last executing test programs: 4m39.696877179s ago: executing program 1 (id=342): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./dev\x00', &(0x7f0000000140)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/md0\x00', 0x2, 0x0) ioctl(r0, 0x40480923, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) 4m39.609916041s ago: executing program 1 (id=343): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), r0) sendmsg$ETHTOOL_MSG_TSINFO_GET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000200000020000180140002006e657464657673696d30000000000000080003"], 0x34}}, 0x0) 4m39.601327701s ago: executing program 1 (id=344): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./dev\x00', &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000940)='./dev/nvme0\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000a40)={0x18, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000a00)=[{0x4, 0x1, 0xe, 0xa}], 0x10, 0x4}, 0x94) ioctl(r0, 0xc0484e43, &(0x7f0000000a00)) 4m39.22346303s ago: executing program 1 (id=349): syz_mount_image$ext4(&(0x7f00000003c0)='ext4\x00', &(0x7f0000000240)='./file3\x00', 0x4010, &(0x7f00000001c0), 0x2, 0xbd8, &(0x7f00000083c0)="$eJzs3M1rHOcZAPBnRqu1ZKtduZRS91KVUmwoXUsuMrUp1C4uvfRQaK8FC3llhNYfSCquZB1W7T9Q2p5begk4MQk5xGdfEpJrLol9TcghYIJiJWBCsmH2Q1K8Wkm2dzWO/PvBu/O+887u8zwer2Ze2N0AXlhj2UMacSwiLiYRpdb+NCKKjd5QRK153PrayvTnayvTSdTrf/okiSQiHq6tTLdfK2ltj7QGQxHx7m+T+N4/OuMuLC3PTVWrlfnW+OTilesnF5aWfzF7Zepy5XLl6sTpX02emjw9fmayZ7U++uDcnc9+8vuPal+8/OXtT//9UhLnYqQ1t7WOXhmLsY1/k60KETHV62A5GWjVs7XOpLDLk9I+JwUAQFfplnu4H0QpBmLz5q0Ub76Xa3IAAABAT9QHIuoAAADAAZdY/wMAAMAB1/4cwMO1lel2y/cTCfvrwfmIGG3Wv95qzZlC1BrboRiMiMMPk9j6tdak+bRnNhYRH94/81rWouN7yP+71YMQO6qtRsQPtzv/SaP+0ca3uDvrTyNivAfxxx4b7/f/v2ep/1wP4uddPwAvprvnmxeyzutfunH/E9tc/wrbXLueRt7Xv/b933rH/d9m/QNd7v/+uMcYN2/990a3uaz+X9/53avtlsXPts9U1BN4sBrxo8J29Scb9Sdd6r+4xxilr25Uus3lXX/9/xHHY/v625Kdf5/o5MxstTLefNw2xuo7k690i593/dn5P9yl/vbvP3U7/9f3GOMvFy683rHz/mZ35/rTj4vJnxu9YmvP36YWF+cnIorJHzr3n9ohkdrmMe3XyOo/8dOd3//b1T/QfLnGXLYWWG1ts/HfHwv7m9s33+iWUnv998Tnf3jXI/Ykq/9Sl/O/tf63C53n/597jPGzt/51otvc1vVv1rL47bUwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALSlETESSVre6KdpuRxxJCK+H4fT6rWFxZ/PXPvr1UvZXMRoDKYzs9XKeESUmuMkG080+pvjU4+NfxkRRyPiP6Xhxrg8fa16Ke/iAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2HAkIkYiScsRkUbEeilNy+W8swIAAAB6bjTvBAAAAIC+s/4HAACAg8/6HwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgD47+uO795KIqJ0dbrRMsTU3mGtmQL+leScA5GYg7wSA3BTyTgDIzROu8d0uwAGU7DI/1HXmUM9zAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOD5dfzY3XtJRNTODjdaptiaG8w1M6Df0rwTAHIzsNNkYf/yAPaftzi8uKzxgWSX+aHNY2rfnDnUt5wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeP6MNFqSliOi2NpXLkd8JyJGYzCZma1WxiPiuxHxfmnwUDaeyDlnAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAem9haXluqlqtzGedNFqdjT3fgk4kzUr6HqsVp5Z/yTo96RTjKZ/+qF6v55183zu5/lkCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAnC0vLc1PVamV+Ie9MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgLwtLC3PTVWrlfk+dvKuEQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/HwdAAD///TiCwo=") openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file2\x00', 0x171804, 0x88) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0x124) r1 = fanotify_init(0x1a, 0x800) fanotify_mark(r1, 0x541, 0x40001019, r0, 0x0) r2 = syz_io_uring_setup(0xeff, &(0x7f0000000400)={0x0, 0x595f, 0x10000, 0x4000000, 0x51}, &(0x7f00000001c0)=0x0, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f0000000280)=@IORING_OP_READV=@pass_iovec={0x1, 0x4, 0x2007, @fd_index=0x5, 0xc, 0x0, 0x0, 0x4, 0x0, {0x1, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r2, 0x7c65, 0xa334, 0x0, 0x0, 0x0) 4m37.9288635s ago: executing program 1 (id=353): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r0 = syz_clone(0x20000000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) openat$make_it_fail(0xffffffffffffff9c, 0x0, 0x1, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x2241, 0x0) setpgid(r0, r0) setpgid(0x0, r0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x22801, 0x20) 4m36.942972122s ago: executing program 1 (id=364): r0 = socket$inet(0x2, 0x1, 0x6) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000000000a0000010900010073797a3100000000200004801c0001800b00010074617267657400000c000280080002400000000114000000110001"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) bind$inet(r0, &(0x7f0000000000)={0x2, 0x801, @loopback}, 0x10) listen(r0, 0x5) setsockopt$inet_buf(r0, 0x0, 0x1, &(0x7f0000000300)="800001000000000000000001", 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={[{'addr=127.0.0.1,port=2049,mountport=2049,proto=tcp,mountproto=tcp,nolock,timeo=10,retrans=1\x00'}]}) r1 = accept$inet(r0, 0x0, 0x0) read(r1, &(0x7f0000000100), 0x4) read(r1, &(0x7f0000000304), 0x4) write(r1, &(0x7f0000000300), 0x100) 4m20.110662038s ago: executing program 32 (id=364): r0 = socket$inet(0x2, 0x1, 0x6) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000000000a0000010900010073797a3100000000200004801c0001800b00010074617267657400000c000280080002400000000114000000110001"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) bind$inet(r0, &(0x7f0000000000)={0x2, 0x801, @loopback}, 0x10) listen(r0, 0x5) setsockopt$inet_buf(r0, 0x0, 0x1, &(0x7f0000000300)="800001000000000000000001", 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount$nfs(&(0x7f0000000080)=':27.0.0.1:/export\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000100), 0x0, &(0x7f0000000140)={[{'addr=127.0.0.1,port=2049,mountport=2049,proto=tcp,mountproto=tcp,nolock,timeo=10,retrans=1\x00'}]}) r1 = accept$inet(r0, 0x0, 0x0) read(r1, &(0x7f0000000100), 0x4) read(r1, &(0x7f0000000304), 0x4) write(r1, &(0x7f0000000300), 0x100) 6.650003768s ago: executing program 0 (id=2548): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000002080)={0x0, 0x0, &(0x7f0000002000)=[{&(0x7f0000000880)="1a", 0x100000}], 0x1}, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f0000001a00)={0x0, 0x0, &(0x7f00000019c0)=[{&(0x7f0000000900)="e0053d17a4dc94182fd2de5b81cd198029b1c56e73849d93712e10f9e5835714d2299c7e3aeaf57aa8e9d62991aa4a9ff5a6bfbcfb4869be98841f8dc5844e45ea30a77ea0bb2a2ae8981e79513c53e6690ef8c830fbc108c0a0b468e847749a834bd986a5309a9d9b7a546f9c0bffa1286fd56315c96ec6969944ffcd12740d7b4788d72bc323111de8523ebb0804c5d90616b1d06c72a7c5a534bf74d0e0ffac1d32579bc53408eeaf4a3bb2034013cb90c6d3a029f0ec469172f6d0958e1174a9a4ce6e73378ee6b3447e2eb193671f2ecb0edb75201f3873ab2b72c2f5b37474d6bbb03c8664d29993d743e5207cc7cde1343548265434545392396a851d6390039954ad90edba054222c028cc861e2f8c92ff441649b98bea1716862820b2354edf8041a9b8033e35341a0dce67381bf55d77f9a88d8df5d5a727b7c47ed4a59caf8f35600af7c71f5537ea0551851ebf4435c9635874e1b43a8ce0a4642e5ce5297ade8b668835324ab9afdf49cee41e7a3dc4dff3ebb636e85cd370c82bab7113a842410c3d3288cabf5c58c2d672adf641aa260a98d17d18f42e5602d953403d7d05917939ee99835a71ce056e7ed73e5711a45383621712438c08abaa6741760f2c8a01f54c03d1656865a54f223c631ec4e8f6861dbbfae95e9fe9e84c2ac8225f8c2548cf9afa9e4ee6de25ae9ae6dbd8a73163c9c26903d7dc390bd1c17d84e24453e753e9669490766335e9add922d26c33e301dbcd94a93eaeed30638a27448e4d54a09856bd17ced2436963cbbe41bb9c3a48104ec45f3fd3966a35153e406c7828328c8d24281dbfa22b6e9de9b439af9804a769bd26fee556c2366421c9e2922b523d3608a661cd16f3cb58ad1772fc95992e18ce10c3b1736a625964323e88dcc1e0c792a772656eeb676d5c1100d9915dc04d4f0ea142f27df14db26cd50fa3b74acf544715c011d21c71393f0d5119ee5781cacf0b515047057c6ff2ae3fced8d1b31d432e311a7fca563f7ef3209b394cd0e3da75e0edd7f9672641d505dfd95c7603ee2478effefefb35940751cb7d8e0fcb7e4e93fc580636ab10e096e1ad04746d43eba8cad1a561a775cf8ae45a4abafc23a1eb0ddab81c4c596053e6287f097f27105dddb93e3f004764c7c100cb0b19b3ca43471a24130844a58e36ce205433e4dc07a0779f6b5d6494a0cc7bc4c6f8aa468050a6c5c24a7aa1f3b4da26679289ad1c15e35435a937139b1e166954bc30c6140365d34b9a57d0763bcacd49259c78fbcd68c7d9530dbfcc7eb268077f5725460a0b9af7a3bc1cf7a1b1b2f737545f2761b2c2271715c549f157f1d6aff9ac441cf6fc964fc4a596864c381031aa18da356fc142414ee599f504c02e868e0b59dc8c937398808a305223030c2c3c9c4b539ace3b124d4c6ed65df150a55af1fecc303c7c00c60e40406500e8819984bc12d3975d474f6364f8f8bf480076ef950f0b48b48e3176c4d7e72baf2361c9f00d493dd6e03550e770a12269681f10f9aa0782609e8c6dac965cfa6959ff91f0f2e10000ebaf760957f937232c101ee8d962f5244da2b77cf4b6e259566e0e7b6afe80e794b6ad84f590a8bb10d0389b4c786d7c793785673bb66c266b8b030a7d6630918c56f40bbf4b1891a9656f0e66027d051abf85e8fe0b3f8d309d16c87278a884acdd6bb4fb481b701d3539b6e99716e3f1f9a8f19b2e8efa7c11c7c338e84fa9aec2c03a2fb5640621f45c8b4498c926757fd7c25bd6cc53d5f9f37a4444faef85995a1c8e1270521ace7e8ec944e881a7e75cef25202c4598ba1a02d0e9a175bb0d18282e98e6cbb78dead40417500650f58f323ccaacdd8c2fa70a15da628833815111fd24b80f899841b6c806b06317b53a2fc0cc1826578c9800f8a903b7f5a5de3929246bc5e8a8938e48f818ac11cc4657b65c6da56717b8e8ba7ec39c991c2d9cd73e71df7df8591b56221acc40f50994ac759928e2212e15548bb86ec3deff476807c185d936cf4a24a27a39d632e42ad9e0a04c75856c1086056ddb69af605264c3d23837771d676f373af3fe4dd0208f22b0adf9cb524e993ecdbf1a0495c60704824b2a4325cb280b33ea017f39fc05fcfe8aa399f029f40b721c33354c5674c4de4caafb3ffe85df3c9daca190fccd4109a7a67af5e0418b6b00976c304d4717f7dc3f44fe37f8cc80f13960a39f7567a81775d0672044c65a9154368f8537fcf8336b97888397a94dfa09bdb2a3340031e44c25e494519741c3b16323108cb11cbd80498b65303425037d04e61f9e290ded5e6c64a561df565ffc74303e5076a56e1b56acc8f3023351cd0fe0048403ed944047e9676493f8fb0290dc7a35cfde0147f31ad91dd7eb56fa318a95a362711b856b27c12c25a366e84c3b3c231103cc5c946e45727c29ba7d212c5408471c28a746f28866ef1ecfaaabd1c6b138ddc07e32669fc707ba47f79f6cd17c732bedd62e4da331599cbf40f58af8481d8da8ef13a8562c71118ddbb81e4a61b4510ee9c1c3b1762e63e87a18568c44e8b127dde030df77576f5dfa3f5dcc7bd51174ed0608371f48762fb3fa9bd254d96dca0cd25cabb90decd0112cf8ea5b0350ce2c5f12cdc79199d39463da40b5a4534cb3cab4aed93918e9aa0d524931b9f7b5779b4b5b4ed2aae111962c15b785f5c57a494169bcb1e6a6558ba66c09fd54319dc261c2a2558a66d31e21dd293c13772d82fdb16d15f710b03cc09c464df5368edff31383208ee1fcd96ab3ba0f285ac319f970b944d1b4322ea4f19991b66be3147c28c43518c3d6aabe03927a269a20016149ab80bc5fc5b4407e3b4a60c0e2ad47bb2a7f757e25f6e6d4d83ef90524a5797145ac9272f2251f64d8e86a032d5c232f5c994d7a3d3b0a820d33ed8985072932e9b12162354b39e6aef496aaf3302fc91d44178a618f0664d1fd203cb713d13042533277afecf6a0cf53631064fcfb51b72b2920055d826dae3950fac96c5e97ac032f4574245fa781bf4cfac6a9abf5394539af55db5a9a61299537fa76d34428cfc3e442b435a17d609d6a96e169852f17423adce411de690230c0c92646f86bf050932485c255de5a215f9d11174e49afd8a874d44d4d4e630b757f19442448a9230ce5e3f808ddc8fc87c628be5b5010a4cd29636df4683e00d2c18fdc702bf787e6d3b7af4207800e67e10a68c6dca47bbef0a12e754d1a4ca7b3fd86659316d670afaf8c8a374a597f704b67a596e9127abf2d624375dcb4c6979ca195ab8654ca9c699013c92a5c95cf78908f220881cc0e0712ea1e8cb514dd5acff7d1d88c0f2acd6083d8fcebf76a05b60389df13726c39e53fbe5dfc53230c5327c2c8b905d923a7e322004839bc8d1dd5c610ecaa5dcbb1a49032e72adaf788234da9a233efb3a7d66f729d823d02adf38c9efe77dfdd878a7bea2aa93cf38c22931ce75367d5cf6ce1bad05d1fdbf40e8904c3e5f7fec578fa31a6d42a52bff188619883b6c71e7f0646188311ca7593f7f28a35a212f9af8ed28e76d008917b0c36b7f959d0d077f2bc709e9523527fc6b65d5a05f494d87f1af83beadfbcd6dbd4b42cfab13e75c34250db86a6100a8521f7d3491a63479a5fa41d986abb21ea689d44a9631ffbd42c4797db14c465cbc4492b745a6d228df0c47d9630c13b10de6746804e854d357e4c97c22415fa764656b10611a139c1d101109de376fcaf1b5205988c9ebd27286029af473bafc10f43f641e4a6b5171089cd41e5c00786e87221f597b1609926ddda5a0ac1a668653303c3f51778d48fae55950f32f046be15ad64d67d57dedffb8ea63844434ebc3cedb0e9437da631b59ac97d73a112b94a380957a64638472b6c7ed548f936c211ee5f11617fa89b7d13f9e40e9d62bbd7ccead8b4760f2b3d24583a8dc1924f7194dd6aae3979227c39c5db1bbd6f174a81dfc74a7232a079954d022d0586b47d280148fe8dd8ceb8cff4cbcb58b3a92edcb74123410f96e76b4556c50b318e36c7a71758873ad5fe0927b885f05c53aa1ce2249d74a39c58a687fff69edf8b9c58e8afc3d3678126ff954989a8104db60660929bd9831b51725b04890de5c2961133facf1499dbeff8c651dde73615dadf5fd1f770df74a55946d175e20f08b480290881d0ec4f3bba342a01927ef4755dd12378ef75c087195a4c13bccf593182e749153bb4da331f9bf960070c07c2161158cd667eee6b7128e75239b1fe63a803bbfc36791f72066406f896a2d8f500a106e7d0f1461ebb15a7d79b3b6132b6a971622f613ad47a17e45c20dd7aa3d86aacd790f44a809c15b9e9a4c233fc427fa54045a4d875a3e80cf3b6661f3733ef1fc705d3f151c999695ec24b3dded0efb0f1b1149e0db873d7d2d141e8888f97778e4a43aa73942c79384ca6baaeaf1177fc1c8e9bd8438543d5d27293b8960926248715b75cada6a5530fca08200021c3da35392738e9dc172574758307407552f6a440e173cb0d8bb7a8ab7f414f3accf48561a4f13c8a070c85c0774e35ceaf55b64e39e7fddf4a2578d8d5a57b6e725d3ac177d024fdd148c3d7215fca0e86073c641404e267d6a921174ffe03fab70de57608bcac57e8eed9222320583fb51b955d56f9cc1025ad60fcd6dcb9f6b97fbc60a09bb4cb48971d5a510e978c27c9410f5cc87bb35c28abdd1a6854c1ad2a7dc2a9e5491a895afb5d0c6b069925ec788ccf45f37930062978770d9644509e6fa151044bada806c07d2309c8a9a32601dc51c265f201986521b27c65fa45b1076dc0e4386f4737a764f03b8e775bea2fbc08312545b3485c86efbcb9df07b4fd56cd87517872fe06b8f8e5d7424405eacc20927d40a1235603ab4aae57cdda30793fea9b83927b14fc559c2473d8419722b94a783c81a6eb115ccf37e49282bd3874397c4669f335c58fdc050e0a4be05513e92c2887de2d856e3392c4de9aa118530dca3344bee037f12f5dd4f227ed591c61027ecccafee2d6a34961c08508e599112ef712b72c557133addd6ea9f57ce7baf500de0467778bd4f6e1a1637d1b427c6375136335b29f3079ad8f14a96b2d1b0d306dc20bfac1b46ec1955c6597fed6a9fa72c7a9026e78af9d2b2190b5bf0c1af385434221b0d9b33a0bd3883bb1ccda4a4f2175dfc58be712d1d5a651ed5cf9f158ecf9da6132bb33b7a08e0832ab1a323869af7bbe22acd8a60c87eea89720bbd635494396c9d48833f61988dad806541273643f8b3be126e5181edaecd31714bbdf22ceaa05ad9b6ff4cf33fafcd0bc1153197fc9f3d85d091997759422df219978be3ee690fdc9e83f85088dfdc6434efb54b08caea8e5ba82da828b1e1a55ebed695f79406a2ac87888914a59eb0a8a528a75310b71f9b677d441cc96f0781c8a8f02faeca2203aa96b6c4c0cb8c648a1dc88d655e27ce8dec7921f25e33a1e357a84b0a32b31ba748bb127da72f51f46e42f1a1af324dd2bbabc91cbe7cea8d3c37fde276e691de881315174d7628aa39e94304866db034ce3e4042c7f3773faff9048194d943d4f974f373776824c544a054667cce11f2f2d5d4e25254a3961e227885567fc7716aed9f3f444c9c297b26c4d5f7278af35d26b4b40cb07ed779517bcf13527d8ec86debe24435f4c6343130a387d09859fb1d765204183046dda083b82d2e011067065fce69a521fa030b623bed242ced20ca59b0b3d6866a5fefffa3b0576bfeafb1a6d26a2add1ffe9", 0x1000}], 0x7d, 0x0, 0x0, 0x48044}, 0x0) 5.668181521s ago: executing program 0 (id=2556): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/vmallocinfo\x00', 0x0, 0x0) read(r0, 0x0, 0x0) 5.389273217s ago: executing program 0 (id=2557): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$kcm(0x23, 0x5, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000440), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) setsockopt$sock_int(r3, 0x1, 0x6, 0x0, 0x0) listen(r3, 0x800) accept4(r3, 0x0, 0x0, 0x80000) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000080)=ANY=[@ANYRESDEC=r0], 0x78) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0, 0x0) r6 = fanotify_init(0xf00, 0x1000) fanotify_mark(r6, 0x105, 0x10000839, r5, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./bus\x00', 0xffffffffffffff9c, 0x0, 0x2) r7 = socket$kcm(0x10, 0x2, 0x4) syz_read_part_table(0x4034, &(0x7f0000004040)="$eJzs0TFKA0EUBuB/l0VZbbyJnkCx9A5ewMZOsBEkV0mVYwTS5CC5Q7oJJLNkSdgmpAl8X/MP8wbmPd7jZvGepHn++f76TdXVbJOU/emtTfocNUP51nXDMFPuD/H5clZZJ6/LJA9XaeT/9OJp4uHfrO7kLuMYra3allImv/uY96vLGgUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB27MCBAAAAAACQ/2sjVFVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVWEHDgQAAAAAgPxfG6GqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqoKO3AgAwAAACDM3zqP9gMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwEkBAAD//022D9c=") sendmsg$inet(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006b0300224ed86e6c1d0002117e182424ee0516cfe6bf030b025e8722bca6e0b030253e06d5e902000000000000000d00000017d34460bc24eab556a705251e6182949a00003d3b48dfd8", 0x50}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) socket$netlink(0x10, 0x3, 0x0) 4.558177306s ago: executing program 5 (id=2565): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) 4.295907052s ago: executing program 0 (id=2566): syz_open_dev$loop(&(0x7f0000000100), 0x7, 0x2001) mlock2(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) prlimit64(0x0, 0x8, 0x0, 0x0) write$rfkill(0xffffffffffffffff, &(0x7f0000000080)={0x2020, 0x8, 0x3, 0x5, 0x1}, 0x8) read$FUSE(0xffffffffffffffff, &(0x7f0000000200)={0x2020}, 0x2020) r4 = fsopen(&(0x7f0000000280)='binder\x00', 0x0) fsmount(r4, 0x0, 0x0) r5 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @private2, 0x809}, {0xa, 0x8, 0x0, @empty}, 0x2, {[0x0, 0x1, 0xfffffffe, 0x0, 0xffffffff, 0x8]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x0, {[0x1, 0x0, 0x0, 0x0, 0x9]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0xcc, &(0x7f00000001c0)={{0xa, 0x0, 0xfffffffd, @local}, {0xa, 0x4e22, 0x800, @empty, 0x3d95}, 0x0, {[0x0, 0x8000, 0x0, 0xfffffffc]}}, 0x60) setsockopt$MRT6_ADD_MFC(r5, 0x29, 0xcc, &(0x7f0000000000)={{0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x8}, {0xa, 0x0, 0x4, @empty}, 0x0, {[0x3, 0x0, 0x0, 0x1, 0x89f, 0x8, 0x1]}}, 0x5c) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000880)={0x15, 0x110, 0xfa00, {0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @ib={0x1b, 0x1, 0xffff, {"6938a03395f5ddccb9c20b8d6d1b4377"}, 0xb, 0xc76, 0xf}, @ib={0x1b, 0x80, 0x7, {"a5c217c7f55e233d74ec62f7f7a2b878"}, 0x101, 0x0, 0x3}}}, 0x118) futex_waitv(&(0x7f0000001680)=[{0x2, 0x0}], 0x1, 0x0, &(0x7f0000001dc0)={0x77359400}, 0x3) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000200)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r7 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x80400, 0x0) ioctl$FBIOPUT_VSCREENINFO(r7, 0x4601, &(0x7f0000000080)={0x3c00, 0x0, 0x1e0, 0x2000, 0x3, 0x80000001, 0x4, 0x2, {0x10, 0x1000}, {0xf, 0x479}, {0x3, 0x7}, {0x1, 0x2, 0x1}, 0x1, 0x80, 0x4, 0x100, 0x1, 0x400, 0x2, 0x100, 0xe, 0x3, 0x1, 0x7, 0x29, 0x100, 0x2}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r6, 0x401c2103, &(0x7f00000001c0)={0x0, 0x4000000}) 3.638038097s ago: executing program 5 (id=2568): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) write$uinput_user_dev(r0, &(0x7f0000000040)={'syz0\x00', {0x1, 0x1, 0x1, 0x1}, 0x1, [0xfa, 0x200021, 0xfffffffe, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc34, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200a, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], [0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10008, 0x0, 0x8000, 0x601f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], [0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) write$input_event(r0, &(0x7f00000004c0)={{}, 0x14, 0x1}, 0xfffffe16) write$input_event(r0, 0x0, 0x0) 3.313850574s ago: executing program 0 (id=2569): socket$inet6(0xa, 0x3, 0x8000000003c) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99f0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r0, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x1, 0x80, 0x1}}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() ftruncate(0xffffffffffffffff, 0x6000000) copy_file_range(0xffffffffffffffff, 0x0, 0xffffffffffffffff, &(0x7f00000004c0)=0x100, 0x9, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x6, @mcast2, 0x6}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000000080)="800037bbfa9ba1ce", 0xffd8, 0x0, 0x0, 0x0) 2.63796527s ago: executing program 2 (id=2575): r0 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r0, &(0x7f0000001640)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, 0x0, 0x0, &(0x7f0000000040)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x11}, @multicast1}}}, @ip_retopts={{0x20, 0x0, 0x7, {[@generic={0x7, 0xd, "090041c20949e0afc65b20"}]}}}], 0x40}, 0x20002800) 2.593545221s ago: executing program 2 (id=2577): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) r5 = userfaultfd(0x80001) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f0000000140)) ioctl(r5, 