ? splice_from_pipe+0x200/0x200 [ 363.631163][T22924] ? splice_shrink_spd+0xb0/0xb0 [ 363.636101][T22924] ? splice_from_pipe+0x200/0x200 [ 363.641122][T22924] direct_splice_actor+0xf7/0x130 [ 363.646248][T22924] splice_direct_to_actor+0x496/0xb00 [ 363.651617][T22924] ? do_splice_direct+0x3d0/0x3d0 [ 363.656644][T22924] ? pipe_to_sendpage+0x300/0x300 [ 363.661767][T22924] ? rw_verify_area+0x1c2/0x360 [ 363.666622][T22924] do_splice_direct+0x279/0x3d0 [ 363.671475][T22924] ? splice_direct_to_actor+0xb00/0xb00 [ 363.677030][T22924] ? security_file_permission+0x157/0x350 [ 363.682880][T22924] do_sendfile+0x89d/0x1110 [ 363.687391][T22924] ? compat_writev+0x390/0x390 [ 363.692153][T22924] ? __kasan_check_write+0x14/0x20 [ 363.697267][T22924] ? fput_many+0x47/0x1a0 [ 363.701598][T22924] __x64_sys_sendfile64+0x1ae/0x220 [ 363.706790][T22924] ? __ia32_sys_sendfile+0x240/0x240 [ 363.712191][T22924] ? syscall_return_slowpath+0x6f/0x500 [ 363.717742][T22924] do_syscall_64+0xc0/0x100 [ 363.722260][T22924] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 363.728148][T22924] RIP: 0033:0x45b399 [ 363.732063][T22924] Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 363.751782][T22924] RSP: 002b:00007efcb804cc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 363.760210][T22924] RAX: ffffffffffffffda RBX: 00007efcb804d6d4 RCX: 000000000045b399 [ 363.768301][T22924] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000004 [ 363.776277][T22924] RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 [ 363.784249][T22924] R10: 0000000000280900 R11: 0000000000000246 R12: 0000000000000006 [ 363.792216][T22924] R13: 00000000000008ca R14: 00000000004ca24d R15: 0000000000000026 [ 363.933523][T22925] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:14:56 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280900) 09:14:56 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0xb00, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:56 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x825, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:56 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x81ffffff, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 364.097487][ T4586] tipc: 32-bit node address hash set to fbff1eac [ 364.166015][ T27] attempt to access beyond end of device [ 364.175043][ T27] loop5: rw=1, want=78, limit=63 [ 364.186000][ T27] attempt to access beyond end of device [ 364.195286][ T27] loop5: rw=1, want=79, limit=63 [ 364.203168][ T27] attempt to access beyond end of device [ 364.208945][ T27] loop5: rw=1, want=80, limit=63 [ 364.214763][T22935] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 364.219175][ T27] attempt to access beyond end of device [ 364.239218][ T4586] tipc: 32-bit node address hash set to fbff1eac [ 364.241355][ T27] loop5: rw=1, want=81, limit=63 [ 364.254121][ T27] attempt to access beyond end of device [ 364.258165][T22933] tipc: Started in network mode [ 364.266755][T22933] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 364.276406][ T27] loop5: rw=1, want=130, limit=63 [ 364.281792][ T27] attempt to access beyond end of device [ 364.287449][ T27] loop5: rw=1, want=131, limit=63 [ 364.295908][T22933] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 364.302684][ T27] attempt to access beyond end of device [ 364.319218][ T27] loop5: rw=1, want=132, limit=63 [ 364.322127][T22933] tipc: Enabled bearer , priority 10 [ 364.324308][ T27] attempt to access beyond end of device [ 364.336571][ T27] loop5: rw=1, want=133, limit=63 [ 364.346282][ T27] attempt to access beyond end of device [ 364.354410][ T27] loop5: rw=1, want=142, limit=63 [ 364.360847][T22934] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 364.361872][ T27] attempt to access beyond end of device [ 364.372119][T22934] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 364.378413][ T27] loop5: rw=1, want=143, limit=63 [ 364.381081][ T4586] tipc: 32-bit node address hash set to fbff1eac [ 364.389600][ T27] attempt to access beyond end of device [ 364.400561][ T27] loop5: rw=1, want=144, limit=63 [ 364.406061][ T27] attempt to access beyond end of device 09:14:56 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x95010000, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 364.410371][T22939] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 364.413903][ T27] loop5: rw=1, want=145, limit=63 [ 364.439739][ T27] attempt to access beyond end of device [ 364.445422][ T27] loop5: rw=1, want=2225, limit=63 [ 364.456064][ T27] attempt to access beyond end of device [ 364.463081][ T27] loop5: rw=1, want=6289, limit=63 [ 364.471458][ T27] attempt to access beyond end of device [ 364.477403][ T27] loop5: rw=1, want=10385, limit=63 [ 364.485798][ T27] attempt to access beyond end of device [ 364.494948][ T27] loop5: rw=1, want=14481, limit=63 [ 364.503345][ T27] attempt to access beyond end of device [ 364.509067][ T27] loop5: rw=1, want=18577, limit=63 [ 364.518002][ T27] attempt to access beyond end of device [ 364.523964][ T27] loop5: rw=1, want=22673, limit=63 [ 364.532713][ T27] attempt to access beyond end of device [ 364.538439][ T27] loop5: rw=1, want=26769, limit=63 [ 364.553174][ T27] attempt to access beyond end of device [ 364.558856][ T27] loop5: rw=1, want=34833, limit=63 [ 364.559286][ T1938] tipc: Disabling bearer [ 364.569648][ T27] attempt to access beyond end of device [ 364.573772][ T1938] tipc: Left network mode [ 364.575340][ T27] loop5: rw=1, want=42353, limit=63 [ 364.591127][ T27] attempt to access beyond end of device [ 364.596833][ T27] loop5: rw=1, want=50177, limit=63 [ 364.611360][ T27] attempt to access beyond end of device [ 364.617293][ T27] loop5: rw=1, want=55765, limit=63 [ 364.939225][ T1938] tipc: Disabling bearer [ 364.944718][ T1938] tipc: Left network mode [ 365.389165][ T1938] tipc: Disabling bearer [ 365.394903][ T1938] tipc: Left network mode [ 365.449201][T17006] tipc: 32-bit node address hash set to fbff1eac [ 365.564233][T22952] cgroup1: Unknown subsys name 'perf_event' [ 365.577077][T22952] cgroup1: Unknown subsys name 'net_cls' [ 365.813824][ T27] attempt to access beyond end of device [ 365.819639][ T27] loop5: rw=1, want=78, limit=63 [ 365.824599][ T27] attempt to access beyond end of device [ 365.839175][ T27] loop5: rw=1, want=79, limit=63 [ 365.844179][ T27] attempt to access beyond end of device [ 365.859167][ T27] loop5: rw=1, want=80, limit=63 [ 365.864258][ T27] attempt to access beyond end of device [ 365.869945][ T27] loop5: rw=1, want=81, limit=63 [ 365.875156][ T27] attempt to access beyond end of device [ 365.880861][ T27] loop5: rw=1, want=130, limit=63 [ 365.886027][ T27] attempt to access beyond end of device [ 365.891857][ T27] loop5: rw=1, want=131, limit=63 [ 365.899187][ T27] attempt to access beyond end of device [ 365.904931][ T27] loop5: rw=1, want=132, limit=63 [ 365.911359][ T27] attempt to access beyond end of device [ 365.919150][ T27] loop5: rw=1, want=133, limit=63 [ 365.924338][ T27] attempt to access beyond end of device [ 365.939169][ T27] loop5: rw=1, want=142, limit=63 [ 365.944295][ T27] attempt to access beyond end of device [ 365.949964][ T27] loop5: rw=1, want=143, limit=63 [ 365.955141][ T27] attempt to access beyond end of device [ 365.960846][ T27] loop5: rw=1, want=144, limit=63 [ 365.966043][ T27] attempt to access beyond end of device [ 365.971747][ T27] loop5: rw=1, want=145, limit=63 [ 366.010583][ T27] attempt to access beyond end of device [ 366.016277][ T27] loop5: rw=1, want=48857, limit=63 [ 366.034631][ T27] attempt to access beyond end of device [ 366.041715][ T27] loop5: rw=1, want=57205, limit=63 [ 366.739653][ T1938] tipc: Disabling bearer [ 366.744992][ T1938] tipc: Left network mode 09:14:59 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x864, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:14:59 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x9effffff, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:59 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0xc00, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:59 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280902) 09:14:59 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/zero\x00', 0x101002, 0x0) statx(0xffffffffffffffff, &(0x7f0000000d40)='./file0\x00', 0x4000, 0x8, &(0x7f00000010c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r5, 0x0, 0x0) fchownat(r2, &(0x7f0000000d00)='./file0\x00', r3, r5, 0x1000) r6 = syz_genetlink_get_family_id$gtp(&(0x7f0000000040)='gtp\x00') r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/mls\x00', 0x0, 0x0) r9 = syz_genetlink_get_family_id$batadv(&(0x7f0000000240)='batadv\x00') sendmsg$BATADV_CMD_SET_VLAN(r8, &(0x7f0000000300)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x110}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r9, 0x4, 0x70bd26, 0x25dfdbfc, {}, [@BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x2000c080) r10 = socket(0x11, 0x800000003, 0x0) bind(r10, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) r11 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r11, 0x0, 0x0) lseek(r11, 0xe7, 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') sendmsg$FOU_CMD_DEL(r12, &(0x7f00000001c0)={&(0x7f0000000000), 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0x1c, r13, 0x0, 0x70bd26, 0x0, {}, [@FOU_ATTR_IFINDEX={0x8}]}, 0x1c}}, 0x0) sendmsg$FOU_CMD_DEL(r11, &(0x7f0000001280)={&(0x7f00000011c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000001240)={&(0x7f0000001200)={0x3c, r13, 0x300, 0x70bd2a, 0x25dfdbfe, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PEER_V6={0x14, 0x9, @remote}, @FOU_ATTR_IFINDEX={0x8}, @FOU_ATTR_AF={0x5, 0x2, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8050}, 0x4008000) clock_gettime(0x0, &(0x7f0000000fc0)={0x0, 0x0}) recvmmsg(r1, &(0x7f0000001640)=[{{&(0x7f0000001380)=@ipx, 0x80, &(0x7f0000000600)=[{&(0x7f0000000380)=""/63, 0x3f}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f00000004c0)=""/211, 0xd3}, {&(0x7f00000005c0)}], 0x4}, 0x6}, {{&(0x7f0000000640)=@x25={0x9, @remote}, 0x80, &(0x7f0000000880)=[{&(0x7f00000006c0)=""/226, 0xe2}, {&(0x7f00000007c0)=""/73, 0x49}], 0x2, &(0x7f00000008c0)=""/164, 0xa4}, 0x3}, {{&(0x7f0000000980)=@ipx, 0x80, &(0x7f0000000b80)=[{&(0x7f00000012c0)=""/150, 0x96}, {&(0x7f0000000ac0)=""/160, 0xa0}], 0x2, &(0x7f0000000bc0)=""/108, 0x6c}, 0xa8d1}, {{&(0x7f0000000c40)=@rc={0x1f, @fixed}, 0x80, &(0x7f0000000d80)=[{&(0x7f0000000cc0)=""/26, 0x1a}, {&(0x7f0000001040)=""/88, 0x58}], 0x2, &(0x7f0000000dc0)=""/205, 0xcd}, 0xb38}, {{0x0, 0x0, &(0x7f0000001540)=[{&(0x7f0000001400)=""/104, 0x68}, {&(0x7f0000001480)=""/149, 0x95}], 0x2, &(0x7f0000001580)=""/167, 0xa7}, 0xf916}], 0x5, 0x20, &(0x7f0000001000)={r14, r15+10000000}) r16 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x3c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0x14, 0x2b, 0x0, 0x1, [@IFLA_XDP_FLAGS={0x8, 0x3, 0x8}, @IFLA_XDP_FD={0x8, 0x1, r16}]}]}, 0x3c}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'batadv_slave_1\x00', 0x0}) sendmsg$GTP_CMD_DELPDP(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x30, r6, 0x100, 0x70bd27, 0x25dfdbfc, {}, [@GTPA_TID={0xc, 0x3, 0x1}, @GTPA_LINK={0x8}, @GTPA_LINK={0x8, 0x1, r17}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x400d1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) 09:14:59 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r1, 0x0, 0x0) lseek(r1, 0xe7, 0x0) mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x100000000) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r3, 0xc0105502, &(0x7f0000000040)=@urb_type_interrupt={0x1, {0x7, 0x1}, 0x6, 0x44, &(0x7f0000000080)="69e5c726c1c0968e3c725272e07ba3ffe4f0396ec774e86f6fa01a126e80877db74cfab4bacd94ea6a5ca7e02931f272e39e112f2387c23d0b5bb0cb88aa557722f5fe932e7c02c8e830ebb4dfa82532a359d015c640683c61107805f0842a64b37abf3551f6017a04a5a2b6e7f1e0a4219b6bc525bab61ed1893c25df2008b7f0680ba14b3c911ee3fa19aaa86d1d7aaa52598f20ef760c863a36c91907804055cb0794d2b0007a01f431742c83a8830984fb39af767f3d853056d34f31bf087bef16b0a5ef62eb55bd253bce246baf7f61537a9774bc6a", 0xd8, 0x7fffffff, 0x6, 0x0, 0x2, 0x931, &(0x7f0000000180)="4a4130e6360d22dfd218f015dc411b7e7fc19d9eb070416f7fec5f5d8b4171d18e1ecc24734939bb997c922b034d92da129a7a48b9722b1b2773ca01e6a459587bb9d7214d62e4ae91f5ab3bc7be08f003"}) r4 = fcntl$dupfd(r3, 0x0, r2) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r5, 0x0, 0x0) lseek(r5, 0x200000000000e7, 0x6) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r5, 0x8983, &(0x7f0000000000)={0x0, 'caif0\x00', {0x2}}) r6 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r6, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$FS_IOC_GETVERSION(r6, 0x80087601, &(0x7f0000000200)) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000c80)=@filter={'filter\x00', 0x50, 0x4, 0x3f8, 0x258, 0xd0, 0x258, 0x0, 0xd0, 0x328, 0x328, 0x328, 0x328, 0x328, 0x4, 0x0, {[{{@ipv6={@mcast1, @ipv4={[], [], @local}, [], [], 'bond_slave_0\x00', 'syzkaller1\x00', {}, {}, 0x0, 0x0, 0x3}, 0x0, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x6}}}, {{@ipv6={@dev, @mcast1, [], [], 'dummy0\x00', 'veth0_to_bond\x00'}, 0x0, 0x160, 0x188, 0x0, {}, [@common=@srh1={{0x90, 'srh\x00'}, {0x0, 0x0, 0x0, 0x0, 0x0, @dev, @ipv4={[], [], @multicast1}, @dev}}, @common=@ipv6header={{0x28, 'ipv6header\x00'}}]}, @REJECT={0x28, 'REJECT\x00'}}, {{@ipv6={@remote, @dev, [], [], 'bridge0\x00', 'ip_vti0\x00'}, 0x0, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00'}}], {{[], 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x458) 09:14:59 executing program 2: prlimit64(0xffffffffffffffff, 0xb, &(0x7f0000000280)={0x1, 0x5c5}, 0x0) symlink(&(0x7f0000000200)='./file0\x00', 0x0) r0 = getpid() sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) waitid(0x3, 0x0, 0x0, 0x1000000, &(0x7f0000000440)) sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0) pipe(&(0x7f0000000840)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3, 0x0, 0xfffffffffffffffb}, 0x0) write$P9_RLINK(0xffffffffffffffff, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7) creat(0x0, 0x0) getpid() perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb9a}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000340)='/dev/hwrng\x00', 0x45dbad4aab307b37, 0x0) r4 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r5 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000009c0)='/dev/loop-control\x00', 0x0, 0x0) r6 = ioctl$LOOP_CTL_GET_FREE(r5, 0x4c82) ioctl$LOOP_CTL_REMOVE(r5, 0x4c81, r6) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, r6) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000700)={0x1c, 0x0, &(0x7f0000000240)=[@increfs, @release={0x40046306, 0x1}, @free_buffer], 0x54, 0x0, &(0x7f0000000900)="6a05d8812bb9a115fbb9136f1f61e9100800374e782f756205da8c7c20dd5ea90200000000003f000000000000000000000000000025476610beb0313d3ad420f9a6a6312e7ab2090a2464126130b1825c24566e"}) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000380)=r3, 0x4) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000001200)=ANY=[@ANYBLOB="01000000000000000a0000000000ff00ff010000000000000000000000000001e5ff01000000000000000000000000000000000000bd000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000067020000000088000100000000000400"], 0x1) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)}], 0x0, 0x0) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) write$FUSE_INTERRUPT(r7, &(0x7f0000000140)={0x10, 0x0, 0x8}, 0x10) [ 367.358229][T23374] ip6t_REJECT: TCP_RESET illegal for non-tcp 09:14:59 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xeaffffff, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 367.422314][T23371] tipc: Started in network mode [ 367.427385][T23371] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 367.443062][T23371] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 367.459940][T23371] tipc: Enabled bearer , priority 10 09:14:59 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0xd00, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:59 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xefffffff, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:14:59 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 367.648615][ T1938] tipc: Disabling bearer [ 367.654056][ T1938] tipc: Left network mode [ 367.691566][T23397] tipc: Enabling of bearer rejected, failed to enable media [ 367.717946][T23400] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 367.740659][T23400] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:14:59 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0xe00, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:14:59 executing program 