last executing test programs: 5.956362659s ago: executing program 4 (id=2200): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="01072cbd7000fcdbdf", @ANYRES32], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) 5.759519567s ago: executing program 4 (id=2203): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000280)=@tipc=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}, 0x2}}, 0x80, 0x0}, 0x20000800) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0xca02}) r0 = socket$netlink(0x10, 0x3, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f00000000c0)=""/4, 0x4}], 0x3bc, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) 5.357061727s ago: executing program 3 (id=2208): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r3) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r5) socket$unix(0x1, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 5.355583658s ago: executing program 0 (id=2209): r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r0, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) listen(r0, 0xda90) setsockopt$inet_opts(r0, 0x0, 0x4, 0x0, 0x0) accept4(r0, 0x0, 0x0, 0x0) 5.229437723s ago: executing program 4 (id=2212): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1342, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r0, &(0x7f0000000340)=[{&(0x7f00000002c0)="89e7ee0c7cdad9b4b47380c988cafb", 0x140}, {&(0x7f0000000440)="448b7c0acf8bc0cefe8360fcbe079c", 0xf}], 0x2) 5.122314314s ago: executing program 2 (id=2213): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB="38010000100033062cbd700000000000fc020000000000000000000000000000ac1414aa0000000000000000000000000000000900000008000000203a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="e0000002000000000000000000000000fffffffd32000000000000000000000000000000000000000700000000000000fcffffffffffffff000000000000000009000000000000000300"/94], 0x138}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}}, 0x29) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x4, 0x0, 0xfffffffffffffffc, 0x0, 0x6}, {0x0, 0x0, 0x400000000}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x0, 0x32}, 0x0, @in=@private=0xa010101, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) write(r1, 0x0, 0x0) 4.318866263s ago: executing program 3 (id=2215): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000000)={0x18, 0x0, {0x3, @remote, 'ip6_vti0\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r1, 0x80047437, &(0x7f0000000040)) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r2, 0x40047438, &(0x7f0000000040)) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f00000000c0)) readv(r0, &(0x7f0000002780)=[{&(0x7f0000000440)=""/125, 0x7d}], 0x1) 4.297798927s ago: executing program 0 (id=2216): bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x1e, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f66f63bb850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0xae, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x8001}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000280)={0x29e9c934, 0x5, 0x0, 0x4}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000010c0)=ANY=[@ANYBLOB="200000001600010800000000000000000a0000000c0000", @ANYRES16=r0], 0x20}, 0x1, 0x0, 0x0, 0x240c0811}, 0x0) 4.292012559s ago: executing program 2 (id=2217): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000280), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xc, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10}, 0x94) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="d80000001b00010000000000fdfffffffc000000000000000000000000000000200100000000000000000000000000004e240000000000010000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7ffcffffffffffffff04000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000006fcffff0000000000000300"], 0xd8}}, 0x20008004) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, r6, 0x1, 0x70bd27, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x51}, 0x4000810) sendmsg$NFT_BATCH(r4, &(0x7f0000003280)={0x0, 0x0, &(0x7f0000003240)={&(0x7f0000003040)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_DELCHAIN={0x14, 0x5, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x6}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x3c}, 0x1, 0x0, 0x0, 0x8c0}, 0x4000800) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x54}}, 0x0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f0000000080)={0x54, r1, 0x1, 0x70bd29, 0x25dfdbfb, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x40d5}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x4008090) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x1, 0x5, &(0x7f0000000500)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e000000850000002a00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r9, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)="1800000072006bcd9e3fe3dc6e080000070900000c000000", 0x18}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) setsockopt$sock_attach_bpf(r7, 0x1, 0x32, &(0x7f0000000080)=r8, 0x4) sendmsg$nl_netfilter(r7, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f00000009c0)={0x14, 0xa, 0xa, 0x301, 0x70bd2d, 0x25dfdbfe, {0x0, 0x0, 0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x2404c015}, 0x44) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001200)={0x0, 0xfffffffffffffff5, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x1c, 0x2, [@TCA_FQ_FLOW_DEFAULT_RATE={0x18, 0x10, 0x3}, @TCA_FQ_FLOW_MAX_RATE={0x2, 0x2, 0x14000000}, @TCA_FQ_PLIMIT={0x1300, 0x1, 0x5}]}}]}, 0x48}}, 0x0) socket$inet6(0xa, 0x2, 0x0) r11 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r11, &(0x7f00000000c0)={&(0x7f0000000740)=@ieee802154={0x24, @short={0x2, 0x2}}, 0x80, &(0x7f0000000680)=[{&(0x7f0000000180)="06031c00160014000200", 0xa}, {&(0x7f00000001c0)="7d3ed2ea1f2f210c0784b2ce65c9e34b1100301a03df46a4853ed1b3f1dc15569532315ad340ebe5f1a7", 0x2a}], 0x2}, 0x40004) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x148e411}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x3c, 0x6, 0xa, 0x801, 0x0, 0x0, {0x5}, [@NFTA_RULE_ID={0x8}, @NFTA_RULE_POSITION_ID={0x8}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x2}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4044841) 4.085827529s ago: executing program 4 (id=2218): socket$tipc(0x1e, 0x5, 0x0) unshare(0x2a060400) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x4e, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xa30e, 0x1, 0xfffffffa}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000800)=@newtfilter={0x64, 0x2c, 0xd3f, 0x70b524, 0x25dfdbfa, {0x0, 0x0, 0x0, r4, {0xfff3, 0xffe0}, {}, {0x7, 0xfff2}}, [@filter_kind_options=@f_flow={{0x9}, {0x34, 0x2, [@TCA_FLOW_EMATCHES={0x20, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x14, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{0x5, 0x2, 0x6}, {0x7, 0x0, 0x2}}}]}]}, @TCA_FLOW_KEYS={0x8, 0x1, 0x18d0b}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4008848}, 0xc884) r5 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @broadcast}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r1, &(0x7f0000000440)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r6, 0x25}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000140)="ac", 0x1}], 0x1}, 0x8804) 4.043054168s ago: executing program 3 (id=2219): r0 = socket$phonet(0x23, 0x2, 0x1) bind$phonet(r0, &(0x7f0000000080)={0x23, 0x2, 0x8, 0x10}, 0x10) sendto$phonet(r0, &(0x7f0000000400)="00200100000045000028", 0xa, 0x0, &(0x7f0000000340)={0x23, 0x1, 0x8}, 0x10) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, 0x0, 0x190) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x50) 4.042391218s ago: executing program 1 (id=2220): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) 4.041941698s ago: executing program 0 (id=2221): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r8, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) close(0x3) 3.991190258s ago: executing program 2 (id=2222): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x2c) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x6, 0x1b, &(0x7f0000001800)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7020000000000008500000017000000180100002020690000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={r1, 0x0, 0x25, 0x0, @val=@tcx}, 0x1c) syz_emit_ethernet(0xc0, &(0x7f0000000880)=ANY=[@ANYBLOB], 0x0) syz_emit_ethernet(0xfdef, &(0x7f00000002c0)={@remote, @empty, @val={@val={0x88a8, 0x6, 0x0, 0x2}, {0x8100, 0x6, 0x1}}, {@llc_tr={0x11, {@snap={0x55, 0x1, "d7", 'U-l', 0x15}}}}}, 0x0) 3.896072737s ago: executing program 3 (id=2223): syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/mnt\x00') socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_WDS_PEER(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x91) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, 0x0, 0x0, 0x0) socket$unix(0x1, 0x1, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) socket$netlink(0x10, 0x3, 0x10) socket(0x28, 0x5, 0x0) socket$netlink(0x10, 0x3, 0xf) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001c00010429bd7000ffdbdf2507000000", @ANYRES32, @ANYBLOB="e0ff8b0a0a0002"], 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x24040040) 3.894765868s ago: executing program 1 (id=2224): unshare(0x26020480) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt(r0, 0xff, 0x2, 0x0, 0x0) 3.764156454s ago: executing program 2 (id=2225): r0 = socket(0x840000000002, 0x3, 0xff) syz_genetlink_get_family_id$nl80211(&(0x7f0000000a00), 0xffffffffffffffff) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f0000000100)=0x5) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000, &(0x7f00000000c0)='\x00') socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) linkat(0xffffffffffffff9c, &(0x7f00000003c0)='./cgroup\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./file7\x00', 0x1000) syz_mount_image$fuse(0x0, &(0x7f0000000000)='./bus\x00', 0x300f401, 0x0, 0x2, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@index_on}]}) chdir(&(0x7f00000003c0)='./bus\x00') renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file7\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./file1\x00', 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x15) recvmsg(0xffffffffffffffff, 0x0, 0x1f21) openat(0xffffffffffffff9c, 0x0, 0x101940, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=ANY=[@ANYBLOB="48000000ff000000000000000003004a00", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b00010062617461647600000400028008000a00", @ANYRES32=r3], 0x48}}, 0x0) sendmsg$inet(r0, &(0x7f0000000300)={&(0x7f00000006c0)={0x2, 0x4e20, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="20000000000000000000650007df000094df431c872b7f00000100000082cbc037e394b7d359"], 0x20}, 0x2400c804) syz_read_part_table(0x5c6, &(0x7f0000000bc0)="$eJzs08FLbGUUAPBzp4bp9d5zHvGgRe3e8CCwhCQSciCRYXCjYmUuWgsuaiG4cDEo46zN/oHCVDA30t6laSAKuhJpJfMPKG1mETdG7zgQtal8ovx+i/nuPZx7vvPxnQnutVwUn1w/pYWI+OPvcp5FROHm7afOQ+FxfLH1ZWWyPj408Xl8lMRXEVF597pcEt2qSff7tFNn5FEcrx4MX+bj8MXJfmktl8V3chGLEfH1+Xrx0T81nf9vZ+bh2C7vFZcas9Xl+XIhqrVm/3Rn8mIwiVicygZr52p9rf3zxv+7f3uir/afOa3WmqXjgY2jdOzi+6cf5PePWx/+epXVc/N/4GH5tD1Sje79//C8flZvjb7cnOvrfT12F1ayi/89Wz/5redO+wUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB6u7fJeKxqz1eX58sxptdbsn36/8s63lW+++/jHwYXJtwencu2s5Db3Ly418tlbrVkqDGwcpWMX8XS2HXizk9d7ey1wh957HLHUnr/O/T6vn9Vboy835/p63zrbXVjJ4ulfPyy+4kYBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgHujEotpOjSRi0jil6QbTwvXayf0c7aOZfGRwmfJ6sHw5dazwxcn+6W18Sy+8yRLPF8vdqv13PYx+Jf+DAAA//84pm1S") 3.694219807s ago: executing program 3 (id=2226): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r3) sendmsg$TIPC_CMD_ENABLE_BEARER(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r5) socket$unix(0x1, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 3.692614977s ago: executing program 0 (id=2227): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB="38010000100033062cbd700000000000fc020000000000000000000000000000ac1414aa0000000000000000000000000000000900000008000000203a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="e0000002000000000000000000000000fffffffd32000000000000000000000000000000000000000700000000000000fcffffffffffffff00000000000000000900000000000000030000000000000000000000000000000000000000000000fcffffffffffffff0000000000000000000000000000000000000000000000000a00"/141], 0x138}}, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}}, 0x29) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x4, 0x0, 0xfffffffffffffffc, 0x0, 0x6}, {0x0, 0x0, 0x400000000}, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x0, 0x32}, 0x0, @in=@private=0xa010101, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) write(r1, 0x0, 0x0) 3.684202859s ago: executing program 1 (id=2228): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x1c1342, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) writev(r0, &(0x7f0000000340)=[{&(0x7f00000002c0)="89e7ee0c7cdad9b4b47380c988cafb", 0x140}, {&(0x7f0000000440)="448b7c0acf8bc0cefe8360fcbe079c", 0xf}], 0x2) 2.813321282s ago: executing program 0 (id=2229): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) setsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x1d, 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x90, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0xb, 0x7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x5c, 0x2, [@TCA_MATCHALL_ACT={0x58, 0x2, [@m_ct={0x54, 0x1, 0x0, 0x0, {{0x7}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x3}}, @TCA_CT_ACTION={0x6, 0x3, 0x19}, @TCA_CT_NAT_IPV4_MIN={0x8}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x90}}, 0x0) write$tun(r0, &(0x7f00000001c0)={@val={0x70}, @void, @eth={@broadcast, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x3c, 0x25, 0x0, 0x0, 0x0, 0x2f, 0x0, @rand_addr=0x64010100, @multicast1}, {0x0, 0x6558, 0x11, 0x0, @opaque="004b00040000000000"}}}}}}, 0x37) 2.756280233s ago: executing program 2 (id=2230): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000062010b00000000009500"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xf}, 0x94) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000002c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x5, 0xc}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x5fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) close(0xffffffffffffffff) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) syz_emit_ethernet(0x6e, &(0x7f0000000440)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd6000104000380600fe880000000000000000000000000001fe8000000000000000000000000000aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="e6000000907806c31312345f8cf949a01b515682f44cecac91bac4d28ad6844b901d12d2b65be055abdf2c91a58744ff85ccc9"], 0x0) socket$can_bcm(0x1d, 0x2, 0x2) sendmsg$nl_route_sched(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000640)=@newtfilter={0x3c, 0x2c, 0xd3f, 0x30bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r7, {0xb, 0x3}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x0, 0xfff1}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x0) 348.060221ms ago: executing program 4 (id=2231): bpf$PROG_LOAD(0x5, &(0x7f0000000a40)={0x1e, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000f66f63bb850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0xae, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x8001}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000280)={0x29e9c934, 0x5, 0x0, 0x4}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000010c0)=ANY=[@ANYBLOB="200000001600010800000000000000000a0000000c0000", @ANYRES16=r0], 0x20}, 0x1, 0x0, 0x0, 0x240c0811}, 0x0) 317.870887ms ago: executing program 1 (id=2232): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000280), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff}) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xc, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10}, 0x94) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="d80000001b00010000000000fdfffffffc000000000000000000000000000000200100000000000000000000000000004e240000000000010000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000ffffffffffffff7ffcffffffffffffff04000000000000000000000000000000fdffffffffffffff00000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000006fcffff0000000000000300"], 0xd8}}, 0x20008004) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NBD_CMD_DISCONNECT(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000200)={0x1c, r6, 0x1, 0x70bd27, 0x25dfdbff, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x51}, 0x4000810) sendmsg$NFT_BATCH(r4, &(0x7f0000003280)={0x0, 0x0, &(0x7f0000003240)={&(0x7f0000003040)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_DELCHAIN={0x14, 0x5, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x6}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x3c}, 0x1, 0x0, 0x0, 0x8c0}, 0x4000800) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x54}}, 0x0) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f0000000080)={0x54, r1, 0x1, 0x70bd29, 0x25dfdbfb, {}, [@NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x40d5}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8}}, {0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000004}, 0x4008090) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x1, 0x5, &(0x7f0000000500)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002e000000850000002a00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r8, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)="1800000072006bcd9e3fe3dc6e080000070900000c000000", 0x18}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) sendmsg$nl_netfilter(r7, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f00000009c0)={0x14, 0xa, 0xa, 0x301, 0x70bd2d, 0x25dfdbfe, {0x0, 0x0, 0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x2404c015}, 0x44) r9 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000001200)={0x0, 0xfffffffffffffff5, &(0x7f0000000000)={&(0x7f00000002c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r10, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x1c, 0x2, [@TCA_FQ_FLOW_DEFAULT_RATE={0x18, 0x10, 0x3}, @TCA_FQ_FLOW_MAX_RATE={0x2, 0x2, 0x14000000}, @TCA_FQ_PLIMIT={0x1300, 0x1, 0x5}]}}]}, 0x48}}, 0x0) socket$inet6(0xa, 0x2, 0x0) r11 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r11, &(0x7f00000000c0)={&(0x7f0000000740)=@ieee802154={0x24, @short={0x2, 0x2}}, 0x80, &(0x7f0000000680)=[{&(0x7f0000000180)="06031c00160014000200", 0xa}, {&(0x7f00000001c0)="7d3ed2ea1f2f210c0784b2ce65c9e34b1100301a03df46a4853ed1b3f1dc15569532315ad340ebe5f1a7", 0x2a}], 0x2}, 0x40004) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x148e411}, 0xc, &(0x7f0000000180)={&(0x7f0000000100)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x3c, 0x6, 0xa, 0x801, 0x0, 0x0, {0x5}, [@NFTA_RULE_ID={0x8}, @NFTA_RULE_POSITION_ID={0x8}, @NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x2}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0x64}, 0x1, 0x0, 0x0, 0x4000}, 0x4044841) 287.986103ms ago: executing