last executing test programs: 6.977165637s ago: executing program 0 (id=42): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) ioctl$int_in(r0, 0x40000000af01, 0x0) 6.971886187s ago: executing program 0 (id=43): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x400, &(0x7f0000000000)={[{@grpjquota}, {@stripe={'stripe', 0x3d, 0x2}}]}, 0x1, 0x4a6, &(0x7f0000000a40)="$eJzs3c9rXNUeAPDvzDRpkua9/niPR9sHr4U+6HtKM/mBNFEXulIXBbHgRqHGZBprJpmQmdQmdJHqrgsXoiiIC/f+BW7syiKIa92LC6lojaCCMHLvzKT5NXXQNAO5nw/czrn33M73nAzfw51z750bQGadTv7JRQxGxBcRcbixunmH042XtbvXp5IlF/X6xe9z6X7JemvX1v87FBGrEdEXEc89FfFybnvc6vLK7GS5XFpsrhdrcwvF6vLKuStzkzOlmdL8yPj5iYnx4bHRiV3r6803X7154eNnej/6+Y07t9/69JOkWYPNuo392E2NrvfE0Q3bDkTE4w8iWBcUmv3p73ZD+FOSz+8fEXEmzf/DUUg/TSAL6vV6/bf6wXbVq3Vg38qnx8C5/FBENMr5/NBQ4xj+nzGQL1eqtYcvV5bmpxvHykeiJ3/5Srk03PyucCR6csn6SFq+tz66ZX0sIj0GfrvQn64PTVXK03s71AFbHNqS/z8VGvkPZISv/JBd8h+yS/5Ddsl/yC75D9kl/yG75D9kl/yH7JL/kF3yH7JL/kMmPXvhQrLUW/e/T19dXpqtXD03XarODs0tTQ1NVRYXhmYqlZn0np25P3q/cqWyMPJILF0r1krVWrG6vHJprrI0X7uU3td/qdSzJ70COnH01K2vchGx+mh/uiR6m3VyFfa3ej0X3b4HGeiOQrcHIKBrTP1BdvmOD+zwE72b9LWrWNj9tgB7I9/tBgBdc/aE83+QVeb/IbvM/0N2OcYHzP9D9pj/h+wabPP8r79teHbXcET8PSK+LPQcbD3rC9gP8t/mmsf/Zw//d3BrbW/ul/QUQW9EvPb+xXevTdZqiyPJ9h/Wt9fea24f7Ub7gU618rSVxwBAdq3dvT7VWvYy7ndPNi5C2B7/QHNusi89Rzmwltt0rUJul65dWL0REcd3ip9rPu+8ceZjYK2wLf6x5muu8RZpew+kz03fm/gnNsT/z4b4J//yXwWy4VYy/gzvlH/5NKdjPf82jz+Du3TtRPvxL78+/hXajH+nOozxygevf9M2/o2IkzvGb8XrS2NtjZ+07WyH8e+8+Py/2tXVP2y8z07xW5JSsTa3UKwur5xLf0dupjQ/Mn5+YmJ8eGx0opjOURdbM9XbPXb889v36/9Am/jt+v9Es03/77D/v/77sxdO3yf+/87s/PkfaxM/0R8RD3UY/8fRr19qV5fEn27T//x94ifbxjqMX33n6YMd7goA7IHq8srsZLlcWlRQUFBYL3R7ZAIetHtJ3+2WAAAAAAAAAAAAAJ3ai8uJu91HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAID94PcAAAD//5j81ps=") mount$tmpfs(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='nr_inodes=M']) chdir(&(0x7f0000000140)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r0 = open(&(0x7f0000000140)='./file0\x00', 0x800, 0x70) mknodat$loop(r0, &(0x7f0000001600)='./file1\x00', 0x0, 0x0) chdir(&(0x7f0000000140)='./bus\x00') unlink(&(0x7f0000000040)='./file1\x00') 6.572436253s ago: executing program 0 (id=50): prctl$PR_SET_NAME(0xf, &(0x7f0000000180)='wg1\x00') r0 = syz_open_dev$mouse(&(0x7f0000000500), 0xffffffff, 0xc080) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000005c0)={'syztnl0\x00', &(0x7f0000000540)={'syztnl0\x00', 0x0, 0x0, 0x7, 0x6, 0x81, 0x10, @rand_addr=' \x01\x00', @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x40, 0x8, 0xfffff2c2, 0xffffffff}}) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x13, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002d0000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r1}, 0x10) r2 = socket$nl_rdma(0x10, 0x3, 0x14) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000020000000c"], 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='sys_enter\x00', r4}, 0x10) setitimer(0x1, 