2: prlimit64(0xffffffffffffffff, 0xb, &(0x7f0000000280)={0x1, 0x5c5}, 0x0) symlink(&(0x7f0000000200)='./file0\x00', 0x0) r0 = getpid() sched_setattr(0x0, &(0x7f0000000040)={0x30, 0x2, 0x0, 0x0, 0x9}, 0x0) waitid(0x3, 0x0, 0x0, 0x1000000, &(0x7f0000000440)) sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xfffffffc}, 0x0) pipe(&(0x7f0000000840)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r2, 0x407, 0x0) write(r2, &(0x7f0000000340), 0x41395527) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x1, 0x0, 0x3, 0x0, 0xfffffffffffffffb}, 0x0) write$P9_RLINK(0xffffffffffffffff, &(0x7f00000000c0)={0x7, 0x47, 0x1}, 0x7) creat(0x0, 0x0) getpid() perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb9a}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000340)='/dev/hwrng\x00', 0x45dbad4aab307b37, 0x0) r4 = creat(&(0x7f0000000180)='./bus\x00', 0x0) r5 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000009c0)='/dev/loop-control\x00', 0x0, 0x0) r6 = ioctl$LOOP_CTL_GET_FREE(r5, 0x4c82) ioctl$LOOP_CTL_REMOVE(r5, 0x4c81, r6) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, r6) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000700)={0x1c, 0x0, &(0x7f0000000240)=[@increfs, @release={0x40046306, 0x1}, @free_buffer], 0x54, 0x0, &(0x7f0000000900)="6a05d8812bb9a115fbb9136f1f61e9100800374e782f756205da8c7c20dd5ea90200000000003f000000000000000000000000000025476610beb0313d3ad420f9a6a6312e7ab2090a2464126130b1825c24566e"}) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000380)=r3, 0x4) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000001200)=ANY=[@ANYBLOB="01000000000000000a0000000000ff00ff010000000000000000000000000001e5ff01000000000000000000000000000000000000bd000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000067020000000088000100000000000400"], 0x1) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000380)=[{&(0x7f0000000100)}], 0x0, 0x0) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) write$FUSE_INTERRUPT(r7, &(0x7f0000000140)={0x10, 0x0, 0x8}, 0x10) 09:14:59 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xf0ffffff, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 367.931514][T23406] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 367.941043][T23406] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 367.956046][T23408] tipc: Enabling of bearer rejected, failed to enable media [ 367.975867][T23411] net_ratelimit: 8 callbacks suppressed 09:14:59 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x2, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 367.975874][T23411] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 368.013424][T23414] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 368.023912][T23414] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 368.057992][T23416] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 368.434888][T23418] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 368.446751][T23370] FAT-fs (loop5): FAT read failed (blocknr 63) [ 368.449062][T23379] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=23379 comm=syz-executor.0 [ 368.454325][T23418] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 368.473383][T23370] FAT-fs (loop5): FAT read failed (blocknr 63) 09:15:00 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280903) 09:15:00 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xfeffffff, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 368.479881][T23385] FAT-fs (loop5): FAT read failed (blocknr 63) [ 368.500484][ T1959] attempt to access beyond end of device [ 368.503579][T23429] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 368.506289][ T1959] loop5: rw=1, want=63513, limit=63 09:15:00 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x111c43) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r1, 0x8982, &(0x7f0000000000)={0x0, 'veth0_virt_wifi\x00', {}, 0x7}) 09:15:00 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x1100, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:15:00 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x3, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:15:00 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xffffff7f, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:15:00 executing program 2: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0xe00, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 368.738244][T23444] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 368.746155][T23444] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 368.785407][T23447] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 368.806291][T23445] tipc: Started in network mode [ 368.811728][T23445] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 368.821571][T23445] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb 09:15:00 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x1200, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 368.834771][T23445] tipc: Enabled bearer , priority 10 [ 368.841562][T23450] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 368.853260][T23450] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 368.868942][T23451] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:15:00 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x4, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:15:00 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xffffff81, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 368.926778][T23455] tipc: Started in network mode [ 368.931942][T23455] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 368.989871][T23455] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 369.001375][T23455] tipc: Enabled bearer , priority 10 [ 369.104519][T23458] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 369.112683][T23458] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 369.120520][T23443] tipc: Started in network mode [ 369.125649][T23443] tipc: Own node identity 00000000000000000000ffffac1e0003, cluster identity 4711 [ 369.135745][T23443] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 369.144303][T23443] tipc: Enabled bearer , priority 10 09:15:01 executing program 2: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0xc00, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 369.150943][T23460] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 369.194875][T23460] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:15:01 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xffffff9e, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 369.249346][T23467] tipc: Started in network mode [ 369.254695][T23467] tipc: Own node identity 00000000000000000000ffffac1e0003, cluster identity 4711 [ 369.302721][T23467] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 369.312517][T23467] tipc: Enabled bearer , priority 10 [ 369.318940][T23468] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 369.335546][T23468] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 369.369623][T23470] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 369.407608][T23434] FAT-fs (loop5): FAT read failed (blocknr 63) [ 369.437926][T23473] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:15:01 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280904) 09:15:01 executing program 2: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) r0 = getpid() sched_setattr(r0, &(0x7f0000000040)={0x38, 0x2, 0x0, 0x0, 0x5}, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f0000000340), 0x41395527) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x30, 0x2, 0x0, 0x0, 0x3}, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x0, 0x300) write(0xffffffffffffffff, &(0x7f0000000000), 0x0) r4 = creat(&(0x7f0000000240)='./bus\x00', 0x0) fallocate(r4, 0x1, 0x0, 0x28120001) recvmmsg(0xffffffffffffffff, &(0x7f0000002ec0), 0x0, 0x2, &(0x7f00000001c0)={0x77359400}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000b80)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2000000014000193ea71bb8f5fb174000a000000", @ANYRES32=0x0, @ANYBLOB="080002007f000001149c0126f1ef6ad95a96416196281547309fae563fe4fc8294ef94cbe4c1cf15cb2c0c074171c928ccb5bc17d00ec2e95226ffea65e266c3eb74e2d668310af4db4bb204d9bdb5b79dcb83e60f282282dd79169dea47ab6ed9c560ba0f194e5f4401"], 0x3}}, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000700)={{{@in=@remote, @in6=@ipv4}}, {{@in6=@local}, 0x0, @in6=@dev}}, &(0x7f0000000140)=0xe8) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNGETSNDBUF(r5, 0x400454d0, 0x0) mount$bpf(0x0, &(0x7f00000004c0)='./file0\x00', 0x0, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB]) socketpair$unix(0x1, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = creat(&(0x7f0000000240)='./bus\x00', 0x0) lseek(r6, 0x7ffffc, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0x2, 0x4000000000080, 0x2}, 0x3c) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0x5, 0x2, 0x4000000000080}, 0x3c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r7, &(0x7f0000000040), &(0x7f00000000c0)}, 0x20) r8 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r8, &(0x7f0000000040), &(0x7f00000000c0)}, 0x20) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000fc7000)={0xa, 0x2, 0x4000000000080, 0x2}, 0x3c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f000051e000)={r9, &(0x7f0000fc5000), &(0x7f0000950000)}, 0x20) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000001940)='lo\x00') sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) 09:15:01 executing program 0: r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r0, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = dup3(r0, 0xffffffffffffffff, 0x0) sendmsg$NFNL_MSG_ACCT_GET_CTRZERO(r1, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0x90, 0x2, 0x7, 0x3, 0x0, 0x0, {0x5, 0x0, 0x6}, [@NFACCT_FILTER={0x14, 0x7, 0x0, 0x1, [@NFACCT_FILTER_MASK={0x8, 0x1, 0x1, 0x0, 0x3}, @NFACCT_FILTER_VALUE={0x8, 0x2, 0x1, 0x0, 0x401}]}, @NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0x3f}, @NFACCT_PKTS={0xc}, @NFACCT_PKTS={0xc, 0x2, 0x1, 0x0, 0x2}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x9}, @NFACCT_QUOTA={0xc, 0x6, 0x1, 0x0, 0x9}, @NFACCT_PKTS={0xc, 0x2, 0x1, 0x0, 0x4}, @NFACCT_NAME={0x9, 0x1, 'syz1\x00'}, @NFACCT_BYTES={0xc, 0x3, 0x1, 0x0, 0xff}, @NFACCT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x2}]}, 0x90}, 0x1, 0x0, 0x0, 0x800}, 0x20004001) unshare(0x44000600) r2 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r2, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r3, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) dup2(r2, r3) r4 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r5, 0x0, 0x0) lseek(r5, 0xe7, 0x0) ioctl$EVIOCGKEY(r5, 0x80404518, &(0x7f0000000000)=""/222) ioctl$USBDEVFS_REAPURBNDELAY(r4, 0x4008550d, 0x0) 09:15:01 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x5, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:15:01 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xffffffea, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:15:01 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x1300, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 369.624861][T23481] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 369.642286][T23481] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:15:01 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x0, 0x119801) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r1, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fremovexattr(r1, &(0x7f0000000000)=@known='user.syz\x00') ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) [ 369.665766][T23487] tipc: Enabling of bearer rejected, failed to enable media 09:15:01 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r1, 0x0, 0x0) lseek(r1, 0xe7, 0x0) ioctl$EVIOCGID(r1, 0x80084502, &(0x7f0000000000)=""/205) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) [ 369.701435][T23482] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:15:01 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x1400, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:15:01 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) pipe2(&(0x7f0000000080), 0x4800) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) lseek(r1, 0xe7, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x1ff400, 0x0) bind(r1, &(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, r2, {0x2, 0xce22, @dev={0xac, 0x14, 0x14, 0x1a}}, 0x3, 0x1, 0x0, 0x1}}, 0x80) 09:15:01 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xffffffef, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 369.842589][T23500] tipc: Started in network mode [ 369.855321][T23500] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 369.867435][T23500] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 369.884489][T23500] tipc: Enabled bearer , priority 10 09:15:01 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x6, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 369.949180][T19161] tipc: 32-bit node address hash set to fbff1eac [ 369.988769][ T1938] tipc: Disabling bearer [ 369.994424][ T1938] tipc: Left network mode [ 369.995017][T23513] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 370.007273][T23513] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 370.033648][ T1938] tipc: Disabling bearer [ 370.038969][ T1938] tipc: Left network mode [ 370.080111][T23517] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 370.087998][T23517] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 370.100407][ T1938] tipc: Disabling bearer [ 370.110108][ T1938] tipc: Left network mode [ 370.299185][ T1938] tipc: Disabling bearer [ 370.305016][ T1938] tipc: Left network mode [ 370.546230][T23493] FAT-fs (loop5): FAT read failed (blocknr 63) 09:15:02 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280905) 09:15:02 executing program 2: r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x1070c5, 0x0) open$dir(&(0x7f0000000200)='./bus\x00', 0x0, 0xfd) write$9p(r1, &(0x7f0000001400)="3b27a4b46ee92b4a59073c369a5e19f9db153c4fdbc76aa2a4bb9f3e5e1aa197a9e97d1016c01813792e50c2692c175aad715d110a892949ccc6e2e54c2d5c8f0b7932b69797f217168b0c1feb128ae34f0daf487a70b5c117acd43725fe17993634f1695dabd7f998cd55e9d5bd911e86aa7a4ad75a574bb96951d6018b25d942a9544bca1ebb0e8d10c092cdcb85797673972099e4041aaf8d636f66cb1103ef2050ad28fabaed33d6927889d97f4b5ce0de71d3fd832980f4f088d0d824e20549b4bbd906ffa51ce9de54d779eb4de462faac20a3ab0ed9934373ca22cea5454f4c2a740cd461e39956bb5f98df2aebc60cf32623adbffbcc378fa7250b6a3fc863dadcf6d4f8b855c4e70f0796eee6218445dad2811dd6b540ff52efa2f167dd9c1b8b016268d37db430983fefc0645d20614c8df2eb0872c58e09664e672b0b6a9970fec199257e1c606ec3e364c66a0f4d258c74accd43b987c756d602fd8787fed3aa43fd8d84e9656d4a413fa9a423bc54b873583d6d497005e54712fafc71384988d80134fbf84f53fdd74b354848006b8b5b67e7cc5a472475d3ae545ca1fcf7628b873e31ba83a98a7ad5b0cfbe9711b517a9a1388ad0efa2a3b4e22152021d631b731e2e100a9831111db7acce948bb5deeea260463c140ac929e77c58402776caf85d4569a75dde2f64c4491508afb541ed9b2c81fc95c06706235f383e31cf662c95b1e49cfd94871e22720a41535756e419b271276941692bd023dd9c9dbec4f7db1e5c00d8b3be7b8e826a6aadd001edd0dfeb00f8048442b5c48456fd642e629dcb2ff55592665ff491cd832672ce4d999da186db2c3a1f8b6b1f7d3750d7cdb3097954e6e14fb2183ad662c63d4ce8b82dc2487f0fe2ea2827b53a7c6dcced878d2fb29c1d3ff583570e7bc172d1a5c716e0447cb08ce3c468ffdf975da372f3f3eb455aaf5822bc04a51b6cad24a2331369df81c123b009a2381b42e9aeb077f621608d81c12a5f5c6c295d74afd4dd5c051296be0b54c70bf899b347c36bff62f313079983409d7f9cf1242c917985c1b5d0736fe21f8514f63d0369a374c42da40bd5140bc3e602d00c3cb4f8e621863ab47422778d67d72de34753fd72cef80649a1548e4e8dcbcffe4054cc9d8a1f922623a75904cbdaacde768131e587269a4a99d82f7009c1b8ab79aa232a2fd45ad71b603803123f6ba979fa6a87525884b08d721a21400fb1f950b96ead82f408cc4388d3b78fb456616429a520656d5e5a876fd04748498902c86f58d45f4c1b3919eb846a00edf07e7a830bf723e4774f085f15534dd3b5246c0c0970b5ad7bb39b30b156a9430378c5b0aab1261c78d72ac301cd552d5e8dd4b642ec1dc0672745d593bb26d095b5b23576e3cfd6ab580f6e09419d0f0c64250fafaa3759aa1888da48d89c3f7c9454b0b3d0ab40445f5bed4493ef43ab08f31b1345ac4ffd94ad79c9eee53904ed6f572817153190d2e6863f2e39356bb99926419fd314341a536b7e76cae60bf7750a4c29e3f4c7f005530b1d4ee0e25b93b76fcc1108222f0b00de52cf4100e97adfd7b9db1370586ba27e1e183299be00d0df8439c380edf2f79deb441eac59b814b04accdff5e17f02046139f91f0332661676ff506e575f0cb2850bcc9f8666f6d1f69f8f4271cb804a79fccd7016f049d1a494c26a527c437fa0be6d51ec7543d9bd7a2f016194ebe3c99080a6c9b5119863dfe865f8e60cae29f50b67dbfaa0a3c9794d73034485ca1613344c572783db3dfab01b28089c51cda99cefa4c1c881a29e229f04c7e0fd04dc425ae8417852e6e31520c6207e9d4e35285feef2a2cb8a3bceb08a166fa4284a516362621e2c06731a442791f1db063a32cf1f005c914102c7273cb4d7ab1bf567d72f230783d2ea99c43a60e8729132441ee6c5362c33f9b613f84417c3c5549f4e3d9e73c6f83f16c8e57ae22fe5f54515e111fe43ad7c400d214281452bb6141cecad84b23a695f061988d906d03be5d89584634b9e9d9a9b072f8e7cbb47c47719318a2001cafa665dd2c82672d16877ea115bd023fc1975f7c59664bfb06f66a1a5e3f05cb283fb45ea67a2727ee6e10bf35b31fdd03d43ec67b753f6737e0d2f4a5275031595878cefc8f0ca", 