program 4 (id=2233): epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x82c03, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}, {0x5}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001300)=@newtfilter={0x48, 0x2c, 0xd27, 0x170bd2c, 0x2, {0x0, 0x0, 0x0, r7, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_flow={{0x9}, {0x18, 0x2, [@TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_KEYS={0x8, 0x1, 0x6}, @TCA_FLOW_ACT={0x4}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0xc8c0}, 0x2) r8 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r8, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r5, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e0003004024c1020000ff1107c2fb7fe0400018534b4f6b3d327db412f40000000000000000", 0x2e}], 0x1}, 0x20040000) 199.95444ms ago: executing program 3 (id=2234): r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="20000000520001000000000000000000020000000c00010001"], 0x20}}, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) r2 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) recvmsg(r2, &(0x7f0000001880)={0x0, 0x0, 0x0}, 0x3c65e5a12d2f864f) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000940)={0x0, 0x0, &(0x7f00000019c0)=[{&(0x7f0000000000)="d80000001c0081064e81f782db44b9040a1d08040600000000f309a1180002000607002603600e12080b0f0000810401a8001605200001400200000803604e0cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4ee0000001fb791643a5ee422fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd400d65afd67580ae4edef5d2defd5ccae8d7fb7c27a1059ae31c6", 0xd8}, {0x0}], 0x2, 0x0, 0x0, 0x7400}, 0x4) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='devices.list\x00', 0x26e1, 0x0) sendmsg$NL80211_CMD_DEL_INTERFACE(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x800}, 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x50) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r1, 0x107, 0x16, &(0x7f00000003c0)={0x3, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x48, 0x83, 0x0, 0x80000001}, {0x6, 0x4, 0x60, 0x5}]}, 0x10) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='GPL\x00', 0x3, 0x0, 0x0, 0x40f00}, 0x94) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') r6 = socket(0x14, 0x2, 0x4) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r7) r9 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r9) getsockname$packet(r9, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newlink={0x38, 0x10, 0x437, 0x800000, 0x0, {0x0, 0x0, 0x0, r10, 0x504c3}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8, 0x1, @udp=r6}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) sendmsg$GTP_CMD_DELPDP(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="030029bd70000e0000", @ANYRES32=r10, @ANYBLOB="08000200c3"], 0x30}, 0x1, 0x0, 0x0, 0x44800}, 0x20000000) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f271a76d2686dd4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) r11 = socket$nl_route(0x10, 0x3, 0x0) r12 = syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/net\x00') sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x50, 0x0, 0x1, 0x201, 0x0, 0x0, {0xb, 0x0, 0x4}, [@CTA_FILTER={0x34, 0x19, 0x0, 0x1, [@CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x511}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0xa68}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0xe87}, @CTA_FILTER_ORIG_FLAGS={0x8, 0x1, 0x40}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x44}, @CTA_FILTER_REPLY_FLAGS={0x8, 0x2, 0x10}]}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x4}]}, 0x50}, 0x1, 0x0, 0x0, 0x4}, 0x4004040) sendmsg$nl_route(r11, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=@newlink={0x28, 0x10, 0x49920d862a92153b, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x403, 0x14112}, [@IFLA_NET_NS_FD={0x8, 0x1c, r12}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x0) 143.300412ms ago: executing program 0 (id=2235): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x2c) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x6, 0x1b, &(0x7f0000001800)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7020000000000008500000017000000180100002020690000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x31, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000280)={r1, 0x0, 0x25, 0x0, @val=@tcx}, 0x1c) syz_emit_ethernet(0xc0, &(0x7f0000000880)=ANY=[@ANYBLOB], 0x0) syz_emit_ethernet(0xfdef, &(0x7f00000002c0)={@remote, @empty, @val={@val={0x88a8, 0x6, 0x0, 0x2}, {0x8100, 0x6, 0x1}}, {@llc_tr={0x11, {@snap={0x55, 0x1, "d7", 'U-l', 0x15}}}}}, 0x0) 124.731125ms ago: executing program 1 (id=2236): bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x4, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa208000000000000006148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5200ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb18770fd2a5418974adfaa34d3f9ac5e5328e6ba2cb7599554eaa5b58baf9a685195b9cf985c6a21cc727e4482ec2202fde10b85b25b04d8ba2f3926daa69e964db4d3891980e19f6675c7d884e9214e6e1c7ee29e35761a213b56c551d0a3f2503741df1dee5f26197cba06e691998f374a08931a7f959fd651f698328835dfcaf442e58fc7547c9cddfa717a01d666d24656cc33189ced70231eb8b45d4e7534ebb2806d44baed548574d9820c15ef59652c3e44b50e5aa8"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0xfffffffc, 0xfffffffe}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x58) 97.87195ms ago: executing program 2 (id=2237): unshare(0x8040480) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x82c03, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000003d40)=@newtfilter={0x138, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x8, 0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x108, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0xa, 0x2}}, @TCA_BASIC_CLASSID={0x8, 0x1, {0x3, 0x9}}, @TCA_BASIC_ACT={0xf4, 0x3, [@m_sample={0x40, 0x4, 0x0, 0x0, {{0xb}, {0x14, 0x2, 0x0, 0x1, [@TCA_SAMPLE_RATE={0x8, 0x3, 0x6}, @TCA_SAMPLE_RATE={0x8, 0x3, 0x9}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_mirred={0xb0, 0x1, 0x0, 0x0, {{0xb}, {0x84, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x8001, 0x400, 0x3, 0x2, 0xaa70}, 0x4}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x5, 0xff, 0x4, 0x5, 0x8}, 0x1}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x1, 0x31b, 0x6, 0xb}, 0x2}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x7, 0x4, 0x4, 0xb, 0xdc}, 0x2, r3}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x138}, 0x1, 0x0, 0x0, 0x10}, 0x8080) sendmsg$nl_generic(r2, 0x0, 0x24) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r5, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e0003000024c1020000ff1107c2fb7fe0400018534b4f6b3d327db412f40000000000000000", 0x2e}], 0x1}, 0x4005) 0s ago: executing program 1 (id=2238): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, &(0x7f0000000600), 0x56) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {0x0, 0x8}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r5, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) close(0x3) kernel console output (not intermixed with test programs): op1): encrypted files will use data=ordered instead of data journaling mode [ 127.714923][ T4802] EXT4-fs error (device loop1): ext4_orphan_get:1409: inode #15: comm syz.1.122: inode has both inline data and extents flags [ 127.761351][ T4802] EXT4-fs error (device loop1): ext4_orphan_get:1414: comm syz.1.122: couldn't read orphan inode 15 (err -117) [ 127.824691][ T4809] loop2: detected capacity change from 0 to 2048 [ 127.910301][ T4802] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 128.569965][ T4809] loop2: p1 < > p4 [ 128.569965][ T4809] p4: [ 128.583533][ T4809] loop2: p4 size 722688 extends beyond EOD, truncated [ 128.695742][ T4285] EXT4-fs (loop1): unmounting filesystem. [ 130.739651][ T4837] Illegal XDP return value 4292583424 on prog (id 6) dev N/A, expect packet loss! [ 130.754236][ T4838] tipc: Failed to remove unknown binding: 66,0,0/0:2783781161/2783781163 [ 130.785253][ T4838] tipc: Failed to remove unknown binding: 66,0,0/0:2783781161/2783781162 [ 130.812402][ T4838] tipc: Failed to remove unknown binding: 66,0,0/0:2783781161/2783781163 [ 130.894165][ T4838] tipc: Failed to remove unknown binding: 66,0,0/0:2783781161/2783781162 [ 131.598510][ T4852] snd_dummy snd_dummy.0: control 0:4:0:syz0:0 is already present [ 133.339078][ T1276] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.345537][ T1276] ieee802154 phy1 wpan1: encryption failed: -22 [ 133.437542][ T4857] loop1: detected capacity change from 0 to 2048 [ 133.494030][ T4857] loop1: p1 < > p4 [ 133.494030][ T4857] p4: [ 133.502205][ T4857] loop1: p4 size 722688 extends beyond EOD, truncated [ 137.823581][ T4896] netlink: 8 bytes leftover after parsing attributes in process `syz.2.146'. [ 137.835913][ T4896] netlink: 8 bytes leftover after parsing attributes in process `syz.2.146'. [ 137.845780][ T4896] netlink: 8 bytes leftover after parsing attributes in process `syz.2.146'. [ 137.856739][ T4896] netlink: 8 bytes leftover after parsing attributes in process `syz.2.146'. [ 137.866960][ T4896] netlink: 8 bytes leftover after parsing attributes in process `syz.2.146'. [ 139.296344][ T4904] loop0: detected capacity change from 0 to 2048 [ 141.030516][ T4915] snd_dummy snd_dummy.0: control 0:4:0:syz0:0 is already present [ 141.928753][ T4926] netlink: 20 bytes leftover after parsing attributes in process `syz.3.153'. [ 143.302257][ T4941] netlink: 'syz.0.157': attribute type 2 has an invalid length. [ 143.310334][ T4941] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 143.541477][ T4822] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 143.583341][ T4949] syz.3.158 uses obsolete (PF_INET,SOCK_PACKET) [ 143.753658][ T4822] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 143.782777][ T4822] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 128 [ 143.818386][ T4822] usb 2-1: config 27 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 143.853892][ T4822] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 143.873310][ T4958] netlink: 36 bytes leftover after parsing attributes in process `syz.4.162'. [ 143.891369][ T4822] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 143.906876][ T4956] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 143.978271][ T4956] netlink: 8 bytes leftover after parsing attributes in process `syz.0.161'. [ 144.026716][ T4943] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 144.188315][ T4960] loop3: detected capacity change from 0 to 2048 [ 144.239463][ T4822] usb 2-1: invalid MIDI out EP 0 [ 144.574387][ T4960] loop3: p1 < > p4 [ 144.574387][ T4960] p4: [ 144.586046][ T4960] loop3: p4 size 722688 extends beyond EOD, truncated [ 144.694537][ T4962] netlink: 8 bytes leftover after parsing attributes in process `syz.4.162'. [ 144.748932][ T4822] snd-usb-audio: probe of 2-1:27.0 failed with error -22 [ 145.073327][ T4822] usb 2-1: USB disconnect, device number 3 [ 145.104360][ T4970] udevd[4970]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 145.895433][ T4979] netlink: 'syz.2.165': attribute type 4 has an invalid length. [ 145.904647][ T4979] netlink: 152 bytes leftover after parsing attributes in process `syz.2.165'. [ 145.926465][ T4981] Zero length message leads to an empty skb [ 147.341098][ T5014] loop3: detected capacity change from 0 to 2048 [ 147.420250][ T5014] loop3: p1 < > p4 [ 147.420250][ T5014] p4: [ 147.463627][ T5014] loop3: p4 size 722688 extends beyond EOD, truncated [ 148.599692][ T4970] udevd[4970]: inotify_add_watch(7, /dev/loop3p4, 10) failed: No such file or directory [ 148.619253][ T4946] udevd[4946]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 148.635117][ T5025] netlink: 68 bytes leftover after parsing attributes in process `syz.3.180'. [ 148.855408][ T5033] netlink: 272 bytes leftover after parsing attributes in process `syz.4.181'. [ 149.229417][ T5045] snd_dummy snd_dummy.0: control 0:4:0:syz0:0 is already present [ 149.815470][ T5043] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 150.689147][ T5059] loop4: detected capacity change from 0 to 2048 [ 152.905427][ T5079] snd_dummy snd_dummy.0: control 0:4:0:syz0:0 is already present [ 154.411294][ T4322] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 154.593012][ T4322] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice= 0.00 [ 154.614754][ T4322] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 155.766172][ T5098] loop1: detected capacity change from 0 to 1024 [ 155.786097][ T5098] EXT4-fs: Ignoring removed bh option [ 155.923066][ T5098] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 156.184393][ T5108] loop4: detected capacity change from 0 to 2048 [ 156.231077][ T4285] EXT4-fs (loop1): unmounting filesystem. [ 156.870153][ T4322] usb 1-1: Firmware version (0.0) predates our first public release. [ 156.951370][ T4322] usb 1-1: Please update to version 0.2 or newer [ 157.123837][ T5117] ip_tables: iptables: counters copy to user failed while replacing table [ 157.204550][ T4322] usb 1-1: Firmware: build  [ 157.610464][ T4322] usb 1-1: USB disconnect, device number 2 [ 157.823737][ T5123] batman_adv: batadv0: Adding interface: syzkaller0 [ 157.851350][ T5123] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 157.887465][ T5123] batman_adv: batadv0: Interface activated: syzkaller0 [ 157.959139][ T5130] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 157.988709][ T5130] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 158.035803][ T5118] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 158.092550][ T5118] batman_adv: batadv0: Removing interface: syzkaller0 [ 158.965352][ T5146] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 158.997169][ T5146] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 159.021841][ T5146] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 159.501342][ T5159] loop4: detected capacity change from 0 to 2048 [ 159.584965][ T5159] loop4: p1 < > p4 [ 159.584965][ T5159] p4: [ 159.608259][ T5159] loop4: p4 size 722688 extends beyond EOD, truncated [ 160.365044][ T5163] loop2: detected capacity change from 0 to 1024 [ 160.579505][ T5168] netlink: 8 bytes leftover after parsing attributes in process `syz.4.220'. [ 160.632572][ T5163] EXT4-fs: Ignoring removed bh option [ 161.034017][ T5163] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 161.293553][ T4280] EXT4-fs (loop2): unmounting filesystem. [ 161.577635][ T5182] device syzkaller1 entered promiscuous mode [ 162.391365][ T4323] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 162.476745][ T5194] lo speed is unknown, defaulting to 1000 [ 162.490701][ T5194] lo speed is unknown, defaulting to 1000 [ 162.499586][ T5194] lo speed is unknown, defaulting to 1000 [ 163.366468][ T5199] loop0: detected capacity change from 0 to 2048 [ 163.901597][ T5199] loop0: p1 < > p4 [ 163.901597][ T5199] p4: [ 163.905256][ T5201] x_tables: duplicate underflow at hook 3 [ 163.911040][ T5199] loop0: p4 size 722688 extends beyond EOD, truncated [ 164.041852][ T4323] usb 4-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice= 0.00 [ 164.092852][ T4323] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 164.116451][ T5194] infiniband syz0: set down [ 164.139170][ T4821] lo speed is unknown, defaulting to 1000 [ 164.149096][ T5194] infiniband syz0: added lo [ 164.158537][ T5194] rdma_rxe: unable to create cq [ 164.164432][ T4946] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 164.164850][ T5194] infiniband syz0: Couldn't create ib_mad CQ [ 164.186612][ T5194] infiniband syz0: Couldn't open port 1 [ 164.321745][ T5209] netlink: 24 bytes leftover after parsing attributes in process `syz.0.234'. [ 164.393972][ T4944] udevd[4944]: inotify_add_watch(7, /dev/loop0p4, 10) failed: No such file or directory [ 164.399250][ T4946] udevd[4946]: inotify_add_watch(7, /dev/loop0p1, 10) failed: No such file or directory [ 164.420583][ T5194] RDS/IB: syz0: added [ 164.478310][ T5211] netlink: 8 bytes leftover after parsing attributes in process `syz.1.233'. [ 164.495230][ T5194] smc: adding ib device syz0 with port count 1 [ 164.533666][ T5194] smc: ib device syz0 port 1 has pnetid [ 164.566056][ T4281] lo speed is unknown, defaulting to 1000 [ 164.631508][ T5194] lo speed is unknown, defaulting to 1000 [ 165.094172][ T4323] usb 4-1: Firmware version (0.0) predates our first public release. [ 165.111683][ T4323] usb 4-1: Please update to version 0.2 or newer [ 165.154988][ T5213] loop4: detected capacity change from 0 to 1024 [ 165.172807][ T5213] EXT4-fs: Ignoring removed bh option [ 165.230910][ T5213] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 165.297432][ T4323] usb 4-1: Firmware: build  [ 165.359150][ T4284] EXT4-fs (loop4): unmounting filesystem. [ 165.364370][ T5194] lo speed is unknown, defaulting to 1000 [ 165.534261][ T4323] usb 4-1: USB disconnect, device number 2 [ 165.579186][ T5194] lo speed is unknown, defaulting to 1000 [ 165.801412][ T5194] lo speed is unknown, defaulting to 1000 [ 166.037541][ T5194] lo speed is unknown, defaulting to 1000 [ 166.183819][ T5235] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 166.268161][ T5235] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 166.321769][ T5235] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 167.826182][ T5252] loop1: detected capacity change from 0 to 2048 [ 168.018672][ T5252] loop1: p1 < > p4 [ 168.018672][ T5252] p4: [ 168.035392][ T5252] loop1: p4 size 722688 extends beyond EOD, truncated [ 168.891621][ T5265] netlink: 8 bytes leftover after parsing attributes in process `syz.2.247'. [ 170.006423][ T5272] loop2: detected capacity change from 0 to 1024 [ 170.042804][ T5272] EXT4-fs: Ignoring removed bh option [ 170.202113][ T5272] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 170.275896][ T5281] netlink: 16 bytes leftover after parsing attributes in process `syz.4.253'. [ 170.286109][ T4280] EXT4-fs (loop2): unmounting filesystem. [ 170.311323][ T5281] netlink: 8 bytes leftover after parsing attributes in process `syz.4.253'. [ 170.451570][ T4779] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 170.670360][ T4779] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice= 0.00 [ 170.789540][ T4779] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 171.083852][ T5303] netlink: 8 bytes leftover after parsing attributes in process `syz.2.260'. [ 171.330315][ T5292] loop4: detected capacity change from 0 to 2048 [ 171.526153][ T5292] loop4: p1 < > p4 [ 171.526153][ T5292] p4: [ 171.534863][ T5292] loop4: p4 size 722688 extends beyond EOD, truncated [ 171.978377][ T4779] usb 1-1: Firmware version (0.0) predates our first public release. [ 171.990250][ T4779] usb 1-1: Please update to version 0.2 or newer [ 172.644847][ T4779] usb 1-1: Firmware: build  [ 172.799007][ T5321] loop3: detected capacity change from 0 to 1024 [ 172.839636][ T5321] EXT4-fs: Ignoring removed bh option [ 172.893384][ T4779] usb 1-1: USB disconnect, device number 3 [ 172.990560][ T5321] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 173.141056][ T4288] EXT4-fs (loop3): unmounting filesystem. [ 173.315931][ T5336] syz.3.270 invoked oom-killer: gfp_mask=0x402dc0(GFP_KERNEL_ACCOUNT|__GFP_NOWARN|__GFP_ZERO), order=0, oom_score_adj=1000 [ 173.332294][ T5336] CPU: 1 PID: 5336 Comm: syz.3.270 Not tainted syzkaller #0 [ 173.339617][ T5336] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 173.349695][ T5336] Call Trace: [ 173.352986][ T5336] [ 173.355930][ T5336] dump_stack_lvl+0x188/0x24e [ 173.360652][ T5336] ? lock_chain_count+0x20/0x20 [ 173.365529][ T5336] ? show_regs_print_info+0x12/0x12 [ 173.370746][ T5336] ? load_image+0x410/0x410 [ 173.375279][ T5336] ? lockdep_hardirqs_on+0x94/0x140 [ 173.380508][ T5336] dump_header+0xd8/0x820 [ 173.384873][ T5336] oom_kill_process+0x361/0x550 [ 173.389744][ T5336] out_of_memory+0xe25/0x1220 [ 173.394448][ T5336] ? print_unlock_imbalance_bug+0x160/0x160 [ 173.400370][ T5336] ? mutex_lock_nested+0x10/0x10 [ 173.405336][ T5336] ? unregister_oom_notifier+0x20/0x20 [ 173.410824][ T5336] mem_cgroup_out_of_memory+0x2c0/0x390 [ 173.416396][ T5336] ? mem_cgroup_oom_trylock+0x210/0x210 [ 173.421973][ T5336] ? do_raw_spin_unlock+0x11d/0x230 [ 173.427196][ T5336] try_charge_memcg+0xc9d/0x17c0 [ 173.432156][ T5336] ? __lock_acquire+0x7c40/0x7c40 [ 173.437219][ T5336] ? percpu_ref_put+0x180/0x180 [ 173.442087][ T5336] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 173.447839][ T5336] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 173.453578][ T5336] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 173.459319][ T5336] ? get_mem_cgroup_from_objcg+0x13c/0x150 [ 173.465153][ T5336] __memcg_kmem_charge_page+0x220/0x380 [ 173.470723][ T5336] __alloc_pages+0x21e/0x4f0 [ 173.475341][ T5336] ? zone_statistics+0x170/0x170 [ 173.480307][ T5336] ? kvmalloc_node+0x6c/0x180 [ 173.485015][ T5336] io_pages_map+0xd8/0x4d0 [ 173.489487][ T5336] io_allocate_scq_urings+0x256/0x437 [ 173.494884][ T5336] io_uring_create+0x574/0xd6c [ 173.499696][ T5336] __x64_sys_io_uring_setup+0x21b/0x230 [ 173.505283][ T5336] ? __ia32_sys_io_uring_enter+0xf0/0xf0 [ 173.510966][ T5336] ? lockdep_hardirqs_on+0x94/0x140 [ 173.516204][ T5336] do_syscall_64+0x4c/0xa0 [ 173.520641][ T5336] ? clear_bhb_loop+0x60/0xb0 [ 173.525344][ T5336] ? clear_bhb_loop+0x60/0xb0 [ 173.530043][ T5336] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 173.535981][ T5336] RIP: 0033:0x7f15dfd9e159 [ 173.540424][ T5336] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 173.560058][ T5336] RSP: 002b:00007f15e0c3dfb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 173.568514][ T5336] RAX: ffffffffffffffda RBX: 00002000000004c0 RCX: 00007f15dfd9e159 [ 173.576513][ T5336] RDX: 0000200000000100 RSI: 00002000000004c0 RDI: 0000000000000020 [ 173.584506][ T5336] RBP: 00007f15dfe3506b R08: 0000000000000000 R09: 0000000000000000 [ 173.592523][ T5336] R10: 00002000000002c0 R11: 0000000000000206 R12: 0000200000000100 [ 173.600506][ T5336] R13: 00002000000002c0 R14: 00002000000000c0 R15: 00007ffc2515d628 [ 173.608504][ T5336] [ 173.617193][ T5343] netlink: 8 bytes leftover after parsing attributes in process `syz.1.272'. [ 174.029749][ T5348] loop2: detected capacity change from 0 to 2048 [ 174.104210][ T5336] memory: usage 8kB, limit 8kB, failcnt 21 [ 174.122351][ T5348] loop2: p1 < > p4 [ 174.122351][ T5348] p4: [ 174.130949][ T5348] loop2: p4 size 722688 extends beyond EOD, truncated [ 174.151148][ T5336] memory+swap: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 174.347603][ T5336] kmem: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 174.382552][ T5336] Memory cgroup stats for /syz3/test: [ 174.382978][ T5336] anon 0 [ 174.382978][ T5336] file 0 [ 174.382978][ T5336] kernel 8192 [ 174.382978][ T5336] kernel_stack 0 [ 174.382978][ T5336] pagetables 0 [ 174.382978][ T5336] sec_pagetables 0 [ 174.382978][ T5336] percpu 0 [ 174.382978][ T5336] sock 0 [ 174.382978][ T5336] vmalloc 0 [ 174.382978][ T5336] shmem 0 [ 174.382978][ T5336] zswap 0 [ 174.382978][ T5336] zswapped 0 [ 174.382978][ T5336] file_mapped 0 [ 174.382978][ T5336] file_dirty 0 [ 174.382978][ T5336] file_writeback 0 [ 174.382978][ T5336] swapcached 0 [ 174.382978][ T5336] anon_thp 0 [ 174.382978][ T5336] file_thp 0 [ 174.382978][ T5336] shmem_thp 0 [ 174.382978][ T5336] inactive_anon 0 [ 174.382978][ T5336] active_anon 0 [ 174.382978][ T5336] inactive_file 0 [ 174.382978][ T5336] active_file 0 [ 174.382978][ T5336] unevictable 0 [ 174.382978][ T5336] slab_reclaimable 0 [ 174.382978][ T5336] slab_unreclaimable 96 [ 174.382978][ T5336] slab 96 [ 174.382978][ T5336] workingset_refault_anon 0 [ 174.400021][ T5351] lo speed is unknown, defaulting to 1000 [ 174.593692][ T5336] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz3/test,task_memcg=/syz3/test,task=syz.3.270,pid=5335,uid=0 [ 174.741511][ T5357] netlink: 16 bytes leftover after parsing attributes in process `syz.2.276'. [ 174.766878][ T5336] Memory cgroup out of memory: Killed process 5336 (syz.3.270) total-vm:102244kB, anon-rss:1428kB, file-rss:22612kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 174.975231][ T5364] lo speed is unknown, defaulting to 1000 [ 176.154603][ T4282] Bluetooth: hci4: link tx timeout [ 176.160102][ T4282] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 176.174303][ T4282] Bluetooth: hci4: link tx timeout [ 176.179453][ T4282] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 176.190739][ T4282] Bluetooth: hci4: link tx timeout [ 176.196139][ T4282] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 176.223979][ T4282] Bluetooth: hci4: link tx timeout [ 176.280662][ T4282] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 176.289095][ T4282] Bluetooth: hci4: link tx timeout [ 176.294394][ T4282] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 176.530470][ T5386] netlink: 'syz.4.283': attribute type 1 has an invalid length. [ 176.618713][ T5386] netlink: 124 bytes leftover after parsing attributes in process `syz.4.283'. [ 177.571591][ T5401] loop1: detected capacity change from 0 to 2048 [ 177.630635][ T5403] syz.3.288 invoked oom-killer: gfp_mask=0x402dc0(GFP_KERNEL_ACCOUNT|__GFP_NOWARN|__GFP_ZERO), order=0, oom_score_adj=1000 [ 177.751412][ T5403] CPU: 0 PID: 5403 Comm: syz.3.288 Not tainted syzkaller #0 [ 177.758757][ T5403] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 177.768833][ T5403] Call Trace: [ 177.772127][ T5403] [ 177.775066][ T5403] dump_stack_lvl+0x188/0x24e [ 177.779757][ T5403] ? ___ratelimit+0x14e/0x610 [ 177.784456][ T5403] ? show_regs_print_info+0x12/0x12 [ 177.789669][ T5403] ? load_image+0x410/0x410 [ 177.794194][ T5403] ? ___ratelimit+0x474/0x610 [ 177.798892][ T5403] ? radix_tree_cpu_dead+0x160/0x160 [ 177.804200][ T5403] dump_header+0xd8/0x820 [ 177.808592][ T5403] oom_kill_process+0x361/0x550 [ 177.813487][ T5403] out_of_memory+0xe25/0x1220 [ 177.818217][ T5403] ? print_unlock_imbalance_bug+0x160/0x160 [ 177.824129][ T5403] ? mutex_lock_nested+0x10/0x10 [ 177.829067][ T5403] ? unregister_oom_notifier+0x20/0x20 [ 177.834561][ T5403] mem_cgroup_out_of_memory+0x2c0/0x390 [ 177.840199][ T5403] ? mem_cgroup_oom_trylock+0x210/0x210 [ 177.845762][ T5403] ? do_raw_spin_unlock+0x11d/0x230 [ 177.850960][ T5403] try_charge_memcg+0xc9d/0x17c0 [ 177.855898][ T5403] ? __lock_acquire+0x7c40/0x7c40 [ 177.860940][ T5403] ? percpu_ref_put+0x180/0x180 [ 177.865787][ T5403] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 177.871513][ T5403] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 177.877234][ T5403] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 177.882958][ T5403] ? get_mem_cgroup_from_objcg+0x13c/0x150 [ 177.888762][ T5403] __memcg_kmem_charge_page+0x220/0x380 [ 177.894328][ T5403] __alloc_pages+0x21e/0x4f0 [ 177.898936][ T5403] ? zone_statistics+0x170/0x170 [ 177.903875][ T5403] ? kvmalloc_node+0x6c/0x180 [ 177.908556][ T5403] io_pages_map+0xd8/0x4d0 [ 177.913032][ T5403] io_allocate_scq_urings+0x256/0x437 [ 177.918430][ T5403] io_uring_create+0x574/0xd6c [ 177.923210][ T5403] __x64_sys_io_uring_setup+0x21b/0x230 [ 177.928795][ T5403] ? __ia32_sys_io_uring_enter+0xf0/0xf0 [ 177.934444][ T5403] ? lockdep_hardirqs_on+0x94/0x140 [ 177.939643][ T5403] do_syscall_64+0x4c/0xa0 [ 177.944054][ T5403] ? clear_bhb_loop+0x60/0xb0 [ 177.948750][ T5403] ? clear_bhb_loop+0x60/0xb0 [ 177.953425][ T5403] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 177.959317][ T5403] RIP: 0033:0x7f15dfd9e159 [ 177.963735][ T5403] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 177.983374][ T5403] RSP: 002b:00007f15e0c3dfb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 177.991788][ T5403] RAX: ffffffffffffffda RBX: 00002000000004c0 RCX: 00007f15dfd9e159 [ 177.999783][ T5403] RDX: 0000200000000100 RSI: 00002000000004c0 RDI: 0000000000000020 [ 178.007746][ T5403] RBP: 00007f15dfe3506b R08: 0000000000000000 R09: 0000000000000000 [ 178.015730][ T5403] R10: 00002000000002c0 R11: 0000000000000206 R12: 0000200000000100 [ 178.023692][ T5403] R13: 00002000000002c0 R14: 00002000000000c0 R15: 00007ffc2515d628 [ 178.031675][ T5403] [ 178.302070][ T4282] Bluetooth: hci4: command 0x0406 tx timeout [ 178.473027][ T5419] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 178.659957][ T5403] memory: usage 8kB, limit 8kB, failcnt 59 [ 178.668837][ T5403] memory+swap: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 178.875651][ T5403] kmem: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 178.897092][ T5403] Memory cgroup stats for /syz3/test: [ 178.900064][ T5403] anon 0 [ 178.900064][ T5403] file 0 [ 178.900064][ T5403] kernel 8192 [ 178.900064][ T5403] kernel_stack 0 [ 178.900064][ T5403] pagetables 0 [ 178.900064][ T5403] sec_pagetables 0 [ 178.900064][ T5403] percpu 0 [ 178.900064][ T5403] sock 0 [ 178.900064][ T5403] vmalloc 0 [ 178.900064][ T5403] shmem 0 [ 178.900064][ T5403] zswap 0 [ 178.900064][ T5403] zswapped 0 [ 178.900064][ T5403] file_mapped 0 [ 178.900064][ T5403] file_dirty 0 [ 178.900064][ T5403] file_writeback 0 [ 178.900064][ T5403] swapcached 0 [ 178.900064][ T5403] anon_thp 0 [ 178.900064][ T5403] file_thp 0 [ 178.900064][ T5403] shmem_thp 0 [ 178.900064][ T5403] inactive_anon 0 [ 178.900064][ T5403] active_anon 0 [ 178.900064][ T5403] inactive_file 0 [ 178.900064][ T5403] active_file 0 [ 178.900064][ T5403] unevictable 0 [ 178.900064][ T5403] slab_reclaimable 0 [ 178.900064][ T5403] slab_unreclaimable 96 [ 178.900064][ T5403] slab 96 [ 178.900064][ T5403] workingset_refault_anon 0 [ 179.112440][ T5403] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz3/test,task_memcg=/syz3/test,task=syz.3.288,pid=5395,uid=0 [ 179.223669][ T5403] Memory cgroup out of memory: Killed process 5403 (syz.3.288) total-vm:102244kB, anon-rss:1428kB, file-rss:22612kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 179.270118][ T4282] Bluetooth: hci4: link tx timeout [ 179.275354][ T4282] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 180.493060][ T5441] futex_wake_op: syz.2.299 tries to shift op by -1; fix this program [ 180.511537][ T5441] loop2: detected capacity change from 0 to 2048 [ 181.011692][ T5441] UDF-fs: error (device loop2): udf_process_sequence: Primary Volume Descriptor not found! [ 181.023622][ T5441] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 181.472839][ T5450] loop4: detected capacity change from 0 to 2048 [ 184.170445][ T5477] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 184.563013][ T5480] futex_wake_op: syz.4.312 tries to shift op by -1; fix this program [ 184.879857][ T5480] loop4: detected capacity change from 0 to 2048 [ 185.037671][ T5480] UDF-fs: error (device loop4): udf_process_sequence: Primary Volume Descriptor not found! [ 185.049654][ T5480] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 185.308817][ T5489] netlink: 964 bytes leftover after parsing attributes in process `syz.3.303'. [ 185.361344][ T5489] A link change request failed with some changes committed already. Interface ip6_vti0 may have been left with an inconsistent configuration, please check. [ 185.966982][ T5502] overlayfs: missing 'lowerdir' [ 186.110717][ T5503] loop1: detected capacity change from 0 to 2048 [ 186.743504][ T5503] loop1: p1 < > p4 [ 186.743504][ T5503] p4: [ 186.752344][ T5503] loop1: p4 size 722688 extends beyond EOD, truncated [ 186.932110][ T5506] loop3: detected capacity change from 0 to 1024 [ 186.939776][ T5506] EXT4-fs: Ignoring removed bh option [ 187.152878][ T5506] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 187.288021][ T4288] EXT4-fs (loop3): unmounting filesystem. [ 188.609431][ T5532] futex_wake_op: syz.2.323 tries to shift op by -1; fix this program [ 189.447749][ T5532] loop2: detected capacity change from 0 to 2048 [ 189.489264][ T5532] UDF-fs: error (device loop2): udf_process_sequence: Primary Volume Descriptor not found! [ 189.523019][ T5532] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 189.693491][ T5535] RDS: rds_bind could not find a transport for ::8000:0:20:0, load rds_tcp or rds_rdma? [ 190.065936][ T5543] overlayfs: missing 'lowerdir' [ 190.210108][ T5544] loop1: detected capacity change from 0 to 2048 [ 190.850162][ T5545] ip_tables: iptables: counters copy to user failed while replacing table [ 191.232061][ T5556] rdma_rxe: rxe_register_device failed with error -23 [ 191.264759][ T5556] rdma_rxe: failed to add lo [ 191.786306][ T5563] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 192.305227][ T5570] futex_wake_op: syz.4.335 tries to shift op by -1; fix this program [ 192.322237][ T5570] loop4: detected capacity change from 0 to 2048 [ 192.898542][ T5570] UDF-fs: error (device loop4): udf_process_sequence: Primary Volume Descriptor not found! [ 192.914216][ T5570] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 193.122769][ T5575] syz.3.337 invoked oom-killer: gfp_mask=0x402dc0(GFP_KERNEL_ACCOUNT|__GFP_NOWARN|__GFP_ZERO), order=0, oom_score_adj=1000 [ 193.161390][ T5575] CPU: 1 PID: 5575 Comm: syz.3.337 Not tainted syzkaller #0 [ 193.168760][ T5575] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 193.178831][ T5575] Call Trace: [ 193.182130][ T5575] [ 193.185079][ T5575] dump_stack_lvl+0x188/0x24e [ 193.189773][ T5575] ? ___ratelimit+0x14e/0x610 [ 193.194482][ T5575] ? show_regs_print_info+0x12/0x12 [ 193.199718][ T5575] ? load_image+0x410/0x410 [ 193.204249][ T5575] ? ___ratelimit+0x474/0x610 [ 193.208947][ T5575] ? radix_tree_cpu_dead+0x160/0x160 [ 193.214281][ T5575] dump_header+0xd8/0x820 [ 193.218636][ T5575] oom_kill_process+0x361/0x550 [ 193.223504][ T5575] out_of_memory+0xe25/0x1220 [ 193.228198][ T5575] ? print_unlock_imbalance_bug+0x160/0x160 [ 193.234114][ T5575] ? mutex_lock_nested+0x10/0x10 [ 193.239080][ T5575] ? unregister_oom_notifier+0x20/0x20 [ 193.244562][ T5575] mem_cgroup_out_of_memory+0x2c0/0x390 [ 193.250130][ T5575] ? mem_cgroup_oom_trylock+0x210/0x210 [ 193.255706][ T5575] ? do_raw_spin_unlock+0x11d/0x230 [ 193.260918][ T5575] try_charge_memcg+0xc9d/0x17c0 [ 193.265874][ T5575] ? __lock_acquire+0x7c40/0x7c40 [ 193.270940][ T5575] ? percpu_ref_put+0x180/0x180 [ 193.275820][ T5575] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 193.281580][ T5575] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 193.287325][ T5575] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 193.293069][ T5575] ? get_mem_cgroup_from_objcg+0x13c/0x150 [ 193.298898][ T5575] __memcg_kmem_charge_page+0x220/0x380 [ 193.304467][ T5575] __alloc_pages+0x21e/0x4f0 [ 193.309084][ T5575] ? zone_statistics+0x170/0x170 [ 193.314044][ T5575] ? kvmalloc_node+0x6c/0x180 [ 193.318748][ T5575] io_pages_map+0xd8/0x4d0 [ 193.323198][ T5575] io_allocate_scq_urings+0x256/0x437 [ 193.328595][ T5575] io_uring_create+0x574/0xd6c [ 193.333389][ T5575] __x64_sys_io_uring_setup+0x21b/0x230 [ 193.338958][ T5575] ? __ia32_sys_io_uring_enter+0xf0/0xf0 [ 193.344635][ T5575] ? lockdep_hardirqs_on+0x94/0x140 [ 193.349857][ T5575] do_syscall_64+0x4c/0xa0 [ 193.354288][ T5575] ? clear_bhb_loop+0x60/0xb0 [ 193.359063][ T5575] ? clear_bhb_loop+0x60/0xb0 [ 193.363753][ T5575] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 193.369667][ T5575] RIP: 0033:0x7f15dfd9e159 [ 193.374097][ T5575] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 193.393727][ T5575] RSP: 002b:00007f15e0c3dfb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 193.402177][ T5575] RAX: ffffffffffffffda RBX: 00002000000004c0 RCX: 00007f15dfd9e159 [ 193.410167][ T5575] RDX: 0000200000000100 RSI: 00002000000004c0 RDI: 0000000000000020 [ 193.418164][ T5575] RBP: 00007f15dfe3506b R08: 0000000000000000 R09: 0000000000000000 [ 193.426153][ T5575] R10: 00002000000002c0 R11: 0000000000000206 R12: 0000200000000100 [ 193.434140][ T5575] R13: 00002000000002c0 R14: 00002000000000c0 R15: 00007ffc2515d628 [ 193.442146][ T5575] [ 193.461404][ T5575] memory: usage 8kB, limit 8kB, failcnt 97 [ 193.467376][ T5575] memory+swap: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 193.475287][ T5575] kmem: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 193.483498][ T5575] Memory cgroup stats for /syz3/test: [ 193.483674][ T5575] anon 0 [ 193.483674][ T5575] file 0 [ 193.483674][ T5575] kernel 8192 [ 193.483674][ T5575] kernel_stack 0 [ 193.483674][ T5575] pagetables 0 [ 193.483674][ T5575] sec_pagetables 0 [ 193.483674][ T5575] percpu 0 [ 193.483674][ T5575] sock 0 [ 193.483674][ T5575] vmalloc 0 [ 193.483674][ T5575] shmem 0 [ 193.483674][ T5575] zswap 0 [ 193.483674][ T5575] zswapped 0 [ 193.483674][ T5575] file_mapped 0 [ 193.483674][ T5575] file_dirty 0 [ 193.483674][ T5575] file_writeback 0 [ 193.483674][ T5575] swapcached 0 [ 193.483674][ T5575] anon_thp 0 [ 193.483674][ T5575] file_thp 0 [ 193.483674][ T5575] shmem_thp 0 [ 193.483674][ T5575] inactive_anon 0 [ 193.483674][ T5575] active_anon 0 [ 193.483674][ T5575] inactive_file 0 [ 193.483674][ T5575] active_file 0 [ 193.483674][ T5575] unevictable 0 [ 193.483674][ T5575] slab_reclaimable 0 [ 193.483674][ T5575] slab_unreclaimable 96 [ 193.483674][ T5575] slab 96 [ 193.483674][ T5575] workingset_refault_anon 0 [ 194.179569][ T1276] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.194556][ T1276] ieee802154 phy1 wpan1: encryption failed: -22 [ 194.211694][ T5577] netlink: 4 bytes leftover after parsing attributes in process `syz.2.339'. [ 194.225146][ T5575] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz3/test,task_memcg=/syz3/test,task=syz.3.337,pid=5573,uid=0 [ 194.324487][ T5577] netlink: 4 bytes leftover after parsing attributes in process `syz.2.339'. [ 194.367938][ T5575] Memory cgroup out of memory: Killed process 5575 (syz.3.337) total-vm:102244kB, anon-rss:1428kB, file-rss:22612kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 194.816275][ T5589] overlayfs: missing 'lowerdir' [ 194.928904][ T5589] loop3: detected capacity change from 0 to 2048 [ 195.014867][ T5589] loop3: p1 < > p4 [ 195.014867][ T5589] p4: [ 195.043063][ T5589] loop3: p4 size 722688 extends beyond EOD, truncated [ 195.865849][ T4970] udevd[4970]: inotify_add_watch(7, /dev/loop3p4, 10) failed: No such file or directory [ 196.212201][ T49] Bluetooth: hci3: command 0x0406 tx timeout [ 196.213213][ T4277] Bluetooth: hci0: command 0x0406 tx timeout [ 196.225532][ T4282] Bluetooth: hci2: command 0x0406 tx timeout [ 196.232475][ T4291] Bluetooth: hci1: command 0x0406 tx timeout [ 196.307820][ T4946] udevd[4946]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 196.823235][ T5613] futex_wake_op: syz.1.348 tries to shift op by -1; fix this program [ 196.840046][ T5613] loop1: detected capacity change from 0 to 2048 [ 197.402258][ T5613] UDF-fs: error (device loop1): udf_process_sequence: Primary Volume Descriptor not found! [ 197.414509][ T5613] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 197.480006][ T5617] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 197.801864][ T5621] lo speed is unknown, defaulting to 1000 [ 197.954830][ T5626] loop4: detected capacity change from 0 to 8 [ 198.036460][ T5626] SQUASHFS error: lzo decompression failed, data probably corrupt [ 198.064622][ T5626] SQUASHFS error: Failed to read block 0x1c0: -5 [ 198.071014][ T5626] SQUASHFS error: Unable to read metadata cache entry [1be] [ 198.360378][ T5634] overlayfs: missing 'lowerdir' [ 198.537007][ T5635] loop2: detected capacity change from 0 to 2048 [ 198.688814][ T5635] loop2: p1 < > p4 [ 198.688814][ T5635] p4: [ 198.752842][ T5635] loop2: p4 size 722688 extends beyond EOD, truncated [ 199.128855][ T4970] udevd[4970]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 199.158768][ T4946] udevd[4946]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 200.606316][ T5649] netlink: 132 bytes leftover after parsing attributes in process `syz.0.360'. [ 201.060238][ T5660] futex_wake_op: syz.4.362 tries to shift op by -1; fix this program [ 201.077557][ T5660] loop4: detected capacity change from 0 to 2048 [ 201.561778][ T5660] UDF-fs: error (device loop4): udf_process_sequence: Primary Volume Descriptor not found! [ 201.580688][ T5660] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 201.840958][ T5664] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 202.363000][ T5676] overlayfs: missing 'lowerdir' [ 202.505434][ T5677] loop2: detected capacity change from 0 to 2048 [ 203.417360][ T5681] loop2: detected capacity change from 0 to 8 [ 203.506554][ T5681] SQUASHFS error: lzo decompression failed, data probably corrupt [ 203.534254][ T5681] SQUASHFS error: Failed to read block 0x1c0: -5 [ 203.550884][ T5681] SQUASHFS error: Unable to read metadata cache entry [1be] [ 203.851447][ T5687] bond1: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 203.906211][ T5687] infiniband syz0: set active [ 203.932628][ T5687] bond1: (slave lo): Enslaving as an active interface with an up link [ 203.961529][ T5687] infiniband syz0: set active [ 203.999221][ T5687] A link change request failed with some changes committed already. Interface tunl0 may have been left with an inconsistent configuration, please check. [ 204.165746][ T4323] lo speed is unknown, defaulting to 1000 [ 204.250145][ T5700] netlink: 132 bytes leftover after parsing attributes in process `syz.1.373'. [ 204.932896][ T4318] lo speed is unknown, defaulting to 1000 [ 204.954815][ T4821] lo speed is unknown, defaulting to 1000 [ 205.303235][ T5712] futex_wake_op: syz.1.375 tries to shift op by -1; fix this program [ 205.320044][ T5712] loop1: detected capacity change from 0 to 2048 [ 205.802715][ T5712] UDF-fs: error (device loop1): udf_process_sequence: Primary Volume Descriptor not found! [ 205.815350][ T5712] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 205.858822][ T5715] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 206.377422][ T5725] overlayfs: missing 'lowerdir' [ 206.946146][ T5723] loop4: detected capacity change from 0 to 2048 [ 207.011650][ T5721] rdma_rxe: rxe_register_device failed with error -23 [ 207.033710][ T5721] rdma_rxe: failed to add lo [ 207.052729][ T5723] loop4: p1 < > p4 [ 207.052729][ T5723] p4: [ 207.061115][ T5723] loop4: p4 size 722688 extends beyond EOD, truncated [ 207.284087][ T5734] netlink: 8 bytes leftover after parsing attributes in process `syz.4.385'. [ 207.708549][ T5741] netlink: 132 bytes leftover after parsing attributes in process `syz.3.386'. [ 208.415477][ T5745] netlink: 20 bytes leftover after parsing attributes in process `syz.3.388'. [ 208.997239][ T5755] futex_wake_op: syz.4.392 tries to shift op by -1; fix this program [ 209.084226][ T5755] loop4: detected capacity change from 0 to 2048 [ 209.533221][ T5755] UDF-fs: error (device loop4): udf_process_sequence: Primary Volume Descriptor not found! [ 209.544746][ T5755] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 210.147765][ T5763] loop2: detected capacity change from 0 to 2048 [ 211.075284][ T5766] vhci_hcd: Failed attach request for unsupported USB speed: super-speed-plus [ 211.127765][ T49] Bluetooth: hci1: unexpected subevent 0x0c length: 30 > 5 [ 211.985031][ T5504] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 212.242163][ T5783] netlink: 132 bytes leftover after parsing attributes in process `syz.0.398'. [ 212.852986][ T5504] usb 5-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice= 0.00 [ 212.871278][ T5504] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 213.997195][ T5799] netlink: 8 bytes leftover after parsing attributes in process `syz.1.404'. [ 214.028415][ T5799] netlink: 48 bytes leftover after parsing attributes in process `syz.1.404'. [ 214.047698][ T5504] usb 5-1: ATUSB: AT86RF231 version 1 [ 214.280228][ T5804] futex_wake_op: syz.3.405 tries to shift op by -1; fix this program [ 214.417535][ T5804] loop3: detected capacity change from 0 to 2048 [ 214.841460][ T5504] usb 5-1: Firmware version (0.0) predates our first public release. [ 214.855574][ T5801] loop2: detected capacity change from 0 to 1024 [ 214.862153][ T5504] usb 5-1: Please update to version 0.2 or newer [ 214.885959][ T5804] UDF-fs: error (device loop3): udf_process_sequence: Primary Volume Descriptor not found! [ 214.904833][ T5804] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 214.947843][ T5811] Bluetooth: MGMT ver 1.22 [ 215.066009][ T5504] usb 5-1: USB disconnect, device number 3 [ 215.076501][ T5801] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 215.222545][ T5801] EXT4-fs (loop2): orphan cleanup on readonly fs [ 215.288743][ T5813] loop1: detected capacity change from 0 to 2048 [ 215.363580][ T5801] EXT4-fs error (device loop2): ext4_free_blocks:6220: comm syz.2.402: Freeing blocks not in datazone - block = 0, count = 4096 [ 215.403330][ T5813] loop1: p1 < > p4 [ 215.403330][ T5813] p4: [ 215.411991][ T5813] loop1: p4 size 722688 extends beyond EOD, truncated [ 215.445641][ T5801] EXT4-fs (loop2): 1 orphan inode deleted [ 215.468957][ T5801] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 215.668634][ T5801] EXT4-fs error (device loop2): ext4_readdir:263: inode #2: block 16: comm syz.2.402: path /95/file1: bad entry in directory: inode out of bounds - offset=44, inode=40, rec_len=16, size=1024 fake=0 [ 215.755854][ T5818] rdma_rxe: rxe_register_device failed with error -23 [ 215.782690][ T5818] rdma_rxe: failed to add lo [ 215.846724][ T5801] EXT4-fs error (device loop2): ext4_readdir:263: inode #2: block 17: comm syz.2.402: path /95/file1: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, size=1024 fake=0 [ 215.970952][ T5817] EXT4-fs error (device loop2): ext4_lookup:1860: inode #15: comm syz.2.402: iget: bad i_size value: 1970324836974602 [ 217.302209][ T4280] EXT4-fs (loop2): unmounting filesystem. [ 217.767059][ T5840] netlink: 8 bytes leftover after parsing attributes in process `syz.0.415'. [ 217.779318][ T5840] netlink: 8 bytes leftover after parsing attributes in process `syz.0.415'. [ 217.789577][ T5840] netlink: 8 bytes leftover after parsing attributes in process `syz.0.415'. [ 217.800772][ T5840] netlink: 8 bytes leftover after parsing attributes in process `syz.0.415'. [ 217.811588][ T5840] netlink: 8 bytes leftover after parsing attributes in process `syz.0.415'. [ 218.949271][ T5847] futex_wake_op: syz.2.418 tries to shift op by -1; fix this program [ 218.974131][ T5847] loop2: detected capacity change from 0 to 2048 [ 219.448343][ T5847] UDF-fs: error (device loop2): udf_process_sequence: Primary Volume Descriptor not found! [ 219.470751][ T5847] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 221.334838][ T5854] snd_dummy snd_dummy.0: control 0:4:0:syz0:0 is already present [ 222.157475][ T5879] loop1: detected capacity change from 0 to 8 [ 222.401282][ T5884] futex_wake_op: syz.3.431 tries to shift op by -1; fix this program [ 222.425479][ T5884] loop3: detected capacity change from 0 to 2048 [ 222.903670][ T5884] UDF-fs: error (device loop3): udf_process_sequence: Primary Volume Descriptor not found! [ 222.922918][ T5884] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 223.190698][ T5887] loop4: detected capacity change from 0 to 2048 [ 223.618886][ T5879] SQUASHFS error: lzo decompression failed, data probably corrupt [ 223.685130][ T5879] SQUASHFS error: Failed to read block 0x1c0: -5 [ 223.752375][ T5879] SQUASHFS error: Unable to read metadata cache entry [1be] [ 227.582603][ T5933] snd_dummy snd_dummy.0: control 0:4:0:syz0:0 is already present [ 227.963245][ T5935] tipc: Failed to remove unknown binding: 66,0,0/0:1533289067/1533289069 [ 228.000653][ T5931] device syzkaller0 entered promiscuous mode [ 228.016988][ T5935] tipc: Failed to remove unknown binding: 66,0,0/0:1533289067/1533289068 [ 228.038073][ T5935] tipc: Failed to remove unknown binding: 66,0,0/0:1533289067/1533289069 [ 228.051620][ T5935] tipc: Failed to remove unknown binding: 66,0,0/0:1533289067/1533289068 [ 231.627379][ T5966] loop2: detected capacity change from 0 to 512 [ 231.781550][ T22] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 231.792153][ T5966] ext3: Unknown parameter 'pcr' [ 232.027357][ T5956] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 232.056257][ T5971] futex_wake_op: syz.4.453 tries to shift op by -1; fix this program [ 232.073774][ T5971] loop4: detected capacity change from 0 to 2048 [ 232.081733][ T5971] UDF-fs: error (device loop4): udf_process_sequence: Primary Volume Descriptor not found! [ 232.095496][ T5971] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 232.149947][ T22] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice= 0.00 [ 232.170833][ T22] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 233.813393][ T5977] ksmbd: Daemon and kernel module version mismatch. ksmbd: 0, kernel module: 1. User-space ksmbd should terminate. [ 233.987325][ T5977] netlink: 8 bytes leftover after parsing attributes in process `syz.1.454'. [ 234.021719][ T22] usb 1-1: ATUSB: AT86RF231 version 1 [ 234.226326][ T22] usb 1-1: Firmware version (0.0) predates our first public release. [ 234.238755][ T22] usb 1-1: Please update to version 0.2 or newer [ 234.373536][ T22] usb 1-1: USB disconnect, device number 4 [ 236.411907][ T6015] snd_dummy snd_dummy.0: control 0:4:0:syz0:0 is already present [ 238.847190][ T6028] loop2: detected capacity change from 0 to 1024 [ 238.949374][ T6028] EXT4-fs (loop2): revision level too high, forcing read-only mode [ 238.960187][ T6028] EXT4-fs (loop2): orphan cleanup on readonly fs [ 238.977444][ T6028] EXT4-fs error (device loop2): ext4_free_blocks:6220: comm syz.2.471: Freeing blocks not in datazone - block = 0, count = 4096 [ 239.051394][ T6028] EXT4-fs (loop2): 1 orphan inode deleted [ 239.110423][ T6028] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 239.254210][ T4280] EXT4-fs (loop2): unmounting filesystem. [ 240.445168][ T6045] futex_wake_op: syz.4.467 tries to shift op by -1; fix this program [ 240.495316][ T6045] loop4: detected capacity change from 0 to 2048 [ 240.535667][ T6045] UDF-fs: error (device loop4): udf_process_sequence: Primary Volume Descriptor not found! [ 240.554794][ T6045] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 240.623113][ T4321] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 241.022667][ T6049] snd_dummy snd_dummy.0: control 0:4:0:syz0:0 is already present [ 241.622515][ T4321] usb 3-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice= 0.00 [ 241.661313][ T4321] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 243.432121][ T4321] usb 3-1: ATUSB: AT86RF231 version 1 [ 243.470534][ T6063] rdma_rxe: rxe_register_device failed with error -23 [ 243.479718][ T6063] rdma_rxe: failed to add lo [ 243.633053][ T4321] usb 3-1: Firmware version (0.0) predates our first public release. [ 243.660143][ T4321] usb 3-1: Please update to version 0.2 or newer [ 243.733021][ T4321] usb 3-1: USB disconnect, device number 4 [ 244.277118][ T6078] hub 8-0:1.0: USB hub found [ 244.284672][ T6078] hub 8-0:1.0: 1 port detected [ 245.196376][ T6090] Bluetooth: ISO socket layer initialized [ 245.412888][ T6094] futex_wake_op: syz.2.486 tries to shift op by -1; fix this program [ 245.464518][ T6094] loop2: detected capacity change from 0 to 2048 [ 245.483147][ T6094] UDF-fs: error (device loop2): udf_process_sequence: Primary Volume Descriptor not found! [ 245.536967][ T6094] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 245.654380][ T6080] kcov: kcov: vm_insert_page() failed [ 246.533164][ T6100] snd_dummy snd_dummy.0: control 0:4:0:syz0:0 is already present [ 247.416631][ T6106] xt_cgroup: invalid path, errno=-2 [ 248.226050][ T6110] rdma_rxe: already configured on lo [ 248.268141][ T6110] infiniband syz0: set down [ 248.305755][ T4821] lo speed is unknown, defaulting to 1000 [ 248.314603][ T4821] lo speed is unknown, defaulting to 1000 [ 251.468424][ T6137] futex_wake_op: syz.0.500 tries to shift op by -1; fix this program [ 251.519193][ T6137] loop0: detected capacity change from 0 to 2048 [ 251.532218][ T6137] UDF-fs: error (device loop0): udf_process_sequence: Primary Volume Descriptor not found! [ 251.549016][ T6137] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 251.926140][ T6138] loop2: detected capacity change from 0 to 1024 [ 252.093064][ T6141] snd_dummy snd_dummy.0: control 0:4:0:syz0:0 is already present [ 252.947902][ T6147] xt_cgroup: invalid path, errno=-2 [ 255.125917][ T6166] rdma_rxe: rxe_register_device failed with error -23 [ 255.429444][ T6166] rdma_rxe: failed to add lo [ 255.493575][ T1276] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.194174][ T6177] futex_wake_op: syz.4.514 tries to shift op by -1; fix this program [ 256.211469][ T6177] loop4: detected capacity change from 0 to 2048 [ 256.222274][ T6177] UDF-fs: error (device loop4): udf_process_sequence: Primary Volume Descriptor not found! [ 256.388553][ T6178] snd_dummy snd_dummy.0: control 0:4:0:syz0:0 is already present [ 257.302163][ T6177] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 257.329130][ T6175] loop0: detected capacity change from 0 to 1024 [ 257.844123][ T6185] xt_cgroup: invalid path, errno=-2 [ 259.798333][ T6218] rdma_rxe: rxe_register_device failed with error -23 [ 259.866032][ T6218] rdma_rxe: failed to add lo [ 260.490522][ T6225] snd_dummy snd_dummy.0: control 0:4:0:syz0:0 is already present [ 262.193388][ T6239] loop2: detected capacity change from 0 to 1024 [ 262.760463][ T6253] xt_cgroup: invalid path, errno=-2 [ 263.843215][ T6262] snd_dummy snd_dummy.0: control 0:4:0:syz0:0 is already present [ 265.823150][ T6277] futex_wake_op: syz.0.528 tries to shift op by -1; fix this program [ 265.840269][ T6277] loop0: detected capacity change from 0 to 2048 [ 265.883807][ T6277] UDF-fs: error (device loop0): udf_process_sequence: Primary Volume Descriptor not found! [ 265.897075][ T6277] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 266.459771][ T6283] loop4: detected capacity change from 0 to 1024 [ 266.778578][ T6284] xt_cgroup: invalid path, errno=-2 [ 268.804671][ T6305] netlink: 8 bytes leftover after parsing attributes in process `syz.4.550'. [ 269.066046][ T6314] netlink: 20 bytes leftover after parsing attributes in process `syz.4.555'. [ 270.169360][ T6329] syz.3.559 invoked oom-killer: gfp_mask=0x402dc0(GFP_KERNEL_ACCOUNT|__GFP_NOWARN|__GFP_ZERO), order=0, oom_score_adj=1000 [ 270.227058][ T6329] CPU: 0 PID: 6329 Comm: syz.3.559 Not tainted syzkaller #0 [ 270.234409][ T6329] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 270.244487][ T6329] Call Trace: [ 270.247782][ T6329] [ 270.250735][ T6329] dump_stack_lvl+0x188/0x24e [ 270.255441][ T6329] ? ___ratelimit+0x14e/0x610 [ 270.260141][ T6329] ? show_regs_print_info+0x12/0x12 [ 270.265371][ T6329] ? load_image+0x410/0x410 [ 270.269902][ T6329] ? ___ratelimit+0x474/0x610 [ 270.274604][ T6329] ? radix_tree_cpu_dead+0x160/0x160 [ 270.279920][ T6329] dump_header+0xd8/0x820 [ 270.284291][ T6329] oom_kill_process+0x361/0x550 [ 270.289176][ T6329] out_of_memory+0xe25/0x1220 [ 270.293881][ T6329] ? print_unlock_imbalance_bug+0x160/0x160 [ 270.299829][ T6329] ? mutex_lock_nested+0x10/0x10 [ 270.304839][ T6329] ? unregister_oom_notifier+0x20/0x20 [ 270.310337][ T6329] mem_cgroup_out_of_memory+0x2c0/0x390 [ 270.315894][ T6329] ? mem_cgroup_oom_trylock+0x210/0x210 [ 270.321463][ T6329] ? do_raw_spin_unlock+0x11d/0x230 [ 270.326659][ T6329] try_charge_memcg+0xc9d/0x17c0 [ 270.331597][ T6329] ? __lock_acquire+0x7c40/0x7c40 [ 270.336630][ T6329] ? percpu_ref_put+0x180/0x180 [ 270.341476][ T6329] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 270.347201][ T6329] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 270.353000][ T6329] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 270.358719][ T6329] ? get_mem_cgroup_from_objcg+0x13c/0x150 [ 270.364524][ T6329] __memcg_kmem_charge_page+0x220/0x380 [ 270.370078][ T6329] __alloc_pages+0x21e/0x4f0 [ 270.374667][ T6329] ? zone_statistics+0x170/0x170 [ 270.379614][ T6329] ? kvmalloc_node+0x6c/0x180 [ 270.384331][ T6329] io_pages_map+0xd8/0x4d0 [ 270.388751][ T6329] io_allocate_scq_urings+0x256/0x437 [ 270.394129][ T6329] io_uring_create+0x574/0xd6c [ 270.398905][ T6329] __x64_sys_io_uring_setup+0x21b/0x230 [ 270.404460][ T6329] ? __ia32_sys_io_uring_enter+0xf0/0xf0 [ 270.410103][ T6329] ? lockdep_hardirqs_on+0x94/0x140 [ 270.415301][ T6329] do_syscall_64+0x4c/0xa0 [ 270.419711][ T6329] ? clear_bhb_loop+0x60/0xb0 [ 270.424381][ T6329] ? clear_bhb_loop+0x60/0xb0 [ 270.429055][ T6329] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 270.434946][ T6329] RIP: 0033:0x7f15dfd9e159 [ 270.439354][ T6329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 270.458983][ T6329] RSP: 002b:00007f15e0c3dfb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 270.467418][ T6329] RAX: ffffffffffffffda RBX: 00002000000004c0 RCX: 00007f15dfd9e159 [ 270.475383][ T6329] RDX: 0000200000000100 RSI: 00002000000004c0 RDI: 0000000000000020 [ 270.483348][ T6329] RBP: 00007f15dfe3506b R08: 0000000000000000 R09: 0000000000000000 [ 270.491313][ T6329] R10: 00002000000002c0 R11: 0000000000000206 R12: 