0xd88, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) r6 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0xecc7, 0x10000, 0x0, 0x51}, 0x0, &(0x7f0000000000), 0x0) io_uring_enter(r6, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) syz_mount_image$ext4(&(0x7f0000000880)='ext2\x00', &(0x7f0000000500)='./file0\x00', 0x0, &(0x7f0000000080), 0x1, 0x530, &(0x7f0000000e00)="$eJzs3U9vI2cZAPBnJvEmu5uSFDiUSi0VLdqtYO1NQ9uIQ7tIiFslULlvo8SJojhxFDtlE/WQig+AhBD0yokDSHwAJNSPgCpVoncECIRgCwcOwKCxx9Rxx/mjje0l+f2kGc+8M/M+zxsl43f+ZCaAK+u5iLgXEVMR8WJEzBflaTHEUXfI1/v44Tur+ZAvefOvSSRFWUQs9OrLy252Nrl+YtzWweHWSqNR3yvma+3t3Vrr4PDO5vbKRn2jvrO0tPjK8qvLLy/fvZB25u167Zt//PEPfvat13791e/97v6fb0/3Ly/acRbpeeJ+1BlXYravLA+8d55KHmNTRXsqk04EAIAzyTuzn42IL3X6//MxFf/rFg926WbHnx0AAABwEbLX5+JfSUQGAAAAXFqvR8RcJGm1uBdgLtK0Wu3ew/v5uJE2mq32V9ab+ztr+bKIhaik65uN+t3intqFqCT5/GJxE3Bv/qWB+aWIeDIifjR/vTNfXW021iZ98gMAAACuiJsDx///mO8e/wMAAACXzMKkEwAAAABGbtjxfzLmPAAAAIDRGXb8PzPmPAAAAICR+PYbb+RDNhvd91+vvX2wv9V8+85avbVV3d5fra4293arG83mRueZfdun1ddoNne/Fjv7D2rt+r2k1jo4vL/d3N9p39/0/kAAAACYlCe/+P5HSUQcff16Z8hdW3srYmrIBp4VAJdGep6V/zC6PIDxG/Y1D1x+05NOAJico0knAEzasUd9lHQK+m/eSftX/s0IkwIAAC7UrS+UXP8vDgEqk04OGKlzXf8HLhXX/+HqOuf1/w9GlQcwfpVPegBuBYIr6rRXfQx9eEfZ9f9rZStm2al1AQAAIzXXGSdptbgWOBdpWq1GPNH5V/9Ksr7ZqN+NiM9ExG/nKzP5/GJ3G68HBAAAAAAAAAAAAAAAAAAAAAAAAIAzyrIkMgAAAOBSi0j/lBTv/7o1/8Lc4PmBa8k/56P7Sq/e+wHbe4t5+d965dF+782fPFhpt/deGvfZCwAAAKBM7zi987k46WwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAuGw+fvjOajFcG2fcv3wjIhaOxV/tLpmO2c7nbFQi4sbfk5ju2y6JiKkLiH/0bkQ8VRY/ydOKhSKLwfhpRFwfT/xnsiwrjX/zAuLDVfZ+vv+5V/b3l8Zznc/yv//pYnhUvf3fTEn83v5vasj+74kzxnj6w1/WhsZ/N+Lp6fL9Ty9+0ok/c2y7vOz5sgpLfihvfffw8FOF3coj+2nErSiP3x+r1t7erbUODu9sbq9s1DfqO0tLi68sv7r88vLd2vpmo16MB6P8PB/98Jlf/Weg/N9ZV6f9MST+wrH2f/rn/0I+UekrzAbDFME+fPDwc93JykAVnfi3ny///XvqhPj578SXi++BfPmt3vRRd7rfs7/44NnSxIr4a0PaP3tK+28Pq3TAi9/5/u/PuCoAMAatg8OtlUajvjfyifeyLHuUem6ML9UrOdHr3Z2wzswjhZh9XFr6/ziRH32NL+hFnNkCAAAeN590+iedCQAAAAAAAAAAAAAAAAAAAFxdrYNIR/04scGYR5NpKgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAif4bAAD//25f1Kg=") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) close_range(r0, r1, 0x0) 2.460134884s ago: executing program 3 (id=2578): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) 2.374663006s ago: executing program 0 (id=2581): r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000540)={0x1c, r2, 0x1, 0x70bd26, 0x25dfdbff, {}, [@NFC_ATTR_DEVICE_INDEX={0x8, 0x1, r3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x91}, 0x80) write$nci(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='p\x00\t'], 0xc) write$nci(r0, &(0x7f0000000180)=ANY=[@ANYBLOB="5001", @ANYRES8=r1], 0x14) 2.100140232s ago: executing program 4 (id=2583): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xa, &(0x7f0000000400)=0x2, 0x4) 1.979396675s ago: executing program 4 (id=2584): r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) getdents64(r0, &(0x7f0000000f80)=""/4096, 0x1000) 1.890857937s ago: executing program 4 (id=2585): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000180)={0x2, &(0x7f0000000040)=[{0x20, 0x4, 0x0, 0xfffff038}, {0x6, 0x24}]}) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000240)={0x1, &(0x7f0000000040)=[{0x30, 0x7f, 0x86, 0xfffff010}]}) ioctl$TUNGETVNETLE(r0, 0x40107446, &(0x7f0000000180)) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r2, 0x4004743d, 0x110e22fff6) write$cgroup_type(r2, &(0x7f0000000280), 0x9) 1.793939509s ago: executing program 4 (id=2586): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000240)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x7, 0xfff2}, {0xa, 0xffff}, {0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_skbmod={0x54, 0x1, 0x0, 0x0, {{0xb}, {0x28, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24, 0x2, {{0xd7, 0xd782, 0x8, 0x704, 0x4}, 0x10}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4008040}, 0x4000000) write$tun(r1, &(0x7f0000000180)={@void, @void, @arp=@generic={0x20, 0x8, 0x6, 0x0, 0xa, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1e}, "", @broadcast}}, 0x14) 1.611103544s ago: executing program 4 (id=2587): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x20008044}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/thread-self/fail-nth\x00', 0x2, 0x101) write(r0, &(0x7f0000000000)='3', 0x4e) ioctl$UBLK_U_CMD_ADD_DEV(r0, 0xc0207504, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r0, 0xc018937c, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000180)={&(0x7f0000000600)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c000000080000000600000002000006"], &(0x7f0000000d40)=""/35, 0x3c, 0x23, 0x1, 0x7}, 0x28) 1.587237274s ago: executing program 3 (id=2588): r0 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r0, &(0x7f0000001640)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, 0x0, 0x0, &(0x7f0000000040)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x11}, @multicast1}}}, @ip_retopts={{0x20, 0x0, 0x7, {[@generic={0x7, 0xd, "090041c20949e0afc65b20"}]}}}], 0x40}, 0x20002800) 1.548569075s ago: executing program 3 (id=2589): setns(0xc9, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r0, &(0x7f00000001c0)={0x10, 0x0, 0x25dfdbfb, 0x400000}, 0xc) r1 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r1, &(0x7f0000000180)={0x10, 0x0, 0x0, 0x10000}, 0xc) r2 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r2, &(0x7f0000000280)={0x10, 0x0, 0x0, 0x800000}, 0xc) r3 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r3, &(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$netlink(0x10, 0x3, 0x4) writev(r4, &(0x7f0000000100)=[{&(0x7f0000000000)="580000001400192340834b80043f679a10ff3d425f9cc3f4ff7f4e32f61bcdf1e422000000000100804824cabecc4b381eaadc28f23457e792945f64009400050028925aaa000000c600000000000000feff2c707f8f00ff", 0x58}], 0x1) 1.488065507s ago: executing program 4 (id=2590): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r0, &(0x7f0000000500)={0x15, 0x110, 0xfa08, {0xffffffffffffffff, 0x0, 0x10, 0x10, 0x0, @in={0x2, 0x4e23, @empty}, @in={0x2, 0x0, @loopback}}}, 0x118) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) r4 = userfaultfd(0x80001) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000140)) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) r5 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0xecc7, 0x10000, 0x0, 0x51}, 0x0, &(0x7f0000000000), 0x0) socket$phonet(0x23, 0x2, 0x1) io_uring_enter(r5, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @empty, 0xd}, 0x1c) syz_mount_image$ext4(&(0x7f0000000880)='ext2\x00', &(0x7f0000000500)='./file0\x00', 0x0, &(0x7f0000000080), 0x1, 0x530, &(0x7f0000000e00)="$eJzs3U9vI2cZAPBnJvEmu5uSFDiUSi0VLdqtYO1NQ9uIQ7tIiFslULlvo8SJojhxFDtlE/WQig+AhBD0yokDSHwAJNSPgCpVoncECIRgCwcOwKCxx9Rxx/mjje0l+f2kGc+8M/M+zxsl43f+ZCaAK+u5iLgXEVMR8WJEzBflaTHEUXfI1/v44Tur+ZAvefOvSSRFWUQs9OrLy252Nrl+YtzWweHWSqNR3yvma+3t3Vrr4PDO5vbKRn2jvrO0tPjK8qvLLy/fvZB25u167Zt//PEPfvat13791e/97v6fb0/3Ly/acRbpeeJ+1BlXYravLA+8d55KHmNTRXsqk04EAIAzyTuzn42IL3X6//MxFf/rFg926WbHnx0AAABwEbLX5+JfSUQGAAAAXFqvR8RcJGm1uBdgLtK0Wu3ew/v5uJE2mq32V9ab+ztr+bKIhaik65uN+t3intqFqCT5/GJxE3Bv/qWB+aWIeDIifjR/vTNfXW021iZ98gMAAACuiJsDx///mO8e/wMAAACXzMKkEwAAAABGbtjxfzLmPAAAAIDRGXb8PzPmPAAAAICR+PYbb+RDNhvd91+vvX2wv9V8+85avbVV3d5fra4293arG83mRueZfdun1ddoNne/Fjv7D2rt+r2k1jo4vL/d3N9p39/0/kAAAACYlCe/+P5HSUQcff16Z8hdW3srYmrIBp4VAJdGep6V/zC6PIDxG/Y1D1x+05NOAJico0knAEzasUd9lHQK+m/eSftX/s0IkwIAAC7UrS+UXP8vDgEqk04OGKlzXf8HLhXX/+HqOuf1/w9GlQcwfpVPegBuBYIr6rRXfQx9eEfZ9f9rZStm2al1AQAAIzXXGSdptbgWOBdpWq1GPNH5V/9Ksr7ZqN+NiM9ExG/nKzP5/GJ3G68HBAAAAAAAAAAAAAAAAAAAAAAAAIAzyrIkMgAAAOBSi0j/lBTv/7o1/8Lc4PmBa8k/56P7Sq/e+wHbe4t5+d965dF+782fPFhpt/deGvfZCwAAAKBM7zi987k46WwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAuGw+fvjOajFcG2fcv3wjIhaOxV/tLpmO2c7nbFQi4sbfk5ju2y6JiKkLiH/0bkQ8VRY/ydOKhSKLwfhpRFwfT/xnsiwrjX/zAuLDVfZ+vv+5V/b3l8Zznc/yv//pYnhUvf3fTEn83v5vasj+74kzxnj6w1/WhsZ/N+Lp6fL9Ty9+0ok/c2y7vOz5sgpLfihvfffw8FOF3coj+2nErSiP3x+r1t7erbUODu9sbq9s1DfqO0tLi68sv7r88vLd2vpmo16MB6P8PB/98Jlf/Weg/N9ZV6f9MST+wrH2f/rn/0I+UekrzAbDFME+fPDwc93JykAVnfi3ny///XvqhPj578SXi++BfPmt3vRRd7rfs7/44NnSxIr4a0PaP3tK+28Pq3TAi9/5/u/PuCoAMAatg8OtlUajvjfyifeyLHuUem6ML9UrOdHr3Z2wzswjhZh9XFr6/ziRH32NL+hFnNkCAAAeN590+iedCQAAAAAAAAAAAAAAAAAAAFxdrYNIR/04scGYR5NpKgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAif4bAAD//25f1Kg=") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYRES32=0x41424344, @ANYBLOB="50c200009078"], 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f00000002c0)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000440)=0x2, 0xffffffffffffffff, 0x0, 0x2, 0x4}}, 0x20) close_range(0xffffffffffffffff, r0, 0x0) 1.487894396s ago: executing program 3 (id=2591): socket$inet6(0xa, 0x3, 0x8000000003c) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99f0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r0, 0x0, 0x2d, 0x0, @val=@netfilter={0xa, 0x1, 0x80, 0x1}}, 0x20) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() ftruncate(0xffffffffffffffff, 0x6000000) copy_file_range(0xffffffffffffffff, 0x0, 0xffffffffffffffff, &(0x7f00000004c0)=0x100, 0x9, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x0, 0x6, @mcast2, 0x6}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000000080)="800037bbfa9ba1ce", 0xffd8, 0x0, 0x0, 0x0) 561.188927ms ago: executing program 3 (id=2592): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x80400, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000080)={0x3c00, 0x0, 0x1e0, 0x2000, 0x3, 0x80000001, 0x4, 0x2, {0x10, 0x1000}, {0xf, 0x479}, {0x3, 0x7}, {0x1, 0x2, 0x1}, 0x1, 0x80, 0x4, 0x100, 0x1, 0x400, 0x2, 0x100, 0xe, 0x3, 0x1, 0x7, 0x29, 0x100, 0x2}) 517.741228ms ago: executing program 3 (id=2593): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$AUDIT_DEL_RULE(0xffffffffffffffff, 0x0, 0x20008080) r2 = getpid() sched_setscheduler(r2, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c00020008000100", @ANYRES16=r1], 0x3c}, 0x1, 0x0, 0x0, 0x4080}, 0x40) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000180)=@newlink={0x44, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @gretap={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_LINK={0x8, 0x1, r3}]}}}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x44}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x3c}}, 0x8000) socket$nl_generic(0x10, 0x3, 0x10) openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) io_uring_enter(0xffffffffffffffff, 0x1, 0x1, 0x1, 0x0, 0x0) sendmsg$inet(r4, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f000801}, 0x0) 432.17328ms ago: executing program 5 (id=2594): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xa, &(0x7f0000000400)=0x2, 0x4) 365.329402ms ago: executing program 5 (id=2595): r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) getdents64(r0, &(0x7f0000000f80)=""/4096, 0x1000) 333.550373ms ago: executing program 5 (id=2596): close(0xffffffffffffffff) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110e22fff6) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000180)={0x2, &(0x7f0000000040)=[{0x20, 0x4, 0x0, 0xfffff038}, {0x6, 0x24}]}) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000240)={0x1, &(0x7f0000000040)=[{0x30, 0x7f, 0x86, 0xfffff010}]}) ioctl$TUNGETVNETLE(0xffffffffffffffff, 0x40107446, &(0x7f0000000180)) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r1, 0x4004743d, 0x110e22fff6) write$cgroup_type(r1, &(0x7f0000000280), 0x9) 282.717374ms ago: executing program 2 (id=2597): socket$nl_route(0x10, 0x3, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffff}, {0xfff1, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000240)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x7, 0xfff2}, {0xa, 0xffff}, {0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_skbmod={0x54, 0x1, 0x0, 0x0, {{0xb}, {0x28, 0x2, 0x0, 0x1, [@TCA_SKBMOD_PARMS={0x24, 0x2, {{0xd7, 0xd782, 0x8, 0x704, 0x4}, 0x10}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4008040}, 0x4000000) write$tun(r0, &(0x7f0000000180)={@void, @void, @arp=@generic={0x20, 0x8, 0x6, 0x0, 0xa, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1e}, "", @broadcast}}, 0x14) 251.156585ms ago: executing program 5 (id=2598): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) 105.341578ms ago: executing program 2 (id=2599): r0 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r0, &(0x7f0000001640)={&(0x7f0000000300)={0x2, 0x0, @multicast2=0xe0000001}, 0x10, 0x0, 0x0, &(0x7f0000000040)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @dev={0xac, 0x14, 0x14, 0x11}, @multicast1}}}, @ip_retopts={{0x20, 0x0, 0x7, {[@generic={0x7, 0xd, "090041c20949e0afc65b20"}]}}}], 0x40}, 0x20002800) 73.022229ms ago: executing program 2 (id=2600): bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x6, 0x4, 0x8, 0x8}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x52, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8001}, 0x94) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f0000000080)=ANY=[], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) 0s ago: executing program 2 (id=2601): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) set_mempolicy(0x6005, &(0x7f0000000080)=0xfffffffffffffffd, 0x4) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000040)=0x1, 0x4) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f00000002c0)={0x22001500, 0x0, 0x0, 0x0, {0x37}, 0x0, 0x0, 0x0, 0x0}, 0x58) r4 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r4, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x2327, @empty}}, 0x24) listen(r4, 0x5) sendmsg(r4, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="180000000000000010010000010000000100000000000000100000000000000010010000000000bd8c5269a5d8f7"], 0x28}, 0x0) sendmsg(r4, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=[{0x18, 0x110, 0x1, "02"}, {0x10, 0x110, 0xe}], 0x28}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0xd) sendmsg(r4, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) r5 = socket(0x40000000015, 0x5, 0x0) madvise(&(0x7f0000078000/0x2000)=nil, 0x2000, 0x65) setsockopt$SO_J1939_FILTER(r5, 0x6b, 0x1, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f00000002c0)="181a7c00"/14, 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9, 0x8}, 0x50) kernel console output (not intermixed with test programs): 71][ T7483] do_el0_svc+0x5c/0x134 [ 165.161333][ T7483] el0_svc+0x58/0x128 [ 165.162072][ T7483] el0t_64_sync_handler+0x84/0xf0 [ 165.163113][ T7483] el0t_64_sync+0x18c/0x190 [ 165.585763][ T7514] loop5: detected capacity change from 0 to 512 [ 165.607648][ T7514] syz.5.984: attempt to access beyond end of device [ 165.607648][ T7514] loop5: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 165.826511][ T7505] netlink: 32 bytes leftover after parsing attributes in process `syz.3.985'. [ 166.531785][ T7517] fuse: Unknown parameter '0x0000000000000007' [ 166.543909][ T4379] lg-g15 0003:046D:0A07.000B: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 166.571610][ T4379] input: Logitech Z-10 LCD Menu Keys as /devices/virtual/misc/uhid/0003:046D:0A07.000B/input/input17 [ 166.593410][ T7521] FAULT_INJECTION: forcing a failure. [ 166.593410][ T7521] name failslab, interval 1, probability 0, space 0, times 0 [ 166.605337][ T7521] CPU: 0 PID: 7521 Comm: syz.3.990 Not tainted syzkaller #0 [ 166.606633][ T7521] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 166.608394][ T7521] Call trace: [ 166.609015][ T7521] dump_backtrace+0x1c4/0x1f0 [ 166.610006][ T7521] show_stack+0x2c/0x3c [ 166.610736][ T7521] __dump_stack+0x30/0x40 [ 166.611481][ T7521] dump_stack_lvl+0xf4/0x15c [ 166.612278][ T7521] dump_stack+0x1c/0x5c [ 166.613115][ T7521] should_fail_ex+0x3cc/0x524 [ 166.614081][ T7521] __should_failslab+0xc0/0x11c [ 166.615084][ T7521] should_failslab+0x10/0x28 [ 166.615997][ T7521] slab_pre_alloc_hook+0x6c/0x31c [ 166.616995][ T7521] kmem_cache_alloc_lru+0x60/0x284 [ 166.617981][ T7521] sock_alloc_inode+0x2c/0xcc [ 166.618900][ T7521] new_inode_pseudo+0x68/0x1cc [ 166.619833][ T7521] __sock_create+0x138/0x8a8 [ 166.620695][ T7521] __sys_socket+0xc0/0x1b0 [ 166.621460][ T7521] __arm64_sys_socket+0x7c/0x94 [ 166.622344][ T7521] invoke_syscall+0x98/0x290 [ 166.623182][ T7521] el0_svc_common+0x13c/0x258 [ 166.624024][ T7521] do_el0_svc+0x5c/0x134 [ 166.624751][ T7521] el0_svc+0x58/0x128 [ 166.625447][ T7521] el0t_64_sync_handler+0x84/0xf0 [ 166.626339][ T7521] el0t_64_sync+0x18c/0x190 [ 166.661866][ T7521] socket: no more sockets [ 166.665842][ T7524] FAULT_INJECTION: forcing a failure. [ 166.665842][ T7524] name failslab, interval 1, probability 0, space 0, times 0 [ 166.668247][ T7524] CPU: 0 PID: 7524 Comm: syz.5.991 Not tainted syzkaller #0 [ 166.669458][ T7524] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 166.671146][ T7524] Call trace: [ 166.671695][ T7524] dump_backtrace+0x1c4/0x1f0 [ 166.672515][ T7524] show_stack+0x2c/0x3c [ 166.673219][ T7524] __dump_stack+0x30/0x40 [ 166.673934][ T7524] dump_stack_lvl+0xf4/0x15c [ 166.674760][ T7524] dump_stack+0x1c/0x5c [ 166.675551][ T7524] should_fail_ex+0x3cc/0x524 [ 166.676421][ T7524] __should_failslab+0xc0/0x11c [ 166.677315][ T7524] should_failslab+0x10/0x28 [ 166.678170][ T7524] kmem_cache_alloc+0x88/0x310 [ 166.679045][ T7524] getname_flags+0xb8/0x458 [ 166.679845][ T7524] __arm64_sys_mkdirat+0x80/0xa8 [ 166.680765][ T7524] invoke_syscall+0x98/0x290 [ 166.681626][ T7524] el0_svc_common+0x13c/0x258 [ 166.682493][ T7524] do_el0_svc+0x5c/0x134 [ 166.683274][ T7524] el0_svc+0x58/0x128 [ 166.684016][ T7524] el0t_64_sync_handler+0x84/0xf0 [ 166.684944][ T7524] el0t_64_sync+0x18c/0x190 [ 166.770331][ T7522] fido_id[7522]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 166.776876][ T7536] sctp: [Deprecated]: syz.5.996 (pid 7536) Use of struct sctp_assoc_value in delayed_ack socket option. [ 166.776876][ T7536] Use struct sctp_sack_info instead [ 167.021503][ T7562] FAULT_INJECTION: forcing a failure. [ 167.021503][ T7562] name failslab, interval 1, probability 0, space 0, times 0 [ 167.039936][ T7562] CPU: 1 PID: 7562 Comm: syz.0.1006 Not tainted syzkaller #0 [ 167.041328][ T7562] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 167.043108][ T7562] Call trace: [ 167.043644][ T7562] dump_backtrace+0x1c4/0x1f0 [ 167.044421][ T7562] show_stack+0x2c/0x3c [ 167.045152][ T7562] __dump_stack+0x30/0x40 [ 167.045881][ T7562] dump_stack_lvl+0xf4/0x15c [ 167.046666][ T7562] dump_stack+0x1c/0x5c [ 167.047433][ T7562] should_fail_ex+0x3cc/0x524 [ 167.048087][ T7566] device syzkaller0 entered promiscuous mode [ 167.048307][ T7562] __should_failslab+0xc0/0x11c [ 167.050328][ T7562] should_failslab+0x10/0x28 [ 167.051149][ T7562] kmem_cache_alloc+0x88/0x310 [ 167.052023][ T7562] getname_flags+0xb8/0x458 [ 167.052766][ T7562] __arm64_sys_mkdirat+0x80/0xa8 [ 167.053596][ T7562] invoke_syscall+0x98/0x290 [ 167.054393][ T7562] el0_svc_common+0x13c/0x258 [ 167.055224][ T7562] do_el0_svc+0x5c/0x134 [ 167.055918][ T7562] el0_svc+0x58/0x128 [ 167.056610][ T7562] el0t_64_sync_handler+0x84/0xf0 [ 167.057531][ T7562] el0t_64_sync+0x18c/0x190 [ 169.460626][ T7575] fuse: Unknown parameter '0x0000000000000005' [ 169.461599][ T4377] lg-g15 0003:046D:0A07.000C: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 169.463488][ T4377] input: Logitech Z-10 LCD Menu Keys as /devices/virtual/misc/uhid/0003:046D:0A07.000C/input/input18 [ 171.123080][ T7600] FAULT_INJECTION: forcing a failure. [ 171.123080][ T7600] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 171.125428][ T7600] CPU: 0 PID: 7600 Comm: syz.5.1020 Not tainted syzkaller #0 [ 171.126822][ T7600] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 171.128738][ T7600] Call trace: [ 171.129335][ T7600] dump_backtrace+0x1c4/0x1f0 [ 171.130187][ T7600] show_stack+0x2c/0x3c [ 171.130914][ T7600] __dump_stack+0x30/0x40 [ 171.131674][ T7600] dump_stack_lvl+0xf4/0x15c [ 171.132490][ T7600] dump_stack+0x1c/0x5c [ 171.133316][ T7600] should_fail_ex+0x3cc/0x524 [ 171.134222][ T7600] should_fail+0x14/0x24 [ 171.135055][ T7600] should_fail_usercopy+0x20/0x30 [ 171.136077][ T7600] strncpy_from_user+0x48/0x59c [ 171.136972][ T7600] getname_flags+0xec/0x458 [ 171.137789][ T7600] __arm64_sys_mkdirat+0x80/0xa8 [ 171.138707][ T7600] invoke_syscall+0x98/0x290 [ 171.139577][ T7600] el0_svc_common+0x13c/0x258 [ 171.140430][ T7600] do_el0_svc+0x5c/0x134 [ 171.141169][ T7600] el0_svc+0x58/0x128 [ 171.141866][ T7600] el0t_64_sync_handler+0x84/0xf0 [ 171.142737][ T7600] el0t_64_sync+0x18c/0x190 [ 171.234406][ T7614] overlayfs: missing 'lowerdir' [ 172.724791][ T7640] FAULT_INJECTION: forcing a failure. [ 172.724791][ T7640] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 172.727081][ T7640] CPU: 0 PID: 7640 Comm: syz.3.1033 Not tainted syzkaller #0 [ 172.728258][ T7640] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 172.729867][ T7640] Call trace: [ 172.730429][ T7640] dump_backtrace+0x1c4/0x1f0 [ 172.731221][ T7640] show_stack+0x2c/0x3c [ 172.731902][ T7640] __dump_stack+0x30/0x40 [ 172.732649][ T7640] dump_stack_lvl+0xf4/0x15c [ 172.733444][ T7640] dump_stack+0x1c/0x5c [ 172.734151][ T7640] should_fail_ex+0x3cc/0x524 [ 172.734971][ T7640] should_fail+0x14/0x24 [ 172.735689][ T7640] should_fail_usercopy+0x20/0x30 [ 172.736546][ T7640] strncpy_from_user+0x48/0x59c [ 172.737394][ T7640] getname_flags+0xec/0x458 [ 172.738194][ T7640] __arm64_sys_mkdirat+0x80/0xa8 [ 172.739202][ T7640] invoke_syscall+0x98/0x290 [ 172.740028][ T7640] el0_svc_common+0x13c/0x258 [ 172.740819][ T7640] do_el0_svc+0x5c/0x134 [ 172.741550][ T7640] el0_svc+0x58/0x128 [ 172.742240][ T7640] el0t_64_sync_handler+0x84/0xf0 [ 172.743147][ T7640] el0t_64_sync+0x18c/0x190 [ 172.776405][ T6140] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 172.783868][ T7626] device syzkaller0 entered promiscuous mode [ 172.813475][ T7649] loop2: detected capacity change from 0 to 512 [ 172.879817][ T7650] loop4: detected capacity change from 0 to 512 [ 173.591708][ T7652] fuse: Unknown parameter '0x0000000000000007' [ 173.641538][ T7635] syz.4.1031: attempt to access beyond end of device [ 173.641538][ T7635] loop4: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 173.709687][ T4377] lg-g15 0003:046D:0A07.000D: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 173.797717][ T4377] input: Logitech Z-10 LCD Menu Keys as /devices/virtual/misc/uhid/0003:046D:0A07.000D/input/input19 [ 173.818881][ T7652] vivid-000: kernel_thread() failed [ 173.889982][ T4322] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 173.893200][ T6140] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 173.993603][ T7657] fido_id[7657]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 174.112944][ T6140] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 174.113537][ T7682] FAULT_INJECTION: forcing a failure. [ 174.113537][ T7682] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 174.118988][ T7682] CPU: 0 PID: 7682 Comm: syz.3.1044 Not tainted syzkaller #0 [ 174.120329][ T7682] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 174.122168][ T7682] Call trace: [ 174.122750][ T7682] dump_backtrace+0x1c4/0x1f0 [ 174.123610][ T7682] show_stack+0x2c/0x3c [ 174.124346][ T7682] __dump_stack+0x30/0x40 [ 174.125127][ T7682] dump_stack_lvl+0xf4/0x15c [ 174.125940][ T7682] dump_stack+0x1c/0x5c [ 174.126608][ T7682] should_fail_ex+0x3cc/0x524 [ 174.127417][ T7682] should_fail+0x14/0x24 [ 174.128146][ T7682] should_fail_usercopy+0x20/0x30 [ 174.129040][ T7682] strncpy_from_user+0x48/0x59c [ 174.129853][ T7682] getname_flags+0xec/0x458 [ 174.130638][ T7682] __arm64_sys_mkdirat+0x80/0xa8 [ 174.131461][ T7682] invoke_syscall+0x98/0x290 [ 174.132240][ T7682] el0_svc_common+0x13c/0x258 [ 174.133081][ T7682] do_el0_svc+0x5c/0x134 [ 174.133860][ T7682] el0_svc+0x58/0x128 [ 174.134566][ T7682] el0t_64_sync_handler+0x84/0xf0 [ 174.135474][ T7682] el0t_64_sync+0x18c/0x190 [ 174.581461][ T7708] loop2: detected capacity change from 0 to 512 [ 174.775752][ T6140] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 175.478839][ T7699] syz.2.1049: attempt to access beyond end of device [ 175.478839][ T7699] loop2: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 175.649214][ T7726] FAULT_INJECTION: forcing a failure. [ 175.649214][ T7726] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 175.651508][ T7726] CPU: 1 PID: 7726 Comm: syz.3.1061 Not tainted syzkaller #0 [ 175.652757][ T7726] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 175.654430][ T7726] Call trace: [ 175.655002][ T7726] dump_backtrace+0x1c4/0x1f0 [ 175.655768][ T7726] show_stack+0x2c/0x3c [ 175.656495][ T7726] __dump_stack+0x30/0x40 [ 175.657271][ T7726] dump_stack_lvl+0xf4/0x15c [ 175.658060][ T7726] dump_stack+0x1c/0x5c [ 175.658795][ T7726] should_fail_ex+0x3cc/0x524 [ 175.659620][ T7726] should_fail+0x14/0x24 [ 175.660347][ T7726] should_fail_usercopy+0x20/0x30 [ 175.661211][ T7726] strncpy_from_user+0x48/0x59c [ 175.662041][ T7726] getname_flags+0xec/0x458 [ 175.662807][ T7726] __arm64_sys_mkdirat+0x80/0xa8 [ 175.663649][ T7726] invoke_syscall+0x98/0x290 [ 175.664434][ T7726] el0_svc_common+0x13c/0x258 [ 175.665242][ T7726] do_el0_svc+0x5c/0x134 [ 175.665961][ T7726] el0_svc+0x58/0x128 [ 175.666773][ T7726] el0t_64_sync_handler+0x84/0xf0 [ 175.667699][ T7726] el0t_64_sync+0x18c/0x190 [ 175.819651][ T6140] tipc: Left network mode [ 175.891581][ T7757] fuse: Unknown parameter '0x0000000000000007' [ 175.952291][ T4376] lg-g15 0003:046D:0A07.000E: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 175.957701][ T4376] input: Logitech Z-10 LCD Menu Keys as /devices/virtual/misc/uhid/0003:046D:0A07.000E/input/input20 [ 176.350761][ T7772] fido_id[7772]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 176.397069][ T7789] FAULT_INJECTION: forcing a failure. [ 176.397069][ T7789] name failslab, interval 1, probability 0, space 0, times 0 [ 176.405706][ T7780] loop2: detected capacity change from 0 to 512 [ 176.411556][ T7780] syz.2.1075: attempt to access beyond end of device [ 176.411556][ T7780] loop2: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 176.414103][ T7789] CPU: 0 PID: 7789 Comm: syz.3.1080 Not tainted syzkaller #0 [ 176.415504][ T7789] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 176.417374][ T7789] Call trace: [ 176.417956][ T7789] dump_backtrace+0x1c4/0x1f0 [ 176.418796][ T7789] show_stack+0x2c/0x3c [ 176.419550][ T7789] __dump_stack+0x30/0x40 [ 176.420349][ T7789] dump_stack_lvl+0xf4/0x15c [ 176.421154][ T7789] dump_stack+0x1c/0x5c [ 176.421861][ T7789] should_fail_ex+0x3cc/0x524 [ 176.422665][ T7789] __should_failslab+0xc0/0x11c [ 176.423538][ T7789] should_failslab+0x10/0x28 [ 176.424358][ T7789] kmem_cache_alloc+0x88/0x310 [ 176.425203][ T7789] getname_flags+0xb8/0x458 [ 176.426007][ T7789] __arm64_sys_mkdirat+0x80/0xa8 [ 176.426870][ T7789] invoke_syscall+0x98/0x290 [ 176.427717][ T7789] el0_svc_common+0x13c/0x258 [ 176.428603][ T7789] do_el0_svc+0x5c/0x134 [ 176.429389][ T7789] el0_svc+0x58/0x128 [ 176.430083][ T7789] el0t_64_sync_handler+0x84/0xf0 [ 176.430991][ T7789] el0t_64_sync+0x18c/0x190 [ 176.929603][ T7848] fuse: Unknown parameter '0x0000000000000007' [ 177.156664][ T4376] lg-g15 0003:046D:0A07.000F: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 177.165303][ T27] audit: type=1326 audit(167.699:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7836 comm="syz.4.1098" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffff91b792a8 code=0x200000 [ 177.411579][ T4376] input: Logitech Z-10 LCD Menu Keys as /devices/virtual/misc/uhid/0003:046D:0A07.000F/input/input21 [ 177.872020][ T7881] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1105'. [ 178.090194][ T7902] loop2: detected capacity change from 0 to 512 [ 178.098390][ T7902] syz.2.1113: attempt to access beyond end of device [ 178.098390][ T7902] loop2: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 178.121709][ T7894] device syzkaller0 entered promiscuous mode [ 178.687639][ T4333] Bluetooth: hci4: command 0x0406 tx timeout [ 178.713223][ T7935] gadgetfs: bound to dummy_udc driver [ 179.003603][ T7960] FAULT_INJECTION: forcing a failure. [ 179.003603][ T7960] name failslab, interval 1, probability 0, space 0, times 0 [ 179.009665][ T7960] CPU: 0 PID: 7960 Comm: syz.2.1131 Not tainted syzkaller #0 [ 179.010947][ T7960] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 179.012863][ T7960] Call trace: [ 179.013479][ T7960] dump_backtrace+0x1c4/0x1f0 [ 179.014355][ T7960] show_stack+0x2c/0x3c [ 179.015155][ T7960] __dump_stack+0x30/0x40 [ 179.015970][ T7960] dump_stack_lvl+0xf4/0x15c [ 179.016813][ T7960] dump_stack+0x1c/0x5c [ 179.017563][ T7960] should_fail_ex+0x3cc/0x524 [ 179.018442][ T7960] __should_failslab+0xc0/0x11c [ 179.019377][ T7960] should_failslab+0x10/0x28 [ 179.020220][ T7960] kmem_cache_alloc+0x88/0x310 [ 179.021015][ T7960] getname_flags+0xb8/0x458 [ 179.021813][ T7960] user_path_at_empty+0x40/0x84 [ 179.022651][ T7960] __arm64_sys_mount+0x468/0x5a0 [ 179.023535][ T7960] invoke_syscall+0x98/0x290 [ 179.024337][ T7960] el0_svc_common+0x13c/0x258 [ 179.025174][ T7960] do_el0_svc+0x5c/0x134 [ 179.025954][ T7960] el0_svc+0x58/0x128 [ 179.026678][ T7960] el0t_64_sync_handler+0x84/0xf0 [ 179.027586][ T7960] el0t_64_sync+0x18c/0x190 [ 179.034937][ T7964] gadgetfs: bound to dummy_udc driver [ 179.233239][ T7982] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1133'. [ 179.261174][ T7991] sctp: [Deprecated]: syz.4.1144 (pid 7991) Use of struct sctp_assoc_value in delayed_ack socket option. [ 179.261174][ T7991] Use struct sctp_sack_info instead [ 179.325874][ T8001] loop0: detected capacity change from 0 to 512 [ 179.328956][ T8001] syz.0.1141: attempt to access beyond end of device [ 179.328956][ T8001] loop0: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 179.356013][ T8004] gadgetfs: bound to dummy_udc driver [ 179.540670][ T8026] FAULT_INJECTION: forcing a failure. [ 179.540670][ T8026] name failslab, interval 1, probability 0, space 0, times 0 [ 179.543231][ T8026] CPU: 0 PID: 8026 Comm: syz.2.1152 Not tainted syzkaller #0 [ 179.544454][ T8026] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 179.546164][ T8026] Call trace: [ 179.546701][ T8026] dump_backtrace+0x1c4/0x1f0 [ 179.547505][ T8026] show_stack+0x2c/0x3c [ 179.548207][ T8026] __dump_stack+0x30/0x40 [ 179.548943][ T8026] dump_stack_lvl+0xf4/0x15c [ 179.549749][ T8026] dump_stack+0x1c/0x5c [ 179.550462][ T8026] should_fail_ex+0x3cc/0x524 [ 179.551270][ T8026] __should_failslab+0xc0/0x11c [ 179.552158][ T8026] should_failslab+0x10/0x28 [ 179.552977][ T8026] kmem_cache_alloc+0x88/0x310 [ 179.553833][ T8026] getname_flags+0xb8/0x458 [ 179.554636][ T8026] user_path_at_empty+0x40/0x84 [ 179.555474][ T8026] __arm64_sys_mount+0x468/0x5a0 [ 179.556313][ T8026] invoke_syscall+0x98/0x290 [ 179.557096][ T8026] el0_svc_common+0x13c/0x258 [ 179.557906][ T8026] do_el0_svc+0x5c/0x134 [ 179.558782][ T8026] el0_svc+0x58/0x128 [ 179.559549][ T8026] el0t_64_sync_handler+0x84/0xf0 [ 179.560530][ T8026] el0t_64_sync+0x18c/0x190 [ 179.624544][ T6140] device hsr_slave_0 left promiscuous mode [ 179.676529][ T6140] device hsr_slave_1 left promiscuous mode [ 179.684074][ T8041] sctp: [Deprecated]: syz.5.1157 (pid 8041) Use of struct sctp_assoc_value in delayed_ack socket option. [ 179.684074][ T8041] Use struct sctp_sack_info instead [ 179.722612][ T6140] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 179.724023][ T6140] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 179.726045][ T6140] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 179.727455][ T6140] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 179.733416][ T6140] device bridge_slave_0 left promiscuous mode [ 179.735370][ T6140] bridge0: port 1(bridge_slave_0) entered disabled state [ 179.742781][ T8049] gadgetfs: bound to dummy_udc driver [ 179.851143][ T6140] device veth1_macvtap left promiscuous mode [ 179.852431][ T6140] device veth0_macvtap left promiscuous mode [ 179.853455][ T6140] device veth1_vlan left promiscuous mode [ 179.854481][ T6140] device veth0_vlan left promiscuous mode [ 179.865176][ T8062] FAULT_INJECTION: forcing a failure. [ 179.865176][ T8062] name failslab, interval 1, probability 0, space 0, times 0 [ 179.868194][ T8062] CPU: 1 PID: 8062 Comm: syz.5.1165 Not tainted syzkaller #0 [ 179.869575][ T8062] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 179.871455][ T8062] Call trace: [ 179.872122][ T8062] dump_backtrace+0x1c4/0x1f0 [ 179.873025][ T8062] show_stack+0x2c/0x3c [ 179.873807][ T8062] __dump_stack+0x30/0x40 [ 179.874577][ T8062] dump_stack_lvl+0xf4/0x15c [ 179.875453][ T8062] dump_stack+0x1c/0x5c [ 179.876240][ T8062] should_fail_ex+0x3cc/0x524 [ 179.877099][ T8062] __should_failslab+0xc0/0x11c [ 179.877957][ T8062] should_failslab+0x10/0x28 [ 179.878895][ T8062] __kmem_cache_alloc_node+0x7c/0x318 [ 179.879808][ T8062] kmalloc_trace+0x48/0x94 [ 179.880636][ T8062] nci_allocate_device+0xe4/0x324 [ 179.881563][ T8062] virtual_ncidev_open+0x5c/0xd8 [ 179.882433][ T8062] misc_open+0x310/0x388 [ 179.883242][ T8062] chrdev_open+0x3d0/0x51c [ 179.884056][ T8062] do_dentry_open+0x738/0xf8c [ 179.884910][ T8062] vfs_open+0x7c/0x90 [ 179.885651][ T8062] path_openat+0x1fc0/0x27a0 [ 179.886497][ T8062] do_filp_open+0x198/0x38c [ 179.887317][ T8062] do_sys_openat2+0x134/0x3fc [ 179.888115][ T8062] __arm64_sys_openat+0x11c/0x150 [ 179.888930][ T8062] invoke_syscall+0x98/0x290 [ 179.889696][ T8062] el0_svc_common+0x13c/0x258 [ 179.890476][ T8062] do_el0_svc+0x5c/0x134 [ 179.891200][ T8062] el0_svc+0x58/0x128 [ 179.891881][ T8062] el0t_64_sync_handler+0x84/0xf0 [ 179.892726][ T8062] el0t_64_sync+0x18c/0x190 [ 179.989400][ T8070] sctp: [Deprecated]: syz.5.1169 (pid 8070) Use of struct sctp_assoc_value in delayed_ack socket option. [ 179.989400][ T8070] Use struct sctp_sack_info instead [ 180.037337][ T8074] gadgetfs: bound to dummy_udc driver [ 180.175517][ T8089] FAULT_INJECTION: forcing a failure. [ 180.175517][ T8089] name failslab, interval 1, probability 0, space 0, times 0 [ 180.185372][ T8089] CPU: 0 PID: 8089 Comm: syz.2.1179 Not tainted syzkaller #0 [ 180.186814][ T8089] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 180.188831][ T8089] Call trace: [ 180.189480][ T8089] dump_backtrace+0x1c4/0x1f0 [ 180.190429][ T8089] show_stack+0x2c/0x3c [ 180.191270][ T8089] __dump_stack+0x30/0x40 [ 180.192064][ T8089] dump_stack_lvl+0xf4/0x15c [ 180.192860][ T8089] dump_stack+0x1c/0x5c [ 180.193577][ T8089] should_fail_ex+0x3cc/0x524 [ 180.194404][ T8089] __should_failslab+0xc0/0x11c [ 180.195286][ T8089] should_failslab+0x10/0x28 [ 180.196133][ T8089] __kmem_cache_alloc_node+0x7c/0x318 [ 180.197115][ T8089] kmalloc_trace+0x48/0x94 [ 180.197907][ T8089] nci_allocate_device+0xe4/0x324 [ 180.198770][ T8089] virtual_ncidev_open+0x5c/0xd8 [ 180.199724][ T8089] misc_open+0x310/0x388 [ 180.200531][ T8089] chrdev_open+0x3d0/0x51c [ 180.201349][ T8089] do_dentry_open+0x738/0xf8c [ 180.202191][ T8089] vfs_open+0x7c/0x90 [ 180.202913][ T8089] path_openat+0x1fc0/0x27a0 [ 180.203760][ T8089] do_filp_open+0x198/0x38c [ 180.204557][ T8089] do_sys_openat2+0x134/0x3fc [ 180.205375][ T8089] __arm64_sys_openat+0x11c/0x150 [ 180.206265][ T8089] invoke_syscall+0x98/0x290 [ 180.207077][ T8089] el0_svc_common+0x13c/0x258 [ 180.207868][ T8089] do_el0_svc+0x5c/0x134 [ 180.208593][ T8089] el0_svc+0x58/0x128 [ 180.209275][ T8089] el0t_64_sync_handler+0x84/0xf0 [ 180.210075][ T8089] el0t_64_sync+0x18c/0x190 [ 180.278676][ T8096] sctp: [Deprecated]: syz.5.1182 (pid 8096) Use of struct sctp_assoc_value in delayed_ack socket option. [ 180.278676][ T8096] Use struct sctp_sack_info instead [ 180.305800][ T8090] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1178'. [ 180.344957][ T8106] gadgetfs: bound to dummy_udc driver [ 180.479005][ T8114] syz.2.1186 (8114): drop_caches: 2 [ 180.558367][ T8115] loop3: detected capacity change from 0 to 512 [ 181.448998][ T8121] FAULT_INJECTION: forcing a failure. [ 181.448998][ T8121] name failslab, interval 1, probability 0, space 0, times 0 [ 181.451400][ T8121] CPU: 1 PID: 8121 Comm: syz.4.1191 Not tainted syzkaller #0 [ 181.452649][ T8121] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 181.454413][ T8121] Call trace: [ 181.454989][ T8121] dump_backtrace+0x1c4/0x1f0 [ 181.455869][ T8121] show_stack+0x2c/0x3c [ 181.456586][ T8121] __dump_stack+0x30/0x40 [ 181.457352][ T8121] dump_stack_lvl+0xf4/0x15c [ 181.458173][ T8121] dump_stack+0x1c/0x5c [ 181.458917][ T8121] should_fail_ex+0x3cc/0x524 [ 181.459739][ T8121] __should_failslab+0xc0/0x11c [ 181.460613][ T8121] should_failslab+0x10/0x28 [ 181.461423][ T8121] kmem_cache_alloc+0x88/0x310 [ 181.462277][ T8121] getname_flags+0xb8/0x458 [ 181.463110][ T8121] user_path_at_empty+0x40/0x84 [ 181.463988][ T8121] __arm64_sys_mount+0x468/0x5a0 [ 181.464889][ T8121] invoke_syscall+0x98/0x290 [ 181.465685][ T8121] el0_svc_common+0x13c/0x258 [ 181.466494][ T8121] do_el0_svc+0x5c/0x134 [ 181.467233][ T8121] el0_svc+0x58/0x128 [ 181.467935][ T8121] el0t_64_sync_handler+0x84/0xf0 [ 181.468763][ T8121] el0t_64_sync+0x18c/0x190 [ 182.474736][ T8115] syz.3.1188: attempt to access beyond end of device [ 182.474736][ T8115] loop3: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 182.516296][ T8135] sctp: [Deprecated]: syz.4.1196 (pid 8135) Use of struct sctp_assoc_value in delayed_ack socket option. [ 182.516296][ T8135] Use struct sctp_sack_info instead [ 182.687895][ T8141] gadgetfs: bound to dummy_udc driver [ 182.885546][ T8150] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1200'. [ 183.225953][ T4375] usb 1-1: new full-speed USB device number 2 using dummy_hcd [ 183.230189][ C1] gadgetfs: connected [ 183.231663][ T4375] gadgetfs: disconnected [ 183.270095][ T8166] FAULT_INJECTION: forcing a failure. [ 183.270095][ T8166] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 183.272557][ T8166] CPU: 1 PID: 8166 Comm: syz.3.1207 Not tainted syzkaller #0 [ 183.273753][ T8166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 183.275393][ T8166] Call trace: [ 183.275963][ T8166] dump_backtrace+0x1c4/0x1f0 [ 183.276790][ T8166] show_stack+0x2c/0x3c [ 183.277520][ T8166] __dump_stack+0x30/0x40 [ 183.278283][ T8166] dump_stack_lvl+0xf4/0x15c [ 183.279108][ T8166] dump_stack+0x1c/0x5c [ 183.279876][ T8166] should_fail_ex+0x3cc/0x524 [ 183.280728][ T8166] should_fail+0x14/0x24 [ 183.281517][ T8166] should_fail_usercopy+0x20/0x30 [ 183.282446][ T8166] strncpy_from_user+0x48/0x59c [ 183.283311][ T8166] getname_flags+0xec/0x458 [ 183.284124][ T8166] user_path_at_empty+0x40/0x84 [ 183.285013][ T8166] __arm64_sys_mount+0x468/0x5a0 [ 183.285883][ T8166] invoke_syscall+0x98/0x290 [ 183.286729][ T8166] el0_svc_common+0x13c/0x258 [ 183.287587][ T8166] do_el0_svc+0x5c/0x134 [ 183.288365][ T8166] el0_svc+0x58/0x128 [ 183.289077][ T8166] el0t_64_sync_handler+0x84/0xf0 [ 183.289908][ T8166] el0t_64_sync+0x18c/0x190 [ 183.347024][ T8173] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 183.349026][ T8173] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 183.407257][ T8177] fuse: Bad value for 'fd' [ 183.427739][ C1] gadgetfs: connected [ 183.430519][ T4375] usb 1-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 183.432403][ T4375] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 183.433904][ T4375] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 183.444343][ C1] gadgetfs: configuration #1 [ 183.664045][ T8187] loop3: detected capacity change from 0 to 512 [ 183.736706][ T8187] syz.3.1212: attempt to access beyond end of device [ 183.736706][ T8187] loop3: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 184.441885][ T8141] gadgetfs: suspended from state 3 [ 184.447736][ T4376] usb 1-1: USB disconnect, device number 2 [ 184.450391][ T8141] gadgetfs: disconnected [ 184.607738][ T8199] FAULT_INJECTION: forcing a failure. [ 184.607738][ T8199] name