0x600) r2 = add_key$keyring(&(0x7f00000005c0)='keyring\x00', &(0x7f0000000600)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, &(0x7f0000000380)='asymmetric\x00', &(0x7f0000000100)=@chain={'key_or_keyring:', 0x0, ':chain\x00'}) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r2, 0x0, 0x0) r3 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f00000000c0)={'syz', 0x3}, 0x0, 0x0, r2) keyctl$describe(0x6, r3, &(0x7f0000000100)=""/72, 0x48) socket$inet(0x2, 0xa, 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r4, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$inet_tcp(0x2, 0x1, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r5, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendfile(r0, r5, 0x0, 0x7c) signalfd(0xffffffffffffffff, 0x0, 0x0) fchdir(0xffffffffffffffff) io_setup(0x0, 0x0) 09:15:02 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xfffffff0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:15:02 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r1, 0x0, 0x0) lseek(r1, 0xe7, 0x0) recvfrom$inet(r1, &(0x7f0000000080)=""/173, 0xad, 0x10, &(0x7f0000000140)={0x2, 0x4e22}, 0x10) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r2, 0x8982, &(0x7f0000000040)={0x7, 'tunl0\x00', {0x4f}, 0xa1}) 09:15:02 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x7, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 370.733274][T23528] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 370.742614][T23528] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 370.789791][T23539] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 370.820930][T23539] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:15:02 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r1 = dup(r0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r2, 0x0, 0x0) lseek(r2, 0xe7, 0x0) ioctl$KDFONTOP_COPY(r2, 0x4b72, &(0x7f0000000000)={0x3, 0x0, 0x1e, 0x5, 0x8f, &(0x7f0000000340)}) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r3, 0x0, 0x0) lseek(r3, 0xe7, 0x0) ioctl$TIOCGISO7816(r3, 0x80285442, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000300)={0x3, &(0x7f00000001c0)=[{0x6, 0x0, 0x0, 0x7fffffff}, {0xac}, {0x6}]}) 09:15:02 executing program 2: open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) 09:15:02 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0xfffffffe, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:15:02 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x2000, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:15:02 executing program 2: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x1400, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:15:02 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x8, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 370.971250][T23549] tipc: Started in network mode [ 370.977565][T23549] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 370.991365][T23549] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 371.007802][T23549] tipc: Enabled bearer , priority 10 [ 371.049386][T23554] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 371.068743][T23554] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 371.087909][T23551] tipc: Started in network mode 09:15:03 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 371.099019][T23551] tipc: Own node identity 00000000000000000000ffffac1e0003, cluster identity 4711 [ 371.145187][T23551] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 371.162449][T23551] tipc: Enabled bearer , priority 10 [ 371.204878][T23560] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 371.222749][T23560] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 371.354109][T21190] tipc: 32-bit node address hash set to fbff1eac [ 371.817642][T23533] FAT-fs (loop5): FAT read failed (blocknr 63) [ 371.829697][T23543] FAT-fs (loop5): FAT read failed (blocknr 63) [ 371.836499][T23563] FAT-fs (loop5): FAT read failed (blocknr 63) [ 371.843051][T23543] FAT-fs (loop5): FAT read failed (blocknr 63) [ 371.849762][T23563] FAT-fs (loop5): FAT read failed (blocknr 63) [ 371.860462][ T1959] attempt to access beyond end of device 09:15:03 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280906) 09:15:03 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r3, 0xc0105502, &(0x7f0000000880)=@urb_type_iso={0x0, {0xe, 0x1}, 0x1f, 0x64, &(0x7f0000000600)="ec2693f8d831dbe5cc836fe6027502a97350315f29f2f719e88eec35e5f7af42a1586e003dc7de3dbeff0148ec90e017d00737ad272a427de5b4bf53a3e5859facf1633542a9f3b63ea983860d37b83fa695155b65a1c90b120e06e5826e27d62beb591afd8c45500c247aad786f9525c7e967352776084fcd545ab6ade3fd0bfeb015780ac2b3f5eef66420509cd1b3618962fa5bc99c2ad5a9199d82", 0x9d, 0x4, 0x2, 0x43, 0x3, 0x2, &(0x7f00000006c0)="cac456b038014fc907a4dbe3c0d7766bf9b83128d037a7a94d8b84865bb5af74dea9979507e8be62de3c3a8dbc578f6856025de1095005672ba0d74bf582d1122d46c2d0b20a47f760d8ce3c5bbab0a5004474bb0a1ae80b443157e45f06671f06ffa3bfaa4ed74c5d7bae16e49fc5287069abf00546e0ed398cb100d9e28bc0bd86772c685537307d31ea47c76112abc4c70c21f28e56cace1663621b18539ae3a18ae01184d8bec374fcc18666e10be7af545c1a7864d0a1cf7e03e87e505a490674efcafc83b768c9ac4d6d94684d28b0d550d3f0d71109c99ea7cfa946b1443d4fc36a771e442eee34e0799a4ab457a5185e411a", [{0xdb04, 0x8, 0x7}, {0x8, 0x4}, {0x400, 0x0, 0xffffff00}, {0x7, 0x4, 0x1}, {0x5, 0x2, 0x2}, {0x40, 0xfffff526}, {0x3, 0x7, 0x4}, {0x8001, 0x4, 0xffffffe1}, {0x4, 0x8001, 0x2}, {0x2, 0x400, 0x4}, {0x80000000, 0x5, 0x8}, {0x6, 0x0, 0x74a}, {0x80000000, 0x6, 0x80000001}, {0x1, 0x40, 0x5}, {0x6, 0x9, 0x7ff}, {0x6, 0x1, 0x4}, {0x4, 0x7fff, 0x400}, {0x2, 0x1, 0x1}, {0xfffffe00, 0x48, 0x8}, {0x5, 0x3ff, 0x4}, {0x2, 0x200, 0x8001}, {0x0, 0x1, 0x8}, {0xaadf, 0x7, 0x1ff}, {0x7, 0x8, 0x4}, {0x2, 0x6, 0x7ff}, {0x2, 0x399, 0x4851}, {0x80000000, 0xb186, 0x7f}, {0x5, 0x1000, 0x1}, {0xea, 0x9}, {0x0, 0x800, 0x6}, {0x9, 0x5, 0x7fff}, {0x0, 0x861, 0x3f}, {0x8001, 0x7, 0x9}, {0x8, 0x400, 0x72f}, {0xb6, 0x2, 0x359}, {0x3, 0xffff0001, 0x1}, {0x80, 0x80, 0x7}, {0x5, 0xffffffff, 0x5}, {0xfffffff7, 0x5, 0x2}, {0x6, 0x8}, {0xfffffffb, 0x1, 0x6}, {0x17, 0x7, 0x8}, {0x8000009, 0x8001}, {0x79c, 0x16, 0x6}, {0x4, 0x4, 0x100}, {0x4, 0x5, 0x6}, {0xfff, 0x8, 0x1}, {0x3, 0x8, 0x1}, {0x1000, 0x0, 0xd7}, {0x578a, 0x4, 0x1}, {0x8001, 0x7f, 0x10001}, {0x3, 0x3, 0x9}, {0x0, 0x5, 0x5}, {0x7, 0x80000001, 0x3}, {0x4000000, 0x1, 0xc}, {0x3, 0x5, 0x6}, {0xb6, 0x6, 0x5}, {0x729a7fe5, 0x20, 0x10001}, {0x3, 0x6, 0x441}, {0x7f, 0x0, 0x8092}, {0x4, 0xff, 0x7ff}, {0x800, 0xf4, 0x5}, {0x7, 0x4, 0x1}, {0x80000001, 0x400, 0x5}, {0xd63d, 0x12c, 0x200}, {0x4, 0x6, 0x8}, {0x80000001, 0x1, 0x400}]}) r4 = getuid() statx(r0, &(0x7f0000000100)='./file0\x00', 0x0, 0xfff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r6, 0x0, 0x0) lseek(r6, 0xe7, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0}, &(0x7f00000002c0)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@local}}, &(0x7f0000000400)=0xe8) lstat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r3, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1, r4}, {0x2, 0x5, r5}, {0x2, 0x1, r7}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4, r8}], {0x4, 0x1}, [{0x8, 0x3, r9}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) write(0xffffffffffffffff, &(0x7f0000000180)="1c0000004a005f0214f9f424000904000a", 0x11) ioctl$PERF_EVENT_IOC_ID(0xffffffffffffffff, 0x80082407, &(0x7f0000000580)) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = fcntl$dupfd(r10, 0x0, r10) ioctl$PERF_EVENT_IOC_ENABLE(r11, 0x8912, 0x400200) splice(r0, 0x0, r1, 0x0, 0x10000, 0x0) 09:15:03 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x2, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:15:03 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x9, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:15:03 executing program 0: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x501100, 0x0) sendmsg$NFNL_MSG_CTHELPER_DEL(r0, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="300000000200000000eaff009445952d40eb0000010900010073797a31000000000800054000000015d1fbf0fd48100ab3b6eae1f439b63e459a662b6abcb2f38843656245edeba2cb4d78db164eff5b44035d3edffd39fc3915990cf7208c2a3c32d81177355450dcfed709f4b2c16d54e902d02ffe15c6cbc3fe8401f52c243ce507b3795b63cebb4e4c109d9023619571d9876d12e7e1b8fc960957303fc093a4fd4e82496e9f5d8737745614c81523cb30ec67e2be5e99126ab924e55f79c7570e00003932b91c8ea138fee3defe92ae04d1857fb10528dae726fd6aa9d129b715160348b21fe03c97f4f728116d8489e01b7f0b4eb5a3cead6c54ba4aeaa713eb02cfdd30a93d"], 0x30}, 0x1, 0x0, 0x0, 0x24044091}, 0x8000) unshare(0x44000600) r1 = syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x908, 0x24a101) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, 0x0) r2 = pkey_alloc(0x0, 0x0) pkey_mprotect(&(0x7f00002d5000/0x1000)=nil, 0x1000, 0x0, r2) pkey_free(r2) pkey_free(r2) ioctl$USBDEVFS_REAPURB(r1, 0x4008550c, &(0x7f0000000000)) 09:15:03 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x2500, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 371.866102][ T1959] loop5: rw=1, want=61949, limit=63 [ 371.878835][ T1959] attempt to access beyond end of device [ 371.885698][ T1959] loop5: rw=1, want=63509, limit=63 [ 371.893761][T23569] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=23569 comm=syz-executor.2 [ 371.920444][T23573] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 371.930275][T23569] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=23569 comm=syz-executor.2 [ 371.932608][T23573] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 371.943568][T23569] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=23569 comm=syz-executor.2 [ 371.962070][T23571] tipc: Started in network mode [ 371.965256][T23569] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=23569 comm=syz-executor.2 [ 371.981532][T23571] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 371.982077][T23569] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=23569 comm=syz-executor.2 [ 371.991428][T23571] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 372.012228][T23569] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=23569 comm=syz-executor.2 [ 372.025418][T23569] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=23569 comm=syz-executor.2 [ 372.029946][T23571] tipc: Enabled bearer , priority 10 [ 372.039688][T23569] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=23569 comm=syz-executor.2 09:15:04 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x2a02, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 372.066086][T23569] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=23569 comm=syz-executor.2 [ 372.103133][T23585] tipc: Started in network mode [ 372.108071][T23585] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 372.117663][T23585] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 372.125892][T20520] tipc: 32-bit node address hash set to fbff1eac [ 372.134668][T23585] tipc: Enabled bearer , priority 10 09:15:04 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x3, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:15:04 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r3, 0xc0105502, &(0x7f0000000880)=@urb_type_iso={0x0, {0xe, 0x1}, 0x1f, 0x64, &(0x7f0000000600)="ec2693f8d831dbe5cc836fe6027502a97350315f29f2f719e88eec35e5f7af42a1586e003dc7de3dbeff0148ec90e017d00737ad272a427de5b4bf53a3e5859facf1633542a9f3b63ea983860d37b83fa695155b65a1c90b120e06e5826e27d62beb591afd8c45500c247aad786f9525c7e967352776084fcd545ab6ade3fd0bfeb015780ac2b3f5eef66420509cd1b3618962fa5bc99c2ad5a9199d82", 0x9d, 0x4, 0x2, 0x43, 0x3, 0x2, &(0x7f00000006c0)="cac456b038014fc907a4dbe3c0d7766bf9b83128d037a7a94d8b84865bb5af74dea9979507e8be62de3c3a8dbc578f6856025de1095005672ba0d74bf582d1122d46c2d0b20a47f760d8ce3c5bbab0a5004474bb0a1ae80b443157e45f06671f06ffa3bfaa4ed74c5d7bae16e49fc5287069abf00546e0ed398cb100d9e28bc0bd86772c685537307d31ea47c76112abc4c70c21f28e56cace1663621b18539ae3a18ae01184d8bec374fcc18666e10be7af545c1a7864d0a1cf7e03e87e505a490674efcafc83b768c9ac4d6d94684d28b0d550d3f0d71109c99ea7cfa946b1443d4fc36a771e442eee34e0799a4ab457a5185e411a", [{0xdb04, 0x8, 0x7}, {0x8, 0x4}, {0x400, 0x0, 0xffffff00}, {0x7, 0x4, 0x1}, {0x5, 0x2, 0x2}, {0x40, 0xfffff526}, {0x3, 0x7, 0x4}, {0x8001, 0x4, 0xffffffe1}, {0x4, 0x8001, 0x2}, {0x2, 0x400, 0x4}, {0x80000000, 0x5, 0x8}, {0x6, 0x0, 0x74a}, {0x80000000, 0x6, 0x80000001}, {0x1, 0x40, 0x5}, {0x6, 0x9, 0x7ff}, {0x6, 0x1, 0x4}, {0x4, 0x7fff, 0x400}, {0x2, 0x1, 0x1}, {0xfffffe00, 0x48, 0x8}, {0x5, 0x3ff, 0x4}, {0x2, 0x200, 0x8001}, {0x0, 0x1, 0x8}, {0xaadf, 0x7, 0x1ff}, {0x7, 0x8, 0x4}, {0x2, 0x6, 0x7ff}, {0x2, 0x399, 0x4851}, {0x80000000, 0xb186, 0x7f}, {0x5, 0x1000, 0x1}, {0xea, 0x9}, {0x0, 0x800, 0x6}, {0x9, 0x5, 0x7fff}, {0x0, 0x861, 0x3f}, {0x8001, 0x7, 0x9}, {0x8, 0x400, 0x72f}, {0xb6, 0x2, 0x359}, {0x3, 0xffff0001, 0x1}, {0x80, 0x80, 0x7}, {0x5, 0xffffffff, 0x5}, {0xfffffff7, 0x5, 0x2}, {0x6, 0x8}, {0xfffffffb, 0x1, 0x6}, {0x17, 0x7, 0x8}, {0x8000009, 0x8001}, {0x79c, 0x16, 0x6}, {0x4, 0x4, 0x100}, {0x4, 0x5, 0x6}, {0xfff, 0x8, 0x1}, {0x3, 0x8, 0x1}, {0x1000, 0x0, 0xd7}, {0x578a, 0x4, 0x1}, {0x8001, 0x7f, 0x10001}, {0x3, 0x3, 0x9}, {0x0, 0x5, 0x5}, {0x7, 0x80000001, 0x3}, {0x4000000, 0x1, 0xc}, {0x3, 0x5, 0x6}, {0xb6, 0x6, 0x5}, {0x729a7fe5, 0x20, 0x10001}, {0x3, 0x6, 0x441}, {0x7f, 0x0, 0x8092}, {0x4, 0xff, 0x7ff}, {0x800, 0xf4, 0x5}, {0x7, 0x4, 0x1}, {0x80000001, 0x400, 0x5}, {0xd63d, 0x12c, 0x200}, {0x4, 0x6, 0x8}, {0x80000001, 0x1, 0x400}]}) r4 = getuid() statx(r0, &(0x7f0000000100)='./file0\x00', 0x0, 0xfff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r6, 0x0, 0x0) lseek(r6, 0xe7, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0}, &(0x7f00000002c0)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@local}}, &(0x7f0000000400)=0xe8) lstat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r3, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1, r4}, {0x2, 0x5, r5}, {0x2, 0x1, r7}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4, r8}], {0x4, 0x1}, [{0x8, 0x3, r9}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) write(0xffffffffffffffff, &(0x7f0000000180)="1c0000004a005f0214f9f424000904000a", 0x11) ioctl$PERF_EVENT_IOC_ID(0xffffffffffffffff, 0x80082407, &(0x7f0000000580)) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = fcntl$dupfd(r10, 0x0, r10) ioctl$PERF_EVENT_IOC_ENABLE(r11, 0x8912, 0x400200) splice(r0, 0x0, r1, 0x0, 0x10000, 0x0) [ 372.230698][T23590] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready 09:15:04 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x2c00, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) [ 372.279490][T20524] tipc: 32-bit node address hash set to fcff1eac [ 372.303329][T23590] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:15:04 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0xa, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:15:04 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r3, 0xc0105502, &(0x7f0000000880)=@urb_type_iso={0x0, {0xe, 0x1}, 0x1f, 0x64, &(0x7f0000000600)="ec2693f8d831dbe5cc836fe6027502a97350315f29f2f719e88eec35e5f7af42a1586e003dc7de3dbeff0148ec90e017d00737ad272a427de5b4bf53a3e5859facf1633542a9f3b63ea983860d37b83fa695155b65a1c90b120e06e5826e27d62beb591afd8c45500c247aad786f9525c7e967352776084fcd545ab6ade3fd0bfeb015780ac2b3f5eef66420509cd1b3618962fa5bc99c2ad5a9199d82", 0x9d, 0x4, 0x2, 0x43, 0x3, 0x2, &(0x7f00000006c0)="cac456b038014fc907a4dbe3c0d7766bf9b83128d037a7a94d8b84865bb5af74dea9979507e8be62de3c3a8dbc578f6856025de1095005672ba0d74bf582d1122d46c2d0b20a47f760d8ce3c5bbab0a5004474bb0a1ae80b443157e45f06671f06ffa3bfaa4ed74c5d7bae16e49fc5287069abf00546e0ed398cb100d9e28bc0bd86772c685537307d31ea47c76112abc4c70c21f28e56cace1663621b18539ae3a18ae01184d8bec374fcc18666e10be7af545c1a7864d0a1cf7e03e87e505a490674efcafc83b768c9ac4d6d94684d28b0d550d3f0d71109c99ea7cfa946b1443d4fc36a771e442eee34e0799a4ab457a5185e411a", [{0xdb04, 0x8, 0x7}, {0x8, 0x4}, {0x400, 0x0, 0xffffff00}, {0x7, 0x4, 0x1}, {0x5, 0x2, 0x2}, {0x40, 0xfffff526}, {0x3, 0x7, 0x4}, {0x8001, 0x4, 0xffffffe1}, {0x4, 0x8001, 0x2}, {0x2, 0x400, 0x4}, {0x80000000, 0x5, 0x8}, {0x6, 0x0, 0x74a}, {0x80000000, 0x6, 0x80000001}, {0x1, 0x40, 0x5}, {0x6, 0x9, 0x7ff}, {0x6, 0x1, 0x4}, {0x4, 0x7fff, 0x400}, {0x2, 0x1, 0x1}, {0xfffffe00, 0x48, 0x8}, {0x5, 0x3ff, 0x4}, {0x2, 0x200, 0x8001}, {0x0, 0x1, 0x8}, {0xaadf, 0x7, 0x1ff}, {0x7, 0x8, 0x4}, {0x2, 0x6, 0x7ff}, {0x2, 0x399, 0x4851}, {0x80000000, 0xb186, 