0000200000000100 [ 270.499287][ T6329] R13: 00002000000002c0 R14: 00002000000000c0 R15: 00007ffc2515d628 [ 270.507264][ T6329] [ 270.516472][ T6329] memory: usage 8kB, limit 8kB, failcnt 154 [ 270.526868][ T6329] memory+swap: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 270.534688][ T6329] kmem: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 270.541960][ T6329] Memory cgroup stats for /syz3/test: [ 270.542121][ T6329] anon 0 [ 270.542121][ T6329] file 0 [ 270.542121][ T6329] kernel 8192 [ 270.542121][ T6329] kernel_stack 0 [ 270.542121][ T6329] pagetables 0 [ 270.542121][ T6329] sec_pagetables 0 [ 270.542121][ T6329] percpu 0 [ 270.542121][ T6329] sock 0 [ 270.542121][ T6329] vmalloc 0 [ 270.542121][ T6329] shmem 0 [ 270.542121][ T6329] zswap 0 [ 270.542121][ T6329] zswapped 0 [ 270.542121][ T6329] file_mapped 0 [ 270.542121][ T6329] file_dirty 0 [ 270.542121][ T6329] file_writeback 0 [ 270.542121][ T6329] swapcached 0 [ 270.542121][ T6329] anon_thp 0 [ 270.542121][ T6329] file_thp 0 [ 270.542121][ T6329] shmem_thp 0 [ 270.542121][ T6329] inactive_anon 0 [ 270.542121][ T6329] active_anon 0 [ 270.542121][ T6329] inactive_file 0 [ 270.542121][ T6329] active_file 0 [ 270.542121][ T6329] unevictable 0 [ 270.542121][ T6329] slab_reclaimable 0 [ 270.542121][ T6329] slab_unreclaimable 96 [ 270.542121][ T6329] slab 96 [ 270.542121][ T6329] workingset_refault_anon 0 [ 271.261466][ T6329] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz3/test,task_memcg=/syz3/test,task=syz.3.559,pid=6328,uid=0 [ 271.298671][ T6329] Memory cgroup out of memory: Killed process 6328 (syz.3.559) total-vm:102376kB, anon-rss:1408kB, file-rss:21896kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 271.810254][ T6374] rdma_rxe: rxe_register_device failed with error -23 [ 271.850199][ T6374] rdma_rxe: failed to add lo [ 272.545263][ T6394] loop1: detected capacity change from 0 to 1024 [ 272.643536][ T6396] netlink: 8 bytes leftover after parsing attributes in process `syz.0.581'. [ 272.804475][ T6398] xt_cgroup: invalid path, errno=-2 [ 273.606292][ T6414] xt_l2tp: invalid flags combination: 8 [ 273.640906][ T6419] rdma_rxe: rxe_register_device failed with error -23 [ 273.669884][ T6419] rdma_rxe: failed to add lo [ 273.743922][ T4281] hid-generic 0005:0008:0009.0001: item fetching failed at offset 2/3 [ 273.787996][ T4281] hid-generic: probe of 0005:0008:0009.0001 failed with error -22 [ 274.455873][ T6441] loop2: detected capacity change from 0 to 1024 [ 274.685452][ T6446] xt_cgroup: invalid path, errno=-2 [ 274.933801][ T6454] netlink: 24 bytes leftover after parsing attributes in process `syz.3.604'. [ 274.979000][ T6457] rdma_rxe: rxe_register_device failed with error -23 [ 275.017779][ T6457] rdma_rxe: failed to add lo [ 276.185515][ T6488] loop2: detected capacity change from 0 to 1024 [ 276.211139][ T6488] EXT4-fs: Ignoring removed bh option [ 276.309600][ T6488] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 276.384209][ T4280] EXT4-fs (loop2): unmounting filesystem. [ 276.407770][ T6497] rdma_rxe: rxe_register_device failed with error -23 [ 276.436371][ T6497] rdma_rxe: failed to add lo [ 276.498686][ T6502] loop0: detected capacity change from 0 to 1024 [ 276.815977][ T6510] xt_cgroup: invalid path, errno=-2 [ 277.525090][ T6515] snd_dummy snd_dummy.0: control 0:4:0:syz0:0 is already present [ 278.412677][ T6519] netlink: 'syz.4.624': attribute type 1 has an invalid length. [ 278.609720][ T6526] device veth3 entered promiscuous mode [ 278.635510][ T6526] bond1: (slave veth3): Enslaving as a backup interface with a down link [ 278.646586][ T6532] loop2: detected capacity change from 0 to 1024 [ 278.653924][ T6532] EXT4-fs: Ignoring removed bh option [ 278.664800][ T6519] netlink: 28 bytes leftover after parsing attributes in process `syz.4.624'. [ 278.727395][ T6519] 8021q: adding VLAN 0 to HW filter on device bond1 [ 278.729358][ T6537] rdma_rxe: rxe_register_device failed with error -23 [ 278.742266][ T6532] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 278.782172][ T6537] rdma_rxe: failed to add lo [ 278.940933][ T4280] EXT4-fs (loop2): unmounting filesystem. [ 279.220910][ T6553] loop2: detected capacity change from 0 to 1024 [ 279.703344][ T6561] xt_cgroup: invalid path, errno=-2 [ 280.989529][ T6576] snd_dummy snd_dummy.0: control 0:4:0:syz0:0 is already present [ 281.032407][ T6575] netlink: 4 bytes leftover after parsing attributes in process `syz.3.640'. [ 281.249606][ T6582] rdma_rxe: rxe_register_device failed with error -23 [ 281.262282][ T6569] netlink: 4 bytes leftover after parsing attributes in process `syz.3.640'. [ 281.293209][ T6582] rdma_rxe: failed to add lo [ 282.349289][ T6604] loop1: detected capacity change from 0 to 1024 [ 282.366258][ T6602] netlink: 8 bytes leftover after parsing attributes in process `syz.2.650'. [ 282.738018][ T6614] xt_cgroup: invalid path, errno=-2 [ 284.178507][ T6633] netlink: 12 bytes leftover after parsing attributes in process `syz.4.644'. [ 284.353097][ T6640] tipc: Started in network mode [ 284.372746][ T6640] tipc: Node identity 9eaf63824174, cluster identity 4711 [ 284.418508][ T6640] tipc: Enabled bearer , priority 0 [ 284.445717][ T6642] device syzkaller0 entered promiscuous mode [ 284.480628][ T6640] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 284.495719][ T6645] loop2: detected capacity change from 0 to 1024 [ 284.540207][ T6645] EXT4-fs: Ignoring removed bh option [ 284.561010][ T6640] sch_tbf: burst 8 is lower than device syzkaller0 mtu (1514) ! [ 284.577884][ T6640] tipc: Resetting bearer [ 284.608584][ T6639] tipc: Resetting bearer [ 284.621131][ T6645] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 284.687921][ T6639] tipc: Disabling bearer [ 284.722362][ T4280] EXT4-fs (loop2): unmounting filesystem. [ 284.811523][ T6650] snd_dummy snd_dummy.0: control 0:4:0:syz0:0 is already present [ 286.267481][ T6665] loop4: detected capacity change from 0 to 1024 [ 286.359927][ T6668] rdma_rxe: rxe_register_device failed with error -23 [ 286.387722][ T6668] rdma_rxe: failed to add lo [ 286.618099][ T6676] xt_cgroup: invalid path, errno=-2 [ 286.838640][ T6680] netlink: 8 bytes leftover after parsing attributes in process `syz.2.667'. [ 287.933430][ T6690] RDS: rds_bind could not find a transport for ::ffff:100.1.1.2, load rds_tcp or rds_rdma? [ 288.101085][ T6690] netlink: 68 bytes leftover after parsing attributes in process `syz.4.669'. [ 288.829150][ T6717] snd_dummy snd_dummy.0: control 0:4:0:syz0:0 is already present [ 292.040766][ T6745] rdma_rxe: rxe_register_device failed with error -23 [ 292.058037][ T6744] loop2: detected capacity change from 0 to 1024 [ 292.071429][ T6745] rdma_rxe: failed to add lo [ 292.397472][ T6744] xt_cgroup: invalid path, errno=-2 [ 293.529868][ T6772] syz.3.694 invoked oom-killer: gfp_mask=0x402dc0(GFP_KERNEL_ACCOUNT|__GFP_NOWARN|__GFP_ZERO), order=0, oom_score_adj=1000 [ 293.612967][ T6772] CPU: 1 PID: 6772 Comm: syz.3.694 Not tainted syzkaller #0 [ 293.620320][ T6772] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 293.630398][ T6772] Call Trace: [ 293.633684][ T6772] [ 293.636614][ T6772] dump_stack_lvl+0x188/0x24e [ 293.641294][ T6772] ? ___ratelimit+0x14e/0x610 [ 293.645972][ T6772] ? show_regs_print_info+0x12/0x12 [ 293.651339][ T6772] ? load_image+0x410/0x410 [ 293.655853][ T6772] ? ___ratelimit+0x474/0x610 [ 293.660532][ T6772] ? radix_tree_cpu_dead+0x160/0x160 [ 293.665820][ T6772] dump_header+0xd8/0x820 [ 293.670157][ T6772] oom_kill_process+0x361/0x550 [ 293.675023][ T6772] out_of_memory+0xe25/0x1220 [ 293.679706][ T6772] ? print_unlock_imbalance_bug+0x160/0x160 [ 293.685606][ T6772] ? mutex_lock_nested+0x10/0x10 [ 293.690551][ T6772] ? unregister_oom_notifier+0x20/0x20 [ 293.696015][ T6772] mem_cgroup_out_of_memory+0x2c0/0x390 [ 293.701572][ T6772] ? mem_cgroup_oom_trylock+0x210/0x210 [ 293.707125][ T6772] ? do_raw_spin_unlock+0x11d/0x230 [ 293.712352][ T6772] try_charge_memcg+0xc9d/0x17c0 [ 293.717295][ T6772] ? __lock_acquire+0x7c40/0x7c40 [ 293.722331][ T6772] ? percpu_ref_put+0x180/0x180 [ 293.727182][ T6772] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 293.732913][ T6772] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 293.738630][ T6772] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 293.744348][ T6772] ? get_mem_cgroup_from_objcg+0x13c/0x150 [ 293.750330][ T6772] __memcg_kmem_charge_page+0x220/0x380 [ 293.755881][ T6772] __alloc_pages+0x21e/0x4f0 [ 293.760478][ T6772] ? zone_statistics+0x170/0x170 [ 293.765424][ T6772] ? kvmalloc_node+0x6c/0x180 [ 293.770110][ T6772] io_pages_map+0xd8/0x4d0 [ 293.774550][ T6772] io_allocate_scq_urings+0x256/0x437 [ 293.779940][ T6772] io_uring_create+0x574/0xd6c [ 293.784712][ T6772] __x64_sys_io_uring_setup+0x21b/0x230 [ 293.790261][ T6772] ? __ia32_sys_io_uring_enter+0xf0/0xf0 [ 293.795907][ T6772] ? lockdep_hardirqs_on+0x94/0x140 [ 293.801113][ T6772] do_syscall_64+0x4c/0xa0 [ 293.805554][ T6772] ? clear_bhb_loop+0x60/0xb0 [ 293.810242][ T6772] ? clear_bhb_loop+0x60/0xb0 [ 293.814939][ T6772] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 293.820854][ T6772] RIP: 0033:0x7f15dfd9e159 [ 293.825269][ T6772] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 293.844878][ T6772] RSP: 002b:00007f15e0c3dfb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 293.853307][ T6772] RAX: ffffffffffffffda RBX: 00002000000004c0 RCX: 00007f15dfd9e159 [ 293.861294][ T6772] RDX: 0000200000000100 RSI: 00002000000004c0 RDI: 0000000000000020 [ 293.869270][ T6772] RBP: 00007f15dfe3506b R08: 0000000000000000 R09: 0000000000000000 [ 293.877236][ T6772] R10: 00002000000002c0 R11: 0000000000000206 R12: 0000200000000100 [ 293.885210][ T6772] R13: 00002000000002c0 R14: 00002000000000c0 R15: 00007ffc2515d628 [ 293.893220][ T6772] [ 294.630184][ T6772] memory: usage 8kB, limit 8kB, failcnt 228 [ 294.646995][ T6772] memory+swap: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 294.711352][ T6772] kmem: usage 8kB, limit 9007199254740988kB, failcnt 0 [ 294.718300][ T6772] Memory cgroup stats for /syz3/test: [ 294.718484][ T6772] anon 0 [ 294.718484][ T6772] file 0 [ 294.718484][ T6772] kernel 8192 [ 294.718484][ T6772] kernel_stack 0 [ 294.718484][ T6772] pagetables 0 [ 294.718484][ T6772] sec_pagetables 0 [ 294.718484][ T6772] percpu 0 [ 294.718484][ T6772] sock 0 [ 294.718484][ T6772] vmalloc 0 [ 294.718484][ T6772] shmem 0 [ 294.718484][ T6772] zswap 0 [ 294.718484][ T6772] zswapped 0 [ 294.718484][ T6772] file_mapped 0 [ 294.718484][ T6772] file_dirty 0 [ 294.718484][ T6772] file_writeback 0 [ 294.718484][ T6772] swapcached 0 [ 294.718484][ T6772] anon_thp 0 [ 294.718484][ T6772] file_thp 0 [ 294.718484][ T6772] shmem_thp 0 [ 294.718484][ T6772] inactive_anon 0 [ 294.718484][ T6772] active_anon 0 [ 294.718484][ T6772] inactive_file 0 [ 294.718484][ T6772] active_file 0 [ 294.718484][ T6772] unevictable 0 [ 294.718484][ T6772] slab_reclaimable 0 [ 294.718484][ T6772] slab_unreclaimable 96 [ 294.718484][ T6772] slab 96 [ 294.718484][ T6772] workingset_refault_anon 0 [ 294.934861][ T6778] snd_dummy snd_dummy.0: control 0:4:0:syz0:0 is already present [ 295.657005][ T6772] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz3/test,task_memcg=/syz3/test,task=syz.3.694,pid=6771,uid=0 [ 295.721321][ T6772] Memory cgroup out of memory: Killed process 6771 (syz.3.694) total-vm:102376kB, anon-rss:1408kB, file-rss:21896kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 296.102713][ T6802] overlayfs: failed to resolve './file0': -2 [ 296.125685][ T6802] loop0: detected capacity change from 0 to 2048 [ 296.795236][ T6802] loop0: p1 < > p4 [ 296.795236][ T6802] p4: [ 296.803475][ T6802] loop0: p4 size 722688 extends beyond EOD, truncated [ 296.932234][ T6749] I/O error, dev loop0, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 297.061581][ T6811] rdma_rxe: rxe_register_device failed with error -23 [ 297.180619][ T6811] rdma_rxe: failed to add lo [ 297.207352][ T6749] udevd[6749]: inotify_add_watch(7, /dev/loop0p1, 10) failed: No such file or directory [ 297.239087][ T6821] udevd[6821]: inotify_add_watch(7, /dev/loop0p4, 10) failed: No such file or directory [ 297.274410][ T6822] loop0: detected capacity change from 0 to 1024 [ 298.631666][ T6822] xt_cgroup: invalid path, errno=-2 [ 299.415663][ T6846] loop2: detected capacity change from 0 to 2048 [ 299.947459][ T6846] loop2: p1 < > p4 [ 299.947459][ T6846] p4: [ 299.958641][ T6846] loop2: p4 size 722688 extends beyond EOD, truncated [ 300.073663][ T6821] udevd[6821]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 300.107691][ T6749] udevd[6749]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 300.292504][ T6857] bond1: (slave lo): Releasing backup interface [ 300.340697][ T6857] bond1: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 300.453412][ T6857] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 300.538179][ T6864] Cannot find set identified by id 0 to match [ 300.576344][ T6862] Cannot find set identified by id 0 to match [ 301.945539][ T6890] netlink: 28 bytes leftover after parsing attributes in process `syz.0.721'. [ 302.629172][ T6914] tipc: Enabled bearer , priority 0 [ 302.732996][ T6918] device syzkaller0 entered promiscuous mode [ 302.824536][ T6920] netlink: 8 bytes leftover after parsing attributes in process `syz.1.728'. [ 303.178270][ T6914] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 303.515385][ T6911] tipc: Resetting bearer [ 303.671874][ T6931] rdma_rxe: already configured on lo [ 303.685426][ T6911] tipc: Disabling bearer [ 303.831560][ T4281] tipc: Node number set to 3755697026 [ 304.205086][ T6955] netlink: 12 bytes leftover after parsing attributes in process `syz.2.735'. [ 304.300260][ T6954] netlink: 28 bytes leftover after parsing attributes in process `syz.4.737'. [ 305.784509][ T6985] netlink: 8 bytes leftover after parsing attributes in process `syz.4.742'. [ 306.605643][ T6989] rdma_rxe: already configured on lo [ 306.609002][ T6993] tipc: Enabled bearer , priority 0 [ 306.619441][ T6993] device syzkaller0 entered promiscuous mode [ 306.629556][ T6993] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 306.663444][ T6993] sch_tbf: burst 8 is lower than device syzkaller0 mtu (1514) ! [ 306.687742][ T6997] netlink: 'syz.1.740': attribute type 29 has an invalid length. [ 306.744898][ T6991] tipc: Resetting bearer [ 306.751760][ T6997] netlink: 8 bytes leftover after parsing attributes in process `syz.1.740'. [ 306.893871][ T6991] tipc: Disabling bearer [ 306.966021][ T6997] netlink: 'syz.1.740': attribute type 29 has an invalid length. [ 306.984918][ T6997] netlink: 8 bytes leftover after parsing attributes in process `syz.1.740'. [ 307.170706][ T7008] device syzkaller0 entered promiscuous mode [ 307.485763][ T7019] netlink: 'syz.3.751': attribute type 1 has an invalid length. [ 307.705681][ T7025] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 307.767585][ T7028] netlink: 28 bytes leftover after parsing attributes in process `syz.3.751'. [ 307.839304][ T4361] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 307.840106][ T7028] 8021q: adding VLAN 0 to HW filter on device bond1 [ 307.995089][ T4361] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 308.182345][ T4339] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 308.369147][ T7037] netlink: 12 bytes leftover after parsing attributes in process `syz.2.755'. [ 309.005914][ T7049] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 309.202987][ T7051] rdma_rxe: rxe_register_device failed with error -23 [ 309.209894][ T7051] rdma_rxe: failed to add lo [ 309.323261][ T7055] tipc: Started in network mode [ 309.350321][ T7055] tipc: Node identity 1a14e63c03f1, cluster identity 4711 [ 309.368776][ T7055] tipc: Enabled bearer , priority 0 [ 309.387459][ T7056] device syzkaller0 entered promiscuous mode [ 309.418319][ T7055] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 309.522651][ T7054] tipc: Resetting bearer [ 309.602467][ T7054] tipc: Disabling bearer [ 309.621856][ T7063] netlink: 8 bytes leftover after parsing attributes in process `syz.3.763'. [ 309.639255][ T7063] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 310.376248][ T49] Bluetooth: hci4: command 0x0405 tx timeout [ 310.537831][ T7073] netlink: 'syz.1.766': attribute type 1 has an invalid length. [ 310.555879][ T7075] Bluetooth: MGMT ver 1.22 [ 310.732166][ T7077] bond1: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 310.750620][ T7079] netlink: 28 bytes leftover after parsing attributes in process `syz.1.766'. [ 310.791518][ T4339] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 310.814324][ T7079] 8021q: adding VLAN 0 to HW filter on device bond1 [ 310.848123][ T7082] netlink: 12 bytes leftover after parsing attributes in process `syz.3.770'. [ 310.943254][ T4339] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 313.271648][ T7102] tipc: Started in network mode [ 313.276562][ T7102] tipc: Node identity def8e07b238, cluster identity 4711 [ 313.301460][ T7102] tipc: Enabled bearer , priority 0 [ 313.322488][ T7102] device syzkaller0 entered promiscuous mode [ 313.354265][ T7102] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 313.455165][ T7101] tipc: Resetting bearer [ 313.519753][ T7101] tipc: Disabling bearer [ 313.614986][ T7113] loop2: detected capacity change from 0 to 256 [ 315.054575][ T7131] netlink: 12 bytes leftover after parsing attributes in process `syz.2.786'. [ 316.316536][ T7147] loop2: detected capacity change from 0 to 256 [ 316.933025][ T1276] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.506755][ T7175] netlink: 12 bytes leftover after parsing attributes in process `syz.1.802'. [ 317.522918][ T4277] Bluetooth: hci4: link tx timeout [ 317.531785][ T4277] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 317.539541][ T4277] Bluetooth: hci4: link tx timeout [ 317.545135][ T4277] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 317.700699][ T7180] netlink: 220 bytes leftover after parsing attributes in process `syz.2.803'. [ 317.711343][ T7180] tc_dump_action: action bad kind [ 318.356356][ T7185] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 318.412590][ T7185] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 318.640243][ T7191] loop4: detected capacity change from 0 to 1024 [ 318.649977][ T7194] loop1: detected capacity change from 0 to 256 [ 318.957822][ T7200] netlink: 72 bytes leftover after parsing attributes in process `syz.0.811'. [ 319.571569][ T4277] Bluetooth: hci4: command 0x0406 tx timeout [ 319.993338][ T7218] netlink: 4 bytes leftover after parsing attributes in process `syz.2.815'. [ 320.032051][ T7218] device veth1_macvtap left promiscuous mode [ 320.157664][ T7223] xt_cgroup: invalid path, errno=-2 [ 320.551270][ T4822] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 320.752652][ T4822] usb 1-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice= 0.00 [ 320.783592][ T4822] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 