0x0, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff000000850000006d00000018110000", @ANYRES32=r3, @ANYBLOB], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000180)='kfree\x00', r5}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, @void, @value}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='block_bio_remap\x00', r7}, 0x10) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000380)={&(0x7f0000000340)='block_bio_remap\x00', r8}, 0x10) r9 = socket$netlink(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000000000)=ANY=[@ANYBLOB="380000000314010000000000000000000900020073797a2f000000000800410072786500140033007465616d5f736c6176655f30"], 0x38}}, 0x0) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x24, 0x140f, 0x1, 0x3, 0x0, "", [@RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x9, 0x45, 'umad\x00'}, @RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x24}}, 0x4000880) r10 = socket$rds(0x15, 0x5, 0x0) r11 = pidfd_getfd(0xffffffffffffffff, r6, 0x0) r12 = syz_genetlink_get_family_id$smc(&(0x7f0000000400), r9) sendmsg$SMC_PNETID_DEL(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x20, r12, 0x400, 0x70bd26, 0x25dfdbfe, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x50}, 0x20004004) getsockopt$inet_sctp_SCTP_MAXSEG(r11, 0x84, 0xd, &(0x7f0000000240)=@assoc_value={0x0, 0xd507}, &(0x7f0000000280)=0x8) bind$rds(r10, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) 6.216941479s ago: executing program 0 (id=53): syz_usb_connect$cdc_ecm(0x0, 0x9f, &(0x7f0000000140)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x8d, 0x1, 0x1, 0x0, 0x50, 0x0, [{{0x9, 0x4, 0x0, 0x80, 0x3, 0x2, 0x6, 0x0, 0x0, {{0x5}, {0x5}, {0xd}, [@ncm={0x6, 0x24, 0x1a, 0x0, 0x18}, @mdlm_detail={0x43, 0x24, 0x13, 0x7, "666f37dcba7dad66341136ea5531d82d42dfba2a6da8214d810637bea56240e5c68aaf5bab28d6fd7d45edc022a1c8ca1d92b2f6327dba29c6ad31edaf08ee"}]}, {[{{0x9, 0x5, 0x81, 0x3, 0x200, 0xd, 0x7}}], {{0x9, 0x5, 0x82, 0x2, 0x10, 0x0, 0xf9}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0x3}}}}}]}}]}}, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000001c0)={0x0, 0x12c000, 0x1000, 0x0, 0x6}, 0x20) 4.762980443s ago: executing program 1 (id=63): syz_usb_connect(0x1, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582239f"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) 4.676692574s ago: executing program 3 (id=65): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() r1 = openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$UI_ABS_SETUP(r1, 0x401c5504, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b0000000700000001001a00090000000100"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)}], 0x1}, 0x0) r6 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$6lowpan_control(r6, &(0x7f00000007c0)='connect aa:aa:aa:aa:aa:11 2', 0x1b) 4.107410003s ago: executing program 4 (id=66): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000240)='./file2\x00', 0x2000090, &(0x7f0000000540), 0x81, 