0x7f}, {0x5, 0x1000, 0x1}, {0xea, 0x9}, {0x0, 0x800, 0x6}, {0x9, 0x5, 0x7fff}, {0x0, 0x861, 0x3f}, {0x8001, 0x7, 0x9}, {0x8, 0x400, 0x72f}, {0xb6, 0x2, 0x359}, {0x3, 0xffff0001, 0x1}, {0x80, 0x80, 0x7}, {0x5, 0xffffffff, 0x5}, {0xfffffff7, 0x5, 0x2}, {0x6, 0x8}, {0xfffffffb, 0x1, 0x6}, {0x17, 0x7, 0x8}, {0x8000009, 0x8001}, {0x79c, 0x16, 0x6}, {0x4, 0x4, 0x100}, {0x4, 0x5, 0x6}, {0xfff, 0x8, 0x1}, {0x3, 0x8, 0x1}, {0x1000, 0x0, 0xd7}, {0x578a, 0x4, 0x1}, {0x8001, 0x7f, 0x10001}, {0x3, 0x3, 0x9}, {0x0, 0x5, 0x5}, {0x7, 0x80000001, 0x3}, {0x4000000, 0x1, 0xc}, {0x3, 0x5, 0x6}, {0xb6, 0x6, 0x5}, {0x729a7fe5, 0x20, 0x10001}, {0x3, 0x6, 0x441}, {0x7f, 0x0, 0x8092}, {0x4, 0xff, 0x7ff}, {0x800, 0xf4, 0x5}, {0x7, 0x4, 0x1}, {0x80000001, 0x400, 0x5}, {0xd63d, 0x12c, 0x200}, {0x4, 0x6, 0x8}, {0x80000001, 0x1, 0x400}]}) r4 = getuid() statx(r0, &(0x7f0000000100)='./file0\x00', 0x0, 0xfff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r6, 0x0, 0x0) lseek(r6, 0xe7, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0}, &(0x7f00000002c0)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@local}}, &(0x7f0000000400)=0xe8) lstat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r3, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1, r4}, {0x2, 0x5, r5}, {0x2, 0x1, r7}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4, r8}], {0x4, 0x1}, [{0x8, 0x3, r9}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) write(0xffffffffffffffff, &(0x7f0000000180)="1c0000004a005f0214f9f424000904000a", 0x11) ioctl$PERF_EVENT_IOC_ID(0xffffffffffffffff, 0x80082407, &(0x7f0000000580)) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = fcntl$dupfd(r10, 0x0, r10) ioctl$PERF_EVENT_IOC_ENABLE(r11, 0x8912, 0x400200) splice(r0, 0x0, r1, 0x0, 0x10000, 0x0) [ 372.412486][T23600] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 372.431469][T23600] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 372.465503][T23603] tipc: Enabling of bearer rejected, failed to enable media [ 372.560606][T23604] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 372.568654][T23604] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 372.804951][T23581] FAT-fs (loop5): FAT read failed (blocknr 63) 09:15:04 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280907) 09:15:04 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0xb, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:15:04 executing program 0: unshare(0x44000600) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x48400, 0x0) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="00010000010101010000000000000000000000073c000f80080001400000000308000340000001d308000140000007ff0800014000000005080002400010000008648f00024000000005080001400000000780000d8014000400fe80000000000000000000000000001314000400fe8000000000000000000000000000aa08000200ac1e01014c000380060001000e230000060001004e210000060002004e200000060002004e220000060001004e230000060002004e23000006000206000000000600d0004e220000060001004e240000300001801400018008000100e000000208000200ac1e01010c00028005000100210000000c000280050001002100"], 0x100}, 0x1, 0x0, 0x0, 0x4000000}, 0x400c040) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x262802, 0x0) rmdir(&(0x7f0000000140)='./file0\x00') r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0) read(r2, 0x0, 0x0) lseek(r2, 0xe7, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000340)={0x0, 'gretap0\x00', {0x4}, 0x854}) getsockname$unix(r1, &(0x7f0000000040)=@abs, &(0x7f00000000c0)=0x6e) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r3, 0x4008550d, 0x0) 09:15:04 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x2d00, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:15:04 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x4, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:15:04 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r3, 0xc0105502, &(0x7f0000000880)=@urb_type_iso={0x0, {0xe, 0x1}, 0x1f, 0x64, &(0x7f0000000600)="ec2693f8d831dbe5cc836fe6027502a97350315f29f2f719e88eec35e5f7af42a1586e003dc7de3dbeff0148ec90e017d00737ad272a427de5b4bf53a3e5859facf1633542a9f3b63ea983860d37b83fa695155b65a1c90b120e06e5826e27d62beb591afd8c45500c247aad786f9525c7e967352776084fcd545ab6ade3fd0bfeb015780ac2b3f5eef66420509cd1b3618962fa5bc99c2ad5a9199d82", 0x9d, 0x4, 0x2, 0x43, 0x3, 0x2, &(0x7f00000006c0)="cac456b038014fc907a4dbe3c0d7766bf9b83128d037a7a94d8b84865bb5af74dea9979507e8be62de3c3a8dbc578f6856025de1095005672ba0d74bf582d1122d46c2d0b20a47f760d8ce3c5bbab0a5004474bb0a1ae80b443157e45f06671f06ffa3bfaa4ed74c5d7bae16e49fc5287069abf00546e0ed398cb100d9e28bc0bd86772c685537307d31ea47c76112abc4c70c21f28e56cace1663621b18539ae3a18ae01184d8bec374fcc18666e10be7af545c1a7864d0a1cf7e03e87e505a490674efcafc83b768c9ac4d6d94684d28b0d550d3f0d71109c99ea7cfa946b1443d4fc36a771e442eee34e0799a4ab457a5185e411a", [{0xdb04, 0x8, 0x7}, {0x8, 0x4}, {0x400, 0x0, 0xffffff00}, {0x7, 0x4, 0x1}, {0x5, 0x2, 0x2}, {0x40, 0xfffff526}, {0x3, 0x7, 0x4}, {0x8001, 0x4, 0xffffffe1}, {0x4, 0x8001, 0x2}, {0x2, 0x400, 0x4}, {0x80000000, 0x5, 0x8}, {0x6, 0x0, 0x74a}, {0x80000000, 0x6, 0x80000001}, {0x1, 0x40, 0x5}, {0x6, 0x9, 0x7ff}, {0x6, 0x1, 0x4}, {0x4, 0x7fff, 0x400}, {0x2, 0x1, 0x1}, {0xfffffe00, 0x48, 0x8}, {0x5, 0x3ff, 0x4}, {0x2, 0x200, 0x8001}, {0x0, 0x1, 0x8}, {0xaadf, 0x7, 0x1ff}, {0x7, 0x8, 0x4}, {0x2, 0x6, 0x7ff}, {0x2, 0x399, 0x4851}, {0x80000000, 0xb186, 0x7f}, {0x5, 0x1000, 0x1}, {0xea, 0x9}, {0x0, 0x800, 0x6}, {0x9, 0x5, 0x7fff}, {0x0, 0x861, 0x3f}, {0x8001, 0x7, 0x9}, {0x8, 0x400, 0x72f}, {0xb6, 0x2, 0x359}, {0x3, 0xffff0001, 0x1}, {0x80, 0x80, 0x7}, {0x5, 0xffffffff, 0x5}, {0xfffffff7, 0x5, 0x2}, {0x6, 0x8}, {0xfffffffb, 0x1, 0x6}, {0x17, 0x7, 0x8}, {0x8000009, 0x8001}, {0x79c, 0x16, 0x6}, {0x4, 0x4, 0x100}, {0x4, 0x5, 0x6}, {0xfff, 0x8, 0x1}, {0x3, 0x8, 0x1}, {0x1000, 0x0, 0xd7}, {0x578a, 0x4, 0x1}, {0x8001, 0x7f, 0x10001}, {0x3, 0x3, 0x9}, {0x0, 0x5, 0x5}, {0x7, 0x80000001, 0x3}, {0x4000000, 0x1, 0xc}, {0x3, 0x5, 0x6}, {0xb6, 0x6, 0x5}, {0x729a7fe5, 0x20, 0x10001}, {0x3, 0x6, 0x441}, {0x7f, 0x0, 0x8092}, {0x4, 0xff, 0x7ff}, {0x800, 0xf4, 0x5}, {0x7, 0x4, 0x1}, {0x80000001, 0x400, 0x5}, {0xd63d, 0x12c, 0x200}, {0x4, 0x6, 0x8}, {0x80000001, 0x1, 0x400}]}) r4 = getuid() statx(r0, &(0x7f0000000100)='./file0\x00', 0x0, 0xfff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r6, 0x0, 0x0) lseek(r6, 0xe7, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0}, &(0x7f00000002c0)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@local}}, &(0x7f0000000400)=0xe8) lstat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r3, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1, r4}, {0x2, 0x5, r5}, {0x2, 0x1, r7}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4, r8}], {0x4, 0x1}, [{0x8, 0x3, r9}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) write(0xffffffffffffffff, &(0x7f0000000180)="1c0000004a005f0214f9f424000904000a", 0x11) ioctl$PERF_EVENT_IOC_ID(0xffffffffffffffff, 0x80082407, &(0x7f0000000580)) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = fcntl$dupfd(r10, 0x0, r10) ioctl$PERF_EVENT_IOC_ENABLE(r11, 0x8912, 0x400200) splice(r0, 0x0, r1, 0x0, 0x10000, 0x0) [ 372.959151][ T1938] tipc: Disabling bearer [ 372.964606][ T1938] tipc: Left network mode [ 372.986366][T23610] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 372.999712][T23610] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 373.009566][ T1938] tipc: Disabling bearer [ 373.014882][ T1938] tipc: Left network mode [ 373.021670][T23614] net_ratelimit: 12 callbacks suppressed [ 373.021675][T23614] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 373.068593][T23617] tipc: Started in network mode [ 373.077492][T23617] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 373.091329][T23617] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 373.099804][T23617] tipc: Enabled bearer , priority 10 [ 373.106201][T23626] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 373.115590][T23626] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 373.128563][T23625] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:15:05 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0xc, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:15:05 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r3, 0xc0105502, &(0x7f0000000880)=@urb_type_iso={0x0, {0xe, 0x1}, 0x1f, 0x64, &(0x7f0000000600)="ec2693f8d831dbe5cc836fe6027502a97350315f29f2f719e88eec35e5f7af42a1586e003dc7de3dbeff0148ec90e017d00737ad272a427de5b4bf53a3e5859facf1633542a9f3b63ea983860d37b83fa695155b65a1c90b120e06e5826e27d62beb591afd8c45500c247aad786f9525c7e967352776084fcd545ab6ade3fd0bfeb015780ac2b3f5eef66420509cd1b3618962fa5bc99c2ad5a9199d82", 0x9d, 0x4, 0x2, 0x43, 0x3, 0x2, &(0x7f00000006c0)="cac456b038014fc907a4dbe3c0d7766bf9b83128d037a7a94d8b84865bb5af74dea9979507e8be62de3c3a8dbc578f6856025de1095005672ba0d74bf582d1122d46c2d0b20a47f760d8ce3c5bbab0a5004474bb0a1ae80b443157e45f06671f06ffa3bfaa4ed74c5d7bae16e49fc5287069abf00546e0ed398cb100d9e28bc0bd86772c685537307d31ea47c76112abc4c70c21f28e56cace1663621b18539ae3a18ae01184d8bec374fcc18666e10be7af545c1a7864d0a1cf7e03e87e505a490674efcafc83b768c9ac4d6d94684d28b0d550d3f0d71109c99ea7cfa946b1443d4fc36a771e442eee34e0799a4ab457a5185e411a", [{0xdb04, 0x8, 0x7}, {0x8, 0x4}, {0x400, 0x0, 0xffffff00}, {0x7, 0x4, 0x1}, {0x5, 0x2, 0x2}, {0x40, 0xfffff526}, {0x3, 0x7, 0x4}, {0x8001, 0x4, 0xffffffe1}, {0x4, 0x8001, 0x2}, {0x2, 0x400, 0x4}, {0x80000000, 0x5, 0x8}, {0x6, 0x0, 0x74a}, {0x80000000, 0x6, 0x80000001}, {0x1, 0x40, 0x5}, {0x6, 0x9, 0x7ff}, {0x6, 0x1, 0x4}, {0x4, 0x7fff, 0x400}, {0x2, 0x1, 0x1}, {0xfffffe00, 0x48, 0x8}, {0x5, 0x3ff, 0x4}, {0x2, 0x200, 0x8001}, {0x0, 0x1, 0x8}, {0xaadf, 0x7, 0x1ff}, {0x7, 0x8, 0x4}, {0x2, 0x6, 0x7ff}, {0x2, 0x399, 0x4851}, {0x80000000, 0xb186, 0x7f}, {0x5, 0x1000, 0x1}, {0xea, 0x9}, {0x0, 0x800, 0x6}, {0x9, 0x5, 0x7fff}, {0x0, 0x861, 0x3f}, {0x8001, 0x7, 0x9}, {0x8, 0x400, 0x72f}, {0xb6, 0x2, 0x359}, {0x3, 0xffff0001, 0x1}, {0x80, 0x80, 0x7}, {0x5, 0xffffffff, 0x5}, {0xfffffff7, 0x5, 0x2}, {0x6, 0x8}, {0xfffffffb, 0x1, 0x6}, {0x17, 0x7, 0x8}, {0x8000009, 0x8001}, {0x79c, 0x16, 0x6}, {0x4, 0x4, 0x100}, {0x4, 0x5, 0x6}, {0xfff, 0x8, 0x1}, {0x3, 0x8, 0x1}, {0x1000, 0x0, 0xd7}, {0x578a, 0x4, 0x1}, {0x8001, 0x7f, 0x10001}, {0x3, 0x3, 0x9}, {0x0, 0x5, 0x5}, {0x7, 0x80000001, 0x3}, {0x4000000, 0x1, 0xc}, {0x3, 0x5, 0x6}, {0xb6, 0x6, 0x5}, {0x729a7fe5, 0x20, 0x10001}, {0x3, 0x6, 0x441}, {0x7f, 0x0, 0x8092}, {0x4, 0xff, 0x7ff}, {0x800, 0xf4, 0x5}, {0x7, 0x4, 0x1}, {0x80000001, 0x400, 0x5}, {0xd63d, 0x12c, 0x200}, {0x4, 0x6, 0x8}, {0x80000001, 0x1, 0x400}]}) r4 = getuid() statx(r0, &(0x7f0000000100)='./file0\x00', 0x0, 0xfff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r6, 0x0, 0x0) lseek(r6, 0xe7, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0}, &(0x7f00000002c0)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@local}}, &(0x7f0000000400)=0xe8) lstat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r3, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1, r4}, {0x2, 0x5, r5}, {0x2, 0x1, r7}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4, r8}], {0x4, 0x1}, [{0x8, 0x3, r9}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) write(0xffffffffffffffff, &(0x7f0000000180)="1c0000004a005f0214f9f424000904000a", 0x11) ioctl$PERF_EVENT_IOC_ID(0xffffffffffffffff, 0x80082407, &(0x7f0000000580)) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = fcntl$dupfd(r10, 0x0, r10) ioctl$PERF_EVENT_IOC_ENABLE(r11, 0x8912, 0x400200) 09:15:05 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x2e00, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:15:05 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x5, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 373.621758][T23634] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 373.632013][T23634] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 373.655531][ T1938] tipc: Disabling bearer [ 373.661133][ T1938] tipc: Left network mode 09:15:05 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r3, 0xc0105502, &(0x7f0000000880)=@urb_type_iso={0x0, {0xe, 0x1}, 0x1f, 0x64, &(0x7f0000000600)="ec2693f8d831dbe5cc836fe6027502a97350315f29f2f719e88eec35e5f7af42a1586e003dc7de3dbeff0148ec90e017d00737ad272a427de5b4bf53a3e5859facf1633542a9f3b63ea983860d37b83fa695155b65a1c90b120e06e5826e27d62beb591afd8c45500c247aad786f9525c7e967352776084fcd545ab6ade3fd0bfeb015780ac2b3f5eef66420509cd1b3618962fa5bc99c2ad5a9199d82", 0x9d, 0x4, 0x2, 0x43, 0x3, 0x2, &(0x7f00000006c0)="cac456b038014fc907a4dbe3c0d7766bf9b83128d037a7a94d8b84865bb5af74dea9979507e8be62de3c3a8dbc578f6856025de1095005672ba0d74bf582d1122d46c2d0b20a47f760d8ce3c5bbab0a5004474bb0a1ae80b443157e45f06671f06ffa3bfaa4ed74c5d7bae16e49fc5287069abf00546e0ed398cb100d9e28bc0bd86772c685537307d31ea47c76112abc4c70c21f28e56cace1663621b18539ae3a18ae01184d8bec374fcc18666e10be7af545c1a7864d0a1cf7e03e87e505a490674efcafc83b768c9ac4d6d94684d28b0d550d3f0d71109c99ea7cfa946b1443d4fc36a771e442eee34e0799a4ab457a5185e411a", [{0xdb04, 0x8, 0x7}, {0x8, 0x4}, {0x400, 0x0, 0xffffff00}, {0x7, 0x4, 0x1}, {0x5, 0x2, 0x2}, {0x40, 0xfffff526}, {0x3, 0x7, 0x4}, {0x8001, 0x4, 0xffffffe1}, {0x4, 0x8001, 0x2}, {0x2, 0x400, 0x4}, {0x80000000, 0x5, 0x8}, {0x6, 0x0, 0x74a}, {0x80000000, 0x6, 0x80000001}, {0x1, 0x40, 0x5}, {0x6, 0x9, 0x7ff}, {0x6, 0x1, 0x4}, {0x4, 0x7fff, 0x400}, {0x2, 0x1, 0x1}, {0xfffffe00, 0x48, 0x8}, {0x5, 0x3ff, 0x4}, {0x2, 0x200, 0x8001}, {0x0, 0x1, 0x8}, {0xaadf, 0x7, 0x1ff}, {0x7, 0x8, 0x4}, {0x2, 0x6, 0x7ff}, {0x2, 0x399, 0x4851}, {0x80000000, 0xb186, 0x7f}, {0x5, 0x1000, 0x1}, {0xea, 0x9}, {0x0, 0x800, 0x6}, {0x9, 0x5, 0x7fff}, {0x0, 0x861, 0x3f}, {0x8001, 0x7, 0x9}, {0x8, 0x400, 0x72f}, {0xb6, 0x2, 0x359}, {0x3, 0xffff0001, 0x1}, {0x80, 0x80, 0x7}, {0x5, 0xffffffff, 0x5}, {0xfffffff7, 0x5, 0x2}, {0x6, 0x8}, {0xfffffffb, 0x1, 0x6}, {0x17, 0x7, 0x8}, {0x8000009, 0x8001}, {0x79c, 0x16, 0x6}, {0x4, 0x4, 0x100}, {0x4, 0x5, 0x6}, {0xfff, 0x8, 0x1}, {0x3, 0x8, 0x1}, {0x1000, 0x0, 0xd7}, {0x578a, 0x4, 0x1}, {0x8001, 0x7f, 0x10001}, {0x3, 0x3, 0x9}, {0x0, 0x5, 0x5}, {0x7, 0x80000001, 0x3}, {0x4000000, 0x1, 0xc}, {0x3, 0x5, 0x6}, {0xb6, 0x6, 0x5}, {0x729a7fe5, 0x20, 0x10001}, {0x3, 0x6, 0x441}, {0x7f, 0x0, 0x8092}, {0x4, 0xff, 0x7ff}, {0x800, 0xf4, 0x5}, {0x7, 0x4, 0x1}, {0x80000001, 0x400, 0x5}, {0xd63d, 0x12c, 0x200}, {0x4, 0x6, 0x8}, {0x80000001, 0x1, 0x400}]}) r4 = getuid() statx(r0, &(0x7f0000000100)='./file0\x00', 0x0, 0xfff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r6, 0x0, 0x0) lseek(r6, 0xe7, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0}, &(0x7f00000002c0)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@local}}, &(0x7f0000000400)=0xe8) lstat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r3, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1, r4}, {0x2, 0x5, r5}, {0x2, 0x1, r7}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4, r8}], {0x4, 0x1}, [{0x8, 0x3, r9}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) write(0xffffffffffffffff, &(0x7f0000000180)="1c0000004a005f0214f9f424000904000a", 0x11) ioctl$PERF_EVENT_IOC_ID(0xffffffffffffffff, 0x80082407, &(0x7f0000000580)) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) fcntl$dupfd(r10, 0x0, r10) [ 373.680060][T23640] tipc: Enabling of bearer rejected, failed to enable media [ 373.716255][T23641] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 373.765205][ T1938] tipc: Disabling bearer [ 373.770823][ T1938] tipc: Left network mode [ 373.790446][ T1938] tipc: Disabling bearer [ 373.795823][ T1938] tipc: Left network mode [ 373.801785][T23641] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:15:05 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r3, 0xc0105502, &(0x7f0000000880)=@urb_type_iso={0x0, {0xe, 0x1}, 0x1f, 0x64, &(0x7f0000000600)="ec2693f8d831dbe5cc836fe6027502a97350315f29f2f719e88eec35e5f7af42a1586e003dc7de3dbeff0148ec90e017d00737ad272a427de5b4bf53a3e5859facf1633542a9f3b63ea983860d37b83fa695155b65a1c90b120e06e5826e27d62beb591afd8c45500c247aad786f9525c7e967352776084fcd545ab6ade3fd0bfeb015780ac2b3f5eef66420509cd1b3618962fa5bc99c2ad5a9199d82", 0x9d, 0x4, 0x2, 0x43, 0x3, 0x2, &(0x7f00000006c0)="cac456b038014fc907a4dbe3c0d7766bf9b83128d037a7a94d8b84865bb5af74dea9979507e8be62de3c3a8dbc578f6856025de1095005672ba0d74bf582d1122d46c2d0b20a47f760d8ce3c5bbab0a5004474bb0a1ae80b443157e45f06671f06ffa3bfaa4ed74c5d7bae16e49fc5287069abf00546e0ed398cb100d9e28bc0bd86772c685537307d31ea47c76112abc4c70c21f28e56cace1663621b18539ae3a18ae01184d8bec374fcc18666e10be7af545c1a7864d0a1cf7e03e87e505a490674efcafc83b768c9ac4d6d94684d28b0d550d3f0d71109c99ea7cfa946b1443d4fc36a771e442eee34e0799a4ab457a5185e411a", [{0xdb04, 0x8, 0x7}, {0x8, 0x4}, {0x400, 0x0, 0xffffff00}, {0x7, 0x4, 0x1}, {0x5, 