failslab, interval 1, probability 0, space 0, times 0 [ 184.641118][ T8199] CPU: 0 PID: 8199 Comm: syz.4.1218 Not tainted syzkaller #0 [ 184.642456][ T8199] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 184.644238][ T8199] Call trace: [ 184.644787][ T8199] dump_backtrace+0x1c4/0x1f0 [ 184.645598][ T8199] show_stack+0x2c/0x3c [ 184.646315][ T8199] __dump_stack+0x30/0x40 [ 184.647016][ T8199] dump_stack_lvl+0xf4/0x15c [ 184.647828][ T8199] dump_stack+0x1c/0x5c [ 184.648523][ T8199] should_fail_ex+0x3cc/0x524 [ 184.649310][ T8199] __should_failslab+0xc0/0x11c [ 184.650157][ T8199] should_failslab+0x10/0x28 [ 184.650972][ T8199] kmem_cache_alloc+0x88/0x310 [ 184.651846][ T8199] getname_flags+0xb8/0x458 [ 184.652663][ T8199] user_path_at_empty+0x40/0x84 [ 184.653542][ T8199] __arm64_sys_mount+0x468/0x5a0 [ 184.654450][ T8199] invoke_syscall+0x98/0x290 [ 184.655329][ T8199] el0_svc_common+0x13c/0x258 [ 184.656205][ T8199] do_el0_svc+0x5c/0x134 [ 184.656959][ T8199] el0_svc+0x58/0x128 [ 184.657669][ T8199] el0t_64_sync_handler+0x84/0xf0 [ 184.658609][ T8199] el0t_64_sync+0x18c/0x190 [ 184.696821][ T8209] overlayfs: missing 'lowerdir' [ 184.733737][ T8216] fuse: Bad value for 'fd' [ 185.317594][ T8238] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1229'. [ 185.730296][ T6140] team0 (unregistering): Port device team_slave_1 removed [ 185.754075][ T8244] input: syz0 as /devices/virtual/input/input22 [ 185.791005][ T8246] overlayfs: missing 'lowerdir' [ 185.955647][ T8254] fuse: Bad value for 'fd' [ 185.956788][ T6140] team0 (unregistering): Port device team_slave_0 removed [ 186.084498][ T8257] loop3: detected capacity change from 0 to 512 [ 186.148652][ T8257] syz.3.1235: attempt to access beyond end of device [ 186.148652][ T8257] loop3: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 187.255085][ T6140] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 187.281725][ T8261] loop3: detected capacity change from 0 to 1024 [ 187.306438][ T8261] EXT4-fs: Ignoring removed mblk_io_submit option [ 187.321623][ T8261] EXT4-fs: Ignoring removed oldalloc option [ 187.356323][ T8269] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1242'. [ 187.383272][ T8261] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 187.440630][ T4330] EXT4-fs (loop3): unmounting filesystem. [ 187.448407][ T6140] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 187.908598][ T6140] bond0 (unregistering): (slave bridge_slave_1): Releasing backup interface [ 187.954407][ T8278] overlayfs: missing 'lowerdir' [ 188.135747][ T8281] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1245'. [ 188.761730][ T8289] fuse: Unknown parameter '0x0000000000000007' [ 188.807192][ T4707] lg-g15 0003:046D:0A07.0010: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 188.821973][ T27] audit: type=1326 audit(178.449:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8286 comm="syz.5.1248" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffff9cf792a8 code=0x200000 [ 188.826788][ T4707] input: Logitech Z-10 LCD Menu Keys as /devices/virtual/misc/uhid/0003:046D:0A07.0010/input/input23 [ 189.158676][ T8296] loop3: detected capacity change from 0 to 512 [ 189.429439][ T8296] syz.3.1249: attempt to access beyond end of device [ 189.429439][ T8296] loop3: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 190.379775][ T8304] loop5: detected capacity change from 0 to 1024 [ 190.381231][ T8304] EXT4-fs: Ignoring removed mblk_io_submit option [ 190.382427][ T8304] EXT4-fs: Ignoring removed oldalloc option [ 190.483271][ T8304] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 190.502156][ T5837] EXT4-fs (loop5): unmounting filesystem. [ 190.584614][ T8312] loop3: detected capacity change from 0 to 512 [ 191.586529][ T8309] syz.3.1254: attempt to access beyond end of device [ 191.586529][ T8309] loop3: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 191.623721][ T8314] overlayfs: missing 'workdir' [ 191.650174][ T8316] FAULT_INJECTION: forcing a failure. [ 191.650174][ T8316] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 191.652393][ T8316] CPU: 0 PID: 8316 Comm: syz.5.1256 Not tainted syzkaller #0 [ 191.653736][ T8316] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 191.655569][ T8316] Call trace: [ 191.656169][ T8316] dump_backtrace+0x1c4/0x1f0 [ 191.657036][ T8316] show_stack+0x2c/0x3c [ 191.657800][ T8316] __dump_stack+0x30/0x40 [ 191.658594][ T8316] dump_stack_lvl+0xf4/0x15c [ 191.659400][ T8316] dump_stack+0x1c/0x5c [ 191.660128][ T8316] should_fail_ex+0x3cc/0x524 [ 191.660926][ T8316] should_fail+0x14/0x24 [ 191.661642][ T8316] should_fail_usercopy+0x20/0x30 [ 191.662520][ T8316] strncpy_from_user+0x48/0x59c [ 191.663399][ T8316] getname_flags+0xec/0x458 [ 191.664207][ T8316] user_path_at_empty+0x40/0x84 [ 191.665074][ T8316] __arm64_sys_mount+0x468/0x5a0 [ 191.665956][ T8316] invoke_syscall+0x98/0x290 [ 191.666768][ T8316] el0_svc_common+0x13c/0x258 [ 191.667600][ T8316] do_el0_svc+0x5c/0x134 [ 191.668357][ T8316] el0_svc+0x58/0x128 [ 191.669057][ T8316] el0t_64_sync_handler+0x84/0xf0 [ 191.669933][ T8316] el0t_64_sync+0x18c/0x190 [ 191.745047][ T8321] input: syz0 as /devices/virtual/input/input24 [ 191.792682][ T6140] bond0 (unregistering): Released all slaves [ 191.966181][ T8327] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1259'. [ 192.302842][ T8335] fuse: Unknown parameter '0x0000000000000007' [ 192.548808][ T4375] lg-g15 0003:046D:0A07.0011: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 192.556621][ T4375] input: Logitech Z-10 LCD Menu Keys as /devices/virtual/misc/uhid/0003:046D:0A07.0011/input/input25 [ 192.642228][ T8339] fido_id[8339]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 192.657867][ T8348] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1264'. [ 192.723864][ T8356] overlayfs: missing 'workdir' [ 192.810119][ T8364] FAULT_INJECTION: forcing a failure. [ 192.810119][ T8364] name failslab, interval 1, probability 0, space 0, times 0 [ 192.812366][ T8364] CPU: 1 PID: 8364 Comm: syz.4.1268 Not tainted syzkaller #0 [ 192.813637][ T8364] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 192.815387][ T8364] Call trace: [ 192.815940][ T8364] dump_backtrace+0x1c4/0x1f0 [ 192.816730][ T8364] show_stack+0x2c/0x3c [ 192.817496][ T8364] __dump_stack+0x30/0x40 [ 192.818238][ T8364] dump_stack_lvl+0xf4/0x15c [ 192.819039][ T8364] dump_stack+0x1c/0x5c [ 192.819777][ T8364] should_fail_ex+0x3cc/0x524 [ 192.820577][ T8364] __should_failslab+0xc0/0x11c [ 192.821452][ T8364] should_failslab+0x10/0x28 [ 192.822298][ T8364] kmem_cache_alloc+0x88/0x310 [ 192.823119][ T8364] getname_flags+0xb8/0x458 [ 192.823906][ T8364] user_path_at_empty+0x40/0x84 [ 192.824754][ T8364] __arm64_sys_mount+0x468/0x5a0 [ 192.825609][ T8364] invoke_syscall+0x98/0x290 [ 192.826434][ T8364] el0_svc_common+0x13c/0x258 [ 192.827277][ T8364] do_el0_svc+0x5c/0x134 [ 192.828020][ T8364] el0_svc+0x58/0x128 [ 192.828665][ T8364] el0t_64_sync_handler+0x84/0xf0 [ 192.829512][ T8364] el0t_64_sync+0x18c/0x190 [ 192.870458][ T8350] loop0: detected capacity change from 0 to 1024 [ 192.872304][ T8350] EXT4-fs: Ignoring removed mblk_io_submit option [ 192.873511][ T8350] EXT4-fs: Ignoring removed oldalloc option [ 192.940253][ T8350] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 193.110736][ T4334] EXT4-fs (loop0): unmounting filesystem. [ 193.113322][ T8395] overlayfs: missing 'workdir' [ 193.163988][ T8396] device syzkaller0 entered promiscuous mode [ 193.393152][ T8413] fuse: Unknown parameter '0xffffffffffffffff' [ 193.723377][ T8430] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1281'. [ 193.758872][ T8436] FAULT_INJECTION: forcing a failure. [ 193.758872][ T8436] name failslab, interval 1, probability 0, space 0, times 0 [ 193.771873][ T8436] CPU: 1 PID: 8436 Comm: syz.3.1283 Not tainted syzkaller #0 [ 193.773096][ T8436] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 193.774878][ T8436] Call trace: [ 193.775468][ T8436] dump_backtrace+0x1c4/0x1f0 [ 193.776380][ T8436] show_stack+0x2c/0x3c [ 193.777165][ T8436] __dump_stack+0x30/0x40 [ 193.777923][ T8436] dump_stack_lvl+0xf4/0x15c [ 193.778695][ T8436] dump_stack+0x1c/0x5c [ 193.779412][ T8436] should_fail_ex+0x3cc/0x524 [ 193.780216][ T8436] __should_failslab+0xc0/0x11c [ 193.781040][ T8436] should_failslab+0x10/0x28 [ 193.781813][ T8436] kmem_cache_alloc+0x88/0x310 [ 193.782637][ T8436] getname_flags+0xb8/0x458 [ 193.783410][ T8436] user_path_at_empty+0x40/0x84 [ 193.784238][ T8436] __arm64_sys_mount+0x468/0x5a0 [ 193.785054][ T8436] invoke_syscall+0x98/0x290 [ 193.785813][ T8436] el0_svc_common+0x13c/0x258 [ 193.786577][ T8436] do_el0_svc+0x5c/0x134 [ 193.787287][ T8436] el0_svc+0x58/0x128 [ 193.787959][ T8436] el0t_64_sync_handler+0x84/0xf0 [ 193.788844][ T8436] el0t_64_sync+0x18c/0x190 [ 194.088175][ T8445] loop0: detected capacity change from 0 to 1024 [ 194.089872][ T8445] EXT4-fs: Ignoring removed mblk_io_submit option [ 194.091127][ T8445] EXT4-fs: Ignoring removed oldalloc option [ 194.181517][ T8445] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 194.253689][ T8471] fuse: Unknown parameter '0x0000000000000007' [ 194.310605][ T8378] EXT4-fs error (device loop0): ext4_validate_block_bitmap:438: comm ext4lazyinit: bg 0: block 112: padding at end of block bitmap is not set [ 194.312604][ T14] lg-g15 0003:046D:0A07.0012: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 194.357258][ T14] input: Logitech Z-10 LCD Menu Keys as /devices/virtual/misc/uhid/0003:046D:0A07.0012/input/input26 [ 194.647562][ T4334] EXT4-fs (loop0): unmounting filesystem. [ 194.762236][ T8492] fuse: Bad value for 'fd' [ 194.779419][ T8477] fido_id[8477]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 195.022354][ T8507] FAULT_INJECTION: forcing a failure. [ 195.022354][ T8507] name failslab, interval 1, probability 0, space 0, times 0 [ 195.025294][ T8507] CPU: 0 PID: 8507 Comm: syz.4.1300 Not tainted syzkaller #0 [ 195.026573][ T8507] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 195.028298][ T8507] Call trace: [ 195.028821][ T8507] dump_backtrace+0x1c4/0x1f0 [ 195.029602][ T8507] show_stack+0x2c/0x3c [ 195.030292][ T8507] __dump_stack+0x30/0x40 [ 195.031004][ T8507] dump_stack_lvl+0xf4/0x15c [ 195.031785][ T8507] dump_stack+0x1c/0x5c [ 195.032543][ T8507] should_fail_ex+0x3cc/0x524 [ 195.033393][ T8507] __should_failslab+0xc0/0x11c [ 195.034399][ T8507] should_failslab+0x10/0x28 [ 195.035308][ T8507] kmem_cache_alloc+0x88/0x310 [ 195.036218][ T8507] getname_flags+0xb8/0x458 [ 195.037036][ T8507] user_path_at_empty+0x40/0x84 [ 195.037927][ T8507] __arm64_sys_mount+0x468/0x5a0 [ 195.038824][ T8507] invoke_syscall+0x98/0x290 [ 195.039680][ T8507] el0_svc_common+0x13c/0x258 [ 195.040502][ T8507] do_el0_svc+0x5c/0x134 [ 195.041286][ T8507] el0_svc+0x58/0x128 [ 195.042017][ T8507] el0t_64_sync_handler+0x84/0xf0 [ 195.042864][ T8507] el0t_64_sync+0x18c/0x190 [ 195.128819][ T8515] loop0: detected capacity change from 0 to 512 [ 196.117853][ T8511] syz.0.1294: attempt to access beyond end of device [ 196.117853][ T8511] loop0: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 196.357271][ T8536] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1306'. [ 196.405133][ T8539] fuse: Unknown parameter '0x0000000000000007' [ 196.593492][ T4707] lg-g15 0003:046D:0A07.0013: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 196.653661][ T4707] input: Logitech Z-10 LCD Menu Keys as /devices/virtual/misc/uhid/0003:046D:0A07.0013/input/input27 [ 196.669355][ T8528] loop4: detected capacity change from 0 to 1024 [ 196.715812][ T8528] EXT4-fs: Ignoring removed mblk_io_submit option [ 196.716992][ T8528] EXT4-fs: Ignoring removed oldalloc option [ 196.757051][ T8550] fuse: Bad value for 'fd' [ 196.829275][ T8546] fido_id[8546]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 196.847601][ T8528] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 196.948503][ T4335] EXT4-fs (loop4): unmounting filesystem. [ 197.004333][ T8574] FAULT_INJECTION: forcing a failure. [ 197.004333][ T8574] name failslab, interval 1, probability 0, space 0, times 0 [ 197.006756][ T8574] CPU: 0 PID: 8574 Comm: syz.5.1317 Not tainted syzkaller #0 [ 197.008085][ T8574] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 197.009885][ T8574] Call trace: [ 197.010471][ T8574] dump_backtrace+0x1c4/0x1f0 [ 197.011289][ T8574] show_stack+0x2c/0x3c [ 197.011986][ T8574] __dump_stack+0x30/0x40 [ 197.012714][ T8574] dump_stack_lvl+0xf4/0x15c [ 197.013535][ T8574] dump_stack+0x1c/0x5c [ 197.014266][ T8574] should_fail_ex+0x3cc/0x524 [ 197.015109][ T8574] __should_failslab+0xc0/0x11c [ 197.015997][ T8574] should_failslab+0x10/0x28 [ 197.016852][ T8574] kmem_cache_alloc+0x88/0x310 [ 197.017692][ T8574] proc_net_ns_init+0x58/0x334 [ 197.018539][ T8574] ops_init+0x2b0/0x53c [ 197.019277][ T8574] setup_net+0x494/0xb6c [ 197.020041][ T8574] copy_net_ns+0x2b8/0x578 [ 197.020872][ T8574] create_new_namespaces+0x30c/0x604 [ 197.021882][ T8574] unshare_nsproxy_namespaces+0x108/0x160 [ 197.022881][ T8574] ksys_unshare+0x3f0/0x70c [ 197.023708][ T8574] __arm64_sys_unshare+0x3c/0x50 [ 197.024608][ T8574] invoke_syscall+0x98/0x290 [ 197.025472][ T8574] el0_svc_common+0x13c/0x258 [ 197.026466][ T8574] do_el0_svc+0x5c/0x134 [ 197.027376][ T8574] el0_svc+0x58/0x128 [ 197.028154][ T8574] el0t_64_sync_handler+0x84/0xf0 [ 197.029124][ T8574] el0t_64_sync+0x18c/0x190 [ 197.127604][ T8579] netlink: 32 bytes leftover after parsing attributes in process `syz.0.1319'. [ 197.238339][ T8585] fuse: Bad value for 'fd' [ 198.562282][ T8592] loop4: detected capacity change from 0 to 512 [ 198.566136][ T2065] ieee802154 phy0 wpan0: encryption failed: -22 [ 198.567376][ T2065] ieee802154 phy1 wpan1: encryption failed: -22 [ 198.629433][ T4377] lg-g15 0003:046D:0A07.0014: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 198.631411][ T4377] input: Logitech Z-10 LCD Menu Keys as /devices/virtual/misc/uhid/0003:046D:0A07.0014/input/input28 [ 198.657217][ T8589] syz.4.1318: attempt to access beyond end of device [ 198.657217][ T8589] loop4: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 198.804901][ T8605] loop3: detected capacity change from 0 to 1024 [ 198.851553][ T8605] EXT4-fs: Ignoring removed mblk_io_submit option [ 198.852678][ T8605] EXT4-fs: Ignoring removed oldalloc option [ 198.889500][ T8627] input: syz0 as /devices/virtual/input/input29 [ 198.931355][ T8623] fido_id[8623]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 198.978578][ T8632] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1331'. [ 199.059462][ T8605] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 199.466573][ T8661] loop2: detected capacity change from 0 to 512 [ 199.498646][ T14] lg-g15 0003:046D:0A07.0015: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 199.527779][ T8661] syz.2.1342: attempt to access beyond end of device [ 199.527779][ T8661] loop2: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 199.694966][ T14] input: Logitech Z-10 LCD Menu Keys as /devices/virtual/misc/uhid/0003:046D:0A07.0015/input/input30 [ 200.521005][ T4330] EXT4-fs (loop3): unmounting filesystem. [ 200.621182][ T8665] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1344'. [ 200.706490][ T8672] proc: Unknown parameter ';' [ 200.708202][ T8672] FAULT_INJECTION: forcing a failure. [ 200.708202][ T8672] name failslab, interval 1, probability 0, space 0, times 0 [ 200.710400][ T8672] CPU: 1 PID: 8672 Comm: syz.4.1347 Not tainted syzkaller #0 [ 200.711584][ T8672] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 200.713303][ T8672] Call trace: [ 200.713899][ T8672] dump_backtrace+0x1c4/0x1f0 [ 200.714750][ T8672] show_stack+0x2c/0x3c [ 200.715510][ T8672] __dump_stack+0x30/0x40 [ 200.716284][ T8672] dump_stack_lvl+0xf4/0x15c [ 200.717102][ T8672] dump_stack+0x1c/0x5c [ 200.717828][ T8672] should_fail_ex+0x3cc/0x524 [ 200.718653][ T8672] __should_failslab+0xc0/0x11c [ 200.719543][ T8672] should_failslab+0x10/0x28 [ 200.720360][ T8672] slab_pre_alloc_hook+0x6c/0x31c [ 200.721250][ T8672] kmem_cache_alloc_lru+0x60/0x284 [ 200.722148][ T8672] sock_alloc_inode+0x2c/0xcc [ 200.723007][ T8672] new_inode_pseudo+0x68/0x1cc [ 200.723837][ T8672] sock_create_lite+0xd0/0x3f8 [ 200.724683][ T8672] __netlink_kernel_create+0xfc/0x6a4 [ 200.725624][ T8672] rtnetlink_net_init+0xa8/0x134 [ 200.726484][ T8672] ops_init+0x2b0/0x53c [ 200.727245][ T8672] setup_net+0x494/0xb6c [ 200.728029][ T8672] copy_net_ns+0x2b8/0x578 [ 200.728812][ T8672] create_new_namespaces+0x30c/0x604 [ 200.729756][ T8672] unshare_nsproxy_namespaces+0x108/0x160 [ 200.730756][ T8672] ksys_unshare+0x3f0/0x70c [ 200.731540][ T8672] __arm64_sys_unshare+0x3c/0x50 [ 200.732394][ T8672] invoke_syscall+0x98/0x290 [ 200.733175][ T8672] el0_svc_common+0x13c/0x258 [ 200.733982][ T8672] do_el0_svc+0x5c/0x134 [ 200.734707][ T8672] el0_svc+0x58/0x128 [ 200.735396][ T8672] el0t_64_sync_handler+0x84/0xf0 [ 200.736280][ T8672] el0t_64_sync+0x18c/0x190 [ 200.799619][ T8673] fido_id[8673]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 200.981846][ T8696] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1356'. [ 201.017772][ T8688] loop5: detected capacity change from 0 to 1024 [ 201.019246][ T8688] EXT4-fs: Ignoring removed mblk_io_submit option [ 201.020458][ T8688] EXT4-fs: Ignoring removed oldalloc option [ 201.102528][ T8705] loop3: detected capacity change from 0 to 512 [ 201.274729][ T8705] syz.3.1355: attempt to access beyond end of device [ 201.274729][ T8705] loop3: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 202.034361][ T8688] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 202.556244][ T4377] lg-g15 0003:046D:0A07.0016: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 202.561117][ T4377] input: Logitech Z-10 LCD Menu Keys as /devices/virtual/misc/uhid/0003:046D:0A07.0016/input/input31 [ 203.107591][ T5837] EXT4-fs (loop5): unmounting filesystem. [ 203.338481][ T8736] proc: Unknown parameter ';' [ 203.348758][ T8736] FAULT_INJECTION: forcing a failure. [ 203.348758][ T8736] name failslab, interval 1, probability 0, space 0, times 0 [ 203.350998][ T8736] CPU: 1 PID: 8736 Comm: syz.2.1366 Not tainted syzkaller #0 [ 203.352233][ T8736] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 203.353961][ T8736] Call trace: [ 203.354525][ T8736] dump_backtrace+0x1c4/0x1f0 [ 203.355323][ T8736] show_stack+0x2c/0x3c [ 203.356049][ T8736] __dump_stack+0x30/0x40 [ 203.356802][ T8736] dump_stack_lvl+0xf4/0x15c [ 203.357589][ T8736] dump_stack+0x1c/0x5c [ 203.358320][ T8736] should_fail_ex+0x3cc/0x524 [ 203.359141][ T8736] __should_failslab+0xc0/0x11c [ 203.360022][ T8736] should_failslab+0x10/0x28 [ 203.360817][ T8736] __kmem_cache_alloc_node+0x7c/0x318 [ 203.361713][ T8736] __kmalloc+0xc4/0x180 [ 203.362431][ T8736] __register_sysctl_table+0x844/0xc88 [ 203.363324][ T8736] register_net_sysctl+0x31c/0x364 [ 203.364214][ T8736] nf_log_net_init+0x474/0x54c [ 203.365057][ T8736] ops_init+0x2b0/0x53c [ 203.365799][ T8736] setup_net+0x494/0xb6c [ 203.366549][ T8736] copy_net_ns+0x2b8/0x578 [ 203.367330][ T8736] create_new_namespaces+0x30c/0x604 [ 203.368289][ T8736] unshare_nsproxy_namespaces+0x108/0x160 [ 203.369310][ T8736] ksys_unshare+0x3f0/0x70c [ 203.370145][ T8736] __arm64_sys_unshare+0x3c/0x50 [ 203.371033][ T8736] invoke_syscall+0x98/0x290 [ 203.371860][ T8736] el0_svc_common+0x13c/0x258 [ 203.372686][ T8736] do_el0_svc+0x5c/0x134 [ 203.373458][ T8736] el0_svc+0x58/0x128 [ 203.374194][ T8736] el0t_64_sync_handler+0x84/0xf0 [ 203.375067][ T8736] el0t_64_sync+0x18c/0x190 [ 203.462822][ T8736] sysctl could not get directory: /net/netfilter -12 [ 203.465143][ T8736] CPU: 1 PID: 8736 Comm: syz.2.1366 Not tainted syzkaller #0 [ 203.466550][ T8736] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 203.468321][ T8736] Call trace: [ 203.468869][ T8736] dump_backtrace+0x1c4/0x1f0 [ 