0x7a5, &(0x7f0000000f80)="$eJzs3c9rXNUeAPDvnfxq0r6XPHjwXl0FBA2UTkyNrYKLigsRLBR0bRsm01AzyZTMpDQh0BYR3AgqLgTddO2PunPrj63+Fy6kpWparLiQkTuZSSbNTJq0mZlgPh+4uefcc2/O+c65P87MvcwEcGCNpn8yEUcj4v0kYri2PImIvmqqN+L02nr3V1dy6ZREpfL6r0l1nXurK7lo2CZ1uJb5f0R8907EsczWektLy7NThUJ+oZYfL89dGi8tLR+/ODc1k5/Jz5+cmJw8ceq5Uyf3Ltbff1w+cvuDV57+8vSfb//v5nvfJ3E6jtTKGuPYK6MxWntN+tKXcJOX97qyLku63QAeSXpo9qwd5XE0hqOnmmphsJMtAwDa5WpEVACAAyZx/QeAA6b+OcC91ZVcferuJxKddeeliDi0Fn/9/uZaSW/tnt2h6n3QoXvJpjsjSUSM7EH9oxHx6ddvfp5O0ab7kADNXLseEedHRree/5Mtzyzs1jPbFVYGqrPRBxY7/0HnfJOOf55vNv7LrI9/osn4Z6DJsfsoHn78Z27tQTUtpeO/FxuebbvfEH/NSE8t96/qmK8vuXCxkE/Pbf+OiLHoG0jzE9VVmz8FNXb3r7ut6m8c//324VufpfWn8401Mrd6BzZvMz1VnnrcuOvuXI94ordZ/Ml6/yctxr9nd1jHqy+8+0mrsjT+NN76tDX+9qrciHiqaf9v9GWy7fOJ49XdYby+UzTx1U8fD7Wqf6P/B6rztP76e4FOSPt/aPv4R5LG5zVLu6/jhxvD37Yqa9z/m8fffP/vT96opvtry65MlcsLExH9yWtbl5/Y2Laer6+fxj/2ZPPjv9X+n6k9G3t+Pbe93tu/fFH7V03jr7rWKv72SuOf3lX/b5Oo1LZ5oOjm/dmeVvXvrP8nq6mx2pKdnP8e0tLH2JsBAAAAAAAAAAAAAAAAAAAAAAAAYPcyEXEkkkx2PZ3JZLNrv+H93xjKFIql8rELxcX56aj+VvZI9GXqX3U53PB9qBO178Ov5088kH82Iv4TER8NDFbz2VyxMN3t4AEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACg5vDm3/+/ms6y2bWynwe63ToAoG0OdbsBAEDHuf4DwMGzu+v/YNvaAQB0zq7f/1eS9jQEAOiYHV//z7e3HQBA57j/DwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQJudPXMmnSp/rK7k0vz05aXF2eLl49P50mx2bjGXzRUXLmVnisWZQj6bK861/EfX1maFYvHSZMwvXhkv50vl8dLS8rm54uJ8+dzFuamZ/Ll8X8ciAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAICdKy0tz04VCvkFiW0Tg/ujGfsm0Rv7ohn/+ER/12pvPEsMdu8EBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALDP/R0AAP//aHclQg==") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.current\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) 3.586123322s ago: executing program 3 (id=67): sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000000)={0xa, 0x4e23, 0x8, @dev={0xfe, 0x80, '\x00', 0xb}, 0x3}, 0x1c, 0x0, 0x0, 0x0, 0x18}, 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='2', 0x1, 0x4fed0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 3.496147763s ago: executing program 3 (id=68): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = getpid() sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88adfda5}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x4}}}, @IFLA_NET_NS_PID={0x8, 0x13, r2}]}, 0x3c}}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="e4000000", @ANYRES16=r5, @ANYBLOB="07002abd5248ffdbdf2507ff000008000300", @ANYRES32=r6, @ANYBLOB="0c00990001000c0069000000140004002f6163766c616e3100000000000000000400cc00080005000a"], 0xe4}}, 0x0) 3.367068486s ago: executing program 3 (id=69): syz_usb_connect(0x2, 