0x2, 0x2}, {0x40, 0xfffff526}, {0x3, 0x7, 0x4}, {0x8001, 0x4, 0xffffffe1}, {0x4, 0x8001, 0x2}, {0x2, 0x400, 0x4}, {0x80000000, 0x5, 0x8}, {0x6, 0x0, 0x74a}, {0x80000000, 0x6, 0x80000001}, {0x1, 0x40, 0x5}, {0x6, 0x9, 0x7ff}, {0x6, 0x1, 0x4}, {0x4, 0x7fff, 0x400}, {0x2, 0x1, 0x1}, {0xfffffe00, 0x48, 0x8}, {0x5, 0x3ff, 0x4}, {0x2, 0x200, 0x8001}, {0x0, 0x1, 0x8}, {0xaadf, 0x7, 0x1ff}, {0x7, 0x8, 0x4}, {0x2, 0x6, 0x7ff}, {0x2, 0x399, 0x4851}, {0x80000000, 0xb186, 0x7f}, {0x5, 0x1000, 0x1}, {0xea, 0x9}, {0x0, 0x800, 0x6}, {0x9, 0x5, 0x7fff}, {0x0, 0x861, 0x3f}, {0x8001, 0x7, 0x9}, {0x8, 0x400, 0x72f}, {0xb6, 0x2, 0x359}, {0x3, 0xffff0001, 0x1}, {0x80, 0x80, 0x7}, {0x5, 0xffffffff, 0x5}, {0xfffffff7, 0x5, 0x2}, {0x6, 0x8}, {0xfffffffb, 0x1, 0x6}, {0x17, 0x7, 0x8}, {0x8000009, 0x8001}, {0x79c, 0x16, 0x6}, {0x4, 0x4, 0x100}, {0x4, 0x5, 0x6}, {0xfff, 0x8, 0x1}, {0x3, 0x8, 0x1}, {0x1000, 0x0, 0xd7}, {0x578a, 0x4, 0x1}, {0x8001, 0x7f, 0x10001}, {0x3, 0x3, 0x9}, {0x0, 0x5, 0x5}, {0x7, 0x80000001, 0x3}, {0x4000000, 0x1, 0xc}, {0x3, 0x5, 0x6}, {0xb6, 0x6, 0x5}, {0x729a7fe5, 0x20, 0x10001}, {0x3, 0x6, 0x441}, {0x7f, 0x0, 0x8092}, {0x4, 0xff, 0x7ff}, {0x800, 0xf4, 0x5}, {0x7, 0x4, 0x1}, {0x80000001, 0x400, 0x5}, {0xd63d, 0x12c, 0x200}, {0x4, 0x6, 0x8}, {0x80000001, 0x1, 0x400}]}) r4 = getuid() statx(r0, &(0x7f0000000100)='./file0\x00', 0x0, 0xfff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r6, 0x0, 0x0) lseek(r6, 0xe7, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0}, &(0x7f00000002c0)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@local}}, &(0x7f0000000400)=0xe8) lstat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r3, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1, r4}, {0x2, 0x5, r5}, {0x2, 0x1, r7}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4, r8}], {0x4, 0x1}, [{0x8, 0x3, r9}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) write(0xffffffffffffffff, &(0x7f0000000180)="1c0000004a005f0214f9f424000904000a", 0x11) ioctl$PERF_EVENT_IOC_ID(0xffffffffffffffff, 0x80082407, &(0x7f0000000580)) socket$inet6_tcp(0xa, 0x1, 0x0) [ 373.878366][T23644] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 373.894041][T23644] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 373.930960][T23623] FAT-fs (loop5): FAT read failed (blocknr 63) 09:15:06 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x6, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:15:06 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280908) 09:15:06 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0xd, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 374.159558][T23652] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 374.167040][T23652] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 374.175882][T23653] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 374.200421][T23658] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 374.208352][T23658] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 374.219712][T20543] tipc: 32-bit node address hash set to fbff1eac [ 374.222022][T23660] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:15:06 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r3, 0xc0105502, &(0x7f0000000880)=@urb_type_iso={0x0, {0xe, 0x1}, 0x1f, 0x64, &(0x7f0000000600)="ec2693f8d831dbe5cc836fe6027502a97350315f29f2f719e88eec35e5f7af42a1586e003dc7de3dbeff0148ec90e017d00737ad272a427de5b4bf53a3e5859facf1633542a9f3b63ea983860d37b83fa695155b65a1c90b120e06e5826e27d62beb591afd8c45500c247aad786f9525c7e967352776084fcd545ab6ade3fd0bfeb015780ac2b3f5eef66420509cd1b3618962fa5bc99c2ad5a9199d82", 0x9d, 0x4, 0x2, 0x43, 0x3, 0x2, &(0x7f00000006c0)="cac456b038014fc907a4dbe3c0d7766bf9b83128d037a7a94d8b84865bb5af74dea9979507e8be62de3c3a8dbc578f6856025de1095005672ba0d74bf582d1122d46c2d0b20a47f760d8ce3c5bbab0a5004474bb0a1ae80b443157e45f06671f06ffa3bfaa4ed74c5d7bae16e49fc5287069abf00546e0ed398cb100d9e28bc0bd86772c685537307d31ea47c76112abc4c70c21f28e56cace1663621b18539ae3a18ae01184d8bec374fcc18666e10be7af545c1a7864d0a1cf7e03e87e505a490674efcafc83b768c9ac4d6d94684d28b0d550d3f0d71109c99ea7cfa946b1443d4fc36a771e442eee34e0799a4ab457a5185e411a", [{0xdb04, 0x8, 0x7}, {0x8, 0x4}, {0x400, 0x0, 0xffffff00}, {0x7, 0x4, 0x1}, {0x5, 0x2, 0x2}, {0x40, 0xfffff526}, {0x3, 0x7, 0x4}, {0x8001, 0x4, 0xffffffe1}, {0x4, 0x8001, 0x2}, {0x2, 0x400, 0x4}, {0x80000000, 0x5, 0x8}, {0x6, 0x0, 0x74a}, {0x80000000, 0x6, 0x80000001}, {0x1, 0x40, 0x5}, {0x6, 0x9, 0x7ff}, {0x6, 0x1, 0x4}, {0x4, 0x7fff, 0x400}, {0x2, 0x1, 0x1}, {0xfffffe00, 0x48, 0x8}, {0x5, 0x3ff, 0x4}, {0x2, 0x200, 0x8001}, {0x0, 0x1, 0x8}, {0xaadf, 0x7, 0x1ff}, {0x7, 0x8, 0x4}, {0x2, 0x6, 0x7ff}, {0x2, 0x399, 0x4851}, {0x80000000, 0xb186, 0x7f}, {0x5, 0x1000, 0x1}, {0xea, 0x9}, {0x0, 0x800, 0x6}, {0x9, 0x5, 0x7fff}, {0x0, 0x861, 0x3f}, {0x8001, 0x7, 0x9}, {0x8, 0x400, 0x72f}, {0xb6, 0x2, 0x359}, {0x3, 0xffff0001, 0x1}, {0x80, 0x80, 0x7}, {0x5, 0xffffffff, 0x5}, {0xfffffff7, 0x5, 0x2}, {0x6, 0x8}, {0xfffffffb, 0x1, 0x6}, {0x17, 0x7, 0x8}, {0x8000009, 0x8001}, {0x79c, 0x16, 0x6}, {0x4, 0x4, 0x100}, {0x4, 0x5, 0x6}, {0xfff, 0x8, 0x1}, {0x3, 0x8, 0x1}, {0x1000, 0x0, 0xd7}, {0x578a, 0x4, 0x1}, {0x8001, 0x7f, 0x10001}, {0x3, 0x3, 0x9}, {0x0, 0x5, 0x5}, {0x7, 0x80000001, 0x3}, {0x4000000, 0x1, 0xc}, {0x3, 0x5, 0x6}, {0xb6, 0x6, 0x5}, {0x729a7fe5, 0x20, 0x10001}, {0x3, 0x6, 0x441}, {0x7f, 0x0, 0x8092}, {0x4, 0xff, 0x7ff}, {0x800, 0xf4, 0x5}, {0x7, 0x4, 0x1}, {0x80000001, 0x400, 0x5}, {0xd63d, 0x12c, 0x200}, {0x4, 0x6, 0x8}, {0x80000001, 0x1, 0x400}]}) r4 = getuid() statx(r0, &(0x7f0000000100)='./file0\x00', 0x0, 0xfff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r6, 0x0, 0x0) lseek(r6, 0xe7, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0}, &(0x7f00000002c0)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@local}}, &(0x7f0000000400)=0xe8) lstat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r3, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1, r4}, {0x2, 0x5, r5}, {0x2, 0x1, r7}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4, r8}], {0x4, 0x1}, [{0x8, 0x3, r9}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) write(0xffffffffffffffff, &(0x7f0000000180)="1c0000004a005f0214f9f424000904000a", 0x11) ioctl$PERF_EVENT_IOC_ID(0xffffffffffffffff, 0x80082407, &(0x7f0000000580)) 09:15:06 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x7, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:15:06 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0xe, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:15:06 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r1, 0x0, 0x0) lseek(r1, 0xe7, 0x0) r2 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000040)='NET_DM\x00') sendmsg$NET_DM_CMD_START(r1, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x14, r2, 0x10, 0x70bd2a, 0x25dfdbfe, {}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x4c000}, 0x4000000) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) [ 374.774355][T23667] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 374.810098][T23669] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 374.818887][T23669] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 374.831691][T23656] FAT-fs (loop5): FAT read failed (blocknr 63) [ 374.873085][T23670] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 374.951418][T23678] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 374.964305][T23678] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:15:07 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x3a00, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:15:07 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r3, 0xc0105502, &(0x7f0000000880)=@urb_type_iso={0x0, {0xe, 0x1}, 0x1f, 0x64, &(0x7f0000000600)="ec2693f8d831dbe5cc836fe6027502a97350315f29f2f719e88eec35e5f7af42a1586e003dc7de3dbeff0148ec90e017d00737ad272a427de5b4bf53a3e5859facf1633542a9f3b63ea983860d37b83fa695155b65a1c90b120e06e5826e27d62beb591afd8c45500c247aad786f9525c7e967352776084fcd545ab6ade3fd0bfeb015780ac2b3f5eef66420509cd1b3618962fa5bc99c2ad5a9199d82", 0x9d, 0x4, 0x2, 0x43, 0x3, 0x2, &(0x7f00000006c0)="cac456b038014fc907a4dbe3c0d7766bf9b83128d037a7a94d8b84865bb5af74dea9979507e8be62de3c3a8dbc578f6856025de1095005672ba0d74bf582d1122d46c2d0b20a47f760d8ce3c5bbab0a5004474bb0a1ae80b443157e45f06671f06ffa3bfaa4ed74c5d7bae16e49fc5287069abf00546e0ed398cb100d9e28bc0bd86772c685537307d31ea47c76112abc4c70c21f28e56cace1663621b18539ae3a18ae01184d8bec374fcc18666e10be7af545c1a7864d0a1cf7e03e87e505a490674efcafc83b768c9ac4d6d94684d28b0d550d3f0d71109c99ea7cfa946b1443d4fc36a771e442eee34e0799a4ab457a5185e411a", [{0xdb04, 0x8, 0x7}, {0x8, 0x4}, {0x400, 0x0, 0xffffff00}, {0x7, 0x4, 0x1}, {0x5, 0x2, 0x2}, {0x40, 0xfffff526}, {0x3, 0x7, 0x4}, {0x8001, 0x4, 0xffffffe1}, {0x4, 0x8001, 0x2}, {0x2, 0x400, 0x4}, {0x80000000, 0x5, 0x8}, {0x6, 0x0, 0x74a}, {0x80000000, 0x6, 0x80000001}, {0x1, 0x40, 0x5}, {0x6, 0x9, 0x7ff}, {0x6, 0x1, 0x4}, {0x4, 0x7fff, 0x400}, {0x2, 0x1, 0x1}, {0xfffffe00, 0x48, 0x8}, {0x5, 0x3ff, 0x4}, {0x2, 0x200, 0x8001}, {0x0, 0x1, 0x8}, {0xaadf, 0x7, 0x1ff}, {0x7, 0x8, 0x4}, {0x2, 0x6, 0x7ff}, {0x2, 0x399, 0x4851}, {0x80000000, 0xb186, 0x7f}, {0x5, 0x1000, 0x1}, {0xea, 0x9}, {0x0, 0x800, 0x6}, {0x9, 0x5, 0x7fff}, {0x0, 0x861, 0x3f}, {0x8001, 0x7, 0x9}, {0x8, 0x400, 0x72f}, {0xb6, 0x2, 0x359}, {0x3, 0xffff0001, 0x1}, {0x80, 0x80, 0x7}, {0x5, 0xffffffff, 0x5}, {0xfffffff7, 0x5, 0x2}, {0x6, 0x8}, {0xfffffffb, 0x1, 0x6}, {0x17, 0x7, 0x8}, {0x8000009, 0x8001}, {0x79c, 0x16, 0x6}, {0x4, 0x4, 0x100}, {0x4, 0x5, 0x6}, {0xfff, 0x8, 0x1}, {0x3, 0x8, 0x1}, {0x1000, 0x0, 0xd7}, {0x578a, 0x4, 0x1}, {0x8001, 0x7f, 0x10001}, {0x3, 0x3, 0x9}, {0x0, 0x5, 0x5}, {0x7, 0x80000001, 0x3}, {0x4000000, 0x1, 0xc}, {0x3, 0x5, 0x6}, {0xb6, 0x6, 0x5}, {0x729a7fe5, 0x20, 0x10001}, {0x3, 0x6, 0x441}, {0x7f, 0x0, 0x8092}, {0x4, 0xff, 0x7ff}, {0x800, 0xf4, 0x5}, {0x7, 0x4, 0x1}, {0x80000001, 0x400, 0x5}, {0xd63d, 0x12c, 0x200}, {0x4, 0x6, 0x8}, {0x80000001, 0x1, 0x400}]}) r4 = getuid() statx(r0, &(0x7f0000000100)='./file0\x00', 0x0, 0xfff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r6, 0x0, 0x0) lseek(r6, 0xe7, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0}, &(0x7f00000002c0)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@local}}, &(0x7f0000000400)=0xe8) lstat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r3, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1, r4}, {0x2, 0x5, r5}, {0x2, 0x1, r7}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4, r8}], {0x4, 0x1}, [{0x8, 0x3, r9}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) write(0xffffffffffffffff, &(0x7f0000000180)="1c0000004a005f0214f9f424000904000a", 0x11) 09:15:07 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x8, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:15:07 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r1, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f0000000000)=@v1={0x0, @adiantum, 0x0, "bb98655fe8869362"}) 09:15:07 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0xf, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:15:07 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x280909) [ 375.156328][T23687] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 375.193284][T23684] tipc: Started in network mode [ 375.204018][T23684] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 375.213851][T23684] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 375.222317][T23684] tipc: Enabled bearer , priority 10 [ 375.228759][T23690] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 375.245163][T23690] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:15:07 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r3, 0xc0105502, &(0x7f0000000880)=@urb_type_iso={0x0, {0xe, 0x1}, 0x1f, 0x64, &(0x7f0000000600)="ec2693f8d831dbe5cc836fe6027502a97350315f29f2f719e88eec35e5f7af42a1586e003dc7de3dbeff0148ec90e017d00737ad272a427de5b4bf53a3e5859facf1633542a9f3b63ea983860d37b83fa695155b65a1c90b120e06e5826e27d62beb591afd8c45500c247aad786f9525c7e967352776084fcd545ab6ade3fd0bfeb015780ac2b3f5eef66420509cd1b3618962fa5bc99c2ad5a9199d82", 0x9d, 0x4, 0x2, 0x43, 0x3, 0x2, &(0x7f00000006c0)="cac456b038014fc907a4dbe3c0d7766bf9b83128d037a7a94d8b84865bb5af74dea9979507e8be62de3c3a8dbc578f6856025de1095005672ba0d74bf582d1122d46c2d0b20a47f760d8ce3c5bbab0a5004474bb0a1ae80b443157e45f06671f06ffa3bfaa4ed74c5d7bae16e49fc5287069abf00546e0ed398cb100d9e28bc0bd86772c685537307d31ea47c76112abc4c70c21f28e56cace1663621b18539ae3a18ae01184d8bec374fcc18666e10be7af545c1a7864d0a1cf7e03e87e505a490674efcafc83b768c9ac4d6d94684d28b0d550d3f0d71109c99ea7cfa946b1443d4fc36a771e442eee34e0799a4ab457a5185e411a", [{0xdb04, 0x8, 0x7}, {0x8, 0x4}, {0x400, 0x0, 0xffffff00}, {0x7, 0x4, 0x1}, {0x5, 0x2, 0x2}, {0x40, 0xfffff526}, {0x3, 0x7, 0x4}, {0x8001, 0x4, 0xffffffe1}, {0x4, 0x8001, 0x2}, {0x2, 0x400, 0x4}, {0x80000000, 0x5, 0x8}, {0x6, 0x0, 0x74a}, {0x80000000, 0x6, 0x80000001}, {0x1, 0x40, 0x5}, {0x6, 0x9, 0x7ff}, {0x6, 0x1, 0x4}, {0x4, 0x7fff, 0x400}, {0x2, 0x1, 0x1}, {0xfffffe00, 0x48, 0x8}, {0x5, 0x3ff, 0x4}, {0x2, 0x200, 0x8001}, {0x0, 0x1, 0x8}, {0xaadf, 0x7, 0x1ff}, {0x7, 0x8, 0x4}, {0x2, 0x6, 0x7ff}, {0x2, 0x399, 0x4851}, {0x80000000, 0xb186, 0x7f}, {0x5, 0x1000, 0x1}, {0xea, 0x9}, {0x0, 0x800, 0x6}, {0x9, 0x5, 0x7fff}, {0x0, 0x861, 0x3f}, {0x8001, 0x7, 0x9}, {0x8, 0x400, 0x72f}, {0xb6, 0x2, 0x359}, {0x3, 0xffff0001, 0x1}, {0x80, 0x80, 0x7}, {0x5, 0xffffffff, 0x5}, {0xfffffff7, 0x5, 0x2}, {0x6, 0x8}, {0xfffffffb, 0x1, 0x6}, {0x17, 0x7, 0x8}, {0x8000009, 0x8001}, {0x79c, 0x16, 0x6}, {0x4, 0x4, 0x100}, {0x4, 0x5, 0x6}, {0xfff, 0x8, 0x1}, {0x3, 0x8, 0x1}, {0x1000, 0x0, 0xd7}, {0x578a, 0x4, 0x1}, {0x8001, 0x7f, 0x10001}, {0x3, 0x3, 0x9}, {0x0, 0x5, 0x5}, {0x7, 0x80000001, 0x3}, {0x4000000, 0x1, 0xc}, {0x3, 0x5, 0x6}, {0xb6, 0x6, 0x5}, {0x729a7fe5, 0x20, 0x10001}, {0x3, 0x6, 0x441}, {0x7f, 0x0, 0x8092}, {0x4, 0xff, 0x7ff}, {0x800, 0xf4, 0x5}, {0x7, 0x4, 0x1}, {0x80000001, 0x400, 0x5}, {0xd63d, 0x12c, 0x200}, {0x4, 0x6, 0x8}, {0x80000001, 0x1, 0x400}]}) r4 = getuid() statx(r0, &(0x7f0000000100)='./file0\x00', 0x0, 0xfff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r6, 0x0, 0x0) lseek(r6, 0xe7, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0}, &(0x7f00000002c0)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@local}}, &(0x7f0000000400)=0xe8) lstat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r3, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1, r4}, {0x2, 0x5, r5}, {0x2, 0x1, r7}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4, r8}], {0x4, 0x1}, [{0x8, 0x3, r9}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) [ 375.260269][T23696] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:15:07 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x3a03, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:15:07 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r3, 0xc0105502, &(0x7f0000000880)=@urb_type_iso={0x0, {0xe, 0x1}, 0x1f, 0x64, &(0x7f0000000600)="ec2693f8d831dbe5cc836fe6027502a97350315f29f2f719e88eec35e5f7af42a1586e003dc7de3dbeff0148ec90e017d00737ad272a427de5b4bf53a3e5859facf1633542a9f3b63ea983860d37b83fa695155b65a1c90b120e06e5826e27d62beb591afd8c45500c247aad786f9525c7e967352776084fcd545ab6ade3fd0bfeb015780ac2b3f5eef66420509cd1b3618962fa5bc99c2ad5a9199d82", 0x9d, 0x4, 0x2, 0x43, 0x3, 0x2, &(0x7f00000006c0)="cac456b038014fc907a4dbe3c0d7766bf9b83128d037a7a94d8b84865bb5af74dea9979507e8be62de3c3a8dbc578f6856025de1095005672ba0d74bf582d1122d46c2d0b20a47f760d8ce3c5bbab0a5004474bb0a1ae80b443157e45f06671f06ffa3bfaa4ed74c5d7bae16e49fc5287069abf00546e0ed398cb100d9e28bc0bd86772c685537307d31ea47c76112abc4c70c21f28e56cace1663621b18539ae3a18ae01184d8bec374fcc18666e10be7af545c1a7864d0a1cf7e03e87e505a490674efcafc83b768c9ac4d6d94684d28b0d550d3f0d71109c99ea7cfa946b1443d4fc36a771e442eee34e0799a4ab457a5185e411a", [{0xdb04, 0x8, 0x7}, {0x8, 0x4}, {0x400, 0x0, 0xffffff00}, {0x7, 0x4, 0x1}, {0x5, 0x2, 0x2}, {0x40, 0xfffff526}, {0x3, 0x7, 0x4}, {0x8001, 0x4, 0xffffffe1}, {0x4, 0x8001, 0x2}, {0x2, 0x400, 0x4}, {0x80000000, 0x5, 0x8}, {0x6, 0x0, 0x74a}, {0x80000000, 0x6, 0x80000001}, {0x1, 0x40, 0x5}, {0x6, 0x9, 0x7ff}, {0x6, 0x1, 0x4}, {0x4, 0x7fff, 0x400}, {0x2, 0x1, 0x1}, {0xfffffe00, 0x48, 0x8}, {0x5, 0x3ff, 0x4}, {0x2, 0x200, 0x8001}, {0x0, 0x1, 0x8}, {0xaadf, 0x7, 0x1ff}, {0x7, 0x8, 0x4}, {0x2, 0x6, 0x7ff}, {0x2, 0x399, 0x4851}, {0x80000000, 0xb186, 0x7f}, {0x5, 0x1000, 0x1}, {0xea, 0x9}, {0x0, 0x800, 0x6}, {0x9, 0x5, 0x7fff}, {0x0, 0x861, 0x3f}, {0x8001, 0x7, 0x9}, {0x8, 0x400, 0x72f}, {0xb6, 0x2, 0x359}, {0x3, 0xffff0001, 0x1}, {0x80, 0x80, 0x7}, {0x5, 0xffffffff, 0x5}, {0xfffffff7, 0x5, 0x2}, {0x6, 0x8}, {0xfffffffb, 0x1, 0x6}, {0x17, 0x7, 0x8}, {0x8000009, 0x8001}, {0x79c, 0x16, 