203.469698][ T8736] show_stack+0x2c/0x3c [ 203.470423][ T8736] __dump_stack+0x30/0x40 [ 203.471187][ T8736] dump_stack_lvl+0xf4/0x15c [ 203.472010][ T8736] dump_stack+0x1c/0x5c [ 203.472734][ T8736] __register_sysctl_table+0xc10/0xc88 [ 203.473693][ T8736] register_net_sysctl+0x31c/0x364 [ 203.474615][ T8736] nf_log_net_init+0x474/0x54c [ 203.475515][ T8736] ops_init+0x2b0/0x53c [ 203.476298][ T8736] setup_net+0x494/0xb6c [ 203.477080][ T8736] copy_net_ns+0x2b8/0x578 [ 203.477919][ T8736] create_new_namespaces+0x30c/0x604 [ 203.478875][ T8736] unshare_nsproxy_namespaces+0x108/0x160 [ 203.479877][ T8736] ksys_unshare+0x3f0/0x70c [ 203.480669][ T8736] __arm64_sys_unshare+0x3c/0x50 [ 203.481552][ T8736] invoke_syscall+0x98/0x290 [ 203.482404][ T8736] el0_svc_common+0x13c/0x258 [ 203.483216][ T8736] do_el0_svc+0x5c/0x134 [ 203.483954][ T8736] el0_svc+0x58/0x128 [ 203.484645][ T8736] el0t_64_sync_handler+0x84/0xf0 [ 203.485512][ T8736] el0t_64_sync+0x18c/0x190 [ 203.486733][ T8740] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1368'. [ 203.593348][ T8747] loop5: detected capacity change from 0 to 1024 [ 203.598559][ T8747] EXT4-fs: Ignoring removed mblk_io_submit option [ 203.611207][ T8747] EXT4-fs: Ignoring removed oldalloc option [ 203.657728][ T8747] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 203.745389][ T5837] EXT4-fs (loop5): unmounting filesystem. [ 203.791794][ T8760] loop2: detected capacity change from 0 to 512 [ 203.795360][ T8760] syz.2.1372: attempt to access beyond end of device [ 203.795360][ T8760] loop2: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 204.226185][ T4375] lg-g15 0003:046D:0A07.0017: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 204.228435][ T4375] input: Logitech Z-10 LCD Menu Keys as /devices/virtual/misc/uhid/0003:046D:0A07.0017/input/input32 [ 205.165867][ T8788] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1381'. [ 205.176304][ T8777] fido_id[8777]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 205.414946][ T8796] loop5: detected capacity change from 0 to 1024 [ 205.450606][ T8796] EXT4-fs: Ignoring removed mblk_io_submit option [ 205.457433][ T8796] EXT4-fs: Ignoring removed oldalloc option [ 205.552689][ T8806] loop3: detected capacity change from 0 to 512 [ 205.721750][ T8806] syz.3.1385: attempt to access beyond end of device [ 205.721750][ T8806] loop3: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 206.793073][ T8796] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 206.942317][ T6592] lg-g15 0003:046D:0A07.0018: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 206.946590][ T6592] input: Logitech Z-10 LCD Menu Keys as /devices/virtual/misc/uhid/0003:046D:0A07.0018/input/input33 [ 206.966383][ T8825] loop4: detected capacity change from 0 to 512 [ 206.976746][ T8825] syz.4.1390: attempt to access beyond end of device [ 206.976746][ T8825] loop4: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 207.201327][ T8832] fuse: Bad value for 'group_id' [ 207.218762][ T5837] EXT4-fs (loop5): unmounting filesystem. [ 207.431367][ T8835] fido_id[8835]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 208.642022][ T8878] fuse: Bad value for 'group_id' [ 208.668588][ T8872] loop5: detected capacity change from 0 to 1024 [ 208.675115][ T8872] EXT4-fs: Ignoring removed mblk_io_submit option [ 208.676218][ T8872] EXT4-fs: Ignoring removed oldalloc option [ 208.703105][ T8854] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1398'. [ 208.719319][ T8872] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 208.898725][ T8892] Console: switching to colour dummy device 80x25 [ 208.956721][ T8892] Console: switching to colour frame buffer device 109x15 [ 209.312794][ T5837] EXT4-fs (loop5): unmounting filesystem. [ 209.759020][ T8916] loop4: detected capacity change from 0 to 512 [ 209.762264][ T8916] syz.4.1409: attempt to access beyond end of device [ 209.762264][ T8916] loop4: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 211.151291][ T8953] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1416'. [ 211.522068][ T8962] loop0: detected capacity change from 0 to 1024 [ 211.533923][ T8962] EXT4-fs: Ignoring removed mblk_io_submit option [ 211.543071][ T8962] EXT4-fs: Ignoring removed oldalloc option [ 211.598636][ T8962] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 211.621981][ T4334] EXT4-fs (loop0): unmounting filesystem. [ 212.088071][ T9011] loop5: detected capacity change from 0 to 512 [ 212.116195][ T9011] syz.5.1428: attempt to access beyond end of device [ 212.116195][ T9011] loop5: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 214.009204][ T9068] loop2: detected capacity change from 0 to 1024 [ 214.010770][ T9068] EXT4-fs: Ignoring removed mblk_io_submit option [ 214.014978][ T9068] EXT4-fs: Ignoring removed oldalloc option [ 214.053780][ T9068] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 214.128592][ T9083] Console: switching to colour dummy device 80x25 [ 214.172251][ T9083] Console: switching to colour frame buffer device 109x15 [ 214.605927][ T4340] EXT4-fs (loop2): unmounting filesystem. [ 214.736302][ T9093] loop3: detected capacity change from 0 to 512 [ 214.754974][ T9093] syz.3.1439: attempt to access beyond end of device [ 214.754974][ T9093] loop3: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 217.151400][ T9126] loop4: detected capacity change from 0 to 1024 [ 217.153084][ T9126] EXT4-fs: Ignoring removed mblk_io_submit option [ 217.154810][ T9126] EXT4-fs: Ignoring removed oldalloc option [ 217.186096][ T9126] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 217.203250][ T4335] EXT4-fs (loop4): unmounting filesystem. [ 218.379065][ T9151] Console: switching to colour dummy device 80x25 [ 218.407044][ T9152] loop0: detected capacity change from 0 to 512 [ 218.409830][ T9152] syz.0.1455: attempt to access beyond end of device [ 218.409830][ T9152] loop0: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 218.414988][ T9151] Console: switching to colour frame buffer device 109x15 [ 219.159283][ T9164] syz.4.1458 (9164): drop_caches: 2 [ 220.020656][ T9184] binder: 9179:9184 ioctl c0306201 20000080 returned -14 [ 220.049349][ T9184] binder: 9179:9184 tried to acquire reference to desc 0, got 1 instead [ 220.050913][ T9184] binder: 9179:9184 ioctl c0306201 200003c0 returned -14 [ 220.057458][ T4377] binder: release 9179:9184 transaction 5 out, still active [ 220.059467][ T4377] binder: undelivered TRANSACTION_COMPLETE [ 220.078937][ T3902] binder: send failed reply for transaction 5, target dead [ 221.333938][ T9202] loop0: detected capacity change from 0 to 1024 [ 221.335482][ T9202] EXT4-fs: Ignoring removed mblk_io_submit option [ 221.336675][ T9202] EXT4-fs: Ignoring removed oldalloc option [ 221.405564][ T9202] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 221.430948][ T9204] loop2: detected capacity change from 0 to 512 [ 221.434199][ T9204] syz.2.1471: attempt to access beyond end of device [ 221.434199][ T9204] loop2: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 221.474518][ T4334] EXT4-fs (loop0): unmounting filesystem. [ 221.939082][ T9233] syz.3.1478 (9233): drop_caches: 2 [ 223.491601][ T9249] loop0: detected capacity change from 0 to 1024 [ 223.493161][ T9249] EXT4-fs: Ignoring removed mblk_io_submit option [ 223.537142][ T9251] loop2: detected capacity change from 0 to 1024 [ 223.567310][ T9249] EXT4-fs: Ignoring removed oldalloc option [ 223.584088][ T9251] EXT4-fs: Ignoring removed oldalloc option [ 223.585198][ T9251] EXT4-fs: Ignoring removed orlov option [ 223.627085][ T9251] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 223.691868][ T9263] EXT4-fs error (device loop2): ext4_validate_block_bitmap:438: comm ext4lazyinit: bg 0: block 112: padding at end of block bitmap is not set [ 223.733462][ T9249] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 224.089476][ T4334] EXT4-fs (loop0): unmounting filesystem. [ 224.178487][ T9286] loop4: detected capacity change from 0 to 512 [ 224.182207][ T9286] syz.4.1492: attempt to access beyond end of device [ 224.182207][ T9286] loop4: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 224.272837][ T9292] syz.0.1493 (9292): drop_caches: 2 [ 224.544563][ T4340] EXT4-fs (loop2): unmounting filesystem. [ 225.819993][ T9313] fuse: Unknown parameter 'group_id00000000000000000000' [ 226.065190][ T9332] binder: 9331:9332 ioctl c0306201 20000080 returned -14 [ 226.090857][ T9332] binder: 9331:9332 got transaction to invalid handle, 1 [ 226.092497][ T9332] binder: 9332:9331 cannot find target node [ 226.126233][ T9332] binder: 9331:9332 transaction call to 0:0 failed 9/29201/-22, size 112-24 line 3062 [ 226.144280][ T5908] binder: undelivered TRANSACTION_ERROR: 29201 [ 226.149966][ T9339] loop2: detected capacity change from 0 to 512 [ 226.155721][ T9339] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 226.176775][ T9325] loop4: detected capacity change from 0 to 1024 [ 226.178207][ T9325] EXT4-fs: Ignoring removed mblk_io_submit option [ 226.179362][ T9325] EXT4-fs: Ignoring removed oldalloc option [ 226.271843][ T9339] EXT4-fs (loop2): 1 truncate cleaned up [ 226.272910][ T9339] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 226.279384][ T9325] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 226.343612][ T4335] EXT4-fs (loop4): unmounting filesystem. [ 226.409758][ T9365] syz.5.1509 (9365): drop_caches: 2 [ 226.552432][ T9376] fuse: Unknown parameter 'group_id00000000000000000000' [ 226.662062][ T9388] fuse: Unknown parameter 'grou00000000000000000000' [ 227.068626][ T4340] EXT4-fs (loop2): unmounting filesystem. [ 227.703337][ T9405] binder: 9402:9405 ioctl c0306201 20000080 returned -14 [ 227.797243][ T9405] binder: BINDER_SET_CONTEXT_MGR already set [ 227.798984][ T9405] binder: 9402:9405 ioctl 4018620d 20000040 returned -16 [ 227.981405][ T9405] binder: 9402:9405 got transaction to invalid handle, 1 [ 227.982747][ T9405] binder: 9405:9402 cannot find target node [ 227.983759][ T9405] binder: 9402:9405 transaction call to 0:0 failed 12/29201/-22, size 112-24 line 3062 [ 227.986211][ T6592] binder: undelivered TRANSACTION_ERROR: 29201 [ 228.250011][ T9427] fuse: Unknown parameter 'group_id00000000000000000000' [ 228.360201][ T9443] fuse: Unknown parameter 'grou00000000000000000000' [ 228.384711][ T9439] can: request_module (can-proto-0) failed. [ 228.470016][ T9431] loop4: detected capacity change from 0 to 1024 [ 228.471842][ T9431] EXT4-fs: Ignoring removed mblk_io_submit option [ 228.472993][ T9431] EXT4-fs: Ignoring removed oldalloc option [ 228.505195][ T9456] syz.2.1529 (9456): drop_caches: 2 [ 228.507437][ T9431] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 228.527228][ T4335] EXT4-fs (loop4): unmounting filesystem. [ 228.594575][ T9463] binder: 9462:9463 ioctl c0306201 20000080 returned -14 [ 228.611190][ T9463] binder: 9462:9463 got transaction to invalid handle, 1 [ 228.612522][ T9463] binder: 9463:9462 cannot find target node [ 228.613444][ T9463] binder: 9462:9463 transaction call to 0:0 failed 16/29201/-22, size 112-24 line 3062 [ 228.634563][ T3902] binder: undelivered TRANSACTION_ERROR: 29201 [ 229.975003][ T9492] fuse: Bad value for 'user_id' [ 230.155042][ T9498] fuse: Unknown parameter 'grou00000000000000000000' [ 230.307172][ T9519] binder: 9517:9519 ioctl c0306201 20000080 returned -14 [ 230.377190][ T9519] binder: 9517:9519 ioctl c0306201 200003c0 returned -14 [ 230.378810][ T9519] binder: 9517:9519 got transaction to invalid handle, 1 [ 230.388462][ T9519] binder: 9519:9517 cannot find target node [ 230.391667][ T9504] loop5: detected capacity change from 0 to 1024 [ 230.393137][ T9504] EXT4-fs: Ignoring removed mblk_io_submit option [ 230.422050][ T9504] EXT4-fs: Ignoring removed oldalloc option [ 230.736233][ T9531] loop3: detected capacity change from 0 to 512 [ 230.743517][ T9531] EXT4-fs: Ignoring removed nomblk_io_submit option [ 230.750787][ T9531] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 230.772701][ T9531] EXT4-fs (loop3): 1 truncate cleaned up [ 230.775062][ T9531] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 230.888949][ T9504] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 231.290825][ T5837] EXT4-fs (loop5): unmounting filesystem. [ 231.337176][ T9551] fuse: Bad value for 'user_id' [ 231.797550][ T4330] EXT4-fs (loop3): unmounting filesystem. [ 232.330838][ T9560] fuse: Unknown parameter 'group_i00000000000000000000' [ 232.665226][ T9579] binder: 9572:9579 ioctl c0306201 20000080 returned -14 [ 232.726701][ T9579] binder: 9572:9579 ioctl c0306201 200003c0 returned -14 [ 232.733080][ T9579] binder: 9572:9579 got transaction to invalid handle, 1 [ 232.753248][ T9579] binder_debug: 2 callbacks suppressed [ 232.753264][ T9579] binder: 9579:9572 cannot find target node [ 232.755392][ T9579] binder: 9572:9579 transaction call to 0:0 failed 22/29201/-22, size 112-24 line 3062 [ 232.760187][ T4376] binder: undelivered TRANSACTION_ERROR: 29201 [ 233.114908][ T9600] fuse: Bad value for 'user_id' [ 233.220585][ T9586] loop0: detected capacity change from 0 to 1024 [ 233.227253][ T9586] EXT4-fs: Ignoring removed mblk_io_submit option [ 233.228389][ T9586] EXT4-fs: Ignoring removed oldalloc option [ 233.231042][ T9608] [ 233.278881][ T9613] fuse: Unknown parameter 'group_i00000000000000000000' [ 233.286680][ T9586] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 233.407166][ T4334] EXT4-fs (loop0): unmounting filesystem. [ 233.507135][ T9621] Injecting memory failure for pfn 0x146931 at process virtual address 0x20000000 [ 233.734745][ T9621] Memory failure: 0x146931: Sending SIGBUS to syz.2.1565:9621 due to hardware memory corruption [ 233.738076][ T9621] Memory failure: 0x146931: recovery action for dirty LRU page: Recovered [ 233.740011][ T9621] Injecting memory failure for pfn 0x14412d at process virtual address 0x20001000 [ 233.747185][ T9621] Memory failure: 0x14412d: Sending SIGBUS to syz.2.1565:9621 due to hardware memory corruption [ 233.749328][ T9621] Memory failure: 0x14412d: recovery action for dirty LRU page: Recovered [ 233.750920][ T9621] Injecting memory failure for pfn 0x14412a at process virtual address 0x20002000 [ 233.752741][ T9621] Memory failure: 0x14412a: Sending SIGBUS to syz.2.1565:9621 due to hardware memory corruption [ 233.754905][ T9621] Memory failure: 0x14412a: recovery action for dirty LRU page: Recovered [ 234.569330][ T9638] binder: 9637:9638 ioctl c0306201 20000080 returned -14 [ 234.701373][ T9642] fuse: Bad value for 'fd' [ 234.776637][ T9638] binder: 9637:9638 ioctl c0306201 200003c0 returned -14 [ 234.809254][ T9638] binder: 9637:9638 got transaction to invalid handle, 1 [ 234.810551][ T9638] binder: 9638:9637 cannot find target node [ 234.811611][ T9638] binder: 9637:9638 transaction call to 0:0 failed 25/29201/-22, size 112-24 line 3062 [ 234.815911][ T3902] binder: undelivered TRANSACTION_ERROR: 29201 [ 234.907366][ T9650] fuse: Unknown parameter 'group_i00000000000000000000' [ 234.991262][ T9648] loop4: detected capacity change from 0 to 1024 [ 235.016198][ T9648] EXT4-fs: Ignoring removed mblk_io_submit option [ 235.035898][ T9648] EXT4-fs: Ignoring removed oldalloc option [ 235.086996][ T9648] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 235.220188][ T4335] EXT4-fs (loop4): unmounting filesystem. [ 235.793095][ T9683] input: syz0 as /devices/virtual/input/input34 [ 236.286269][ T9694] fuse: Bad value for 'fd' [ 236.304187][ T9698] fuse: Unknown parameter 'group_id00000000000000000000' [ 236.657498][ T9707] FAULT_INJECTION: forcing a failure. [ 236.657498][ T9707] name failslab, interval 1, probability 0, space 0, times 0 [ 236.665535][ T9707] CPU: 0 PID: 9707 Comm: syz.2.1588 Not tainted syzkaller #0 [ 236.666903][ T9707] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 236.668764][ T9707] Call trace: [ 236.669366][ T9707] dump_backtrace+0x1c4/0x1f0 [ 236.670237][ T9707] show_stack+0x2c/0x3c [ 236.670991][ T9707] __dump_stack+0x30/0x40 [ 236.671792][ T9707] dump_stack_lvl+0xf4/0x15c [ 236.672638][ T9707] dump_stack+0x1c/0x5c [ 236.673356][ T9707] should_fail_ex+0x3cc/0x524 [ 236.674178][ T9707] __should_failslab+0xc0/0x11c [ 236.675052][ T9707] should_failslab+0x10/0x28 [ 236.675859][ T9707] __kmem_cache_alloc_node+0x7c/0x318 [ 236.676794][ T9707] __kmalloc_node_track_caller+0xb8/0x174 [ 236.677841][ T9707] kstrdup+0x68/0xb0 [ 236.678473][ T9707] led_tg_check+0x1b4/0x3b8 [ 236.679253][ T9707] xt_check_target+0x40c/0xa1c [ 236.680091][ T9707] translate_table+0x121c/0x1928 [ 236.680875][ T9707] do_ip6t_set_ctl+0x7f8/0xb84 [ 236.681676][ T9707] nf_setsockopt+0x260/0x280 [ 236.682443][ T9707] ipv6_setsockopt+0x168/0x1a0 [ 236.683273][ T9707] udpv6_setsockopt+0xa8/0xc0 [ 236.684120][ T9707] sock_common_setsockopt+0xb0/0xcc [ 236.685025][ T9707] __sys_setsockopt+0x2fc/0x50c [ 236.685839][ T9707] __arm64_sys_setsockopt+0xc0/0xdc [ 236.686747][ T9707] invoke_syscall+0x98/0x290 [ 236.687599][ T9707] el0_svc_common+0x13c/0x258 [ 236.688450][ T9707] do_el0_svc+0x5c/0x134 [ 236.689243][ T9707] el0_svc+0x58/0x128 [ 236.689994][ T9707] el0t_64_sync_handler+0x84/0xf0 [ 236.690942][ T9707] el0t_64_sync+0x18c/0x190 [ 238.399086][ T9760] fuse: Bad value for 'fd' [ 238.703144][ T9768] Console: switching to colour dummy device 80x25 [ 238.874865][ T9768] Console: switching to colour frame buffer device 109x15 [ 240.748540][ T9805] fuse: Bad value for 'fd' [ 240.827257][ T9814] fuse: Bad value for 'user_id' [ 241.214173][ T48] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 241.598646][ T9849] Console: switching to colour dummy device 80x25 [ 241.634445][ T9849] Console: switching to colour frame buffer device 109x15 [ 241.877340][ T9856] fuse: Bad value for 'fd' [ 242.777694][ T9863] fuse: Bad value for 'user_id' [ 242.962357][ T9874] loop4: detected capacity change from 0 to 1024 [ 242.974951][ T9874] EXT4-fs: Ignoring removed oldalloc option [ 243.117046][ T9882] input: syz0 as /devices/virtual/input/input35 [ 243.142696][ T9874] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 243.194262][ T9874] EXT4-fs (loop4): unmounting filesystem. [ 243.372420][ T9905] fuse: Bad value for 'fd' [ 243.833127][ T9913] Console: switching to colour dummy device 80x25 [ 243.852953][ T9926] fuse: Bad value for 'user_id' [ 243.855682][ T9913] Console: switching to colour frame buffer device 109x15 [ 244.545250][ T9950] ubi: mtd0 is already attached to ubi0 [ 245.413309][ T9961] fuse: Invalid rootmode [ 245.712798][ T9975] fuse: Bad value for 'fd' [ 245.873616][ T9978] fuse: Invalid rootmode [ 245.938356][ T6143] Bluetooth: hci0: Frame reassembly failed (-84) [ 246.007342][ T9991] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1650'. [ 246.022317][ T9993] loop4: detected capacity change from 0 to 1024 [ 246.050305][ T9993] EXT4-fs: Ignoring removed mblk_io_submit option [ 246.051456][ T9993] EXT4-fs: Ignoring removed oldalloc option [ 246.117119][ T9993] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 246.506551][ T4335] EXT4-fs (loop4): unmounting filesystem. [ 246.993524][T10022] Console: switching to colour dummy device 80x25 [ 247.016446][T10022] Console: switching to colour frame buffer device 109x15 [ 247.087602][T10026] fuse: Bad value for 'fd' [ 247.212245][T10035] fuse: Invalid rootmode [ 247.442214][T10048] loop3: detected capacity change from 0 to 1024 [ 247.522009][T10048] EXT4-fs: Ignoring removed mblk_io_submit option [ 247.523163][T10048] EXT4-fs: Ignoring removed oldalloc option [ 247.852161][T10048] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 247.899226][ T4330] EXT4-fs (loop3): unmounting filesystem. [ 248.013649][T10082] binder: 10081:10082 ioctl c0306201 200003c0 returned -14 [ 248.016577][T10082] binder: 10081:10082 got transaction to invalid handle, 1 [ 248.019231][T10082] binder: 10082:10081 cannot find target node [ 248.021717][T10082] binder: 