321.640300][ T7246] loop3: detected capacity change from 0 to 256 [ 322.503453][ T4822] usb 1-1: Firmware version (0.0) predates our first public release. [ 322.511753][ T4822] usb 1-1: Please update to version 0.2 or newer [ 322.573548][ T4822] usb 1-1: USB disconnect, device number 5 [ 324.266217][ T7276] loop3: detected capacity change from 0 to 2048 [ 324.888281][ T7278] loop0: detected capacity change from 0 to 1024 [ 325.434605][ T7282] xt_cgroup: invalid path, errno=-2 [ 325.617486][ T7284] loop2: detected capacity change from 0 to 256 [ 327.025767][ T7313] loop1: detected capacity change from 0 to 1024 [ 327.059722][ T7313] EXT4-fs: Ignoring removed bh option [ 327.164512][ T7313] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 327.240551][ T7315] lo speed is unknown, defaulting to 1000 [ 327.391579][ T4285] EXT4-fs (loop1): unmounting filesystem. [ 328.723301][ T7348] netlink: 24 bytes leftover after parsing attributes in process `syz.4.856'. [ 328.993928][ T7355] loop2: detected capacity change from 0 to 1024 [ 329.193222][ T7360] loop0: detected capacity change from 0 to 2048 [ 329.526509][ T7355] EXT4-fs: Ignoring removed bh option [ 329.626281][ T7360] loop0: p1 < > p4 [ 329.626281][ T7360] p4: [ 329.832018][ T7360] loop0: p4 size 722688 extends beyond EOD, truncated [ 329.872661][ T7358] loop4: detected capacity change from 0 to 1024 [ 329.934161][ T7355] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 330.308025][ T4280] EXT4-fs (loop2): unmounting filesystem. [ 330.364075][ T7375] xt_cgroup: invalid path, errno=-2 [ 332.645872][ T7395] tipc: Enabled bearer , priority 0 [ 332.715999][ T7396] device syzkaller0 entered promiscuous mode [ 332.776678][ T7395] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 332.872003][ T7394] tipc: Resetting bearer [ 332.994415][ T7394] tipc: Disabling bearer [ 333.422280][ T7412] loop0: detected capacity change from 0 to 2048 [ 333.695913][ T7412] loop0: p1 < > p4 [ 333.695913][ T7412] p4: [ 334.014314][ T7412] loop0: p4 size 722688 extends beyond EOD, truncated [ 334.096949][ T7413] loop2: detected capacity change from 0 to 1024 [ 334.168586][ T7114] udevd[7114]: inotify_add_watch(7, /dev/loop0p1, 10) failed: No such file or directory [ 334.169041][ T7255] udevd[7255]: inotify_add_watch(7, /dev/loop0p4, 10) failed: No such file or directory [ 334.189160][ T7413] EXT4-fs: Ignoring removed bh option [ 335.465399][ T7413] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 335.597454][ T4280] EXT4-fs (loop2): unmounting filesystem. [ 337.874428][ T7451] loop2: detected capacity change from 0 to 2048 [ 338.481545][ T7453] tipc: Started in network mode [ 338.486481][ T7453] tipc: Node identity c6142028945b, cluster identity 4711 [ 338.598000][ T7453] tipc: Enabled bearer , priority 0 [ 338.673744][ T7453] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 338.712840][ T7454] device syzkaller0 entered promiscuous mode [ 338.762932][ T7452] tipc: Resetting bearer [ 339.984430][ T7461] loop3: detected capacity change from 0 to 1024 [ 340.021088][ T7452] tipc: Disabling bearer [ 340.080535][ T7461] EXT4-fs: Ignoring removed bh option [ 340.165336][ T4318] tipc: Node number set to 1380917288 [ 340.230075][ T7461] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 340.436590][ T4288] EXT4-fs (loop3): unmounting filesystem. [ 340.884605][ T7470] netlink: 'syz.3.894': attribute type 12 has an invalid length. [ 341.229294][ T7470] netlink: 4 bytes leftover after parsing attributes in process `syz.3.894'. [ 342.491985][ T7487] loop2: detected capacity change from 0 to 1024 [ 343.377649][ T7502] loop0: detected capacity change from 0 to 2048 [ 343.504530][ T7502] loop0: p1 < > p4 [ 343.504530][ T7502] p4: [ 343.513316][ T7502] loop0: p4 size 722688 extends beyond EOD, truncated [ 343.536595][ T7503] xt_cgroup: invalid path, errno=-2 [ 343.585643][ T7494] tipc: Enabled bearer , priority 0 [ 343.644255][ T7494] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 343.782729][ T7493] tipc: Disabling bearer [ 344.778983][ T7514] rdma_rxe: rxe_register_device failed with error -23 [ 344.817624][ T7514] rdma_rxe: failed to add lo [ 345.596110][ T7535] netlink: 4 bytes leftover after parsing attributes in process `syz.0.915'. [ 346.335627][ T7531] tipc: Enabled bearer , priority 0 [ 346.364822][ T7531] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 346.389499][ T7545] rdma_rxe: already configured on lo [ 346.417076][ T7529] tipc: Disabling bearer [ 346.530748][ T7547] loop2: detected capacity change from 0 to 1024 [ 346.970725][ T7551] xt_cgroup: invalid path, errno=-2 [ 347.647557][ T7565] loop3: detected capacity change from 0 to 2048 [ 348.271743][ T7565] loop3: p1 < > p4 [ 348.271743][ T7565] p4: [ 348.280317][ T7565] loop3: p4 size 722688 extends beyond EOD, truncated [ 348.378741][ T7114] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 348.528539][ T7255] udevd[7255]: inotify_add_watch(7, /dev/loop3p4, 10) failed: No such file or directory [ 348.554037][ T7114] udevd[7114]: inotify_add_watch(7, /dev/loop3p1, 10) failed: No such file or directory [ 348.716712][ T7575] rdma_rxe: rxe_register_device failed with error -23 [ 348.755461][ T7575] rdma_rxe: failed to add lo [ 348.848796][ T7577] tipc: Started in network mode [ 348.888133][ T7577] tipc: Node identity 4e76d94bdb06, cluster identity 4711 [ 348.897792][ T7577] tipc: Enabled bearer , priority 0 [ 348.988223][ T7581] device syzkaller0 entered promiscuous mode [ 349.037742][ T7577] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 349.753838][ T7576] tipc: Resetting bearer [ 349.797016][ T7576] tipc: Disabling bearer [ 349.891642][ T7583] tipc: Enabled bearer , priority 0 [ 350.059320][ T7588] device syzkaller0 entered promiscuous mode [ 350.094634][ T7588] tipc: Resetting bearer [ 350.145362][ T7580] tipc: Resetting bearer [ 350.764033][ T7607] loop1: detected capacity change from 0 to 2048 [ 351.626779][ T7617] rdma_rxe: rxe_register_device failed with error -23 [ 351.639792][ T7617] rdma_rxe: failed to add lo [ 353.930972][ T7580] tipc: Disabling bearer [ 353.966530][ T7635] device syzkaller0 entered promiscuous mode [ 354.155349][ T7654] netlink: 16 bytes leftover after parsing attributes in process `syz.0.944'. [ 355.346005][ T7676] loop4: detected capacity change from 0 to 2048 [ 355.436099][ T7676] loop4: p1 < > p4 [ 355.436099][ T7676] p4: [ 355.449872][ T7676] loop4: p4 size 722688 extends beyond EOD, truncated [ 355.706234][ T7678] rdma_rxe: rxe_register_device failed with error -23 [ 355.934680][ T7678] rdma_rxe: failed to add lo [ 356.046578][ T7683] tipc: Enabled bearer , priority 0 [ 356.092221][ T7683] device syzkaller0 entered promiscuous mode [ 356.108899][ T7685] tipc: Enabled bearer , priority 0 [ 356.118621][ T7685] device syzkaller0 entered promiscuous mode [ 356.141432][ T7683] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 356.167598][ T7689] device syzkaller0 entered promiscuous mode [ 356.177525][ T7684] tipc: Resetting bearer [ 356.204997][ T7684] tipc: Disabling bearer [ 356.221871][ T7683] tipc: Resetting bearer [ 356.248459][ T7681] tipc: Resetting bearer [ 356.266440][ T7681] tipc: Disabling bearer [ 357.617128][ T7719] tipc: Enabled bearer , priority 0 [ 357.642873][ T7719] device syzkaller0 entered promiscuous mode [ 357.755529][ T7726] overlayfs: failed to resolve './file0': -2 [ 357.828852][ T7727] loop1: detected capacity change from 0 to 2048 [ 358.293542][ T7727] loop1: p1 < > p4 [ 358.293542][ T7727] p4: [ 358.306419][ T7727] loop1: p4 size 722688 extends beyond EOD, truncated [ 358.478722][ T7718] tipc: Resetting bearer [ 358.510747][ T7255] udevd[7255]: inotify_add_watch(7, /dev/loop1p4, 10) failed: No such file or directory [ 358.528171][ T7114] udevd[7114]: inotify_add_watch(7, /dev/loop1p1, 10) failed: No such file or directory [ 358.639015][ T7718] tipc: Disabling bearer [ 358.678490][ T7728] device syzkaller0 entered promiscuous mode [ 359.484438][ T7759] loop1: detected capacity change from 0 to 2048 [ 360.043909][ T7759] loop1: p1 < > p4 [ 360.043909][ T7759] p4: [ 360.052344][ T7759] loop1: p4 size 722688 extends beyond EOD, truncated [ 361.097327][ T7766] device syzkaller0 entered promiscuous mode [ 361.128710][ T7774] tipc: Enabled bearer , priority 0 [ 363.459181][ T7767] tipc: Disabling bearer [ 363.476823][ T7787] netlink: 216 bytes leftover after parsing attributes in process `syz.3.987'. [ 363.486098][ T7787] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 363.494247][ T7787] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 363.502147][ T7787] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 363.509582][ T7787] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 363.626703][ T4822] tipc: Node number set to 4252557435 [ 363.935027][ T7819] loop0: detected capacity change from 0 to 2048 [ 364.026269][ T7819] loop0: p1 < > p4 [ 364.026269][ T7819] p4: [ 364.038497][ T7819] loop0: p4 size 722688 extends beyond EOD, truncated [ 365.667839][ T7839] tipc: Enabled bearer , priority 0 [ 365.690614][ T7839] device syzkaller0 entered promiscuous mode [ 365.749448][ T7838] tipc: Resetting bearer [ 365.837860][ T7838] tipc: Disabling bearer [ 366.770217][ T7871] loop2: detected capacity change from 0 to 2048 [ 367.778479][ T7887] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 367.793527][ T7885] tipc: Enabled bearer , priority 0 [ 367.833736][ T7885] device syzkaller0 entered promiscuous mode [ 368.523527][ T7881] tipc: Resetting bearer [ 368.633967][ T7881] tipc: Disabling bearer [ 369.008394][ T7905] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 369.544914][ T7924] tipc: Enabled bearer , priority 0 [ 369.581739][ T7924] device syzkaller0 entered promiscuous mode [ 369.627746][ T7923] tipc: Resetting bearer [ 369.712234][ T7923] tipc: Disabling bearer [ 371.696460][ T7974] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1046'. [ 371.733691][ T7974] nfnetlink_queue: nf_queue: full at 0 entries, dropping packets(s) [ 371.750112][ T7977] tipc: Enabled bearer , priority 0 [ 371.759290][ T7977] device syzkaller0 entered promiscuous mode [ 371.839056][ T7976] tipc: Resetting bearer [ 371.905199][ T7976] tipc: Disabling bearer [ 373.856797][ T4281] kernel write not supported for file /cpu/0/msr (pid: 4281 comm: kworker/1:3) [ 374.458400][ T8028] tipc: Enabled bearer , priority 0 [ 374.580191][ T8018] tipc: Disabling bearer [ 376.784465][ T8069] tipc: Enabled bearer , priority 0 [ 376.808139][ T8069] device syzkaller0 entered promiscuous mode [ 376.830214][ T8072] tipc: Enabling of bearer rejected, failed to enable media [ 376.955881][ T8068] tipc: Resetting bearer [ 377.014807][ T8068] tipc: Disabling bearer [ 378.985450][ T1276] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.389144][ T8104] tipc: Enabling of bearer rejected, failed to enable media [ 380.801462][ T8115] tipc: Enabling of bearer rejected, failed to enable media [ 381.952241][ T8138] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1094'. [ 382.587887][ T8145] snd_dummy snd_dummy.0: control 0:4:0:syz0:0 is already present [ 383.218498][ T8157] device syzkaller0 entered promiscuous mode [ 383.266203][ T8157] tipc: Enabled bearer , priority 0 [ 383.325848][ T8157] tipc: Resetting bearer [ 383.398819][ T8156] tipc: Resetting bearer [ 383.441062][ T8156] tipc: Disabling bearer [ 383.539765][ T8164] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1101'. [ 383.675746][ T8168] tipc: Enabled bearer , priority 0 [ 383.692192][ T8168] device syzkaller0 entered promiscuous mode [ 383.714726][ T8170] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1105'. [ 383.741044][ T8168] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 383.877357][ T8167] tipc: Resetting bearer [ 384.033444][ T8167] tipc: Disabling bearer [ 385.465565][ T8205] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1117'. [ 385.735454][ T8214] tipc: Enabled bearer , priority 0 [ 385.786198][ T8214] device syzkaller0 entered promiscuous mode [ 385.804270][ T8209] snd_dummy snd_dummy.0: control 0:4:0:syz0:0 is already present [ 385.843954][ T8219] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 385.955916][ T8220] device syzkaller0 entered promiscuous mode [ 386.022274][ T8212] tipc: Resetting bearer [ 386.100529][ T8212] tipc: Disabling bearer [ 386.263571][ T8224] device syzkaller0 entered promiscuous mode [ 387.656127][ T8244] tipc: Enabled bearer , priority 0 [ 387.677016][ T8246] device syzkaller0 entered promiscuous mode [ 387.693013][ T8244] device syzkaller0 entered promiscuous mode [ 387.758643][ T8244] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 387.821145][ T8244] tipc: Resetting bearer [ 387.878075][ T8243] tipc: Resetting bearer [ 387.929426][ T8243] tipc: Disabling bearer [ 388.035834][ T8254] tipc: Enabled bearer , priority 0 [ 388.062481][ T8254] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 388.133553][ T8254] sch_tbf: burst 8 is lower than device syzkaller0 mtu (1514) ! [ 388.291983][ T8253] tipc: Disabling bearer [ 388.599080][ T8272] device syzkaller0 entered promiscuous mode [ 389.047984][ T8276] snd_dummy snd_dummy.0: control 0:4:0:syz0:0 is already present [ 389.224107][ T8282] device syzkaller0 entered promiscuous mode [ 389.532794][ T8292] loop0: detected capacity change from 0 to 256 [ 390.842149][ T8297] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 391.561528][ T8297] sch_tbf: burst 8 is lower than device syzkaller0 mtu (1514) ! [ 392.252688][ T8324] loop2: detected capacity change from 0 to 256 [ 392.352721][ T8331] device syzkaller0 entered promiscuous mode [ 392.428227][ T8326] device bond_slave_0 entered promiscuous mode [ 392.435086][ T8326] device bond_slave_1 entered promiscuous mode [ 392.571568][ T8326] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 393.165468][ T8326] bond2: (slave macvlan3): making interface the new active one [ 393.317118][ T8326] bond2: (slave macvlan3): Enslaving as an active interface with an up link [ 393.648069][ T8337] tipc: Enabling of bearer rejected, failed to enable media [ 393.667095][ T8349] device syzkaller0 entered promiscuous mode [ 394.084809][ T8372] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 394.150150][ T8372] sch_tbf: burst 8 is lower than device syzkaller0 mtu (1514) ! [ 394.272829][ T8376] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1165'. [ 394.385747][ T8376] 8021q: adding VLAN 0 to HW filter on device bond2 [ 394.585157][ T8383] bond2: (slave syz_tun): Enslaving as an active interface with an up link [ 394.688599][ T4360] IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready [ 395.192184][ T8412] tipc: Enabled bearer , priority 0 [ 395.203343][ T8411] tipc: Disabling bearer [ 395.236576][ T8410] device syzkaller0 entered promiscuous mode [ 395.261162][ T8410] tipc: Enabled bearer , priority 0 [ 395.338660][ T8409] tipc: Resetting bearer [ 395.464388][ T8409] tipc: Disabling bearer [ 395.571915][ T8426] tipc: Enabled bearer , priority 0 [ 395.670329][ T8426] device syzkaller0 entered promiscuous mode [ 395.690970][ T8426] tipc: Resetting bearer [ 395.872415][ T4658] tipc: Resetting bearer [ 395.893724][ T8425] tipc: Resetting bearer [ 398.836069][ T8425] tipc: Disabling bearer [ 398.901240][ T8460] tipc: Enabling of bearer rejected, failed to enable media [ 398.914873][ T8472] device syzkaller0 entered promiscuous mode [ 399.181494][ T8488] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1197'. [ 399.316126][ T8497] loop3: detected capacity change from 0 to 1024 [ 400.492833][ T8501] device bond_slave_0 entered promiscuous mode [ 400.499128][ T8501] device bond_slave_1 entered promiscuous mode [ 400.575616][ T8501] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 400.615010][ T8501] bond2: (slave macvlan2): making interface the new active one [ 400.629278][ T8501] bond2: (slave macvlan2): Enslaving as an active interface with an up link [ 400.754790][ T8522] tipc: Enabled bearer , priority 0 [ 400.815109][ T8528] device syzkaller0 entered promiscuous mode [ 400.856310][ T8528] tipc: Enabled bearer , priority 0 [ 400.880704][ T8531] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1211'. [ 400.920533][ T8527] tipc: Resetting bearer [ 400.963623][ T8527] tipc: Disabling bearer [ 401.049606][ T8521] tipc: Disabling bearer [ 401.423510][ T8566] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1224'. [ 401.525266][ T8568] bond2: option mode: unable to set because the bond device has slaves [ 401.796616][ T8575] futex_wake_op: syz.3.1227 tries to shift op by -1; fix this program [ 402.532579][ T8575] loop3: detected capacity change from 0 to 2048 [ 402.562216][ T8575] UDF-fs: error (device loop3): udf_process_sequence: Primary Volume Descriptor not found! [ 402.574533][ T8575] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 402.669068][ T8568] bond2: (slave macvlan3): Error -98 calling set_mac_address [ 402.817217][ T8585] device syzkaller0 entered promiscuous mode [ 402.867834][ T8585] tipc: Enabled bearer , priority 0 [ 402.920185][ T8584] tipc: Resetting bearer [ 402.999659][ T8584] tipc: Disabling bearer [ 403.304415][ T8604] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1237'. [ 403.726232][ T8615] futex_wake_op: syz.1.1240 tries to shift op by -1; fix this program [ 403.750074][ T8615] loop1: detected capacity change from 0 to 2048 [ 404.249156][ T8615] UDF-fs: error (device loop1): udf_process_sequence: Primary Volume Descriptor not found! [ 404.270231][ T8615] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 404.337848][ T8617] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1241'. [ 404.624704][ T8626] device syzkaller0 entered promiscuous mode [ 404.660081][ T8626] tipc: Enabled bearer , priority 0 [ 404.682646][ T8625] tipc: Resetting bearer [ 404.724346][ T8625] tipc: Disabling bearer [ 405.384024][ T8650] futex_wake_op: syz.4.1255 tries to shift op by -1; fix this program [ 406.127812][ T8650] loop4: detected capacity change from 0 to 2048 [ 406.191796][ T8650] UDF-fs: error (device loop4): udf_process_sequence: Primary Volume Descriptor not found! [ 406.207062][ T8650] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 406.456591][ T8661] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1258'. [ 406.654505][ T8666] device syzkaller0 entered promiscuous mode [ 406.699783][ T8666] tipc: Enabled bearer , priority 0 [ 406.743074][ T8665] tipc: Resetting bearer [ 406.826017][ T8665] tipc: Disabling bearer [ 407.633235][ T8686] futex_wake_op: syz.0.1270 tries to shift op by -1; fix this program [ 407.650287][ T8686] loop0: detected capacity change from 0 to 2048 [ 408.082857][ T8686] UDF-fs: error (device loop0): udf_process_sequence: Primary Volume Descriptor not found! [ 408.096771][ T8686] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 408.428465][ T8698] loop1: detected capacity change from 0 to 2048 [ 408.932940][ T8698] loop1: p1 < > p4 [ 408.932940][ T8698] p4: [ 408.941490][ T8698] loop1: p4 size 722688 extends beyond EOD, truncated [ 409.112991][ T8703] device syzkaller0 entered promiscuous mode [ 409.277839][ T8703] tipc: Enabled bearer , priority 0 [ 409.304310][ T8701] tipc: Resetting bearer [ 409.985324][ T8701] tipc: Disabling bearer [ 410.320630][ T8720] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1281'. [ 411.158587][ T8733] futex_wake_op: syz.2.1284 tries to shift op by -1; fix this program [ 411.895932][ T8733] loop2: detected capacity change from 0 to 2048 [ 411.952239][ T8733] UDF-fs: error (device loop2): udf_process_sequence: Primary Volume Descriptor not found! [ 411.964410][ T8733] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 412.551978][ T8745] device syzkaller0 entered promiscuous mode [ 412.585902][ T8745] tipc: Enabled bearer , priority 0 [ 412.631538][ T8743] tipc: Resetting bearer [ 412.699775][ T8743] tipc: Disabling bearer [ 412.745420][ T8749] device syzkaller0 entered promiscuous mode [ 413.331619][ T8767] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1296'. [ 413.392094][ T8767] nfnetlink_queue: nf_queue: full at 0 entries, dropping packets(s) [ 413.425318][ T8775] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1298'. [ 413.455067][ T8774] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 413.485559][ T8774] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 413.616135][ T8784] device syzkaller0 entered promiscuous mode [ 413.648213][ T8784] tipc: Enabled bearer , priority 0 [ 413.675766][ T8783] tipc: Resetting bearer [ 413.728148][ T8783] tipc: Disabling bearer [ 413.874660][ T8790] device syzkaller0 entered promiscuous mode [ 414.172948][ T8812] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1316'. [ 414.222907][ T8812] nfnetlink_queue: nf_queue: full at 0 entries, dropping packets(s) [ 416.259877][ T8828] tipc: Enabling of bearer rejected, failed to enable media [ 416.506337][ T8845] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1327'. [ 416.846200][ T8863] device syzkaller0 entered promiscuous mode [ 416.873967][ T8869] tipc: Enabled bearer , priority 0 [ 420.813614][ T8866] tipc: Disabling bearer [ 421.914919][ T8950] device syzkaller0 entered promiscuous mode [ 424.609361][ T9001] device bond_slave_0 entered promiscuous mode [ 424.615814][ T9001] device bond_slave_1 entered promiscuous mode [ 424.700649][ T9001] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 424.753354][ T9001] bond3: (slave macvlan2): making interface the new active one [ 424.799262][ T9001] bond3: (slave macvlan2): Enslaving as an active interface with an up link [ 425.294789][ T9031] device syzkaller0 entered promiscuous mode [ 428.535812][ T9080] device syzkaller0 entered promiscuous mode [ 432.072903][ T9145] bond1: (slave macvlan2): Error -22 calling dev_set_mtu [ 432.460350][ T9159] tipc: Enabled bearer , priority 0 [ 432.490862][ T9158] tipc: Disabling bearer [ 433.586658][ T9183] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1426'. [ 433.704393][ T9175] device syzkaller0 entered promiscuous mode [ 433.898810][ T9195] loop4: detected capacity change from 0 to 1024 [ 434.844973][ T9206] xt_cgroup: invalid path, errno=-2 [ 437.463704][ T9200] netlink: 'syz.2.1433': attribute type 21 has an invalid length. [ 437.620301][ T9241] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1441'. [ 437.634802][ T9239] device syzkaller0 entered promiscuous mode [ 437.879526][ T9254] loop3: detected capacity change from 0 to 1024 [ 438.932486][ T9274] xt_cgroup: invalid path, errno=-2 [ 439.493639][ T9290] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1457'. [ 439.533180][ T9288] device syzkaller0 entered promiscuous mode [ 439.814524][ T1276] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.029486][ T9314] loop0: detected capacity change from 0 to 1024 [ 440.477115][ T9319] xt_cgroup: invalid path, errno=-2 [ 441.503791][ T9344] loop4: detected capacity change from 0 to 2048 [ 441.576905][ T9344] loop4: p1 < > p4 [ 441.576905][ T9344] p4: [ 441.594866][ T9344] loop4: p4 size 722688 extends beyond EOD, truncated [ 442.053506][ T9260] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 442.243544][ T9143] udevd[9143]: inotify_add_watch(7, /dev/loop4p4, 10) failed: No such file or directory [ 442.246922][ T9260] udevd[9260]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 442.313417][ T9260] udevd[9260]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 442.324582][ T9143] udevd[9143]: inotify_add_watch(7, /dev/loop4p4, 10) failed: No such file or directory [ 442.426079][ T9361] loop3: detected capacity change from 0 to 1024 [ 442.670099][ T9367] tipc: Enabled bearer , priority 0 [ 442.697207][ T9367] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 442.718465][ T9367] sch_tbf: burst 8 is lower than device syzkaller0 mtu (1514) ! [ 442.765471][ T9366] tipc: Disabling bearer [ 443.107304][ T9374] xt_cgroup: invalid path, errno=-2 [ 443.945897][ T9408] loop4: detected capacity change from 0 to 1024 [ 443.950957][ T9400] tipc: Enabled bearer , priority 0 [ 443.959983][ T9402] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 444.012159][ T9400] sch_tbf: burst 8 is lower than device syzkaller0 mtu (1514) ! [ 444.191854][ T9397] tipc: Disabling bearer [ 444.199311][ T9408] xt_cgroup: invalid path, errno=-2 [ 444.969806][ T9438] loop3: detected capacity change from 0 to 1024 [ 445.234327][ T9438] xt_cgroup: invalid path, errno=-2 [ 445.294403][ T9451] tipc: Enabled bearer , priority 0 [ 445.363273][ T9451] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 445.404909][ T9451] sch_tbf: burst 8 is lower than device syzkaller0 mtu (1514) ! [ 445.465466][ T9450] tipc: Disabling bearer [ 445.735808][ T9459] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1518'. [ 446.990998][ T9484] loop4: detected capacity change from 0 to 1024 [ 447.234579][ T9484] xt_cgroup: invalid path, errno=-2 [ 447.377425][ T9495] tipc: Enabled bearer , priority 0 [ 447.407732][ T9493] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 447.436728][ T9493] sch_tbf: burst 8 is lower than device syzkaller0 mtu (1514) ! [ 447.593572][ T9492] tipc: Disabling bearer [ 447.964042][ T9523] loop4: detected capacity change from 0 to 1024 [ 448.796857][ T9535] xt_cgroup: invalid path, errno=-2 [ 449.282523][ T9547] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1547'. [ 450.478174][ T9574] loop1: detected capacity change from 0 to 1024 [ 451.358442][ T9581] xt_cgroup: invalid path, errno=-2 [ 452.042122][ T9594] netlink: 'syz.0.1562': attribute type 1 has an invalid length. [ 452.191987][ T9594] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1562'. [ 452.904995][ T9630] batman_adv: batadv0: Adding interface: syzkaller0 [ 453.084308][ T9630] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 453.480526][ T9630] batman_adv: batadv0: Interface activated: syzkaller0 [ 453.564089][ T9631] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 453.595885][ T9631] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 453.754584][ T9628] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 453.810183][ T9628] batman_adv: batadv0: Removing interface: syzkaller0 [ 453.823218][ T9647] netlink: 'syz.4.1581': attribute type 1 has an invalid length. [ 453.888297][ T9650] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1581'. [ 455.346712][ T9681] device geneve2 entered promiscuous mode [ 455.887266][ T9702] loop2: detected capacity change from 0 to 2048 [ 456.049143][ T9702] loop2: p1 < > p4 [ 456.049143][ T9702] p4: [ 456.061118][ T9702] loop2: p4 size 722688 extends beyond EOD, truncated [ 456.495302][ T9704] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1597'. [ 456.590352][ T9707] netem: change failed [ 458.810651][ T9764] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1613'. [ 460.058940][ T9784] device syzkaller0 entered promiscuous mode [ 460.079023][ T9784] tipc: Enabled bearer , priority 0 [ 460.108725][ T9784] tipc: Resetting bearer [ 460.118967][ T9783] tipc: Resetting bearer [ 460.140953][ T9783] tipc: Disabling bearer [ 461.254747][ T9807] loop4: detected capacity change from 0 to 1024 [ 461.516280][ T9812] xt_cgroup: invalid path, errno=-2 [ 461.539596][ T9814] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1626'. [ 461.876177][ T9811] 9pnet_fd: Insufficient options for proto=fd [ 463.315120][ T9850] device syzkaller0 entered promiscuous mode [ 463.437488][ T9850] tipc: Enabled bearer , priority 0 [ 463.481989][ T9850] tipc: Resetting bearer [ 463.512379][ T9849] tipc: Resetting bearer [ 463.570567][ T9849] tipc: Disabling bearer [ 464.046552][ T9872] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1638'. [ 464.125011][ T9874] tipc: Enabled bearer , priority 0 [ 464.269346][ T9873] tipc: Disabling bearer [ 464.288436][ T9880] loop4: detected capacity change from 0 to 1024 [ 464.546725][ T9884] xt_cgroup: invalid path, errno=-2 [ 464.690178][ T9889] tipc: Enabled bearer , priority 0 [ 465.892897][ T9891] ttyS ttyS3: ldisc open failed (-12), clearing slot 3 [ 466.028825][ T4322] tipc: Node number set to 434497084 [ 466.044287][ T9888] tipc: Disabling bearer [ 466.863459][ T9908] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1650'. [ 467.086134][ T9918] tipc: Enabled bearer , priority 0 [ 467.174029][ T9916] tipc: Disabling bearer [ 468.060879][ T9943] tipc: Enabled bearer , priority 0 [ 468.105118][ T9943] tipc: Resetting bearer [ 468.213585][ T9942] tipc: Disabling bearer [ 468.289962][ T9947] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1665'. [ 469.251409][ T4277] Bluetooth: hci4: command 0x0405 tx timeout [ 469.489492][ T9964] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1669'. [ 469.837411][ T9956] sctp: failed to load transform for md5: -2 [ 470.072310][ T9964] team0: Port device team_slave_0 removed [ 470.193122][ T9977] tipc: Enabled bearer , priority 0 [ 470.258946][T10002] tipc: Enabled bearer , priority 0 [ 470.323887][ T9975] device syzkaller0 entered promiscuous mode [ 470.355090][ T9966] tipc: Resetting bearer [ 470.513686][ T9966] tipc: Disabling bearer [ 470.528389][ T9980] device syzkaller0 entered promiscuous mode [ 470.560664][ T9971] tipc: Resetting bearer [ 471.428570][ T9971] tipc: Disabling bearer [ 471.538793][T10018] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1678'. [ 471.756817][T10025] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1679'. [ 473.198840][T10056] bond2: option mode: unable to set because the bond device has slaves [ 473.252692][T10057] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 473.275913][T10056] bond2: (slave macvlan4): Error -98 calling set_mac_address [ 473.446533][T10059] device syzkaller0 entered promiscuous mode [ 476.758150][T10074] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1694'. [ 476.857501][T10106] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 477.656917][T10115] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 477.756989][T10118] bond3: option mode: unable to set because the bond device has slaves [ 477.825431][T10118] bond3: (slave macvlan3): Error -98 calling set_mac_address [ 478.078933][T10132] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1711'. [ 480.363644][T10159] bond2: option mode: unable to set because the bond device has slaves [ 480.381790][T10157] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 480.417626][T10159] bond2: (slave macvlan3): Error -98 calling set_mac_address [ 480.438104][T10163] loop3: detected capacity change from 0 to 1024 [ 480.695513][T10168] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1724'. [ 480.790960][T10169] xt_cgroup: invalid path, errno=-2 [ 481.459770][T10171] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1725'. [ 481.932499][T10181] device syzkaller0 entered promiscuous mode [ 483.908333][T10207] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1735'. [ 483.993631][T10209] device syzkaller0 entered promiscuous mode [ 484.019513][T10212] loop3: detected capacity change from 0 to 1024 [ 484.093068][T10215] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1739'. [ 484.345959][T10220] xt_cgroup: invalid path, errno=-2 [ 486.881758][T10250] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1750'. [ 487.078825][T10259] loop2: detected capacity change from 0 to 1024 [ 488.026265][T10272] tipc: Enabling of bearer rejected, failed to enable media [ 488.945777][T10298] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 488.999052][T10299] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1765'. [ 489.049111][T10299] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1765'. [ 489.089479][T10299] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 4352 - 0 [ 489.099248][T10299] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 4352 - 0 [ 489.108106][T10299] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 4352 - 0 [ 489.117070][T10299] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 4352 - 0 [ 489.134251][T10306] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 489.163651][T10307] tipc: Enabling of bearer rejected, failed to enable media [ 489.587862][T10317] loop2: detected capacity change from 0 to 1024 [ 490.578504][T10325] device gretap1 entered promiscuous mode [ 490.631996][T10330] tipc: Enabling of bearer rejected, failed to enable media [ 491.490805][T10348] tipc: Enabled bearer , priority 0 [ 491.528373][T10349] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1783'. [ 491.551510][T10347] tipc: Disabling bearer [ 491.987181][T10373] loop1: detected capacity change from 0 to 1024 [ 492.999766][T10384] bond2: option mode: unable to set because the bond device has slaves [ 493.037796][T10390] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 493.066440][T10384] bond2: (slave macvlan4): Error -98 calling set_mac_address [ 493.734141][T10398] device syzkaller0 entered promiscuous mode [ 493.825791][T10402] smc: removing ib device syz0 [ 494.219460][T10410] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 494.240243][T10410] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 494.275587][T10410] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 494.326784][T10411] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1800'. [ 494.422507][T10411] device veth1_to_team entered promiscuous mode [ 494.452224][T10411] device veth0_to_team entered promiscuous mode [ 494.498034][T10411] device hsr1 entered promiscuous mode [ 494.754052][T10426] loop4: detected capacity change from 0 to 1024 [ 494.853231][T10428] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 496.638959][T10449] device syzkaller0 entered promiscuous mode [ 496.738458][ T4277] Bluetooth: hci4: unexpected cc 0x1003 length: 8 < 9 [ 497.000010][T10469] loop2: detected capacity change from 0 to 1024 [ 498.019239][T10487] device syzkaller0 entered promiscuous mode [ 498.034003][ T4277] Bluetooth: hci4: unexpected cc 0x1003 length: 8 < 9 [ 499.054801][T10501] loop0: detected capacity change from 0 to 2048 [ 499.125389][T10501] loop0: p1 < > p4 [ 499.125389][T10501] p4: [ 499.137359][T10501] loop0: p4 size 722688 extends beyond EOD, truncated [ 499.245858][T10499] device syzkaller0 entered promiscuous mode [ 500.777167][T10532] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1838'. [ 500.809785][T10533] device syzkaller1 entered promiscuous mode [ 500.878009][T10535] device syzkaller0 entered promiscuous mode [ 500.904316][T10537] device syzkaller0 entered promiscuous mode [ 500.922724][T10535] tipc: Enabled bearer , priority 0 [ 500.932120][T10534] tipc: Resetting bearer [ 500.979453][T10534] tipc: Disabling bearer [ 501.256248][ T1276] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.914193][T10551] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 502.139194][T10564] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1852'. [ 502.198389][T10561] device syzkaller0 entered promiscuous mode [ 502.218188][T10570] device syzkaller0 entered promiscuous mode [ 502.236702][T10569] device syzkaller0 entered promiscuous mode [ 502.250298][T10565] tipc: Enabled bearer , priority 0 [ 504.610694][T10563] tipc: Resetting bearer [ 504.663005][T10563] tipc: Disabling bearer [ 504.718300][T10594] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1861'. [ 504.731706][T10594] IPv6: ADDRCONF(NETDEV_CHANGE): gre2: link becomes ready [ 504.955738][T10605] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 505.010198][T10611] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1866'. [ 505.037882][T10612] device syzkaller0 entered promiscuous mode [ 505.259075][T10621] tipc: Enabled bearer , priority 0 [ 505.376657][T10621] device syzkaller0 entered promiscuous mode [ 505.387489][T10621] tipc: Resetting bearer [ 505.463573][T10619] tipc: Resetting bearer [ 508.045929][T10619] tipc: Disabling bearer [ 508.069515][T10650] tipc: Enabling of bearer rejected, failed to enable media [ 508.081924][T10655] device syzkaller0 entered promiscuous mode [ 508.315041][T10671] device syzkaller0 entered promiscuous mode [ 508.472790][T10685] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1885'. [ 511.514698][T10681] device syzkaller0 entered promiscuous mode [ 513.883723][T10711] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1890'. [ 514.105835][T10727] device syzkaller0 entered promiscuous mode [ 514.125378][T10727] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 514.177156][T10727] sch_tbf: burst 8 is lower than device syzkaller0 mtu (1514) ! [ 514.194049][T10732] tipc: Enabling of bearer rejected, failed to enable media [ 514.266605][T10735] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1897'. [ 515.394245][T10754] device syzkaller0 entered promiscuous mode [ 515.411642][T10755] Bluetooth: MGMT ver 1.22 [ 515.698207][T10761] bond1: (slave macvlan2): Error -22 calling dev_set_mtu [ 515.842168][T10771] device syzkaller0 entered promiscuous mode [ 515.877774][T10771] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 515.988262][T10771] sch_tbf: burst 8 is lower than device syzkaller0 mtu (1514) ! [ 516.091161][T10776] bond3: (slave ip6gretap1): Enslaving as an active interface with an up link [ 516.145213][T10786] tipc: Enabling of bearer rejected, failed to enable media [ 516.165747][T10783] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1910'. [ 516.189758][T10783] 8021q: adding VLAN 0 to HW filter on device bond3 [ 516.403657][T10801] device syzkaller1 entered promiscuous mode [ 516.619673][T10810] device syzkaller0 entered promiscuous mode [ 516.635400][T10810] tipc: Enabled bearer , priority 0 [ 516.646154][T10806] tipc: Resetting bearer [ 516.676305][T10806] tipc: Disabling bearer [ 516.701499][T10808] batman_adv: batadv0: Adding interface: macvtap1 [ 516.708395][T10808] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 516.760387][T10808] batman_adv: batadv0: Not using interface macvtap1 (retrying later): interface not active [ 516.843811][T10814] batman_adv: batadv0: Removing interface: macvtap1 [ 