0x4db, &(0x7f0000000c00)=ANY=[@ANYBLOB="12010002ef8e4b0823398a71c01f010203010902c90401000260010904c0070d6ab5158609050b0000040007087003aa1676361bfaafde7b3c197300d7d36f917667a0ea6e4791ae17d0be38cd15fbed426e156a607477279af05e97fb6c210b8c1295570e7af0999339fb75af881cfabe912221dba0549312c54b40200bd14614a283026562319915b0400def10c7c3a45b64968a9fef423ddf72c3f0389d502e7ad1f6e3bc4a78a3e66480e7a64735c5c515b874b3a3cbf19257a8c21b9095e2fa049add006050bb7c7ecdd2a1389c9c802f9a3b09050801ff03fc060c0725010109070009050504ff0304010ba0074171fc069ce5b9999f6da10269a371115d75ab5837b383912e84420678cf4ce6f1b3d33d896873f1ed9bbf38cc13ae13b7e5162d289ae27c918afd53063ee7ec23b28c64fa402ea0bf4971e51119909101e50a824a83824d57a0b438e06d023b1ed363431ffdc3fae6888b44235e0dcd096a724b2e204f3e176d12ed688a9444a13794a12cf9c9c2dc177dac40b228ad09d5342046d7535f808db14be5232c01a48f7d534f0421db341e3d295a9e14cdaf9903c3dcd56ce1fe30223c2b3cf187f0e339908e0b7ee122f209050000100006b34409050700000403e40307250181ad1a00090500020004c880050725018009ad83820864e455d01df33b2ecb06d77f6e39708f65a977e18914037af3db9ca3b5adb80b5f1aeb916e45d4ec2323b95d511a056875815b2d06def8e92b6d69420950a8532791e2b5819d368b752b2d3a2261b928132f8d62cb17a9c070f3138970098bedee138abf08dd74c4de3dbc59d238789f75677bc4de80e23803cab0f3b0120de209050d0000040cfe07510eb589e9a2f551c5808bfae83ca0da31be534bae7e1f1f82cb658d76d567ba0285ae8e825b84da3fd8169e2dab48c162cc392c5ffded3409c23b955fa6b7c297539e4ab00e206900b8d98dd915be871e0905020008000007082704a24ee6b01c05a8091bec20f0a6cbe8c7fcf09ea667019df6dc58cba88bd1a288d665ed092d0905080410000704045e116842b0f84080417bcb55aced61a888b5b56ad34dca069137ffbb0521cdb371dca0a98cd8200219c7a901600e813a03ba8761b69d5f27b47885ee64aca9c97d29e3540adbabea9e5bc1ed30c52ece67b5f8f6e84a91fd28d5f997abdc09050910000007020107250104610500072501000d070009050a00"], &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0}) 3.13091485s ago: executing program 4 (id=70): syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x2000c16, &(0x7f0000000400)={[{@resgid}, {@acl}]}, 0x40, 0x257, &(0x7f0000000500)="$eJzs3U9oFFccB/DfzO42TbKUtL0USv9AKaUNhPRW6CW9tBAoIZRSaAsppfSiJEJM8JZ48uJBj6KSk5cg3oweJZfgRRE8Rc0hXgQNHgweVFjZnQTyTxOzmx1xPh+YzEzy5v3eMPN9ExaGDaCweiJiICJKEdEbEZWISDY2+DJbetZ2ZzoXRiJqtd8eJ4122X5m/bjuiJiOiB8iYj5N4lA5YnLur+Wni798c3Ki8vWFuT8723qSa1aWl35dPT904vLg95M3bz8cSmIgqpvOq/WSHX5XTiI+Oohib4mknPcI2IvhY5fu1HP/cUR81ch/JdLILt6p8ffmK/HduVcde/rRrU/bOVag9Wq1Sv0ZOF0DCieNiGokaV9EZNtp2teX/Q9/t9SVHh4bP9r7/9jE6H95z1RAq1Qjln6+2nGle0v+H5Sy/APvqOxDqaXfh2fv1TdWS3kPCGiLz7JV/fnf+8/UtyH/UDjyD8Ul/1Bc8g/FJf9QXPIPxSX/UFzyD8Ul/1Bc+87/mRcHNyigLTbmHwAollrHvt4abv2LyEDb5T3/AAAAAAAAAAAAAAAAAAAA2810LoysL63psbxri+tnI1Z+yppur19qfB9xxPuNn11Pkk09Jnuq8Hp/f9FkB026mPPb1x/cz7f+jc/zrT81GjF9PCL6y+Xt91+ydv/t34e7/L3yb5MF3lCyZf/HP9pbf6vns/nWH1yMuFaff/p3mn/S+KSx3nn+qdavX5P1jzxrsgMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADa5mUAAAD//7FLbdg=") socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x2, 0x0, 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000680)={@val={0x0, 0x809b}, @void, @arp=@generic={0x302, 0x8864, 0x6, 0x0, 0x0, @local, "", @remote}}, 0x18) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000c80), 0xffffffffffffffff) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000400)=@raw={'raw\x00', 0x8, 0x3, 0x370, 0x238, 0x11, 0x148, 0x238, 0x0, 0x2d8, 0x2a8, 0x2a8, 0x2d8, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x1f0, 