10081:10082 transaction call to 0:0 failed 29/29201/-22, size 112-24 line 3062 [ 248.026314][ T4407] binder: undelivered TRANSACTION_ERROR: 29201 [ 248.151435][ T48] Bluetooth: hci0: command 0x1003 tx timeout [ 248.153690][ T4333] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 248.284970][T10094] ubi: mtd0 is already attached to ubi0 [ 248.483517][T10098] fuse: Bad value for 'rootmode' [ 249.083312][T10124] syz.5.1679 (10124): drop_caches: 2 [ 249.113103][T10129] Console: switching to colour dummy device 80x25 [ 249.120860][T10127] binder: 10126:10127 ioctl c0306201 200003c0 returned -14 [ 249.120975][T10127] binder: 10126:10127 got transaction to invalid handle, 1 [ 249.121010][T10127] binder: 10127:10126 cannot find target node [ 249.121019][T10127] binder: 10126:10127 transaction call to 0:0 failed 33/29201/-22, size 112-24 line 3062 [ 249.121251][ T4378] binder: undelivered TRANSACTION_ERROR: 29201 [ 249.147915][T10129] Console: switching to colour frame buffer device 109x15 [ 249.373000][T10165] syz.5.1692 (10165): drop_caches: 2 [ 249.416732][T10172] binder: 10170:10172 ioctl c0306201 200003c0 returned -14 [ 249.419015][T10172] binder: 10170:10172 got transaction to invalid handle, 1 [ 249.420542][T10172] binder: 10172:10170 cannot find target node [ 249.421722][T10172] binder: 10170:10172 transaction call to 0:0 failed 37/29201/-22, size 112-24 line 3062 [ 249.423769][ T4378] binder: undelivered TRANSACTION_ERROR: 29201 [ 249.477762][T10178] fuse: Bad value for 'fd' [ 249.485288][T10180] Console: switching to colour dummy device 80x25 [ 249.509755][T10180] Console: switching to colour frame buffer device 109x15 [ 249.575346][T10183] ubi: mtd0 is already attached to ubi0 [ 249.984658][T10215] binder: BINDER_SET_CONTEXT_MGR already set [ 249.986042][T10215] binder: 10214:10215 ioctl 4018620d 20000040 returned -16 [ 249.987689][T10215] binder: 10214:10215 got transaction to invalid handle, 1 [ 249.989332][T10215] binder: 10215:10214 cannot find target node [ 250.159849][T10231] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1707'. [ 250.161027][T10232] syz.2.1704 (10232): drop_caches: 2 [ 250.162602][T10231] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1707'. [ 250.164349][T10231] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1707'. [ 250.298229][T10241] Console: switching to colour dummy device 80x25 [ 250.321826][T10241] Console: switching to colour frame buffer device 109x15 [ 250.653802][ T4333] Bluetooth: hci5: command 0x0406 tx timeout [ 250.853845][T10269] binder: BINDER_SET_CONTEXT_MGR already set [ 250.855183][T10269] binder: 10267:10269 ioctl 4018620d 20000040 returned -16 [ 250.862347][T10269] binder: 10267:10269 got transaction to invalid handle, 1 [ 251.096079][T10290] fuse: Invalid rootmode [ 251.187450][T10298] loop4: detected capacity change from 0 to 512 [ 251.202744][T10295] input: syz0 as /devices/virtual/input/input36 [ 251.220093][T10298] syz.4.1721: attempt to access beyond end of device [ 251.220093][T10298] loop4: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 251.559941][T10317] binder: BINDER_SET_CONTEXT_MGR already set [ 251.561284][T10317] binder: 10316:10317 ioctl 4018620d 20000040 returned -16 [ 251.563126][T10317] binder: 10316:10317 got transaction to invalid handle, 1 [ 251.950241][T10326] fuse: Invalid rootmode [ 252.000055][T10324] netlink: 64 bytes leftover after parsing attributes in process `syz.2.1731'. [ 252.001905][T10324] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1731'. [ 252.003675][T10324] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1731'. [ 252.047022][T10330] syz.3.1732 (10330): drop_caches: 2 [ 252.767392][T10350] binder: 10349:10350 Acquire 1 refcount change on invalid ref 0 ret -22 [ 252.769150][T10350] binder: 10349:10350 ioctl c0306201 20000080 returned -14 [ 252.778508][T10350] binder: 10349:10350 ioctl c0306201 200003c0 returned -14 [ 252.779776][T10350] binder: 10349:10350 got transaction to invalid handle, 1 [ 252.814764][T10352] input: syz0 as /devices/virtual/input/input37 [ 252.946565][T10361] fuse: Invalid rootmode [ 253.238525][T10379] binder: 10378:10379 Acquire 1 refcount change on invalid ref 0 ret -22 [ 253.240359][T10379] binder: 10378:10379 ioctl c0306201 20000080 returned -14 [ 253.243250][T10379] binder: 10378:10379 ioctl c0306201 200003c0 returned -14 [ 253.245665][T10379] binder: 10378:10379 got transaction to invalid handle, 1 [ 253.396078][T10382] netlink: 48 bytes leftover after parsing attributes in process `syz.2.1752'. [ 254.081963][T10388] loop7: detected capacity change from 0 to 7 [ 254.312466][T10388] Dev loop7: unable to read RDB block 7 [ 254.313634][T10388] loop7: unable to read partition table [ 254.314621][T10388] loop7: partition table beyond EOD, truncated [ 254.315804][T10388] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 254.324185][T10275] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 254.441536][T10395] fuse: Bad value for 'rootmode' [ 254.807687][T10401] syz.0.1757 (10401): drop_caches: 2 [ 254.940999][T10411] binder: 10410:10411 Acquire 1 refcount change on invalid ref 0 ret -22 [ 254.942876][T10411] binder: 10410:10411 ioctl c0306201 20000080 returned -14 [ 254.952501][T10411] binder: 10410:10411 ioctl c0306201 200003c0 returned -14 [ 254.954053][T10411] binder: 10410:10411 got transaction to invalid handle, 1 [ 254.960032][T10411] binder_debug: 14 callbacks suppressed [ 254.960046][T10411] binder: 10411:10410 cannot find target node [ 254.964479][T10411] binder: 10410:10411 transaction call to 0:0 failed 52/29201/-22, size 112-24 line 3062 [ 254.971313][ T4379] binder: undelivered TRANSACTION_ERROR: 29201 [ 255.156909][T10421] loop5: detected capacity change from 0 to 512 [ 255.161354][T10421] syz.5.1765: attempt to access beyond end of device [ 255.161354][T10421] loop5: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 255.431315][T10433] fuse: Bad value for 'rootmode' [ 255.529768][T10446] binder: 10445:10446 Acquire 1 refcount change on invalid ref 0 ret -22 [ 255.545237][T10446] binder: 10445:10446 ioctl c0306201 20000080 returned -14 [ 255.550204][T10446] binder: 10445:10446 ioctl c0306201 200003c0 returned -14 [ 256.111232][T10486] binder: 10484:10486 Acquire 1 refcount change on invalid ref 0 ret -22 [ 256.112809][T10486] binder: 10484:10486 ioctl c0306201 20000080 returned -14 [ 256.128517][T10486] binder: 10484:10486 ioctl c0306201 200003c0 returned -14 [ 256.302857][T10506] syz.5.1790 (10506): drop_caches: 2 [ 256.578533][T10527] binder: 10526:10527 Acquire 1 refcount change on invalid ref 0 ret -22 [ 256.580300][T10527] binder: 10526:10527 ioctl c0306201 20000080 returned -14 [ 256.587368][T10527] binder: 10526:10527 ioctl c0306201 200003c0 returned -14 [ 257.407295][T10568] binder: 10567:10568 Acquire 1 refcount change on invalid ref 0 ret -22 [ 257.413420][T10568] binder: 10567:10568 ioctl c0306201 20000080 returned -14 [ 257.421263][T10568] binder: 10567:10568 ioctl c0306201 200003c0 returned -14 [ 257.450802][T10576] fuse: Bad value for 'fd' [ 257.518205][T10579] loop7: detected capacity change from 0 to 7 [ 257.727995][T10579] Dev loop7: unable to read RDB block 7 [ 257.729284][T10579] loop7: unable to read partition table [ 257.730452][T10579] loop7: partition table beyond EOD, truncated [ 257.731589][T10579] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %`ր{֐ȵ4FLQk݊) failed (rc=-5) [ 257.883827][T10601] input: syz0 as /devices/virtual/input/input38 [ 257.964401][T10607] fuse: Unknown parameter 'user_id00000000000000000000' [ 258.103530][T10611] loop2: detected capacity change from 0 to 512 [ 258.258720][T10611] syz.2.1825: attempt to access beyond end of device [ 258.258720][T10611] loop2: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 258.275840][T10613] binder: 10612:10613 Acquire 1 refcount change on invalid ref 0 ret -22 [ 258.285998][T10613] binder: 10612:10613 ioctl c0306201 20000080 returned -14 [ 258.304148][T10613] binder: 10612:10613 ioctl c0306201 200003c0 returned -14 [ 258.439455][T10618] fuse: Bad value for 'fd' [ 259.157090][T10634] fuse: Unknown parameter 'user_id00000000000000000000' [ 259.170802][T10636] loop2: detected capacity change from 0 to 512 [ 259.177261][T10636] syz.2.1840: attempt to access beyond end of device [ 259.177261][T10636] loop2: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 259.279834][T10644] binder: 10643:10644 Acquire 1 refcount change on invalid ref 0 ret -22 [ 259.281660][T10644] binder: 10643:10644 ioctl c0306201 20000080 returned -14 [ 259.291277][T10644] binder: 10643:10644 ioctl c0306201 200003c0 returned -14 [ 259.340558][T10653] fuse: Unknown parameter 'use00000000000000000000' [ 259.538428][T10659] usb usb8: usbfs: process 10659 (syz.5.1844) did not claim interface 7 before use [ 259.805550][T10667] fuse: Bad value for 'fd' [ 260.004595][T10674] loop4: detected capacity change from 0 to 512 [ 260.039674][T10674] syz.4.1853: attempt to access beyond end of device [ 260.039674][T10674] loop4: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 260.065119][T10677] Console: switching to colour dummy device 80x25 [ 260.074969][T10675] loop0: detected capacity change from 0 to 512 [ 260.092681][T10675] syz.0.1852: attempt to access beyond end of device [ 260.092681][T10675] loop0: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 260.104864][T10677] Console: switching to colour frame buffer device 109x15 [ 260.245062][T10681] fuse: Unknown parameter 'user_i00000000000000000000' [ 260.282343][T10683] binder: 10682:10683 ioctl 4018620d 0 returned -22 [ 260.290442][T10683] binder: 10682:10683 Acquire 1 refcount change on invalid ref 0 ret -22 [ 260.292065][T10683] binder: 10682:10683 ioctl c0306201 20000080 returned -14 [ 260.295098][T10683] binder: 10682:10683 ioctl c0306201 200003c0 returned -14 [ 260.300994][T10683] binder: 10682:10683 got transaction to invalid handle, 1 [ 260.302460][T10683] binder: 10683:10682 cannot find target node [ 260.303850][T10683] binder: 10682:10683 transaction call to 0:0 failed 67/29201/-22, size 112-24 line 3062 [ 260.306967][ T4407] binder: undelivered TRANSACTION_ERROR: 29201 [ 260.421063][T10691] FAULT_INJECTION: forcing a failure. [ 260.421063][T10691] name failslab, interval 1, probability 0, space 0, times 0 [ 260.423176][T10691] CPU: 1 PID: 10691 Comm: syz.5.1861 Not tainted syzkaller #0 [ 260.424472][T10691] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 260.426354][T10691] Call trace: [ 260.426956][T10691] dump_backtrace+0x1c4/0x1f0 [ 260.427787][T10691] show_stack+0x2c/0x3c [ 260.428550][T10691] __dump_stack+0x30/0x40 [ 260.429352][T10691] dump_stack_lvl+0xf4/0x15c [ 260.430224][T10691] dump_stack+0x1c/0x5c [ 260.431010][T10691] should_fail_ex+0x3cc/0x524 [ 260.431846][T10691] __should_failslab+0xc0/0x11c [ 260.432705][T10691] should_failslab+0x10/0x28 [ 260.433540][T10691] slab_pre_alloc_hook+0x6c/0x31c [ 260.434434][T10691] kmem_cache_alloc_lru+0x60/0x284 [ 260.435324][T10691] sock_alloc_inode+0x2c/0xcc [ 260.436161][T10691] new_inode_pseudo+0x68/0x1cc [ 260.437017][T10691] __sock_create+0x138/0x8a8 [ 260.437822][T10691] __sys_socket+0xc0/0x1b0 [ 260.438630][T10691] __arm64_sys_socket+0x7c/0x94 [ 260.439500][T10691] invoke_syscall+0x98/0x290 [ 260.440256][T10691] el0_svc_common+0x13c/0x258 [ 260.441115][T10691] do_el0_svc+0x5c/0x134 [ 260.441878][T10691] el0_svc+0x58/0x128 [ 260.442587][T10691] el0t_64_sync_handler+0x84/0xf0 [ 260.443449][T10691] el0t_64_sync+0x18c/0x190 [ 260.444212][ C1] vkms_vblank_simulate: vblank timer overrun [ 260.511668][T10691] socket: no more sockets [ 260.927242][T10698] fuse: Bad value for 'fd' [ 261.110521][T10702] syz.5.1865 (10702): drop_caches: 2 [ 261.994892][T10712] binder: 10711:10712 ioctl 4018620d 0 returned -22 [ 261.996629][T10712] binder: 10711:10712 Acquire 1 refcount change on invalid ref 0 ret -22 [ 261.998366][T10712] binder: 10711:10712 ioctl c0306201 20000080 returned -14 [ 262.000809][T10712] binder: 10711:10712 ioctl c0306201 200003c0 returned -14 [ 262.002128][T10712] binder: 10711:10712 got transaction to invalid handle, 1 [ 262.003491][T10712] binder: 10712:10711 cannot find target node [ 262.004499][T10712] binder: 10711:10712 transaction call to 0:0 failed 70/29201/-22, size 112-24 line 3062 [ 262.011960][ T4375] binder: undelivered TRANSACTION_ERROR: 29201 [ 262.056035][T10719] FAULT_INJECTION: forcing a failure. [ 262.056035][T10719] name failslab, interval 1, probability 0, space 0, times 0 [ 262.058936][T10719] CPU: 1 PID: 10719 Comm: syz.5.1872 Not tainted syzkaller #0 [ 262.060351][T10719] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 262.062371][T10719] Call trace: [ 262.063031][T10719] dump_backtrace+0x1c4/0x1f0 [ 262.063985][T10719] show_stack+0x2c/0x3c [ 262.064829][T10719] __dump_stack+0x30/0x40 [ 262.065695][T10719] dump_stack_lvl+0xf4/0x15c [ 262.066587][T10719] dump_stack+0x1c/0x5c [ 262.067384][T10719] should_fail_ex+0x3cc/0x524 [ 262.068259][T10719] __should_failslab+0xc0/0x11c [ 262.069179][T10719] should_failslab+0x10/0x28 [ 262.070005][T10719] kmem_cache_alloc+0x88/0x310 [ 262.070896][T10719] security_inode_alloc+0x38/0x11c [ 262.071816][T10719] inode_init_always+0x6c8/0xb28 [ 262.072684][T10719] new_inode_pseudo+0x7c/0x1cc [ 262.073559][T10719] __sock_create+0x138/0x8a8 [ 262.074372][T10719] __sys_socket+0xc0/0x1b0 [ 262.075177][T10719] __arm64_sys_socket+0x7c/0x94 [ 262.076074][T10719] invoke_syscall+0x98/0x290 [ 262.076943][T10719] el0_svc_common+0x13c/0x258 [ 262.077799][T10719] do_el0_svc+0x5c/0x134 [ 262.078571][T10719] el0_svc+0x58/0x128 [ 262.079276][T10719] el0t_64_sync_handler+0x84/0xf0 [ 262.080117][T10719] el0t_64_sync+0x18c/0x190 [ 262.083892][T10719] socket: no more sockets [ 262.132243][T10723] fuse: Bad value for 'fd' [ 262.173354][T10725] fuse: Unknown parameter 'user_i00000000000000000000' [ 262.374339][T10740] input: syz0 as /devices/virtual/input/input39 [ 262.470750][T10744] binder: 10743:10744 ioctl 4018620d 0 returned -22 [ 262.479942][T10744] binder: 10743:10744 Acquire 1 refcount change on invalid ref 0 ret -22 [ 262.482213][T10744] binder: 10743:10744 ioctl c0306201 20000080 returned -14 [ 262.496113][T10744] binder: 10743:10744 ioctl c0306201 200003c0 returned -14 [ 262.498827][T10744] binder: 10743:10744 got transaction to invalid handle, 1 [ 262.500136][T10744] binder: 10744:10743 cannot find target node [ 262.501250][T10744] binder: 10743:10744 transaction call to 0:0 failed 73/29201/-22, size 112-24 line 3062 [ 262.503357][ T4379] binder: undelivered TRANSACTION_ERROR: 29201 [ 262.587832][T10749] FAULT_INJECTION: forcing a failure. [ 262.587832][T10749] name failslab, interval 1, probability 0, space 0, times 0 [ 262.592401][T10749] CPU: 1 PID: 10749 Comm: syz.3.1884 Not tainted syzkaller #0 [ 262.593824][T10749] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 262.595750][T10749] Call trace: [ 262.596391][T10749] dump_backtrace+0x1c4/0x1f0 [ 262.597278][T10749] show_stack+0x2c/0x3c [ 262.598074][T10749] __dump_stack+0x30/0x40 [ 262.598854][T10749] dump_stack_lvl+0xf4/0x15c [ 262.599698][T10749] dump_stack+0x1c/0x5c [ 262.600439][T10749] should_fail_ex+0x3cc/0x524 [ 262.601249][T10749] __should_failslab+0xc0/0x11c [ 262.602260][T10749] should_failslab+0x10/0x28 [ 262.603135][T10749] kmem_cache_alloc+0x88/0x310 [ 262.603997][T10749] security_inode_alloc+0x38/0x11c [ 262.604853][T10749] inode_init_always+0x6c8/0xb28 [ 262.605686][T10749] new_inode_pseudo+0x7c/0x1cc [ 262.606496][T10749] __sock_create+0x138/0x8a8 [ 262.607285][T10749] __sys_socket+0xc0/0x1b0 [ 262.608061][T10749] __arm64_sys_socket+0x7c/0x94 [ 262.608882][T10749] invoke_syscall+0x98/0x290 [ 262.609655][T10749] el0_svc_common+0x13c/0x258 [ 262.610481][T10749] do_el0_svc+0x5c/0x134 [ 262.611242][T10749] el0_svc+0x58/0x128 [ 262.611916][T10749] el0t_64_sync_handler+0x84/0xf0 [ 262.612792][T10749] el0t_64_sync+0x18c/0x190 [ 262.649836][T10749] socket: no more sockets [ 262.690478][T10754] fuse: Unknown parameter '0x0000000000000003' [ 262.740904][T10761] fuse: Unknown parameter 'user_id00000000000000000000' [ 262.860050][T10758] loop4: detected capacity change from 0 to 1024 [ 262.869359][T10774] binder: BINDER_SET_CONTEXT_MGR already set [ 262.870514][T10774] binder: 10772:10774 ioctl 4018620d 20000040 returned -16 [ 262.880356][T10774] binder: 10772:10774 got transaction to invalid handle, 1 [ 262.880860][T10758] EXT4-fs: Ignoring removed mblk_io_submit option [ 262.881762][T10774] binder: 10774:10772 cannot find target node [ 262.884161][T10774] binder: 10772:10774 transaction call to 0:0 failed 75/29201/-22, size 112-24 line 3062 [ 262.885964][T10758] EXT4-fs: Ignoring removed oldalloc option [ 262.886854][ T5908] binder: undelivered TRANSACTION_ERROR: 29201 [ 262.929275][T10758] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 263.041829][T10780] usb usb8: usbfs: process 10780 (syz.3.1892) did not claim interface 7 before use [ 263.264266][ T4335] EXT4-fs (loop4): unmounting filesystem. [ 263.507873][T10789] loop4: detected capacity change from 0 to 512 [ 263.523638][T10789] syz.4.1896: attempt to access beyond end of device [ 263.523638][T10789] loop4: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 263.569130][T10790] loop0: detected capacity change from 0 to 512 [ 263.581586][T10790] syz.0.1897: attempt to access beyond end of device [ 263.581586][T10790] loop0: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 263.770925][ T4333] Bluetooth: hci0: command 0x1003 tx timeout [ 263.773600][ T48] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 263.854292][T10796] fuse: Unknown parameter '0x0000000000000003' [ 263.857276][T10794] FAULT_INJECTION: forcing a failure. [ 263.857276][T10794] name failslab, interval 1, probability 0, space 0, times 0 [ 263.859631][T10794] CPU: 1 PID: 10794 Comm: syz.3.1899 Not tainted syzkaller #0 [ 263.860922][T10794] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 263.862589][T10794] Call trace: [ 263.863142][T10794] dump_backtrace+0x1c4/0x1f0 [ 263.864024][T10794] show_stack+0x2c/0x3c [ 263.864768][T10794] __dump_stack+0x30/0x40 [ 263.865545][T10794] dump_stack_lvl+0xf4/0x15c [ 263.866308][T10794] dump_stack+0x1c/0x5c [ 263.867015][T10794] should_fail_ex+0x3cc/0x524 [ 263.867808][T10794] __should_failslab+0xc0/0x11c [ 263.868643][T10794] should_failslab+0x10/0x28 [ 263.869488][T10794] slab_pre_alloc_hook+0x6c/0x31c [ 263.870412][T10794] kmem_cache_alloc_lru+0x60/0x284 [ 263.871319][T10794] sock_alloc_inode+0x2c/0xcc [ 263.872168][T10794] new_inode_pseudo+0x68/0x1cc [ 263.873046][T10794] __sock_create+0x138/0x8a8 [ 263.873874][T10794] __sys_socket+0xc0/0x1b0 [ 263.874673][T10794] __arm64_sys_socket+0x7c/0x94 [ 263.875558][T10794] invoke_syscall+0x98/0x290 [ 263.876385][T10794] el0_svc_common+0x13c/0x258 [ 263.877187][T10794] do_el0_svc+0x5c/0x134 [ 263.877954][T10794] el0_svc+0x58/0x128 [ 263.878628][T10794] el0t_64_sync_handler+0x84/0xf0 [ 263.879541][T10794] el0t_64_sync+0x18c/0x190 [ 263.941650][T10798] fuse: Unknown parameter 'user_id00000000000000000000' [ 263.954012][T10794] socket: no more sockets [ 264.547075][T10820] loop3: detected capacity change from 0 to 1024 [ 264.581173][T10820] EXT4-fs: Ignoring removed mblk_io_submit option [ 264.592611][T10820] EXT4-fs: Ignoring removed oldalloc option [ 264.675826][T10820] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 264.767470][ T4330] EXT4-fs (loop3): unmounting filesystem. [ 264.968901][ T2065] ieee802154 phy0 wpan0: encryption failed: -22 [ 264.970159][ T2065] ieee802154 phy1 wpan1: encryption failed: -22 [ 265.230696][T10854] fuse: Unknown parameter '0x0000000000000003' [ 265.336460][T10855] usb usb8: usbfs: process 10855 (syz.2.1910) did not claim interface 7 before use [ 265.654623][T10858] fuse: Unknown parameter 'user_id00000000000000000000' [ 266.233247][T10871] loop2: detected capacity change from 0 to 