517.147615][T10828] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1927'. [ 517.157825][T10828] 8021q: adding VLAN 0 to HW filter on device bond2 [ 518.039556][T10849] tipc: Enabling of bearer rejected, failed to enable media [ 518.135238][T10851] device syzkaller0 entered promiscuous mode [ 518.167795][T10854] device syzkaller0 entered promiscuous mode [ 518.179238][T10851] tipc: Enabled bearer , priority 0 [ 518.269532][T10850] tipc: Resetting bearer [ 518.354040][T10850] tipc: Disabling bearer [ 518.578602][T10870] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1939'. [ 518.600285][T10870] 8021q: adding VLAN 0 to HW filter on device bond3 [ 519.701864][T10893] device syzkaller0 entered promiscuous mode [ 519.925711][T10910] tipc: Enabling of bearer rejected, failed to enable media [ 520.068850][T10921] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1954'. [ 520.094586][T10921] 8021q: adding VLAN 0 to HW filter on device bond3 [ 521.144570][T10940] ip_tables: iptables: counters copy to user failed while replacing table [ 521.402343][T10947] device syzkaller0 entered promiscuous mode [ 521.748919][T10964] loop0: detected capacity change from 0 to 2048 [ 522.005133][T10964] loop0: p1 < > p4 [ 522.005133][T10964] p4: [ 522.017308][T10964] loop0: p4 size 722688 extends beyond EOD, truncated [ 522.190804][ T3639] loop0: p1 < > p4 [ 522.190804][ T3639] p4: [ 522.240654][ T3639] loop0: p4 size 722688 extends beyond EOD, truncated [ 522.259054][T10971] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1968'. [ 522.292118][T10971] 8021q: adding VLAN 0 to HW filter on device bond4 [ 522.317210][T10970] tipc: Enabling of bearer rejected, failed to enable media [ 522.631168][T10977] udevd[10977]: inotify_add_watch(7, /dev/loop0p4, 10) failed: No such file or directory [ 523.148683][T10977] udevd[10977]: inotify_add_watch(7, /dev/loop0p4, 10) failed: No such file or directory [ 523.177969][T10968] udevd[10968]: inotify_add_watch(7, /dev/loop0p1, 10) failed: No such file or directory [ 523.585566][T11001] tipc: Enabled bearer , priority 0 [ 523.618602][T11000] tipc: Disabling bearer [ 523.711623][T11003] device syzkaller0 entered promiscuous mode [ 523.916480][T11010] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1984'. [ 523.926576][T11010] 8021q: adding VLAN 0 to HW filter on device bond5 [ 523.944604][T11016] tipc: Enabled bearer , priority 0 [ 523.964103][T11016] tipc: Resetting bearer [ 523.980802][T11015] tipc: Disabling bearer [ 524.149676][T11025] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1990'. [ 524.549433][T11041] device syzkaller0 entered promiscuous mode [ 524.622585][T11043] netlink: 'syz.4.1998': attribute type 1 has an invalid length. [ 524.771865][T11045] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1998'. [ 524.808583][T11045] 8021q: adding VLAN 0 to HW filter on device bond4 [ 524.882339][T11051] tipc: Enabled bearer , priority 0 [ 524.913615][T11051] tipc: Resetting bearer [ 524.934998][T11054] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2003'. [ 524.956254][T11050] tipc: Disabling bearer [ 525.087541][T11061] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2006'. [ 525.414060][T11081] device syzkaller0 entered promiscuous mode [ 525.545497][T11084] af_packet: packet size is too long (65369 > 2016) [ 525.602336][T11086] netlink: 'syz.3.2015': attribute type 1 has an invalid length. [ 525.654395][T11086] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2015'. [ 525.713921][T11086] 8021q: adding VLAN 0 to HW filter on device bond4 [ 525.782519][T11091] tipc: Enabled bearer , priority 0 [ 525.833441][T11091] tipc: Resetting bearer [ 525.846116][T11090] tipc: Disabling bearer [ 525.880091][T11095] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2018'. [ 526.410441][T11112] device syzkaller0 entered promiscuous mode [ 526.449909][T11116] netlink: 'syz.4.2029': attribute type 1 has an invalid length. [ 526.589152][T11116] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2029'. [ 526.618984][T11116] 8021q: adding VLAN 0 to HW filter on device bond6 [ 526.801910][T11131] device syzkaller0 entered promiscuous mode [ 526.827188][T11131] tipc: Enabled bearer , priority 0 [ 526.846201][T11136] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 526.867243][T11131] tipc: Resetting bearer [ 526.883082][T11130] tipc: Resetting bearer [ 526.950963][T11130] tipc: Disabling bearer [ 527.352696][T11155] device syzkaller0 entered promiscuous mode [ 527.442893][T11158] netlink: 'syz.0.2043': attribute type 1 has an invalid length. [ 527.497111][T11158] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2043'. [ 527.507469][T11158] 8021q: adding VLAN 0 to HW filter on device bond5 [ 527.621012][T11166] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 527.803727][T11178] tipc: Can't bind to reserved service type 0 [ 527.823829][T11175] device syzkaller1 entered promiscuous mode [ 528.129124][T11190] netlink: 'syz.1.2055': attribute type 1 has an invalid length. [ 528.193115][T11190] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2055'. [ 528.222817][T11190] 8021q: adding VLAN 0 to HW filter on device bond4 [ 528.251939][T11193] device syzkaller0 entered promiscuous mode [ 528.311400][T11199] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 528.563856][T11212] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2064'. [ 528.798490][T11229] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 529.019334][T11233] netlink: 'syz.2.2072': attribute type 1 has an invalid length. [ 529.060863][T11233] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2072'. [ 529.070990][T11233] 8021q: adding VLAN 0 to HW filter on device bond6 [ 529.079810][T11238] device syzkaller0 entered promiscuous mode [ 529.199714][T11244] netlink: 'syz.0.2078': attribute type 1 has an invalid length. [ 529.250433][T11244] 8021q: adding VLAN 0 to HW filter on device bond6 [ 529.282397][T11247] device syzkaller0 entered promiscuous mode [ 529.338083][T11244] bond6: (slave syz_tun): Enslaving as a backup interface with an up link [ 529.372203][ T4734] IPv6: ADDRCONF(NETDEV_CHANGE): bond6: link becomes ready [ 529.522474][T11256] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2081'. [ 529.636437][T11263] x_tables: ip6_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 529.822731][T11271] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2087'. [ 529.893751][T11273] device syzkaller0 entered promiscuous mode [ 529.998831][T11280] netlink: 'syz.1.2092': attribute type 10 has an invalid length. [ 530.099904][T11280] team0: Port device netdevsim0 added [ 530.146721][T11287] device syzkaller0 entered promiscuous mode [ 530.500237][T11307] __nla_validate_parse: 2 callbacks suppressed [ 530.500324][T11307] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2104'. [ 530.564262][T11307] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2104'. [ 530.928528][T11318] device syzkaller0 entered promiscuous mode [ 533.378849][T11333] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2113'. [ 533.401299][T11353] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2118'. [ 533.433138][T11358] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2118'. [ 533.562466][T11361] netlink: 104 bytes leftover after parsing attributes in process `syz.3.2120'. [ 533.592414][T11366] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2122'. [ 533.927176][T11383] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 533.958526][T11383] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 534.181578][T11394] device syzkaller0 entered promiscuous mode [ 534.202109][T11401] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2133'. [ 534.378467][T11404] x_tables: duplicate underflow at hook 1 [ 534.414363][T11406] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2136'. [ 536.610264][T11418] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2139'. [ 536.655042][T11423] bond1: (slave macvlan2): Error -22 calling dev_set_mtu [ 536.820130][T11431] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2145'. [ 537.168633][T11450] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2150'. [ 537.302913][T11457] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2153'. [ 537.509204][T11470] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2159'. [ 538.366651][T11507] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2169'. [ 538.850451][T11531] device syzkaller0 entered promiscuous mode [ 539.101817][T11547] netlink: 72 bytes leftover after parsing attributes in process `syz.4.2183'. [ 539.993881][T11581] loop4: detected capacity change from 0 to 2048 [ 540.060452][T11581] loop4: p1 < > p4 [ 540.060452][T11581] p4: [ 540.075376][T11581] loop4: p4 size 722688 extends beyond EOD, truncated [ 540.416371][ T3639] loop4: p1 < > p4 [ 540.416371][ T3639] p4: [ 540.497645][ T3639] loop4: p4 size 722688 extends beyond EOD, truncated [ 540.674172][T11589] udevd[11589]: inotify_add_watch(7, /dev/loop4p4, 10) failed: No such file or directory [ 540.749512][T11582] udevd[11582]: inotify_add_watch(7, /dev/loop4p4, 10) failed: No such file or directory [ 540.770681][T11589] udevd[11589]: inotify_add_watch(7, /dev/loop4p1, 10) failed: No such file or directory [ 541.311041][T11619] device syzkaller0 entered promiscuous mode [ 541.330519][T11619] tipc: Enabled bearer , priority 0 [ 541.366987][T11619] tipc: Resetting bearer [ 541.393666][T11618] tipc: Resetting bearer [ 541.618979][T11630] loop1: detected capacity change from 0 to 2048 [ 541.704895][T11630] loop1: p1 < > p4 [ 541.704895][T11630] p4: [ 541.716746][T11630] loop1: p4 size 722688 extends beyond EOD, truncated [ 541.749373][T11618] tipc: Disabling bearer [ 542.152737][T11634] netlink: 72 bytes leftover after parsing attributes in process `syz.2.2213'. [ 542.358325][T11637] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2216'. [ 542.413219][T11642] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2217'. [ 542.962138][T11675] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2227'. [ 542.983127][T11671] device syzkaller0 entered promiscuous mode [ 543.164449][T11678] loop2: detected capacity change from 0 to 2048 [ 543.204705][T11678] loop2: p1 < > p4 [ 543.204705][T11678] p4: [ 543.217514][T11678] loop2: p4 size 722688 extends beyond EOD, truncated [ 543.726936][T11676] device syzkaller0 entered promiscuous mode [ 543.908980][T11589] udevd[11589]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 543.909139][T11582] udevd[11582]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 546.194548][T11702] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2231'. [ 546.324460][T11704] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2232'. [ 546.349573][T11706] device syzkaller0 entered promiscuous mode [ 546.480448][T11708] netlink: 132 bytes leftover after parsing attributes in process `syz.3.2234'. [ 546.539258][T11715] device syzkaller0 entered promiscuous mode [ 546.569567][T11715] [ 546.571936][T11715] ============================================ [ 546.578090][T11715] WARNING: possible recursive locking detected [ 546.584262][T11715] syzkaller #0 Not tainted [ 546.588694][T11715] -------------------------------------------- [ 546.594845][T11715] syz.2.2237/11715 is trying to acquire lock: [ 546.600916][T11715] ffff888031ab0108 (&sch->root_lock_key#341){+...}-{2:2}, at: __dev_queue_xmit+0xe46/0x3810 [ 546.611097][T11715] [ 546.611097][T11715] but task is already holding lock: [ 546.618464][T11715] ffff888031ab0108 (&sch->root_lock_key#341){+...}-{2:2}, at: __dev_queue_xmit+0xe46/0x3810 [ 546.618586][T11721] netlink: 72 bytes leftover after parsing attributes in process `syz.0.2239'. [ 546.628574][T11715] [ 546.628574][T11715] other info that might help us debug this: [ 546.628585][T11715] Possible unsafe locking scenario: [ 546.628585][T11715] [ 546.628589][T11715] CPU0 [ 546.628592][T11715] ---- [ 546.628594][T11715] lock(&sch->root_lock_key#341); [ 546.628616][T11715] lock(&sch->root_lock_key#341); [ 546.628629][T11715] [ 546.628629][T11715] *** DEADLOCK *** [ 546.628629][T11715] [ 546.628633][T11715] May be due to missing lock nesting notation [ 546.628633][T11715] [ 546.628638][T11715] 3 locks held by syz.2.2237/11715: [ 546.628647][T11715] #0: ffffffff8cb2d840 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x281/0x3810 [ 546.628703][T11715] #1: ffff888031ab0108 (&sch->root_lock_key#341){+...}-{2:2}, at: __dev_queue_xmit+0xe46/0x3810 [ 546.628752][T11715] #2: ffffffff8cb2d840 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x281/0x3810 [ 546.628790][T11715] [ 546.628790][T11715] stack backtrace: [ 546.628796][T11715] CPU: 0 PID: 11715 Comm: syz.2.2237 Not tainted syzkaller #0 [ 546.628809][T11715] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 546.690865][T11722] batman_adv: batadv0: Adding interface: gretap1 [ 546.691797][T11715] Call Trace: [ 546.691864][T11715] [ 546.691928][T11715] dump_stack_lvl+0x188/0x24e [ 546.692005][T11715] ? show_regs_print_info+0x12/0x12 [ 546.707586][T11722] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 546.712350][T11715] ? load_image+0x410/0x410 [ 546.712383][T11715] __lock_acquire+0x12c8/0x7c40 [ 546.727641][T11722] batman_adv: batadv0: Interface activated: gretap1 [ 546.728268][T11715] ? lockdep_lock+0x1f0/0x1f0 [ 546.799394][T11726] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2243'. [ 546.802785][T11715] ? verify_lock_unused+0x140/0x140 [ 546.802815][T11715] ? add_lock_to_list+0x191/0x280 [ 546.802835][T11715] ? verify_lock_unused+0x140/0x140 [ 546.802854][T11715] ? __lock_acquire+0x28d6/0x7c40 [ 546.802877][T11715] ? cpu_attach_domain+0x730/0x1090 [ 546.802898][T11715] lock_acquire+0x1bb/0x4a0 [ 546.802919][T11715] ? __dev_queue_xmit+0xe46/0x3810 [ 546.802944][T11715] ? read_lock_is_recursive+0x10/0x10 [ 546.802965][T11715] ? rcu_lockdep_current_cpu_online+0x33/0x120 [ 546.825064][T11717] device syzkaller0 entered promiscuous mode [ 546.828289][T11715] ? rcu_read_lock_bh_held+0x76/0xf0 [ 546.881141][T11715] ? rcu_read_lock_held+0x40/0x40 [ 546.886199][T11715] _raw_spin_lock+0x2a/0x40 [ 546.890726][T11715] ? __dev_queue_xmit+0xe46/0x3810 [ 546.895858][T11715] __dev_queue_xmit+0xe46/0x3810 [ 546.900820][T11715] ? __dev_queue_xmit+0x281/0x3810 [ 546.905953][T11715] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 546.911960][T11715] ? __lock_acquire+0x7c40/0x7c40 [ 546.917012][T11715] ? netdev_core_pick_tx+0x360/0x360 [ 546.922315][T11715] ? _raw_spin_unlock_irqrestore+0x82/0x120 [ 546.928233][T11715] ? lockdep_hardirqs_on+0x94/0x140 [ 546.933452][T11715] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 546.939364][T11715] ? _raw_spin_unlock+0x40/0x40 [ 546.944236][T11715] ? stack_trace_save+0xa6/0xf0 [ 546.949167][T11715] ? stack_trace_snprint+0xe0/0xe0 [ 546.954305][T11715] ? tcf_mirred_offload_act_setup+0xb00/0xb00 [ 546.960406][T11715] sch_frag_xmit_hook+0x2a4/0x11c0 [ 546.965540][T11715] ? kasan_set_track+0x60/0x70 [ 546.970411][T11715] ? kasan_set_track+0x4b/0x70 [ 546.975213][T11715] ? slab_post_alloc_hook+0x4b/0x490 [ 546.980614][T11715] ? kmem_cache_alloc+0x18b/0x2f0 [ 546.985660][T11715] ? skb_clone+0x1e7/0x370 [ 546.990104][T11715] ? tcf_mirred_act+0x563/0x1640 [ 546.995064][T11715] ? tcf_action_exec+0x174/0x590 [ 547.000114][T11715] ? basic_classify+0x1ae/0x2c0 [ 547.004985][T11715] ? tcf_classify+0x33e/0xbf0 [ 547.009736][T11715] ? qfq_enqueue+0x31c/0x12c0 [ 547.014424][T11715] ? dev_qdisc_enqueue+0x4c/0x2b0 [ 547.019462][T11715] ? __dev_queue_xmit+0x1031/0x3810 [ 547.024679][T11715] ? packet_sendmsg+0x3a9e/0x4c30 [ 547.029723][T11715] ? ____sys_sendmsg+0x5ed/0x9a0 [ 547.034676][T11715] ? mq_dump_class_stats+0x490/0x490 [ 547.039987][T11715] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 547.046095][T11715] ? lockdep_lock+0xf1/0x1f0 [ 547.050706][T11715] ? __copy_skb_header+0x3ba/0x4f0 [ 547.055828][T11715] ? memcpy+0x3c/0x60 [ 547.059824][T11715] ? __copy_skb_header+0x3ba/0x4f0 [ 547.064947][T11715] ? __skb_clone+0x446/0x6c0 [ 547.069550][T11715] ? skb_clone+0x21b/0x370 [ 547.073975][T11715] ? tcf_mirred_act+0x552/0x1640 [ 547.078936][T11715] tcf_mirred_act+0xb1c/0x1640 [ 547.083732][T11715] tcf_action_exec+0x174/0x590 [ 547.088513][T11715] basic_classify+0x1ae/0x2c0 [ 547.093214][T11715] tcf_classify+0x33e/0xbf0 [ 547.097743][T11715] qfq_enqueue+0x31c/0x12c0 [ 547.102273][T11715] ? sch_tree_lock+0x1b0/0x1b0 [ 547.107058][T11715] ? do_raw_spin_lock+0x128/0x2f0 [ 547.112109][T11715] ? __rwlock_init+0x140/0x140 [ 547.116889][T11715] dev_qdisc_enqueue+0x4c/0x2b0 [ 547.121762][T11715] __dev_queue_xmit+0x1031/0x3810 [ 547.126800][T11715] ? __dev_queue_xmit+0x281/0x3810 [ 547.132970][T11715] ? _copy_from_iter+0x5df/0x1130 [ 547.138095][T11715] ? netdev_core_pick_tx+0x360/0x360 [ 547.143403][T11715] ? virtio_net_hdr_to_skb+0x938/0x12b0 [ 547.148974][T11715] ? packet_extra_vlan_len_allowed+0x200/0x200 [ 547.155153][T11715] ? dev_get_by_index+0x1e/0x2d0 [ 547.160119][T11715] ? skb_put+0x10e/0x200 [ 547.164389][T11715] packet_sendmsg+0x3a9e/0x4c30 [ 547.169267][T11715] ? lock_chain_count+0x20/0x20 [ 547.174139][T11715] ? verify_lock_unused+0x140/0x140 [ 547.179373][T11715] ? aa_sk_perm+0x81f/0x950 [ 547.183959][T11715] ? aa_af_perm+0x340/0x340 [ 547.188479][T11715] ? packet_getsockopt+0x980/0x980 [ 547.193615][T11715] ? apparmor_socket_sendmsg+0x8a/0x330 [ 547.199246][T11715] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 547.204617][T11715] ? security_socket_sendmsg+0x7c/0xa0 [ 547.210183][T11715] ? packet_getsockopt+0x980/0x980 [ 547.215311][T11715] ____sys_sendmsg+0x5ed/0x9a0 [ 547.220083][T11715] ? __sys_sendmsg_sock+0x30/0x30 [ 547.225111][T11715] ? __import_iovec+0x306/0x510 [ 547.230011][T11715] ? import_iovec+0x6f/0xa0 [ 547.234538][T11715] ___sys_sendmsg+0x2a2/0x360 [ 547.239244][T11715] ? __sys_sendmsg+0x2a0/0x2a0 [ 547.244029][T11715] ? futex_wake+0x426/0x4f0 [ 547.248636][T11715] __se_sys_sendmsg+0x1c3/0x2b0 [ 547.253504][T11715] ? __x64_sys_sendmsg+0x80/0x80 [ 547.258499][T11715] ? lockdep_hardirqs_on+0x94/0x140 [ 547.263723][T11715] do_syscall_64+0x4c/0xa0 [ 547.268152][T11715] ? clear_bhb_loop+0x60/0xb0 [ 547.272848][T11715] ? clear_bhb_loop+0x60/0xb0 [ 547.277542][T11715] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 547.283468][T11715] RIP: 0033:0x7f8fbef9e159 [ 547.287965][T11715] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 547.307659][T11715] RSP: 002b:00007f8fbfef6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 547.316094][T11715] RAX: ffffffffffffffda RBX: 00007f8fbf225fa0 RCX: 00007f8fbef9e159 [ 547.324089][T11715] RDX: 0000000000004005 RSI: 0000200000000280 RDI: 0000000000000006 [ 547.332083][T11715] RBP: 00007f8fbf03506b R08: 0000000000000000 R09: 0000000000000000 [ 547.340091][T11715] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 547.348144][T11715] R13: 00007f8fbf226038 R14: 00007f8fbf225fa0 R15: 00007ffe90ed0348 [ 547.356119][T11715] [ 547.724969][T11748] netlink: 24 bytes leftover after parsing attributes in process `syz.3.2246'.