0x238, 0x0, {}, [@common=@inet=@socket2={{0x28}}, @common=@inet=@hashlimit3={{0x158}, {'bridge0\x00', {0x6, 0x6, 0x40, 0x6, 0x0, 0x3, 0x5, 0x8, 0x0, 0x20}, {0x5}}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0xfffffffe}}}, {{@ip={@multicast2, @remote, 0x0, 0x0, 'vlan0\x00', 'macvlan1\x00', {}, {0xff}}, 0x0, 0x70, 0xa0}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3d0) openat$cgroup_devices(0xffffffffffffffff, 0x0, 0x2, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup\x00', 0x0, 0x1) openat(0xffffffffffffff9c, 0x0, 0x101042, 0x45) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f00000002c0)={{0x2, 0x4e20, @local}, {0x306, @random="f289017f20ee"}, 0x4, {0x2, 0x4e21, @remote}}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x0) write$FUSE_WRITE(r2, &(0x7f00000000c0)={0x18}, 0xfffffdef) 3.07714299s ago: executing program 0 (id=71): r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r2 = socket$inet6(0x10, 0x3, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f00000000c0)={0x4000000a}) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000100)={0x20000000}) r3 = socket$nl_sock_diag(0x10, 0x3, 0x4) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r3, &(0x7f0000000040)={0x80000001}) 2.896401163s ago: executing program 0 (id=72): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0xd9, 0x72, 0xa4, 0x40, 0x20b7, 0x1540, 0xb75a, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xff}}]}}]}}, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000740)={0x24, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 2.641493597s ago: executing program 1 (id=73): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000280)=[{0x200000000006, 0x0, 0xfd, 0x7ffc0002}]}) sync() 2.541128759s ago: executing program 4 (id=74): r0 = socket(0x10, 0x3, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x9) sendmsg$nl_generic(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="200000001600010a"], 0x20}}, 0x840) 2.46693038s ago: executing program 4 (id=75): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x9) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000004c0)={0x14, r3, 0x1, 0x70bd2c, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x20000800}, 0x800) 2.342368502s ago: executing program 4 (id=76): memfd_create(&(0x7f0000000340)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\xdenJ\xeb\x87\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdb\x00b\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14OD\\\xe8R\xe4\xcd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\xe0\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\xd9w\\\xf0\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12', 0x2) r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="300000001014"], 0x30}, 0x1, 0x0, 0x0, 0x24044836}, 0xc094) 2.276941773s ago: executing program 1 (id=77): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() r1 = openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$UI_ABS_SETUP(r1, 0x401c5504, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b0000000700000001001a00090000000100"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000140)}], 0x1}, 0x0) r6 = openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$6lowpan_control(r6, &(0x7f00000007c0)='connect aa:aa:aa:aa:aa:11 2', 0x1b) 2.244617894s ago: executing program 4 (id=78): syz_emit_ethernet(0x86, &(0x7f0000000c80)=ANY=[@ANYBLOB="ffffffffffffffffffffffff0800450000780000000000019078ac1e0001e000000205009078e00000e0470000000000000000840000ac1414aa00000000070f287f00000164010101ac1414aa07030244340003000000000001"], 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000140), 0x75f, 0xa382) r1 = memfd_create(&(0x7f0000000880)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc90\xb9voI\xa5/\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\x81\x00V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J\x80\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93\x9c5\xcf\t\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\x94\x13^\x13\xaf\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n [ 82.345371][ T4170] dump_stack_lvl+0x1e3/0x2d0 [ 82.350082][ T4170] ? io_uring_drop_tctx_refs+0x1a0/0x1a0 [ 82.355740][ T4170] ? _printk+0xd1/0x120 [ 82.359928][ T4170] ? __wake_up_klogd+0xcc/0x100 [ 82.364804][ T4170] ? panic+0x860/0x860 [ 82.368882][ T4170] ? _raw_spin_lock_irqsave+0xdd/0x120 [ 82.374346][ T4170] print_address_description+0x63/0x3b0 [ 82.379894][ T4170] ? hci_le_meta_evt+0x11f1/0x3f50 [ 82.385004][ T4170] kasan_report+0x16b/0x1c0 [ 82.389506][ T4170] ? hci_le_meta_evt+0x11f1/0x3f50 [ 82.394617][ T4170] hci_le_meta_evt+0x11f1/0x3f50 [ 82.399741][ T4170] ? __lock_acquire+0x1ff0/0x1ff0 [ 82.404866][ T4170] ? hci_remote_host_features_evt+0x280/0x280 [ 82.410931][ T4170] ? __mutex_unlock_slowpath+0x218/0x750 [ 82.416560][ T4170] ? hci_event_packet+0x3b4/0x1550 [ 82.421674][ T4170] ? mutex_unlock+0x10/0x10 [ 82.426181][ T4170] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 82.432161][ T4170] ? print_irqtrace_events+0x210/0x210 [ 82.437620][ T4170] hci_event_packet+0xc41/0x1550 [ 82.442583][ T4170] ? rcu_lock_release+0x20/0x20 [ 82.447441][ T4170] ? hci_send_to_monitor+0x99/0x4d0 [ 82.452727][ T4170] hci_rx_work+0x237/0xa10 [ 82.457152][ T4170] process_one_work+0x8a1/0x10c0 [ 82.462097][ T4170] ? worker_detach_from_pool+0x260/0x260 [ 82.467734][ T4170] ? _raw_spin_lock_irqsave+0x120/0x120 [ 82.473275][ T4170] ? kthread_data+0x4e/0xc0 [ 82.477794][ T4170] ? wq_worker_running+0x97/0x170 [ 82.482819][ T4170] worker_thread+0xaca/0x1280 [ 82.487512][ T4170] kthread+0x3f6/0x4f0 [ 82.491579][ T4170] ? rcu_lock_release+0x20/0x20 [ 82.496434][ T4170] ? kthread_blkcg+0xd0/0xd0 [ 82.501021][ T4170] ret_from_fork+0x1f/0x30 [ 82.505447][ T4170] [ 82.508458][ T4170] [ 82.510772][ T4170] Allocated by task 4482: [ 82.515098][ T4170] ____kasan_kmalloc+0xba/0xf0 [ 82.519861][ T4170] __kmalloc_node_track_caller+0x195/0x390 [ 82.525691][ T4170] __alloc_skb+0x12c/0x590 [ 82.530101][ T4170] vhci_write+0xbc/0x430 [ 82.534335][ T4170] vfs_write+0xacd/0xe50 [ 82.538568][ T4170] ksys_write+0x1a2/0x2c0 [ 82.542890][ T4170] do_syscall_64+0x3b/0x80 [ 82.547305][ T4170] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 82.553194][ T4170] [ 82.555509][ T4170] The buggy address belongs to the object at ffff888074fa6000 [ 82.555509][ T4170] which belongs to the cache kmalloc-1k of size 1024 [ 82.569564][ T4170] The buggy address is located 5 bytes to the right of [ 82.569564][ T4170] 1024-byte region [ffff888074fa6000, ffff888074fa6400) [ 82.583286][ T4170] The buggy address belongs to the page: [ 82.588932][ T4170] page:ffffea0001d3e800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x74fa0 [ 82.599101][ T4170] head:ffffea0001d3e800 order:3 compound_mapcount:0 compound_pincount:0 [ 82.607415][ T4170] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 82.615406][ T4170] raw: 00fff00000010200 ffffea0001fbee00 0000000700000007 ffff888017441dc0 [ 82.623999][ T4170] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 82.632584][ T4170] page dumped because: kasan: bad access detected [ 82.638998][ T4170] page_owner tracks the page as allocated [ 82.644707][ T4170] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4223, ts 65095606614, free_ts 65079840035 [ 82.663821][ T4170] get_page_from_freelist+0x3b78/0x3d40 [ 82.669376][ T4170] __alloc_pages+0x272/0x700 [ 82.673983][ T4170] new_slab+0xbb/0x4b0 [ 82.678057][ T4170] ___slab_alloc+0x6f6/0xe10 [ 82.682646][ T4170] __kmalloc+0x1c9/0x300 [ 82.686892][ T4170] load_elf_binary+0x2ec/0x2750 [ 82.691750][ T4170] bprm_execve+0x8fd/0x17c0 [ 82.696280][ T4170] kernel_execve+0x8ce/0x9b0 [ 82.700892][ T4170] call_usermodehelper_exec_async+0x22f/0x370 [ 82.706969][ T4170] ret_from_fork+0x1f/0x30 [ 82.711389][ T4170] page last free stack trace: [ 82.716055][ T4170] free_unref_page_prepare+0xc34/0xcf0 [ 82.721518][ T4170] free_unref_page+0x95/0x2d0 [ 82.726191][ T4170] __unfreeze_partials+0x1b7/0x210 [ 82.731297][ T4170] put_cpu_partial+0x132/0x1a0 [ 82.736057][ T4170] ___cache_free+0xe3/0x100 [ 82.740571][ T4170] qlist_free_all+0x36/0x90 [ 82.745068][ T4170] kasan_quarantine_reduce+0x162/0x180 [ 82.750518][ T4170] __kasan_slab_alloc+0x2f/0xc0 [ 82.755362][ T4170] slab_post_alloc_hook+0x53/0x380 [ 82.760474][ T4170] __kmalloc+0x120/0x300 [ 82.764708][ T4170] tomoyo_realpath_from_path+0xd8/0x5e0 [ 82.770251][ T4170] tomoyo_path_perm+0x273/0x6b0 [ 82.775112][ T4170] security_inode_getattr+0xcf/0x120 [ 82.780393][ T4170] vfs_getattr+0x26/0x360 [ 82.784717][ T4170] vfs_statx+0x18f/0x3b0 [ 82.788955][ T4170] __x64_sys_newfstatat+0x12c/0x1b0 [ 82.794156][ T4170] [ 82.796473][ T4170] Memory state around the buggy address: [ 82.802119][ T4170] ffff888074fa6300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 82.810170][ T4170] ffff888074fa6380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 