0x6}, {0x4, 0x4, 0x100}, {0x4, 0x5, 0x6}, {0xfff, 0x8, 0x1}, {0x3, 0x8, 0x1}, {0x1000, 0x0, 0xd7}, {0x578a, 0x4, 0x1}, {0x8001, 0x7f, 0x10001}, {0x3, 0x3, 0x9}, {0x0, 0x5, 0x5}, {0x7, 0x80000001, 0x3}, {0x4000000, 0x1, 0xc}, {0x3, 0x5, 0x6}, {0xb6, 0x6, 0x5}, {0x729a7fe5, 0x20, 0x10001}, {0x3, 0x6, 0x441}, {0x7f, 0x0, 0x8092}, {0x4, 0xff, 0x7ff}, {0x800, 0xf4, 0x5}, {0x7, 0x4, 0x1}, {0x80000001, 0x400, 0x5}, {0xd63d, 0x12c, 0x200}, {0x4, 0x6, 0x8}, {0x80000001, 0x1, 0x400}]}) r4 = getuid() statx(r0, &(0x7f0000000100)='./file0\x00', 0x0, 0xfff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r6, 0x0, 0x0) lseek(r6, 0xe7, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0}, &(0x7f00000002c0)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@local}}, &(0x7f0000000400)=0xe8) fsetxattr$system_posix_acl(r3, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1, r4}, {0x2, 0x5, r5}, {0x2, 0x1, r7}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4, r8}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) 09:15:07 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x9, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 375.355994][T23705] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 375.389868][T23705] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:15:07 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r3, 0xc0105502, &(0x7f0000000880)=@urb_type_iso={0x0, {0xe, 0x1}, 0x1f, 0x64, &(0x7f0000000600)="ec2693f8d831dbe5cc836fe6027502a97350315f29f2f719e88eec35e5f7af42a1586e003dc7de3dbeff0148ec90e017d00737ad272a427de5b4bf53a3e5859facf1633542a9f3b63ea983860d37b83fa695155b65a1c90b120e06e5826e27d62beb591afd8c45500c247aad786f9525c7e967352776084fcd545ab6ade3fd0bfeb015780ac2b3f5eef66420509cd1b3618962fa5bc99c2ad5a9199d82", 0x9d, 0x4, 0x2, 0x43, 0x3, 0x2, &(0x7f00000006c0)="cac456b038014fc907a4dbe3c0d7766bf9b83128d037a7a94d8b84865bb5af74dea9979507e8be62de3c3a8dbc578f6856025de1095005672ba0d74bf582d1122d46c2d0b20a47f760d8ce3c5bbab0a5004474bb0a1ae80b443157e45f06671f06ffa3bfaa4ed74c5d7bae16e49fc5287069abf00546e0ed398cb100d9e28bc0bd86772c685537307d31ea47c76112abc4c70c21f28e56cace1663621b18539ae3a18ae01184d8bec374fcc18666e10be7af545c1a7864d0a1cf7e03e87e505a490674efcafc83b768c9ac4d6d94684d28b0d550d3f0d71109c99ea7cfa946b1443d4fc36a771e442eee34e0799a4ab457a5185e411a", [{0xdb04, 0x8, 0x7}, {0x8, 0x4}, {0x400, 0x0, 0xffffff00}, {0x7, 0x4, 0x1}, {0x5, 0x2, 0x2}, {0x40, 0xfffff526}, {0x3, 0x7, 0x4}, {0x8001, 0x4, 0xffffffe1}, {0x4, 0x8001, 0x2}, {0x2, 0x400, 0x4}, {0x80000000, 0x5, 0x8}, {0x6, 0x0, 0x74a}, {0x80000000, 0x6, 0x80000001}, {0x1, 0x40, 0x5}, {0x6, 0x9, 0x7ff}, {0x6, 0x1, 0x4}, {0x4, 0x7fff, 0x400}, {0x2, 0x1, 0x1}, {0xfffffe00, 0x48, 0x8}, {0x5, 0x3ff, 0x4}, {0x2, 0x200, 0x8001}, {0x0, 0x1, 0x8}, {0xaadf, 0x7, 0x1ff}, {0x7, 0x8, 0x4}, {0x2, 0x6, 0x7ff}, {0x2, 0x399, 0x4851}, {0x80000000, 0xb186, 0x7f}, {0x5, 0x1000, 0x1}, {0xea, 0x9}, {0x0, 0x800, 0x6}, {0x9, 0x5, 0x7fff}, {0x0, 0x861, 0x3f}, {0x8001, 0x7, 0x9}, {0x8, 0x400, 0x72f}, {0xb6, 0x2, 0x359}, {0x3, 0xffff0001, 0x1}, {0x80, 0x80, 0x7}, {0x5, 0xffffffff, 0x5}, {0xfffffff7, 0x5, 0x2}, {0x6, 0x8}, {0xfffffffb, 0x1, 0x6}, {0x17, 0x7, 0x8}, {0x8000009, 0x8001}, {0x79c, 0x16, 0x6}, {0x4, 0x4, 0x100}, {0x4, 0x5, 0x6}, {0xfff, 0x8, 0x1}, {0x3, 0x8, 0x1}, {0x1000, 0x0, 0xd7}, {0x578a, 0x4, 0x1}, {0x8001, 0x7f, 0x10001}, {0x3, 0x3, 0x9}, {0x0, 0x5, 0x5}, {0x7, 0x80000001, 0x3}, {0x4000000, 0x1, 0xc}, {0x3, 0x5, 0x6}, {0xb6, 0x6, 0x5}, {0x729a7fe5, 0x20, 0x10001}, {0x3, 0x6, 0x441}, {0x7f, 0x0, 0x8092}, {0x4, 0xff, 0x7ff}, {0x800, 0xf4, 0x5}, {0x7, 0x4, 0x1}, {0x80000001, 0x400, 0x5}, {0xd63d, 0x12c, 0x200}, {0x4, 0x6, 0x8}, {0x80000001, 0x1, 0x400}]}) r4 = getuid() statx(r0, &(0x7f0000000100)='./file0\x00', 0x0, 0xfff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r6, 0x0, 0x0) lseek(r6, 0xe7, 0x0) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000140)={0x0, 0x0}, &(0x7f00000002c0)=0xc) fsetxattr$system_posix_acl(r3, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1, r4}, {0x2, 0x5, r5}, {0x2, 0x1, r7}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) 09:15:07 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x10, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:15:07 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r3, 0xc0105502, &(0x7f0000000880)=@urb_type_iso={0x0, {0xe, 0x1}, 0x1f, 0x64, &(0x7f0000000600)="ec2693f8d831dbe5cc836fe6027502a97350315f29f2f719e88eec35e5f7af42a1586e003dc7de3dbeff0148ec90e017d00737ad272a427de5b4bf53a3e5859facf1633542a9f3b63ea983860d37b83fa695155b65a1c90b120e06e5826e27d62beb591afd8c45500c247aad786f9525c7e967352776084fcd545ab6ade3fd0bfeb015780ac2b3f5eef66420509cd1b3618962fa5bc99c2ad5a9199d82", 0x9d, 0x4, 0x2, 0x43, 0x3, 0x2, &(0x7f00000006c0)="cac456b038014fc907a4dbe3c0d7766bf9b83128d037a7a94d8b84865bb5af74dea9979507e8be62de3c3a8dbc578f6856025de1095005672ba0d74bf582d1122d46c2d0b20a47f760d8ce3c5bbab0a5004474bb0a1ae80b443157e45f06671f06ffa3bfaa4ed74c5d7bae16e49fc5287069abf00546e0ed398cb100d9e28bc0bd86772c685537307d31ea47c76112abc4c70c21f28e56cace1663621b18539ae3a18ae01184d8bec374fcc18666e10be7af545c1a7864d0a1cf7e03e87e505a490674efcafc83b768c9ac4d6d94684d28b0d550d3f0d71109c99ea7cfa946b1443d4fc36a771e442eee34e0799a4ab457a5185e411a", [{0xdb04, 0x8, 0x7}, {0x8, 0x4}, {0x400, 0x0, 0xffffff00}, {0x7, 0x4, 0x1}, {0x5, 0x2, 0x2}, {0x40, 0xfffff526}, {0x3, 0x7, 0x4}, {0x8001, 0x4, 0xffffffe1}, {0x4, 0x8001, 0x2}, {0x2, 0x400, 0x4}, {0x80000000, 0x5, 0x8}, {0x6, 0x0, 0x74a}, {0x80000000, 0x6, 0x80000001}, {0x1, 0x40, 0x5}, {0x6, 0x9, 0x7ff}, {0x6, 0x1, 0x4}, {0x4, 0x7fff, 0x400}, {0x2, 0x1, 0x1}, {0xfffffe00, 0x48, 0x8}, {0x5, 0x3ff, 0x4}, {0x2, 0x200, 0x8001}, {0x0, 0x1, 0x8}, {0xaadf, 0x7, 0x1ff}, {0x7, 0x8, 0x4}, {0x2, 0x6, 0x7ff}, {0x2, 0x399, 0x4851}, {0x80000000, 0xb186, 0x7f}, {0x5, 0x1000, 0x1}, {0xea, 0x9}, {0x0, 0x800, 0x6}, {0x9, 0x5, 0x7fff}, {0x0, 0x861, 0x3f}, {0x8001, 0x7, 0x9}, {0x8, 0x400, 0x72f}, {0xb6, 0x2, 0x359}, {0x3, 0xffff0001, 0x1}, {0x80, 0x80, 0x7}, {0x5, 0xffffffff, 0x5}, {0xfffffff7, 0x5, 0x2}, {0x6, 0x8}, {0xfffffffb, 0x1, 0x6}, {0x17, 0x7, 0x8}, {0x8000009, 0x8001}, {0x79c, 0x16, 0x6}, {0x4, 0x4, 0x100}, {0x4, 0x5, 0x6}, {0xfff, 0x8, 0x1}, {0x3, 0x8, 0x1}, {0x1000, 0x0, 0xd7}, {0x578a, 0x4, 0x1}, {0x8001, 0x7f, 0x10001}, {0x3, 0x3, 0x9}, {0x0, 0x5, 0x5}, {0x7, 0x80000001, 0x3}, {0x4000000, 0x1, 0xc}, {0x3, 0x5, 0x6}, {0xb6, 0x6, 0x5}, {0x729a7fe5, 0x20, 0x10001}, {0x3, 0x6, 0x441}, {0x7f, 0x0, 0x8092}, {0x4, 0xff, 0x7ff}, {0x800, 0xf4, 0x5}, {0x7, 0x4, 0x1}, {0x80000001, 0x400, 0x5}, {0xd63d, 0x12c, 0x200}, {0x4, 0x6, 0x8}, {0x80000001, 0x1, 0x400}]}) r4 = getuid() statx(r0, &(0x7f0000000100)='./file0\x00', 0x0, 0xfff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r6, 0x0, 0x0) lseek(r6, 0xe7, 0x0) fsetxattr$system_posix_acl(r3, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1, r4}, {0x2, 0x5, r5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) 09:15:07 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x3c03, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:15:07 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0xa, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 375.576792][T23717] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 375.607685][T23717] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:15:07 executing program 0: unshare(0x44000600) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x400, 0x0) accept$unix(r0, &(0x7f0000000040)=@abs, &(0x7f00000000c0)=0x6e) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, 0x0) 09:15:07 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r3, 0xc0105502, &(0x7f0000000880)=@urb_type_iso={0x0, {0xe, 0x1}, 0x1f, 0x64, &(0x7f0000000600)="ec2693f8d831dbe5cc836fe6027502a97350315f29f2f719e88eec35e5f7af42a1586e003dc7de3dbeff0148ec90e017d00737ad272a427de5b4bf53a3e5859facf1633542a9f3b63ea983860d37b83fa695155b65a1c90b120e06e5826e27d62beb591afd8c45500c247aad786f9525c7e967352776084fcd545ab6ade3fd0bfeb015780ac2b3f5eef66420509cd1b3618962fa5bc99c2ad5a9199d82", 0x9d, 0x4, 0x2, 0x43, 0x3, 0x2, &(0x7f00000006c0)="cac456b038014fc907a4dbe3c0d7766bf9b83128d037a7a94d8b84865bb5af74dea9979507e8be62de3c3a8dbc578f6856025de1095005672ba0d74bf582d1122d46c2d0b20a47f760d8ce3c5bbab0a5004474bb0a1ae80b443157e45f06671f06ffa3bfaa4ed74c5d7bae16e49fc5287069abf00546e0ed398cb100d9e28bc0bd86772c685537307d31ea47c76112abc4c70c21f28e56cace1663621b18539ae3a18ae01184d8bec374fcc18666e10be7af545c1a7864d0a1cf7e03e87e505a490674efcafc83b768c9ac4d6d94684d28b0d550d3f0d71109c99ea7cfa946b1443d4fc36a771e442eee34e0799a4ab457a5185e411a", [{0xdb04, 0x8, 0x7}, {0x8, 0x4}, {0x400, 0x0, 0xffffff00}, {0x7, 0x4, 0x1}, {0x5, 0x2, 0x2}, {0x40, 0xfffff526}, {0x3, 0x7, 0x4}, {0x8001, 0x4, 0xffffffe1}, {0x4, 0x8001, 0x2}, {0x2, 0x400, 0x4}, {0x80000000, 0x5, 0x8}, {0x6, 0x0, 0x74a}, {0x80000000, 0x6, 0x80000001}, {0x1, 0x40, 0x5}, {0x6, 0x9, 0x7ff}, {0x6, 0x1, 0x4}, {0x4, 0x7fff, 0x400}, {0x2, 0x1, 0x1}, {0xfffffe00, 0x48, 0x8}, {0x5, 0x3ff, 0x4}, {0x2, 0x200, 0x8001}, {0x0, 0x1, 0x8}, {0xaadf, 0x7, 0x1ff}, {0x7, 0x8, 0x4}, {0x2, 0x6, 0x7ff}, {0x2, 0x399, 0x4851}, {0x80000000, 0xb186, 0x7f}, {0x5, 0x1000, 0x1}, {0xea, 0x9}, {0x0, 0x800, 0x6}, {0x9, 0x5, 0x7fff}, {0x0, 0x861, 0x3f}, {0x8001, 0x7, 0x9}, {0x8, 0x400, 0x72f}, {0xb6, 0x2, 0x359}, {0x3, 0xffff0001, 0x1}, {0x80, 0x80, 0x7}, {0x5, 0xffffffff, 0x5}, {0xfffffff7, 0x5, 0x2}, {0x6, 0x8}, {0xfffffffb, 0x1, 0x6}, {0x17, 0x7, 0x8}, {0x8000009, 0x8001}, {0x79c, 0x16, 0x6}, {0x4, 0x4, 0x100}, {0x4, 0x5, 0x6}, {0xfff, 0x8, 0x1}, {0x3, 0x8, 0x1}, {0x1000, 0x0, 0xd7}, {0x578a, 0x4, 0x1}, {0x8001, 0x7f, 0x10001}, {0x3, 0x3, 0x9}, {0x0, 0x5, 0x5}, {0x7, 0x80000001, 0x3}, {0x4000000, 0x1, 0xc}, {0x3, 0x5, 0x6}, {0xb6, 0x6, 0x5}, {0x729a7fe5, 0x20, 0x10001}, {0x3, 0x6, 0x441}, {0x7f, 0x0, 0x8092}, {0x4, 0xff, 0x7ff}, {0x800, 0xf4, 0x5}, {0x7, 0x4, 0x1}, {0x80000001, 0x400, 0x5}, {0xd63d, 0x12c, 0x200}, {0x4, 0x6, 0x8}, {0x80000001, 0x1, 0x400}]}) r4 = getuid() statx(r0, &(0x7f0000000100)='./file0\x00', 0x0, 0xfff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r6, 0x0, 0x0) fsetxattr$system_posix_acl(r3, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1, r4}, {0x2, 0x5, r5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) [ 375.685264][T23722] tipc: Started in network mode [ 375.691887][T23722] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 375.701623][T23722] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 375.717483][T23722] tipc: Enabled bearer , priority 10 [ 375.752616][ T1938] tipc: Disabling bearer [ 375.757998][ T1938] tipc: Left network mode [ 375.769549][ T1938] tipc: Disabling bearer [ 375.786755][ T1938] tipc: Left network mode [ 375.810785][T23725] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 375.820157][T23725] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:15:08 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0xb, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:15:08 executing program 0: unshare(0x44000600) r0 = add_key$keyring(&(0x7f00000005c0)='keyring\x00', &(0x7f0000000600)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, &(0x7f0000000380)='asymmetric\x00', &(0x7f0000000100)=@chain={'key_or_keyring:', 0x0, ':chain\x00'}) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r0, 0x0, 0x0) r1 = request_key(&(0x7f0000000000)='pkcs7_test\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000000c0)='%\\\x00', r0) r2 = add_key(&(0x7f0000000100)='id_resolver\x00', &(0x7f0000000140)={'syz', 0x1}, &(0x7f0000000180)="bbeb84bf338fd08f5f1cdcf13a43fe240509b9b8f67e6f3c1df36059b91cba82af50cc1e557edd2ef89ef24912", 0x2d, 0xfffffffffffffff8) r3 = add_key$keyring(&(0x7f00000005c0)='keyring\x00', &(0x7f0000000600)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) prctl$PR_CAPBSET_DROP(0x18, 0x12) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, &(0x7f0000000380)='asymmetric\x00', &(0x7f0000000100)=@chain={'key_or_keyring:', 0x0, ':chain\x00'}) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r3, 0x0, 0x0) r4 = add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000200)={'syz', 0x0}, 0x0, 0x0, r3) keyctl$KEYCTL_MOVE(0x1e, r1, r2, r4, 0x0) getpid() r5 = syz_open_dev$usbfs(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x90c, 0x24043) ioctl$USBDEVFS_REAPURBNDELAY(r5, 0x4008550d, 0x0) r6 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$LOOP_GET_STATUS64(r6, 0x4c05, &(0x7f0000000280)) 09:15:08 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x11, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:15:08 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r3, 0xc0105502, &(0x7f0000000880)=@urb_type_iso={0x0, {0xe, 0x1}, 0x1f, 0x64, &(0x7f0000000600)="ec2693f8d831dbe5cc836fe6027502a97350315f29f2f719e88eec35e5f7af42a1586e003dc7de3dbeff0148ec90e017d00737ad272a427de5b4bf53a3e5859facf1633542a9f3b63ea983860d37b83fa695155b65a1c90b120e06e5826e27d62beb591afd8c45500c247aad786f9525c7e967352776084fcd545ab6ade3fd0bfeb015780ac2b3f5eef66420509cd1b3618962fa5bc99c2ad5a9199d82", 0x9d, 0x4, 0x2, 0x43, 0x3, 0x2, &(0x7f00000006c0)="cac456b038014fc907a4dbe3c0d7766bf9b83128d037a7a94d8b84865bb5af74dea9979507e8be62de3c3a8dbc578f6856025de1095005672ba0d74bf582d1122d46c2d0b20a47f760d8ce3c5bbab0a5004474bb0a1ae80b443157e45f06671f06ffa3bfaa4ed74c5d7bae16e49fc5287069abf00546e0ed398cb100d9e28bc0bd86772c685537307d31ea47c76112abc4c70c21f28e56cace1663621b18539ae3a18ae01184d8bec374fcc18666e10be7af545c1a7864d0a1cf7e03e87e505a490674efcafc83b768c9ac4d6d94684d28b0d550d3f0d71109c99ea7cfa946b1443d4fc36a771e442eee34e0799a4ab457a5185e411a", [{0xdb04, 0x8, 0x7}, {0x8, 0x4}, {0x400, 0x0, 0xffffff00}, {0x7, 0x4, 0x1}, {0x5, 0x2, 0x2}, {0x40, 0xfffff526}, {0x3, 0x7, 0x4}, {0x8001, 0x4, 0xffffffe1}, {0x4, 0x8001, 0x2}, {0x2, 0x400, 0x4}, {0x80000000, 0x5, 0x8}, {0x6, 0x0, 0x74a}, {0x80000000, 0x6, 0x80000001}, {0x1, 0x40, 0x5}, {0x6, 0x9, 0x7ff}, {0x6, 0x1, 0x4}, {0x4, 0x7fff, 0x400}, {0x2, 0x1, 0x1}, {0xfffffe00, 0x48, 0x8}, {0x5, 0x3ff, 0x4}, {0x2, 0x200, 0x8001}, {0x0, 0x1, 0x8}, {0xaadf, 0x7, 0x1ff}, {0x7, 0x8, 0x4}, {0x2, 0x6, 0x7ff}, {0x2, 0x399, 0x4851}, {0x80000000, 0xb186, 0x7f}, {0x5, 0x1000, 0x1}, {0xea, 0x9}, {0x0, 0x800, 0x6}, {0x9, 0x5, 0x7fff}, {0x0, 0x861, 0x3f}, {0x8001, 0x7, 0x9}, {0x8, 0x400, 0x72f}, {0xb6, 0x2, 0x359}, {0x3, 0xffff0001, 0x1}, {0x80, 0x80, 0x7}, {0x5, 0xffffffff, 0x5}, {0xfffffff7, 0x5, 0x2}, {0x6, 0x8}, {0xfffffffb, 0x1, 0x6}, {0x17, 0x7, 0x8}, {0x8000009, 0x8001}, {0x79c, 0x16, 0x6}, {0x4, 0x4, 0x100}, {0x4, 0x5, 0x6}, {0xfff, 0x8, 0x1}, {0x3, 0x8, 0x1}, {0x1000, 0x0, 0xd7}, {0x578a, 0x4, 0x1}, {0x8001, 0x7f, 0x10001}, {0x3, 0x3, 0x9}, {0x0, 0x5, 0x5}, {0x7, 0x80000001, 0x3}, {0x4000000, 0x1, 0xc}, {0x3, 0x5, 0x6}, {0xb6, 0x6, 0x5}, {0x729a7fe5, 0x20, 0x10001}, {0x3, 0x6, 0x441}, {0x7f, 0x0, 0x8092}, {0x4, 0xff, 0x7ff}, {0x800, 0xf4, 0x5}, {0x7, 0x4, 0x1}, {0x80000001, 0x400, 0x5}, {0xd63d, 0x12c, 0x200}, {0x4, 0x6, 0x8}, {0x80000001, 0x1, 0x400}]}) r4 = getuid() statx(r0, &(0x7f0000000100)='./file0\x00', 0x0, 0xfff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) fsetxattr$system_posix_acl(r3, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1, r4}, {0x2, 0x5, r5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) 09:15:08 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x28090a) [ 376.193728][T23691] FAT-fs (loop5): FAT read failed (blocknr 63) [ 376.202833][T23698] FAT-fs (loop5): FAT read failed (blocknr 63) [ 376.209326][T23698] FAT-fs (loop5): FAT read failed (blocknr 63) [ 376.215785][T23735] FAT-fs (loop5): FAT read failed (blocknr 63) [ 376.223387][T23735] FAT-fs (loop5): FAT read failed (blocknr 63) 09:15:08 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r1) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) r3 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r3, 0xc0105502, &(0x7f0000000880)=@urb_type_iso={0x0, {0xe, 0x1}, 0x1f, 0x64, &(0x7f0000000600)="ec2693f8d831dbe5cc836fe6027502a97350315f29f2f719e88eec35e5f7af42a1586e003dc7de3dbeff0148ec90e017d00737ad272a427de5b4bf53a3e5859facf1633542a9f3b63ea983860d37b83fa695155b65a1c90b120e06e5826e27d62beb591afd8c45500c247aad786f9525c7e967352776084fcd545ab6ade3fd0bfeb015780ac2b3f5eef66420509cd1b3618962fa5bc99c2ad5a9199d82", 0x9d, 0x4, 0x2, 0x43, 0x3, 0x2, &(0x7f00000006c0)="cac456b038014fc907a4dbe3c0d7766bf9b83128d037a7a94d8b84865bb5af74dea9979507e8be62de3c3a8dbc578f6856025de1095005672ba0d74bf582d1122d46c2d0b20a47f760d8ce3c5bbab0a5004474bb0a1ae80b443157e45f06671f06ffa3bfaa4ed74c5d7bae16e49fc5287069abf00546e0ed398cb100d9e28bc0bd86772c685537307d31ea47c76112abc4c70c21f28e56cace1663621b18539ae3a18ae01184d8bec374fcc18666e10be7af545c1a7864d0a1cf7e03e87e505a490674efcafc83b768c9ac4d6d94684d28b0d550d3f0d71109c99ea7cfa946b1443d4fc36a771e442eee34e0799a4ab457a5185e411a", [{0xdb04, 