82.818309][ T4170] >ffff888074fa6400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 82.826361][ T4170] ^ [ 82.830448][ T4170] ffff888074fa6480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 82.838502][ T4170] ffff888074fa6500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 82.846566][ T4170] ================================================================== [ 82.854632][ T4170] Disabling lock debugging due to kernel taint [ 82.864609][ T4170] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 82.871844][ T4170] CPU: 1 PID: 4170 Comm: kworker/u5:1 Tainted: G B 5.15.180-syzkaller #0 [ 82.881575][ T4170] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 82.891800][ T4170] Workqueue: hci1 hci_rx_work [ 82.896700][ T4170] Call Trace: [ 82.899989][ T4170] [ 82.902923][ T4170] dump_stack_lvl+0x1e3/0x2d0 [ 82.907626][ T4170] ? io_uring_drop_tctx_refs+0x1a0/0x1a0 [ 82.913278][ T4170] ? panic+0x860/0x860 [ 82.917364][ T4170] ? rcu_is_watching+0x11/0xa0 [ 82.922148][ T4170] ? preempt_schedule_common+0xa6/0xd0 [ 82.927629][ T4170] panic+0x318/0x860 [ 82.931543][ T4170] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 82.937711][ T4170] ? check_panic_on_warn+0x1d/0xa0 [ 82.942833][ T4170] ? fb_is_primary_device+0xd0/0xd0 [ 82.948043][ T4170] ? _raw_spin_unlock_irqrestore+0x128/0x130 [ 82.954044][ T4170] ? _raw_spin_unlock+0x40/0x40 [ 82.958908][ T4170] check_panic_on_warn+0x7e/0xa0 [ 82.963858][ T4170] ? hci_le_meta_evt+0x11f1/0x3f50 [ 82.968978][ T4170] end_report+0x6d/0xf0 [ 82.973144][ T4170] kasan_report+0x18e/0x1c0 [ 82.977669][ T4170] ? hci_le_meta_evt+0x11f1/0x3f50 [ 82.982799][ T4170] hci_le_meta_evt+0x11f1/0x3f50 [ 82.987751][ T4170] ? __lock_acquire+0x1ff0/0x1ff0 [ 82.992801][ T4170] ? hci_remote_host_features_evt+0x280/0x280 [ 82.998903][ T4170] ? __mutex_unlock_slowpath+0x218/0x750 [ 83.004555][ T4170] ? hci_event_packet+0x3b4/0x1550 [ 83.009690][ T4170] ? mutex_unlock+0x10/0x10 [ 83.014223][ T4170] ? lockdep_hardirqs_on_prepare+0x438/0x7a0 [ 83.020232][ T4170] ? print_irqtrace_events+0x210/0x210 [ 83.025756][ T4170] hci_event_packet+0xc41/0x1550 [ 83.030721][ T4170] ? rcu_lock_release+0x20/0x20 [ 83.035615][ T4170] ? hci_send_to_monitor+0x99/0x4d0 [ 83.040846][ T4170] hci_rx_work+0x237/0xa10 [ 83.045294][ T4170] process_one_work+0x8a1/0x10c0 [ 83.050259][ T4170] ? worker_detach_from_pool+0x260/0x260 [ 83.055916][ T4170] ? _raw_spin_lock_irqsave+0x120/0x120 [ 83.061484][ T4170] ? kthread_data+0x4e/0xc0 [ 83.066006][ T4170] ? wq_worker_running+0x97/0x170 [ 83.071053][ T4170] worker_thread+0xaca/0x1280 [ 83.075765][ T4170] kthread+0x3f6/0x4f0 [ 83.076936][ T4488] loop4: detected capacity change from 0 to 512 [ 83.079849][ T4170] ? rcu_lock_release+0x20/0x20 [ 83.079876][ T4170] ? kthread_blkcg+0xd0/0xd0 [ 83.095553][ T4170] ret_from_fork+0x1f/0x30 [ 83.099997][ T4170] [ 83.103270][ T4170] Kernel Offset: disabled [ 83.107601][ T4170] Rebooting in 86400 seconds..