0x8, 0x7}, {0x8, 0x4}, {0x400, 0x0, 0xffffff00}, {0x7, 0x4, 0x1}, {0x5, 0x2, 0x2}, {0x40, 0xfffff526}, {0x3, 0x7, 0x4}, {0x8001, 0x4, 0xffffffe1}, {0x4, 0x8001, 0x2}, {0x2, 0x400, 0x4}, {0x80000000, 0x5, 0x8}, {0x6, 0x0, 0x74a}, {0x80000000, 0x6, 0x80000001}, {0x1, 0x40, 0x5}, {0x6, 0x9, 0x7ff}, {0x6, 0x1, 0x4}, {0x4, 0x7fff, 0x400}, {0x2, 0x1, 0x1}, {0xfffffe00, 0x48, 0x8}, {0x5, 0x3ff, 0x4}, {0x2, 0x200, 0x8001}, {0x0, 0x1, 0x8}, {0xaadf, 0x7, 0x1ff}, {0x7, 0x8, 0x4}, {0x2, 0x6, 0x7ff}, {0x2, 0x399, 0x4851}, {0x80000000, 0xb186, 0x7f}, {0x5, 0x1000, 0x1}, {0xea, 0x9}, {0x0, 0x800, 0x6}, {0x9, 0x5, 0x7fff}, {0x0, 0x861, 0x3f}, {0x8001, 0x7, 0x9}, {0x8, 0x400, 0x72f}, {0xb6, 0x2, 0x359}, {0x3, 0xffff0001, 0x1}, {0x80, 0x80, 0x7}, {0x5, 0xffffffff, 0x5}, {0xfffffff7, 0x5, 0x2}, {0x6, 0x8}, {0xfffffffb, 0x1, 0x6}, {0x17, 0x7, 0x8}, {0x8000009, 0x8001}, {0x79c, 0x16, 0x6}, {0x4, 0x4, 0x100}, {0x4, 0x5, 0x6}, {0xfff, 0x8, 0x1}, {0x3, 0x8, 0x1}, {0x1000, 0x0, 0xd7}, {0x578a, 0x4, 0x1}, {0x8001, 0x7f, 0x10001}, {0x3, 0x3, 0x9}, {0x0, 0x5, 0x5}, {0x7, 0x80000001, 0x3}, {0x4000000, 0x1, 0xc}, {0x3, 0x5, 0x6}, {0xb6, 0x6, 0x5}, {0x729a7fe5, 0x20, 0x10001}, {0x3, 0x6, 0x441}, {0x7f, 0x0, 0x8092}, {0x4, 0xff, 0x7ff}, {0x800, 0xf4, 0x5}, {0x7, 0x4, 0x1}, {0x80000001, 0x400, 0x5}, {0xd63d, 0x12c, 0x200}, {0x4, 0x6, 0x8}, {0x80000001, 0x1, 0x400}]}) r4 = getuid() statx(r0, &(0x7f0000000100)='./file0\x00', 0x0, 0xfff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r3, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1, r4}, {0x2, 0x5, r5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) 09:15:08 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r0) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) r2 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r2, 0xc0105502, &(0x7f0000000880)=@urb_type_iso={0x0, {0xe, 0x1}, 0x1f, 0x64, &(0x7f0000000600)="ec2693f8d831dbe5cc836fe6027502a97350315f29f2f719e88eec35e5f7af42a1586e003dc7de3dbeff0148ec90e017d00737ad272a427de5b4bf53a3e5859facf1633542a9f3b63ea983860d37b83fa695155b65a1c90b120e06e5826e27d62beb591afd8c45500c247aad786f9525c7e967352776084fcd545ab6ade3fd0bfeb015780ac2b3f5eef66420509cd1b3618962fa5bc99c2ad5a9199d82", 0x9d, 0x4, 0x2, 0x43, 0x3, 0x2, &(0x7f00000006c0)="cac456b038014fc907a4dbe3c0d7766bf9b83128d037a7a94d8b84865bb5af74dea9979507e8be62de3c3a8dbc578f6856025de1095005672ba0d74bf582d1122d46c2d0b20a47f760d8ce3c5bbab0a5004474bb0a1ae80b443157e45f06671f06ffa3bfaa4ed74c5d7bae16e49fc5287069abf00546e0ed398cb100d9e28bc0bd86772c685537307d31ea47c76112abc4c70c21f28e56cace1663621b18539ae3a18ae01184d8bec374fcc18666e10be7af545c1a7864d0a1cf7e03e87e505a490674efcafc83b768c9ac4d6d94684d28b0d550d3f0d71109c99ea7cfa946b1443d4fc36a771e442eee34e0799a4ab457a5185e411a", [{0xdb04, 0x8, 0x7}, {0x8, 0x4}, {0x400, 0x0, 0xffffff00}, {0x7, 0x4, 0x1}, {0x5, 0x2, 0x2}, {0x40, 0xfffff526}, {0x3, 0x7, 0x4}, {0x8001, 0x4, 0xffffffe1}, {0x4, 0x8001, 0x2}, {0x2, 0x400, 0x4}, {0x80000000, 0x5, 0x8}, {0x6, 0x0, 0x74a}, {0x80000000, 0x6, 0x80000001}, {0x1, 0x40, 0x5}, {0x6, 0x9, 0x7ff}, {0x6, 0x1, 0x4}, {0x4, 0x7fff, 0x400}, {0x2, 0x1, 0x1}, {0xfffffe00, 0x48, 0x8}, {0x5, 0x3ff, 0x4}, {0x2, 0x200, 0x8001}, {0x0, 0x1, 0x8}, {0xaadf, 0x7, 0x1ff}, {0x7, 0x8, 0x4}, {0x2, 0x6, 0x7ff}, {0x2, 0x399, 0x4851}, {0x80000000, 0xb186, 0x7f}, {0x5, 0x1000, 0x1}, {0xea, 0x9}, {0x0, 0x800, 0x6}, {0x9, 0x5, 0x7fff}, {0x0, 0x861, 0x3f}, {0x8001, 0x7, 0x9}, {0x8, 0x400, 0x72f}, {0xb6, 0x2, 0x359}, {0x3, 0xffff0001, 0x1}, {0x80, 0x80, 0x7}, {0x5, 0xffffffff, 0x5}, {0xfffffff7, 0x5, 0x2}, {0x6, 0x8}, {0xfffffffb, 0x1, 0x6}, {0x17, 0x7, 0x8}, {0x8000009, 0x8001}, {0x79c, 0x16, 0x6}, {0x4, 0x4, 0x100}, {0x4, 0x5, 0x6}, {0xfff, 0x8, 0x1}, {0x3, 0x8, 0x1}, {0x1000, 0x0, 0xd7}, {0x578a, 0x4, 0x1}, {0x8001, 0x7f, 0x10001}, {0x3, 0x3, 0x9}, {0x0, 0x5, 0x5}, {0x7, 0x80000001, 0x3}, {0x4000000, 0x1, 0xc}, {0x3, 0x5, 0x6}, {0xb6, 0x6, 0x5}, {0x729a7fe5, 0x20, 0x10001}, {0x3, 0x6, 0x441}, {0x7f, 0x0, 0x8092}, {0x4, 0xff, 0x7ff}, {0x800, 0xf4, 0x5}, {0x7, 0x4, 0x1}, {0x80000001, 0x400, 0x5}, {0xd63d, 0x12c, 0x200}, {0x4, 0x6, 0x8}, {0x80000001, 0x1, 0x400}]}) r3 = getuid() fsetxattr$system_posix_acl(r2, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1, r3}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) 09:15:08 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x6, 0xc2380) ioctl$USBDEVFS_CLAIMINTERFACE(0xffffffffffffffff, 0x8004550f, &(0x7f0000000040)=0x100) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) [ 376.243303][ T1959] attempt to access beyond end of device [ 376.250096][ T1959] loop5: rw=1, want=63513, limit=63 [ 376.259694][T23742] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 376.269710][T23742] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 376.380728][T23758] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 376.389432][T23758] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:15:08 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x3f00, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:15:08 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x9389, 0x8200) write$selinux_attr(0xffffffffffffffff, &(0x7f0000000080)='system_u:object_r:unconfined_execmem_exec_t:s0\x00', 0x2f) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r1, 0x0, 0x0) lseek(r1, 0xe7, 0x0) getpeername$netlink(r1, &(0x7f0000000000), &(0x7f0000000040)=0xc) 09:15:08 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r0) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) r2 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r2, 0xc0105502, &(0x7f0000000880)=@urb_type_iso={0x0, {0xe, 0x1}, 0x1f, 0x64, &(0x7f0000000600)="ec2693f8d831dbe5cc836fe6027502a97350315f29f2f719e88eec35e5f7af42a1586e003dc7de3dbeff0148ec90e017d00737ad272a427de5b4bf53a3e5859facf1633542a9f3b63ea983860d37b83fa695155b65a1c90b120e06e5826e27d62beb591afd8c45500c247aad786f9525c7e967352776084fcd545ab6ade3fd0bfeb015780ac2b3f5eef66420509cd1b3618962fa5bc99c2ad5a9199d82", 0x9d, 0x4, 0x2, 0x43, 0x3, 0x2, &(0x7f00000006c0)="cac456b038014fc907a4dbe3c0d7766bf9b83128d037a7a94d8b84865bb5af74dea9979507e8be62de3c3a8dbc578f6856025de1095005672ba0d74bf582d1122d46c2d0b20a47f760d8ce3c5bbab0a5004474bb0a1ae80b443157e45f06671f06ffa3bfaa4ed74c5d7bae16e49fc5287069abf00546e0ed398cb100d9e28bc0bd86772c685537307d31ea47c76112abc4c70c21f28e56cace1663621b18539ae3a18ae01184d8bec374fcc18666e10be7af545c1a7864d0a1cf7e03e87e505a490674efcafc83b768c9ac4d6d94684d28b0d550d3f0d71109c99ea7cfa946b1443d4fc36a771e442eee34e0799a4ab457a5185e411a", [{0xdb04, 0x8, 0x7}, {0x8, 0x4}, {0x400, 0x0, 0xffffff00}, {0x7, 0x4, 0x1}, {0x5, 0x2, 0x2}, {0x40, 0xfffff526}, {0x3, 0x7, 0x4}, {0x8001, 0x4, 0xffffffe1}, {0x4, 0x8001, 0x2}, {0x2, 0x400, 0x4}, {0x80000000, 0x5, 0x8}, {0x6, 0x0, 0x74a}, {0x80000000, 0x6, 0x80000001}, {0x1, 0x40, 0x5}, {0x6, 0x9, 0x7ff}, {0x6, 0x1, 0x4}, {0x4, 0x7fff, 0x400}, {0x2, 0x1, 0x1}, {0xfffffe00, 0x48, 0x8}, {0x5, 0x3ff, 0x4}, {0x2, 0x200, 0x8001}, {0x0, 0x1, 0x8}, {0xaadf, 0x7, 0x1ff}, {0x7, 0x8, 0x4}, {0x2, 0x6, 0x7ff}, {0x2, 0x399, 0x4851}, {0x80000000, 0xb186, 0x7f}, {0x5, 0x1000, 0x1}, {0xea, 0x9}, {0x0, 0x800, 0x6}, {0x9, 0x5, 0x7fff}, {0x0, 0x861, 0x3f}, {0x8001, 0x7, 0x9}, {0x8, 0x400, 0x72f}, {0xb6, 0x2, 0x359}, {0x3, 0xffff0001, 0x1}, {0x80, 0x80, 0x7}, {0x5, 0xffffffff, 0x5}, {0xfffffff7, 0x5, 0x2}, {0x6, 0x8}, {0xfffffffb, 0x1, 0x6}, {0x17, 0x7, 0x8}, {0x8000009, 0x8001}, {0x79c, 0x16, 0x6}, {0x4, 0x4, 0x100}, {0x4, 0x5, 0x6}, {0xfff, 0x8, 0x1}, {0x3, 0x8, 0x1}, {0x1000, 0x0, 0xd7}, {0x578a, 0x4, 0x1}, {0x8001, 0x7f, 0x10001}, {0x3, 0x3, 0x9}, {0x0, 0x5, 0x5}, {0x7, 0x80000001, 0x3}, {0x4000000, 0x1, 0xc}, {0x3, 0x5, 0x6}, {0xb6, 0x6, 0x5}, {0x729a7fe5, 0x20, 0x10001}, {0x3, 0x6, 0x441}, {0x7f, 0x0, 0x8092}, {0x4, 0xff, 0x7ff}, {0x800, 0xf4, 0x5}, {0x7, 0x4, 0x1}, {0x80000001, 0x400, 0x5}, {0xd63d, 0x12c, 0x200}, {0x4, 0x6, 0x8}, {0x80000001, 0x1, 0x400}]}) fsetxattr$system_posix_acl(r2, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) 09:15:08 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0xc, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:15:08 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x12, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) [ 376.808377][T23765] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 376.821914][T23765] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 376.829526][T20523] tipc: 32-bit node address hash set to fbff1eac [ 376.875951][T23769] tipc: Enabling of bearer rejected, failed to enable media [ 376.935276][T23773] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 376.959972][T23752] FAT-fs (loop5): FAT read failed (blocknr 63) [ 376.964616][T23773] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:15:09 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x4000, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:15:09 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r0) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) r2 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) fsetxattr$system_posix_acl(r2, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) 09:15:09 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000040)={0x8, &(0x7f0000000000)=[{0x8, 0x3, 0x1, 0x1000}, {0x7f, 0x80, 0x2, 0x2}, {0x6, 0x6, 0x5}, {0x9, 0x0, 0x8c, 0x80000001}, {0x8, 0x8, 0x4}, {0x0, 0x3b, 0x7, 0xd3b}, {0x81, 0x2, 0x8, 0x3}, {0x3f, 0xa4, 0x3f}]}, 0x10) socketpair(0x4, 0x800, 0x40, &(0x7f0000000080)={0xffffffffffffffff}) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r3, 0x0) r4 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r5, 0x0, 0x0) fchown(r1, r3, r5) 09:15:09 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0xd, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:15:09 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x28090b) 09:15:09 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x25, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:15:09 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r0) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) [ 377.194141][T23785] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 377.214390][T23785] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:15:09 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r0) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) 09:15:09 executing program 0: unshare(0x44000600) syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x800, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r0, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) pipe2(&(0x7f0000000040), 0x800) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r1, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x28103, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(r2, 0x4008550d, 0x0) [ 377.243128][T23787] tipc: Started in network mode [ 377.248959][T23787] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 377.258520][T23787] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 377.273283][T23787] tipc: Enabled bearer , priority 10 09:15:09 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r0) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) [ 377.290204][T23797] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 377.313118][T23797] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:15:09 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r0) socket(0x10, 0x3, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) fsetxattr$system_posix_acl(r1, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) 09:15:09 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) close(r0) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) fsetxattr$system_posix_acl(r1, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) [ 377.696310][ T1938] tipc: Disabling bearer [ 377.701812][ T1938] tipc: Left network mode [ 377.898069][T23802] FAT-fs (loop5): FAT read failed (blocknr 63) 09:15:10 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x4203, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:15:10 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0xe, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:15:10 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x48, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:15:10 executing program 0: unshare(0x44000600) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(r0, 0x0, 0x0) lseek(r0, 0xe7, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x2400, 0xffffffff) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r1, 0x4008550d, 0x0) 09:15:10 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r0, &(0x7f00000000c0)=[{&(0x7f0000000180)="77690addcfbe1fbb66ec", 0xff3b}], 0x1, 0x1) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) fsetxattr$system_posix_acl(r1, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) 09:15:10 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x28090c) [ 378.269167][T17006] tipc: 32-bit node address hash set to fbff1eac [ 378.280370][T23823] net_ratelimit: 7 callbacks suppressed [ 378.280375][T23823] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:15:10 executing program 2: pipe(&(0x7f0000000000)) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) 09:15:10 executing program 2: r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) [ 378.399784][T23835] tipc: Enabling of bearer rejected, failed to enable media [ 378.417190][T23831] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 378.425863][T23831] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:15:10 executing program 2: r0 = syz_open_dev$usbfs(0x0, 0x908, 0x1) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) [ 378.448524][T23841] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:15:10 executing program 0: unshare(0x44040000) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x201) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) 09:15:10 executing program 2: r0 = syz_open_dev$usbfs(0x0, 0x908, 0x1) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) 09:15:10 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x4800, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:15:10 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x10, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:15:10 executing program 2: r0 = syz_open_dev$usbfs(0x0, 0x908, 0x1) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) 09:15:10 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x4c, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:15:10 executing program 2: r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x0, 0x1) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) [ 378.621162][ T1938] tipc: Disabling bearer [ 378.626614][ T1938] tipc: Left network mode [ 378.652816][T23859] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:15:10 executing program 2: r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x0, 0x1) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) [ 378.689007][T23862] tipc: Enabling of bearer rejected, failed to enable media [ 378.722753][T23865] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 378.744371][T23867] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 378.761174][T23867] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 378.858335][T23870] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 378.866786][T23870] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 379.079760][T23832] FAT-fs (loop5): FAT read failed (blocknr 63) 09:15:11 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x28090d) 09:15:11 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x4c00, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:15:11 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r1, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$rtc(0xffffffffffffff9c, 0xfffffffffffffffd, 0x0, 0x0) ioctl$FICLONE(r1, 0x40049409, r2) 09:15:11 executing program 2: r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x0, 0x1) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) 09:15:11 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x60, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:15:11 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x11, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:15:11 executing program 2: r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x0) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) [ 379.274567][T23881] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 379.296706][T23878] tipc: Started in network mode [ 379.301826][T23878] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 09:15:11 executing program 2: syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) [ 379.339676][T23878] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 379.357015][T23878] tipc: Enabled bearer , priority 10 [ 379.370515][T23883] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 379.388933][T23883] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 379.412206][T23888] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. 09:15:11 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x12, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:15:11 executing program 2: syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) 09:15:11 executing program 2: syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) [ 379.498634][T23902] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 379.525883][T23904] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready 09:15:11 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x25, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 379.562477][T23904] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 379.637745][T23911] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 379.702078][T23912] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 380.025421][T23890] FAT-fs (loop5): FAT read failed (blocknr 63) 09:15:12 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x28090e) 09:15:12 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x68, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:15:12 executing program 2: r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x0) fsetxattr$system_posix_acl(r0, 0x0, &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) 09:15:12 executing program 0: unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000240)='/dev/bus/usb/00#/00#\x00', 0x909, 0x34041) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x200000, 0x0) r2 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r3, 0x0) r4 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) r6 = socket$key(0xf, 0x3, 0x2) fcntl$notify(r6, 0x402, 0x80000020) setresgid(r5, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='fuse\x00', 0x8000, &(0x7f00000000c0)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {'group_id', 0x3d, r5}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x2}}, {@allow_other='allow_other'}, {@default_permissions='default_permissions'}, {@allow_other='allow_other'}], [{@permit_directio='permit_directio'}, {@fsuuid={'fsuuid', 0x3d, {[0x37, 0x38, 0x39, 0x61, 0x62, 0x36, 0x30, 0x63], 0x2d, [0x38, 0x51, 0x38, 0x34], 0x2d, [0x36, 0x64, 0x3f, 0x33], 0x2d, [0x34, 0xbabb64aa7037971b, 0x31, 0x61], 0x2d, [0x63, 0x62, 0x31, 0x35, 0x33, 0x66, 0x63, 0x65]}}}, {@subj_type={'subj_type', 0x3d, '/dev/bus/usb/00#/00#\x00'}}, {@smackfsroot={'smackfsroot', 0x3d, '/dev/bus/usb/00#/00#\x00'}}, {@appraise_type='appraise_type=imasig'}, {@subj_type={'subj_type', 0x3d, '/dev/bus/usb/00#/00#\x00'}}]}}) 09:15:12 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x48, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:15:12 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x5203, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:15:12 executing program 2: r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x0) fsetxattr$system_posix_acl(r0, 0x0, &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) 09:15:12 executing program 2: r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x0) fsetxattr$system_posix_acl(r0, 0x0, &(0x7f0000000500)={{}, {0x1, 0x1}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) [ 380.229360][T23919] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 380.244637][T23922] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 380.253572][T23922] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:15:12 executing program 2: r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x0) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', 0x0, 0x0, 0x0) 09:15:12 executing program 2: r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x0) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', 0x0, 0x0, 0x0) [ 380.282688][T23923] tipc: Started in network mode [ 380.290020][T23923] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 380.299916][T23923] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 380.308158][T23923] tipc: Enabled bearer , priority 10 09:15:12 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x4c, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:15:12 executing program 0: unshare(0x44000600) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyS3\x00', 0x4000c0, 0x0) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r1 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x1) ioctl$USBDEVFS_SUBMITURB(r1, 0xc0105502, &(0x7f0000000040)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f0000000040)={0xfff, 0xffffffff, 0x6, 0x0, 0x1ff}) [ 380.461168][ T1938] tipc: Disabling bearer [ 380.466600][ T1938] tipc: Left network mode [ 380.915545][T23935] FAT-fs (loop5): FAT read failed (blocknr 63) 09:15:13 executing program 5: prlimit64(0x0, 0xe, &(0x7f0000000280)={0x9, 0x8d}, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x38, 0x2, 0x0, 0x0, 0x3}, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x7fff, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000680)='./bus\x00', 0x0) ftruncate(r1, 0x800) lseek(r1, 0x0, 0x2) r2 = open(&(0x7f0000001840)='./bus\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) sendfile(r1, r2, 0x0, 0x28090f) 09:15:13 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x801, 0x6c, 0x0, {}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) 09:15:13 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x5a02, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:15:13 executing program 2: r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x0) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', 0x0, 0x0, 0x0) 09:15:13 executing program 0: unshare(0x44000600) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/bus/input/devices\x00', 0x0, 0x0) read(0xffffffffffffffff, 0x0, 0x0) lseek(r0, 0xe7, 0x0) ioctl$TIOCSTI(r0, 0x5412, 0x81) ioctl$USBDEVFS_REAPURBNDELAY(0xffffffffffffffff, 0x4008550d, 0x0) 09:15:13 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x60, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) 09:15:13 executing program 2: r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x0) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}, {0x2, 0x4}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x6c, 0x0) 09:15:13 executing program 2: r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x0) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}, {0x2, 0x2}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x64, 0x0) 09:15:13 executing program 0: socket(0x2b, 0xa, 0x4) unshare(0x44000600) r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x0) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0) [ 381.134702][T23967] tipc: Started in network mode [ 381.140432][T23967] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 381.151607][T23967] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 381.161620][T23967] tipc: Enabled bearer , priority 10 [ 381.212325][T23966] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 381.224391][T23966] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 09:15:13 executing program 3: unshare(0x44000600) r0 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f00000002c0)={0x0, 0x5f00, &(0x7f0000000000)={&(0x7f0000000100)={0x6c, r0, 0xc573de0d27bdfe6f, 0x0, 0x0, {}, [@TIPC_NLA_BEARER={0x58, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @initdev={0xac, 0x1e, 0x0, 0x0}}}}, {0x20, 0x2, @in6={0xa, 0x0, 0x0, @remote}}}}]}]}, 0x6c}}, 0x0) 09:15:13 executing program 2: r0 = syz_open_dev$usbfs(&(0x7f0000000840)='/dev/bus/usb/00#/00#\x00', 0x908, 0x0) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000500)={{}, {}, [{0x2, 0x1}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x2, 0xee01}], {0x4, 0x1}, [{0x8, 0x3}, {0x8, 0x4, 0xee01}, {0x8, 0x1, 0xee00}], {0x10, 0x5}, {0x20, 0x6}}, 0x5c, 0x0) 09:15:13 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x11, 0x800000003, 0x0) bind(r3, &(0x7f0000000080)=@generic={0x11, "0000010000000000080044944eeba71a4976e252922cb18f6e2e2aba000000012e0b3836005404b0e0301a4ce875f2e3ff5f163ee340b7679500800000000000000101013c5811039e15775027ecce66fd792bbf0e5bf5ff1b0816f3f6db1c00010000000000000049740000000000000006ad8e5ecc326d3a09ffc2c654"}, 0x80) getsockname$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000140)=0x14) r5 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=@newlink={0x34, 0x10, 0x801, 0x0, 0x0, {0x68, 0x0, 0x0, r4}, [@IFLA_MASTER={0x8, 0x4}, @IFLA_XDP={0xc, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8, 0x1, r5}]}]}, 0x34}}, 0x0) [ 381.273263][T23988] tipc: Started in network mode [ 381.279884][T23988] tipc: Own node identity 00000000000000000000ffffac1e0004, cluster identity 4711 [ 381.304193][T23988] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 381.313747][T23988] tipc: Enabled bearer , priority 10 [ 381.321900][ T1938] tipc: Disabling bearer [ 381.327223][ T1938] tipc: Left network mode [ 381.361597][T23994] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 381.370855][T16995] tipc: 32-bit node address hash set to fbff1eac [ 381.377530][T16995] ================================================================== [ 381.384856][T23994] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 381.385599][T16995] BUG: KASAN: slab-out-of-bounds in tipc_named_reinit+0x1aa/0x360 [ 381.385606][T16995] Read of size 8 at addr ffff8881c505e000 by task kworker/0:9/16995 [ 381.385614][T16995] [ 381.411012][T16995] CPU: 0 PID: 16995 Comm: kworker/0:9 Not tainted 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 381.420955][T16995] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 381.431000][T16995] Workqueue: events tipc_net_finalize_work [ 381.437003][T16995] Call Trace: [ 381.440433][T16995] dump_stack+0x1b0/0x228 [ 381.444858][T16995] ? show_regs_print_info+0x18/0x18 [ 381.450048][T16995] ? vprintk_func+0x105/0x110 [ 381.454717][T16995] ? printk+0xc0/0x109 [ 381.458773][T16995] print_address_description+0x96/0x5d0 [ 381.464304][T16995] ? devkmsg_release+0x127/0x127 [ 381.469240][T16995] ? devkmsg_release+0x127/0x127 [ 381.474243][T16995] ? perf_pmu_sched_task+0x370/0x370 [ 381.479742][T16995] __kasan_report+0x14b/0x1c0 [ 381.484432][T16995] ? _raw_spin_lock_irq+0x110/0x180 [ 381.489661][T16995] ? tipc_named_reinit+0x1aa/0x360 [ 381.494843][T16995] kasan_report+0x26/0x50 [ 381.499166][T16995] __asan_report_load8_noabort+0x14/0x20 [ 381.504838][T16995] tipc_named_reinit+0x1aa/0x360 [ 381.509771][T16995] tipc_net_finalize+0xcb/0x130 [ 381.514615][T16995] tipc_net_finalize_work+0x54/0x80 [ 381.519907][T16995] process_one_work+0x9d8/0x1030 [ 381.524841][T16995] worker_thread+0xbbc/0x1610 [ 381.529503][T16995] kthread+0x31a/0x340 [ 381.533573][T16995] ? process_one_work+0x1030/0x1030 [ 381.538881][T16995] ? kthread_destroy_worker+0x270/0x270 [ 381.544405][T16995] ret_from_fork+0x1f/0x30 [ 381.548798][T16995] [ 381.551106][T16995] Allocated by task 0: [ 381.555145][T16995] (stack is not available) [ 381.560055][T16995] [ 381.562372][T16995] Freed by task 0: [ 381.566631][T16995] (stack is not available) [ 381.571056][T16995] [ 381.573429][T16995] The buggy address belongs to the object at ffff8881c505df80 [ 381.573429][T16995] which belongs to the cache TIPC of size 984 [ 381.586858][T16995] The buggy address is located 128 bytes inside of [ 381.586858][T16995] 984-byte region [ffff8881c505df80, ffff8881c505e358) [ 381.600389][T16995] The buggy address belongs to the page: [ 381.606008][T16995] page:ffffea0007141700 refcount:1 mapcount:0 mapping:ffff8881d70cf400 index:0x0 compound_mapcount: 0 [ 381.616938][T16995] raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881d70cf400 [ 381.625563][T16995] raw: 0000000000000000 00000000800e000e 00000001ffffffff 0000000000000000 [ 381.634744][T16995] page dumped because: kasan: bad access detected [ 381.641145][T16995] [ 381.643456][T16995] Memory state around the buggy address: [ 381.649068][T16995] ffff8881c505df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 381.657319][T16995] ffff8881c505df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 381.665386][T16995] >ffff8881c505e000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 381.673563][T16995] ^ [ 381.677634][T16995] ffff8881c505e080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 381.685696][T16995] ffff8881c505e100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 381.694097][T16995] ================================================================== [ 381.702152][T16995] Disabling lock debugging due to kernel taint [ 381.923092][T16995] kasan: CONFIG_KASAN_INLINE enabled [ 381.936808][T16995] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 381.953879][T16995] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 381.960968][T16995] CPU: 0 PID: 16995 Comm: kworker/0:9 Tainted: G B 5.4.17-syzkaller-00005-g2303d908db80 #0 [ 381.972228][T16995] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 381.982308][T16995] Workqueue: events tipc_net_finalize_work [ 381.988205][T16995] RIP: 0010:__rhashtable_walk_find_next+0x4b5/0x9b0 [ 381.994771][T16995] Code: 00 74 0e 89 cb e8 7b a8 78 ff 89 d9 48 8b 7c 24 78 49 c1 e7 03 4c 03 3f 48 8b 44 24 58 d3 e8 89 44 24 2c 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 4c a8 78 ff 4d 8b 3f 31 ff 4c 89 [ 382.015653][T16995] RSP: 0018:ffff88819cd779e0 EFLAGS: 00010246 [ 382.021703][T16995] RAX: 0000000000000000 RBX: 00000000ffff8881 RCX: 00000000ffff8881 [ 382.029753][T16995] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881c73b0040 [ 382.037856][T16995] RBP: ffff88819cd77b40 R08: ffffffff81f8318d R09: 0000000000000003 [ 382.045904][T16995] R10: ffffed10339aef49 R11: 0000000000000004 R12: ffff8881c505e010 [ 382.054003][T16995] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 382.063103][T16995] FS: 0000000000000000(0000) GS:ffff8881dba00000(0000) knlGS:0000000000000000 [ 382.073918][T16995] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 382.080485][T16995] CR2: 0000000020001840 CR3: 00000001c7890004 CR4: 00000000001606f0 [ 382.088549][T16995] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 382.096624][T16995] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 382.104579][T16995] Call Trace: [ 382.107858][T16995] ? rhashtable_walk_next+0x2e0/0x2e0 [ 382.113219][T16995] ? rhashtable_walk_start_check+0x6fe/0xce0 [ 382.119247][T16995] ? rhashtable_walk_exit+0x1a0/0x1a0 [ 382.124595][T16995] rhashtable_walk_next+0x23b/0x2e0 [ 382.129789][T16995] ? rhashtable_walk_enter+0x18e/0x1a0 [ 382.135759][T16995] tipc_sk_reinit+0x119/0x4a0 [ 382.140502][T16995] ? tipc_sk_lookup+0x5b0/0x5b0 [ 382.145332][T16995] ? tipc_named_reinit+0x1aa/0x360 [ 382.150426][T16995] ? _raw_spin_unlock_bh+0x19/0x20 [ 382.155520][T16995] ? tipc_named_reinit+0x2b5/0x360 [ 382.161000][T16995] tipc_net_finalize+0xd3/0x130 [ 382.165839][T16995] tipc_net_finalize_work+0x54/0x80 [ 382.171017][T16995] process_one_work+0x9d8/0x1030 [ 382.175942][T16995] worker_thread+0xbbc/0x1610 [ 382.180650][T16995] kthread+0x31a/0x340 [ 382.184696][T16995] ? process_one_work+0x1030/0x1030 [ 382.189985][T16995] ? kthread_destroy_worker+0x270/0x270 [ 382.195765][T16995] ret_from_fork+0x1f/0x30 [ 382.200185][T16995] Modules linked in: [ 382.204433][T16995] ---[ end trace 7e2eda9cb19c9b43 ]--- [ 382.209933][T16995] RIP: 0010:__rhashtable_walk_find_next+0x4b5/0x9b0 [ 382.216516][T16995] Code: 00 74 0e 89 cb e8 7b a8 78 ff 89 d9 48 8b 7c 24 78 49 c1 e7 03 4c 03 3f 48 8b 44 24 58 d3 e8 89 44 24 2c 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 4c a8 78 ff 4d 8b 3f 31 ff 4c 89 [ 382.236262][T16995] RSP: 0018:ffff88819cd779e0 EFLAGS: 00010246 [ 382.242341][T16995] RAX: 0000000000000000 RBX: 00000000ffff8881 RCX: 00000000ffff8881 [ 382.250521][T16995] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881c73b0040 [ 382.258489][T16995] RBP: ffff88819cd77b40 R08: ffffffff81f8318d R09: 0000000000000003 [ 382.266500][T16995] R10: ffffed10339aef49 R11: 0000000000000004 R12: ffff8881c505e010 [ 382.274498][T16995] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 382.282506][T16995] FS: 0000000000000000(0000) GS:ffff8881dba00000(0000) knlGS:0000000000000000 [ 382.291460][T16995] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 382.298036][T16995] CR2: 0000000020001840 CR3: 00000001c7890004 CR4: 00000000001606f0 [ 382.308814][T16995] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 382.317451][T16995] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 382.325816][T16995] Kernel panic - not syncing: Fatal exception [ 382.332820][T16995] Kernel Offset: disabled [ 382.337282][T16995] Rebooting in 86400 seconds..