1024 [ 266.234736][T10871] EXT4-fs: Ignoring removed mblk_io_submit option [ 266.235852][T10871] EXT4-fs: Ignoring removed oldalloc option [ 266.396197][T10871] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 266.420324][T10881] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1919'. [ 266.485497][ T4340] EXT4-fs (loop2): unmounting filesystem. [ 266.829297][T10889] fuse: Unknown parameter '0x0000000000000003' [ 267.087112][T10905] input: syz0 as /devices/virtual/input/input40 [ 267.160688][T10909] loop4: detected capacity change from 0 to 1024 [ 267.164547][T10909] EXT4-fs: Ignoring removed mblk_io_submit option [ 267.166945][T10909] EXT4-fs: Ignoring removed oldalloc option [ 267.248233][T10909] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 267.342575][ T4335] EXT4-fs (loop4): unmounting filesystem. [ 267.407770][T10923] loop2: detected capacity change from 0 to 512 [ 267.424963][T10925] fuse: Unknown parameter '0x0000000000000003' [ 267.511632][T10923] syz.2.1930: attempt to access beyond end of device [ 267.511632][T10923] loop2: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 267.516816][T10930] binder: 10929:10930 ioctl c0306201 200003c0 returned -14 [ 267.523703][T10930] binder: 10929:10930 got transaction to invalid handle, 1 [ 267.524946][T10930] binder: 10930:10929 cannot find target node [ 267.526010][T10930] binder: 10929:10930 transaction call to 0:0 failed 79/29201/-22, size 112-24 line 3062 [ 267.534786][ T4407] binder: undelivered TRANSACTION_ERROR: 29201 [ 267.546893][T10932] FAULT_INJECTION: forcing a failure. [ 267.546893][T10932] name failslab, interval 1, probability 0, space 0, times 0 [ 267.552991][T10932] CPU: 0 PID: 10932 Comm: syz.0.1938 Not tainted syzkaller #0 [ 267.554362][T10932] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 267.556075][T10932] Call trace: [ 267.556633][T10932] dump_backtrace+0x1c4/0x1f0 [ 267.557459][T10932] show_stack+0x2c/0x3c [ 267.558166][T10932] __dump_stack+0x30/0x40 [ 267.558937][T10932] dump_stack_lvl+0xf4/0x15c [ 267.559719][T10932] dump_stack+0x1c/0x5c [ 267.560415][T10932] should_fail_ex+0x3cc/0x524 [ 267.561237][T10932] __should_failslab+0xc0/0x11c [ 267.562096][T10932] should_failslab+0x10/0x28 [ 267.562915][T10932] slab_pre_alloc_hook+0x6c/0x31c [ 267.563837][T10932] kmem_cache_alloc_lru+0x60/0x284 [ 267.564715][T10932] sock_alloc_inode+0x2c/0xcc [ 267.565549][T10932] new_inode_pseudo+0x68/0x1cc [ 267.566417][T10932] __sock_create+0x138/0x8a8 [ 267.567218][T10932] __sys_socket+0xc0/0x1b0 [ 267.567994][T10932] __arm64_sys_socket+0x7c/0x94 [ 267.568854][T10932] invoke_syscall+0x98/0x290 [ 267.569668][T10932] el0_svc_common+0x13c/0x258 [ 267.570486][T10932] do_el0_svc+0x5c/0x134 [ 267.571215][T10932] el0_svc+0x58/0x128 [ 267.571911][T10932] el0t_64_sync_handler+0x84/0xf0 [ 267.572781][T10932] el0t_64_sync+0x18c/0x190 [ 267.594731][T10932] socket: no more sockets [ 267.801469][T10943] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1942'. [ 268.131405][T10958] FAULT_INJECTION: forcing a failure. [ 268.131405][T10958] name failslab, interval 1, probability 0, space 0, times 0 [ 268.138991][T10958] CPU: 1 PID: 10958 Comm: syz.0.1950 Not tainted syzkaller #0 [ 268.140447][T10958] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 268.142386][T10958] Call trace: [ 268.142966][T10958] dump_backtrace+0x1c4/0x1f0 [ 268.143816][T10958] show_stack+0x2c/0x3c [ 268.144586][T10958] __dump_stack+0x30/0x40 [ 268.145313][T10958] dump_stack_lvl+0xf4/0x15c [ 268.146074][T10958] dump_stack+0x1c/0x5c [ 268.146801][T10958] should_fail_ex+0x3cc/0x524 [ 268.147651][T10958] __should_failslab+0xc0/0x11c [ 268.148512][T10958] should_failslab+0x10/0x28 [ 268.149358][T10958] slab_pre_alloc_hook+0x6c/0x31c [ 268.150257][T10958] kmem_cache_alloc_lru+0x60/0x284 [ 268.151180][T10958] sock_alloc_inode+0x2c/0xcc [ 268.152025][T10958] new_inode_pseudo+0x68/0x1cc [ 268.152886][T10958] __sock_create+0x138/0x8a8 [ 268.153734][T10958] __sys_socket+0xc0/0x1b0 [ 268.154572][T10958] __arm64_sys_socket+0x7c/0x94 [ 268.155443][T10958] invoke_syscall+0x98/0x290 [ 268.156268][T10958] el0_svc_common+0x13c/0x258 [ 268.157087][T10958] do_el0_svc+0x5c/0x134 [ 268.157871][T10958] el0_svc+0x58/0x128 [ 268.158605][T10958] el0t_64_sync_handler+0x84/0xf0 [ 268.159529][T10958] el0t_64_sync+0x18c/0x190 [ 268.160378][ C1] vkms_vblank_simulate: vblank timer overrun [ 268.171749][T10959] binder: 10957:10959 ioctl c0306201 200003c0 returned -14 [ 268.176748][T10959] binder: 10957:10959 got transaction to invalid handle, 1 [ 268.183677][T10959] binder: 10959:10957 cannot find target node [ 268.186233][T10959] binder: 10957:10959 transaction call to 0:0 failed 83/29201/-22, size 112-24 line 3062 [ 268.196414][ T4375] binder: undelivered TRANSACTION_ERROR: 29201 [ 268.248740][T10962] fuse: Unknown parameter '0x0000000000000003' [ 268.259727][T10958] socket: no more sockets [ 268.431164][T10969] FAULT_INJECTION: forcing a failure. [ 268.431164][T10969] name fail_futex, interval 1, probability 0, space 0, times 0 [ 268.435615][T10969] CPU: 0 PID: 10969 Comm: syz.4.1954 Not tainted syzkaller #0 [ 268.436912][T10969] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 268.438579][T10969] Call trace: [ 268.439131][T10969] dump_backtrace+0x1c4/0x1f0 [ 268.439975][T10969] show_stack+0x2c/0x3c [ 268.440769][T10969] __dump_stack+0x30/0x40 [ 268.441559][T10969] dump_stack_lvl+0xf4/0x15c [ 268.442400][T10969] dump_stack+0x1c/0x5c [ 268.443183][T10969] should_fail_ex+0x3cc/0x524 [ 268.443998][T10969] should_fail+0x14/0x24 [ 268.444866][T10969] get_futex_key+0x904/0xfb0 [ 268.445881][T10969] futex_wait_setup+0xbc/0x320 [ 268.446829][T10969] futex_wait+0x164/0x424 [ 268.447728][T10969] do_futex+0x2e8/0x340 [ 268.448483][T10969] __arm64_sys_futex+0x390/0x414 [ 268.449421][T10969] invoke_syscall+0x98/0x290 [ 268.450224][T10969] el0_svc_common+0x13c/0x258 [ 268.451081][T10969] do_el0_svc+0x5c/0x134 [ 268.451812][T10969] el0_svc+0x58/0x128 [ 268.452487][T10969] el0t_64_sync_handler+0x84/0xf0 [ 268.453379][T10969] el0t_64_sync+0x18c/0x190 [ 269.137261][T10991] fuse: Unknown parameter 'fd0x0000000000000003' [ 269.210418][T10994] FAULT_INJECTION: forcing a failure. [ 269.210418][T10994] name failslab, interval 1, probability 0, space 0, times 0 [ 269.213251][T10995] binder: 10993:10995 ioctl c0306201 200003c0 returned -14 [ 269.214744][T10995] binder: 10993:10995 got transaction to invalid handle, 1 [ 269.215230][T10994] CPU: 0 PID: 10994 Comm: syz.4.1964 Not tainted syzkaller #0 [ 269.216040][T10995] binder: 10995:10993 cannot find target node [ 269.217431][T10994] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 269.217447][T10994] Call trace: [ 269.217452][T10994] dump_backtrace+0x1c4/0x1f0 [ 269.221731][T10994] show_stack+0x2c/0x3c [ 269.222487][T10994] __dump_stack+0x30/0x40 [ 269.223283][T10994] dump_stack_lvl+0xf4/0x15c [ 269.224240][T10994] dump_stack+0x1c/0x5c [ 269.225114][T10994] should_fail_ex+0x3cc/0x524 [ 269.226068][T10994] __should_failslab+0xc0/0x11c [ 269.227068][T10994] should_failslab+0x10/0x28 [ 269.227948][T10994] slab_pre_alloc_hook+0x6c/0x31c [ 269.228924][T10994] kmem_cache_alloc_lru+0x60/0x284 [ 269.229398][T10995] binder: 10993:10995 transaction call to 0:0 failed 87/29201/-22, size 112-24 line 3062 [ 269.229990][T10994] sock_alloc_inode+0x2c/0xcc [ 269.232760][T10994] new_inode_pseudo+0x68/0x1cc [ 269.233145][ T4375] binder: undelivered TRANSACTION_ERROR: 29201 [ 269.233728][T10994] __sock_create+0x138/0x8a8 [ 269.233746][T10994] __sys_socket+0xc0/0x1b0 [ 269.236453][T10994] __arm64_sys_socket+0x7c/0x94 [ 269.237364][T10994] invoke_syscall+0x98/0x290 [ 269.238212][T10994] el0_svc_common+0x13c/0x258 [ 269.239075][T10994] do_el0_svc+0x5c/0x134 [ 269.239863][T10994] el0_svc+0x58/0x128 [ 269.240615][T10994] el0t_64_sync_handler+0x84/0xf0 [ 269.241465][T10994] el0t_64_sync+0x18c/0x190 [ 269.305424][T10994] socket: no more sockets [ 269.557510][T11010] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1969'. [ 269.561285][T11009] fuse: Unknown parameter '0x0000000000000003' [ 269.675881][T11017] fuse: Unknown parameter 'fd0x0000000000000003' [ 269.883809][T11021] binder: 11020:11021 ioctl c0306201 200003c0 returned -14 [ 269.893109][T11021] binder: 11020:11021 got transaction to invalid handle, 1 [ 269.894496][T11021] binder: 11021:11020 cannot find target node [ 270.043902][T11036] fuse: Unknown parameter '0x0000000000000003' [ 270.064691][T11038] fuse: Unknown parameter 'fd0x0000000000000003' [ 270.178183][T11048] binder: 11047:11048 ioctl c0306201 20000080 returned -14 [ 270.180325][T11048] binder: 11047:11048 ioctl c0306201 200003c0 returned -14 [ 270.181872][T11048] binder: 11047:11048 got transaction to invalid handle, 1 [ 270.303262][T11051] loop0: detected capacity change from 0 to 512 [ 270.802836][T11051] syz.0.1985: attempt to access beyond end of device [ 270.802836][T11051] loop0: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 271.355409][T11062] fuse: Unknown parameter '0x0000000000000003' [ 271.487366][T11070] input: syz0 as /devices/virtual/input/input41 [ 271.515493][T11073] binder: 11072:11073 ioctl c0306201 20000080 returned -14 [ 271.519575][T11073] binder: 11072:11073 ioctl c0306201 200003c0 returned -14 [ 271.526138][T11073] binder: 11072:11073 got transaction to invalid handle, 1 [ 271.638235][T11080] netlink: 32 bytes leftover after parsing attributes in process `syz.5.2000'. [ 271.898689][T11093] fuse: Unknown parameter '0x0000000000000003' [ 272.137071][T11104] loop2: detected capacity change from 0 to 512 [ 272.167238][T11104] syz.2.2008: attempt to access beyond end of device [ 272.167238][T11104] loop2: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 273.310259][T11112] binder: 11111:11112 ioctl c0306201 20000080 returned -14 [ 273.324583][T11112] binder: 11111:11112 ioctl c0306201 200003c0 returned -14 [ 273.325987][T11112] binder: 11111:11112 got transaction to invalid handle, 1 [ 273.327168][T11112] binder_debug: 8 callbacks suppressed [ 273.327181][T11112] binder: 11112:11111 cannot find target node [ 273.338997][T11112] binder: 11111:11112 transaction call to 0:0 failed 100/29201/-22, size 112-24 line 3062 [ 273.341091][ T4407] binder: undelivered TRANSACTION_ERROR: 29201 [ 273.608666][T11131] netlink: 32 bytes leftover after parsing attributes in process `syz.5.2020'. [ 273.812447][T11142] loop4: detected capacity change from 0 to 512 [ 273.971567][T11142] syz.4.2021: attempt to access beyond end of device [ 273.971567][T11142] loop4: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 274.890638][T11144] binder: 11143:11144 ioctl c0306201 20000080 returned -14 [ 274.938837][T11144] binder: 11143:11144 ioctl 4018620d 0 returned -22 [ 274.949090][T11144] binder: 11143:11144 ioctl c0306201 200003c0 returned -14 [ 274.950529][T11144] binder: 11143:11144 got transaction to invalid handle, 1 [ 274.951747][T11144] binder: 11144:11143 cannot find target node [ 274.952736][T11144] binder: 11143:11144 transaction call to 0:0 failed 103/29201/-22, size 112-24 line 3062 [ 274.969994][ T5908] binder: undelivered TRANSACTION_ERROR: 29201 [ 275.086626][T11157] fuse: Unknown parameter 'fd0x0000000000000003' [ 275.594899][T11176] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2035'. [ 275.733861][T11179] loop4: detected capacity change from 0 to 512 [ 276.115451][T11179] syz.4.2038: attempt to access beyond end of device [ 276.115451][T11179] loop4: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 276.523925][T11183] binder: 11181:11183 ioctl c0306201 20000080 returned -14 [ 276.539889][T11183] binder: 11181:11183 ioctl 4018620d 0 returned -22 [ 276.541250][T11183] binder: 11181:11183 ioctl c0306201 200003c0 returned -14 [ 276.542583][T11183] binder: 11181:11183 got transaction to invalid handle, 1 [ 276.554792][T11183] binder: 11183:11181 cannot find target node [ 276.555893][T11183] binder: 11181:11183 transaction call to 0:0 failed 106/29201/-22, size 112-24 line 3062 [ 276.592534][ T4375] binder: undelivered TRANSACTION_ERROR: 29201 [ 277.331198][T11208] loop5: detected capacity change from 0 to 4096 [ 277.366577][T11208] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 277.851823][T11219] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2050'. [ 278.062560][T11223] binder: 11222:11223 ioctl c0306201 20000080 returned -14 [ 278.065421][T11223] binder: 11222:11223 ioctl 4018620d 0 returned -22 [ 278.066967][T11223] binder: 11222:11223 ioctl c0306201 200003c0 returned -14 [ 278.068549][T11223] binder: 11222:11223 got transaction to invalid handle, 1 [ 278.069948][T11223] binder: 11223:11222 cannot find target node [ 278.283673][T11232] loop3: detected capacity change from 0 to 512 [ 278.315867][T11232] syz.3.2054: attempt to access beyond end of device [ 278.315867][T11232] loop3: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 279.043260][ T5837] EXT4-fs (loop5): unmounting filesystem. [ 279.260648][T11245] loop2: detected capacity change from 0 to 256 [ 279.392279][T11252] input: syz0 as /devices/virtual/input/input42 [ 279.741527][T11260] binder: 11259:11260 ioctl c0306201 20000080 returned -14 [ 279.749510][T11260] binder: 11259:11260 ioctl c0306201 0 returned -14 [ 279.752717][T11260] binder: 11259:11260 got transaction to invalid handle, 1 [ 279.755927][T11260] binder_debug: 2 callbacks suppressed [ 279.755940][T11260] binder: 11260:11259 cannot find target node [ 279.759415][T11260] binder: 11259:11260 transaction call to 0:0 failed 113/29201/-22, size 112-24 line 3062 [ 279.763530][ T5908] binder: undelivered TRANSACTION_ERROR: 29201 [ 280.039158][T11269] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2068'. [ 281.060923][T11289] loop4: detected capacity change from 0 to 512 [ 281.970549][T11289] syz.4.2072: attempt to access beyond end of device [ 281.970549][T11289] loop4: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 282.213125][T11295] binder: 11294:11295 ioctl c0306201 20000080 returned -14 [ 282.233276][T11295] binder: 11294:11295 ioctl c0306201 0 returned -14 [ 282.234707][T11295] binder: 11294:11295 got transaction to invalid handle, 1 [ 282.235963][T11295] binder: 11295:11294 cannot find target node [ 282.237052][T11295] binder: 11294:11295 transaction call to 0:0 failed 117/29201/-22, size 112-24 line 3062 [ 282.252092][ T4378] binder: undelivered TRANSACTION_ERROR: 29201 [ 282.272054][T11301] loop2: detected capacity change from 0 to 256 [ 282.273663][T11301] FAT-fs (loop2): Unrecognized mount option "shortna򇇥T" or missing value [ 282.352364][ T7671] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 282.831532][T11313] loop5: detected capacity change from 0 to 512 [ 282.889998][T11313] syz.5.2081: attempt to access beyond end of device [ 282.889998][T11313] loop5: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 283.781220][T11330] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2088'. [ 283.880762][T11338] binder: 11336:11338 ioctl c0306201 20000080 returned -14 [ 283.885752][T11338] binder: 11336:11338 ioctl c0306201 0 returned -14 [ 283.888023][T11338] binder: 11336:11338 got transaction to invalid handle, 1 [ 283.889525][T11338] binder: 11338:11336 cannot find target node [ 283.893804][T11338] binder: 11336:11338 transaction call to 0:0 failed 121/29201/-22, size 112-24 line 3062 [ 283.896180][ T4378] binder: undelivered TRANSACTION_ERROR: 29201 [ 285.369123][T11402] binder: 11401:11402 ioctl c0306201 20000080 returned -14 [ 285.372167][T11402] binder: 11401:11402 got transaction to invalid handle, 1 [ 285.375382][T11402] binder: 11402:11401 cannot find target node [ 285.376674][T11402] binder: 11401:11402 transaction call to 0:0 failed 125/29201/-22, size 112-24 line 3062 [ 285.378899][ T4407] binder: undelivered TRANSACTION_ERROR: 29201 [ 285.478385][T11407] loop2: detected capacity change from 0 to 512 [ 285.482204][T11407] syz.2.2102: attempt to access beyond end of device [ 285.482204][T11407] loop2: rw=0, sector=1022032, nr_sectors = 8 limit=512 P- [ 286.243080][T11449] input: syz0 as /devices/virtual/input/input43 [ 286.271939][T11455] binder: 11454:11455 ioctl c0306201 20000080 returned -14 [ 286.279572][T11455] binder: 11454:11455 got transaction to invalid handle, 1 [ 286.282080][T11455] binder: 11455:11454 cannot find target node [ 286.284435][T11455] binder: 11454:11455 transaction call to 0:0 failed 129/29201/-22, size 112-24 line 3062 [ 286.288876][ T4407] binder: undelivered TRANSACTION_ERROR: 29201 [ 287.568889][T11487] binder: 11486:11487 ioctl c0306201 20000080 returned -14 [ 287.573918][T11487] binder: 11486:11487 got transaction to invalid handle, 1 [ 287.578688][T11487] binder: 11487:11486 cannot find target node [ 287.581029][T11487] binder: 11486:11487 transaction call to 0:0 failed 133/29201/-22, size 112-24 line 3062 [ 287.585577][ T4378] binder: undelivered TRANSACTION_ERROR: 29201 [ 287.830791][T11498] loop4: detected capacity change from 0 to 512 [ 287.841678][T11498] syz.4.2128: attempt to access beyond end of device [ 287.841678][T11498] loop4: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 288.778968][T11521] binder: 11520:11521 ioctl c0306201 20000080 returned -14 [ 288.781992][T11521] binder: 11520:11521 got transaction to invalid handle, 1 [ 288.783532][T11521] binder: 11521:11520 cannot find target node [ 288.903815][T11528] device syzkaller0 entered promiscuous mode [ 288.991550][T11534] loop0: detected capacity change from 0 to 4096 [ 288.994597][T11534] EXT4-fs: inline encryption not supported [ 289.011273][T11534] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 289.013156][T11534] EXT4-fs (loop0): Test dummy encryption mode enabled [ 289.044358][T11534] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 289.206966][ T4334] EXT4-fs (loop0): unmounting filesystem. [ 289.249968][T11546] input: syz0 as /devices/virtual/input/input44 [ 289.368575][T11555] binder: 11554:11555 ioctl c0306201 20000080 returned -14 [ 289.375320][T11555] binder: 11554:11555 got transaction to invalid handle, 1 [ 289.719075][T11570] FAULT_INJECTION: forcing a failure. [ 289.719075][T11570] name fail_futex, interval 1, probability 0, space 0, times 0 [ 289.720722][T11572] device syzkaller0 entered promiscuous mode [ 289.725139][T11570] CPU: 0 PID: 11570 Comm: syz.4.2159 Not tainted syzkaller #0 [ 289.726480][T11570] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 289.728351][T11570] Call trace: [ 289.728980][T11570] dump_backtrace+0x1c4/0x1f0 [ 289.729928][T11570] show_stack+0x2c/0x3c [ 289.730687][T11570] __dump_stack+0x30/0x40 [ 289.731475][T11570] dump_stack_lvl+0xf4/0x15c [ 289.732314][T11570] dump_stack+0x1c/0x5c [ 289.733087][T11570] should_fail_ex+0x3cc/0x524 [ 289.733889][T11570] should_fail+0x14/0x24 [ 289.734594][T11570] get_futex_key+0x904/0xfb0 [ 289.735372][T11570] futex_wake+0x10c/0x458 [ 289.736114][T11570] do_futex+0x2c4/0x340 [ 289.736813][T11570] __arm64_sys_futex+0x390/0x414 [ 289.737674][T11570] invoke_syscall+0x98/0x290 [ 289.738482][T11570] el0_svc_common+0x13c/0x258 [ 289.739322][T11570] do_el0_svc+0x5c/0x134 [ 289.740146][T11570] el0_svc+0x58/0x128 [ 289.740847][T11570] el0t_64_sync_handler+0x84/0xf0 [ 289.741693][T11570] el0t_64_sync+0x18c/0x190 [ 290.023401][T11588] binder: 11587:11588 ioctl c0306201 20000080 returned -14 [ 290.029104][T11588] binder: 11587:11588 got transaction to invalid handle, 1 [ 290.590754][T11613] device syzkaller0 entered promiscuous mode [ 290.827675][T11621] binder: 11620:11621 ioctl c0306201 20000080 returned -14 [ 290.835565][T11621] binder: 11620:11621 tried to acquire reference to desc 0, got 1 instead [ 290.842237][T11621] binder: 11620:11621 ioctl c0306201 200003c0 returned -14 [ 290.847166][T11621] binder: 11620:11621 ioctl c0306201 0 returned -14 [ 290.995138][T11635] loop3: detected capacity change from 0 to 256 [ 290.997238][T11635] FAT-fs (loop3): Directory bread(block 1285) failed [ 290.998604][T11635] FAT-fs (loop3): Directory bread(block 1286) failed [ 291.000090][T11635] FAT-fs (loop3): Directory bread(block 1287) failed [ 291.001444][T11635] FAT-fs (loop3): Directory bread(block 1288) failed [ 291.184054][T11637] FAT-fs (loop3): Directory bread(block 1285) failed [ 291.185842][T11637] FAT-fs (loop3): Directory bread(block 1286) failed [ 291.187268][T11637] FAT-fs (loop3): Directory bread(block 1287) failed [ 291.188645][T11637] FAT-fs (loop3): Directory bread(block 1288) failed [ 291.191898][T11637] FAT-fs (loop3): FAT read failed (blocknr 1281) [ 291.411786][T11639] loop2: detected capacity change from 0 to 1024 [ 291.491212][T11639] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 291.808790][ T4340] EXT4-fs (loop2): unmounting filesystem. [ 291.884499][T11652] device syzkaller0 entered promiscuous mode [ 291.935122][T11655] binder: 11654:11655 ioctl c0306201 20000080 returned -14 [ 291.937997][T11655] binder: 11654:11655 tried to acquire reference to desc 0, got 1 instead [ 291.939757][T11655] binder: 11654:11655 ioctl c0306201 200003c0 returned -14 [ 291.941676][T11655] binder: 11654:11655 ioctl c0306201 0 returned -14 [ 292.588925][T11691] loop4: detected capacity change from 0 to 512 [ 292.690237][T11691] syz.4.2202: attempt to access beyond end of device [ 292.690237][T11691] loop4: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 293.346866][T11690] input: syz0 as /devices/virtual/input/input45 [ 293.403752][T11693] binder: 11692:11693 ioctl c0306201 20000080 returned -14 [ 293.414537][T11693] binder: 11692:11693 tried to acquire reference to desc 0, got 1 instead [ 293.430993][T11693] binder: 11692:11693 ioctl c0306201 200003c0 returned -14 [ 293.432453][T11693] binder: 11692:11693 ioctl c0306201 0 returned -14 [ 293.624623][T11703] device syzkaller0 entered promiscuous mode [ 293.777432][T11716] loop3: detected capacity change from 0 to 256 [ 293.894865][T11721] device syzkaller0 entered promiscuous mode [ 294.205045][T11721] tipc: Started in network mode [ 294.206135][T11721] tipc: Node identity 36a1b6e1e82e, cluster identity 4711 [ 294.208774][T11721] tipc: Enabled bearer , priority 0 [ 294.213615][T11720] tipc: Resetting bearer [ 294.411279][T11720] tipc: Disabling bearer [ 294.662563][T11731] binder: 11730:11731 ioctl c0306201 20000080 returned -14 [ 294.665449][T11731] binder: 11730:11731 tried to acquire reference to desc 0, got 1 instead [ 294.667563][T11731] binder: 11730:11731 ioctl c0306201 200003c0 returned -14 [ 294.909518][T11739] loop2: detected capacity change from 0 to 512 [ 295.208435][T11739] syz.2.2218: attempt to access beyond end of device [ 295.208435][T11739] loop2: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 296.067906][T11755] device syzkaller0 entered promiscuous mode [ 296.744057][T11775] binder: 11774:11775 ioctl c0306201 20000080 returned -14 [ 296.747971][T11775] binder: 11774:11775 tried to acquire reference to desc 0, got 1 instead [ 296.749544][T11775] binder: 11774:11775 ioctl c0306201 200003c0 returned -14 [ 297.099537][T11796] loop0: detected capacity change from 0 to 512 [ 297.657628][T11796] syz.0.2235: attempt to access beyond end of device [ 297.657628][T11796] loop0: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 298.071423][T11801] input: syz0 as /devices/virtual/input/input46 [ 298.137894][T11805] device syzkaller0 entered promiscuous mode [ 298.920199][T11832] syz.2.2248 (11832): drop_caches: 2 [ 299.892709][T11852] loop0: detected capacity change from 0 to 512 [ 299.965359][T11852] syz.0.2253: attempt to access beyond end of device [ 299.965359][T11852] loop0: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 301.047046][T11863] device syzkaller0 entered promiscuous mode [ 301.485986][T11894] loop5: detected capacity change from 0 to 512 [ 301.654317][T11894] syz.5.2266: attempt to access beyond end of device [ 301.654317][T11894] loop5: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 302.355094][T11899] loop4: detected capacity change from 0 to 256 [ 302.836278][T11909] binder: 11908:11909 ioctl c0306201 20000080 returned -14 [ 302.844225][T11909] binder: 11908:11909 tried to acquire reference to desc 0, got 1 instead [ 302.848549][T11909] binder: 11908:11909 ioctl c0306201 200003c0 returned -14 [ 302.854894][T11910] syz.5.2270 (11910): drop_caches: 2 [ 303.208859][T11924] device syzkaller0 entered promiscuous mode [ 303.983104][T11941] loop3: detected capacity change from 0 to 512 [ 304.977942][T11936] syz.3.2280: attempt to access beyond end of device [ 304.977942][T11936] loop3: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 305.112652][T11953] input: syz0 as /devices/virtual/input/input47 [ 305.619173][T11965] device syzkaller0 entered promiscuous mode [ 305.990871][T11973] loop2: detected capacity change from 0 to 256 [ 306.019916][T11974] syz.0.2291 (11974): drop_caches: 2 [ 306.094311][T11976] binder: 11975:11976 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 306.942299][T12001] device syzkaller0 entered promiscuous mode [ 307.679052][T12032] syz.4.2310 (12032): drop_caches: 2 [ 308.260347][T12052] device syz_tun entered promiscuous mode [ 308.829522][T12062] device syzkaller0 entered promiscuous mode [ 309.398126][T12076] input: syz0 as /devices/virtual/input/input48 [ 309.909097][T12098] FAULT_INJECTION: forcing a failure. [ 309.909097][T12098] name fail_futex, interval 1, probability 0, space 0, times 0 [ 309.919391][T12098] CPU: 1 PID: 12098 Comm: syz.0.2332 Not tainted syzkaller #0 [ 309.920810][T12098] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 309.922558][T12098] Call trace: [ 309.923115][T12098] dump_backtrace+0x1c4/0x1f0 [ 309.924076][T12098] show_stack+0x2c/0x3c [ 309.924859][T12098] __dump_stack+0x30/0x40 [ 309.925648][T12098] dump_stack_lvl+0xf4/0x15c [ 309.926545][T12098] dump_stack+0x1c/0x5c [ 309.927279][T12098] should_fail_ex+0x3cc/0x524 [ 309.928102][T12098] should_fail+0x14/0x24 [ 309.928961][T12098] get_futex_key+0x904/0xfb0 [ 309.929773][T12098] futex_wake+0x10c/0x458 [ 309.930530][T12098] do_futex+0x2c4/0x340 [ 309.931256][T12098] __arm64_sys_futex+0x390/0x414 [ 309.932123][T12098] invoke_syscall+0x98/0x290 [ 309.932947][T12098] el0_svc_common+0x13c/0x258 [ 309.933744][T12098] do_el0_svc+0x5c/0x134 [ 309.934494][T12098] el0_svc+0x58/0x128 [ 309.935161][T12098] el0t_64_sync_handler+0x84/0xf0 [ 309.936018][T12098] el0t_64_sync+0x18c/0x190 [ 309.971409][T12100] syz.3.2331 (12100): drop_caches: 2 [ 310.212148][T12104] loop0: detected capacity change from 0 to 256 [ 310.215559][T12104] FAT-fs (loop0): Unrecognized mount option "dosxfloppy" or missing value [ 312.190156][T12131] loop5: detected capacity change from 0 to 256 [ 312.530447][T12145] Soft offlining pfn 0x13df56 at process virtual address 0x20000000 [ 312.537305][T12145] Soft offlining pfn 0x145b57 at process virtual address 0x20001000 [ 312.538800][T12145] Soft offlining pfn 0x1465a8 at process virtual address 0x20002000 [ 313.144272][T12154] loop4: detected capacity change from 0 to 256 [ 313.147833][T12154] FAT-fs (loop4): Unrecognized mount option "dosxfloppy" or missing value [ 314.171561][T12158] syz.3.2349 (12158): drop_caches: 2 [ 314.532497][T12173] loop4: detected capacity change from 0 to 512 [ 314.536303][T12177] loop5: detected capacity change from 0 to 256 [ 314.608724][T12173] syz.4.2350: attempt to access beyond end of device [ 314.608724][T12173] loop4: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 314.675736][T12181] device syzkaller0 entered promiscuous mode [ 314.851026][T12189] tipc: Started in network mode [ 314.852010][T12189] tipc: Node identity 72de431ac7d6, cluster identity 4711 [ 315.181570][T12189] tipc: Enabled bearer , priority 0 [ 315.197225][T12180] tipc: Resetting bearer [ 315.386262][T12180] tipc: Disabling bearer [ 315.487802][T12198] loop3: detected capacity change from 0 to 512 [ 315.517573][T12198] syz.3.2362: attempt to access beyond end of device [ 315.517573][T12198] loop3: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 316.378642][T12202] input: syz0 as /devices/virtual/input/input49 [ 316.717437][T12215] loop3: detected capacity change from 0 to 256 [ 316.951886][T12224] syz.0.2372 (12224): drop_caches: 2 [ 317.119045][T12228] device syzkaller0 entered promiscuous mode [ 317.195209][T12228] tipc: Started in network mode [ 317.196158][T12228] tipc: Node identity 06af3a339b1b, cluster identity 4711 [ 317.197515][T12228] tipc: Enabled bearer , priority 0 [ 317.199474][T12227] tipc: Resetting bearer [ 317.374933][T12227] tipc: Disabling bearer [ 317.796765][T12238] loop3: detected capacity change from 0 to 512 [ 317.960024][T12238] syz.3.2376: attempt to access beyond end of device [ 317.960024][T12238] loop3: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 319.050548][T12250] loop5: detected capacity change from 0 to 512 [ 320.005048][T12250] syz.5.2390: attempt to access beyond end of device [ 320.005048][T12250] loop5: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 320.932123][T12264] tipc: Enabled bearer , priority 0 [ 320.965474][T12272] device syzkaller0 entered promiscuous mode [ 320.978130][T12263] tipc: Resetting bearer [ 321.084511][T12263] tipc: Disabling bearer [ 321.297991][T12300] loop3: detected capacity change from 0 to 8192 [ 321.313275][T12300] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 321.355384][T12300] netlink: 32 bytes leftover after parsing attributes in process `syz.3.2393'. [ 322.552622][T12319] loop5: detected capacity change from 0 to 512 [ 322.594076][T12319] syz.5.2396: attempt to access beyond end of device [ 322.594076][T12319] loop5: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 323.587345][T12327] loop0: detected capacity change from 0 to 512 [ 323.656354][T12327] syz.0.2395: attempt to access beyond end of device [ 323.656354][T12327] loop0: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 323.924802][T12352] device syzkaller0 entered promiscuous mode [ 323.962356][T12352] tipc: Enabled bearer , priority 0 [ 323.970042][T12351] tipc: Resetting bearer [ 324.152404][T12351] tipc: Disabling bearer [ 324.517872][T12384] netlink: 'syz.2.2409': attribute type 1 has an invalid length. [ 324.537186][T12384] 8021q: adding VLAN 0 to HW filter on device bond1 [ 324.595421][T12384] bond1: (slave gretap1): Enslaving as a backup interface with an up link [ 324.629305][T12384] bond1: (slave dummy0): Enslaving as a backup interface with an up link [ 324.639412][T12384] netlink: 'syz.2.2409': attribute type 10 has an invalid length. [ 324.641080][T12384] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2409'. [ 324.642772][T12384] device dummy0 entered promiscuous mode [ 324.644576][ T4391] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 324.648319][T12384] bond1: (slave dummy0): Releasing backup interface [ 324.691824][ T5532] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 324.783030][ T5519] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 324.924874][T12402] loop2: detected capacity change from 0 to 512 [ 325.511889][T12402] syz.2.2412: attempt to access beyond end of device [ 325.511889][T12402] loop2: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 325.902205][T12408] syz.3.2415 (12408): drop_caches: 2 [ 326.138587][T12418] device syzkaller0 entered promiscuous mode [ 326.240576][T12429] loop4: detected capacity change from 0 to 256 [ 326.244004][T12429] FAT-fs (loop4): Unrecognized mount option "dosxfloppy" or missing value [ 327.254829][T12418] tipc: Enabled bearer , priority 0 [ 327.273082][ T4321] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 327.301202][T12417] tipc: Resetting bearer [ 327.739215][T12417] tipc: Disabling bearer [ 327.749502][T12452] syz.4.2428 (12452): drop_caches: 2 [ 327.996277][T12468] loop4: detected capacity change from 0 to 512 [ 328.185143][T12468] syz.4.2429: attempt to access beyond end of device [ 328.185143][T12468] loop4: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 329.306215][T12496] syz.2.2440 (12496): drop_caches: 2 [ 329.396895][T12499] loop0: detected capacity change from 0 to 256 [ 329.400363][T12499] FAT-fs (loop0): Unrecognized mount option "dosxfloppy" or missing value [ 330.684385][ T2065] ieee802154 phy0 wpan0: encryption failed: -22 [ 330.687095][ T2065] ieee802154 phy1 wpan1: encryption failed: -22 [ 331.072279][T12527] loop4: detected capacity change from 0 to 512 [ 331.191747][T12527] syz.4.2447: attempt to access beyond end of device [ 331.191747][T12527] loop4: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 331.992110][T12533] input: syz0 as /devices/virtual/input/input53 [ 332.244588][T12546] loop3: detected capacity change from 0 to 512 [ 332.277620][T12547] syz.5.2457 (12547): drop_caches: 2 [ 332.324898][T12546] syz.3.2448: attempt to access beyond end of device [ 332.324898][T12546] loop3: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 332.575808][ T48] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 332.577563][ T4333] Bluetooth: hci0: command 0x1003 tx timeout [ 333.175478][T12576] input: syz0 as /devices/virtual/input/input54 [ 333.907590][T12605] syz.3.2477 (12605): drop_caches: 2 [ 333.940247][T12606] loop4: detected capacity change from 0 to 512 [ 333.943496][T12606] syz.4.2474: attempt to access beyond end of device [ 333.943496][T12606] loop4: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 334.720673][T12616] input: syz0 as /devices/virtual/input/input55 [ 335.441094][ T48] Bluetooth: hci0: command 0x1003 tx timeout [ 335.443637][ T4336] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 335.538346][T12671] syz.2.2491 (12671): drop_caches: 2 [ 335.587322][T12674] input: syz0 as /devices/virtual/input/input56 [ 335.680653][T12676] loop0: detected capacity change from 0 to 512 [ 335.683967][T12676] syz.0.2493: attempt to access beyond end of device [ 335.683967][T12676] loop0: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 337.288449][T12723] syz.0.2507 (12723): drop_caches: 2 [ 337.867332][T12746] loop4: detected capacity change from 0 to 512 [ 337.884477][T12746] syz.4.2511: attempt to access beyond end of device [ 337.884477][T12746] loop4: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 338.096843][T12748] netlink: 'syz.3.2512': attribute type 1 has an invalid length. [ 338.124178][T12748] 8021q: adding VLAN 0 to HW filter on device bond1 [ 338.162614][T12748] bond1: (slave gretap1): Enslaving as a backup interface with an up link [ 338.231014][ T6135] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 338.265654][T12748] netlink: 'syz.3.2512': attribute type 10 has an invalid length. [ 338.267004][T12748] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2512'. [ 338.268586][T12748] device dummy0 entered promiscuous mode [ 338.269940][ T6143] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 338.315199][T12754] loop5: detected capacity change from 0 to 256 [ 338.349150][ T6135] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 339.009260][T12775] syz.3.2523 (12775): drop_caches: 2 [ 339.036317][T12777] input: syz0 as /devices/virtual/input/input57 [ 339.203812][ T48] Bluetooth: hci0: command 0x1003 tx timeout [ 339.206648][ T4336] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 339.371071][T12782] netlink: 'syz.0.2527': attribute type 1 has an invalid length. [ 339.386437][T12782] 8021q: adding VLAN 0 to HW filter on device bond1 [ 339.454637][T12782] bond1: (slave gretap1): Enslaving as a backup interface with an up link [ 339.465170][T12782] netlink: 'syz.0.2527': attribute type 10 has an invalid length. [ 339.470197][T12782] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2527'. [ 339.475011][T12782] device dummy0 entered promiscuous mode [ 339.492937][ T6143] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 339.496465][ T5175] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 339.621647][ T5175] bond1: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 339.625769][T12793] loop2: detected capacity change from 0 to 256 [ 340.587681][T12848] loop2: detected capacity change from 0 to 512 [ 341.628448][T12843] syz.2.2541: attempt to access beyond end of device [ 341.628448][T12843] loop2: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 341.702611][T12858] loop3: detected capacity change from 0 to 256 [ 341.731591][T12859] syz.4.2546 (12859): drop_caches: 2 [ 342.255401][T12880] loop2: detected capacity change from 0 to 512 [ 342.278542][T12880] syz.2.2554: attempt to access beyond end of device [ 342.278542][T12880] loop2: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 343.357869][T12891] loop0: detected capacity change from 0 to 32768 [ 343.386200][T12891] loop0: [POWERTEC] p1 p2 p3 [ 343.387072][T12891] loop0: p1 start 1768846639 is beyond EOD, truncated [ 343.388275][T12891] loop0: p2 start 1056964608 is beyond EOD, truncated [ 343.389468][T12891] loop0: p3 start 3242065920 is beyond EOD, truncated [ 343.558794][T12898] loop5: detected capacity change from 0 to 256 [ 343.816465][T12908] loop4: detected capacity change from 0 to 512 [ 343.839313][T12908] syz.4.2561: attempt to access beyond end of device [ 343.839313][T12908] loop4: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 343.908987][T12911] syz.5.2565 (12911): drop_caches: 2 [ 344.777551][T12920] input: syz0 as /devices/virtual/input/input58 [ 345.142060][T12870] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 345.572731][T12932] loop3: detected capacity change from 0 to 256 [ 345.957084][T12947] syz.3.2578 (12947): drop_caches: 2 [ 346.100491][T12952] loop2: detected capacity change from 0 to 512 [ 346.164364][T12952] syz.2.2577: attempt to access beyond end of device [ 346.164364][T12952] loop2: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 347.332667][T12982] loop4: detected capacity change from 0 to 512 [ 347.369211][T12982] syz.4.2590: attempt to access beyond end of device [ 347.369211][T12982] loop4: rw=0, sector=1022032, nr_sectors = 8 limit=512 [ 347.989770][T12989] netlink: 'syz.3.2593': attribute type 1 has an invalid length. [ 348.001426][T12989] 8021q: adding VLAN 0 to HW filter on device bond2 [ 348.047760][T12989] bond2: (slave gretap2): Enslaving as a backup interface with an up link [ 348.079588][T12989] device dummy0 left promiscuous mode [ 348.093181][T12989] bond2: (slave dummy0): Enslaving as a backup interface with an up link [ 348.130590][ T6120] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 348.140152][ T6120] IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready [ 348.214079][T13000] syz.5.2598 (13000): drop_caches: 2 [ 348.252555][ T6135] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 348.551979][T13008] rxrpc: Assertion failed - 5(0x5) == 11(0xb) is false [ 348.553884][T13008] ------------[ cut here ]------------ [ 348.554829][T13008] kernel BUG at net/rxrpc/call_object.c:689! [ 348.555961][T13008] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP [ 348.557207][T13008] Modules linked in: [ 348.557921][T13008] CPU: 1 PID: 13008 Comm: syz.2.2601 Not tainted syzkaller #0 [ 348.559215][T13008] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026 [ 348.560988][T13008] pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 348.562366][T13008] pc : rxrpc_cleanup_call+0x1b0/0x1c8 [ 348.563363][T13008] lr : rxrpc_cleanup_call+0x1b0/0x1c8 [ 348.564353][T13008] sp : ffff800022937620 [ 348.565130][T13008] x29: ffff800022937620 x28: ffff0000db021ce0 x27: dfff800000000000 [ 348.566649][T13008] x26: ffff0000db021a40 x25: 0000000000000000 x24: 0000000000000001 [ 348.568060][T13008] x23: 0000000000000002 x22: ffff0000db021718 x21: dfff800000000000 [ 348.569473][T13008] x20: 0000000000000005 x19: ffff0000db021a40 x18: 1fffe00033e7217e [ 348.570874][T13008] x17: ffff80001539d000 x16: ffff800011ba0e90 x15: ffff00019f390bfc [ 348.572250][T13008] x14: 0000000000000001 x13: 1ffff00004526e2c x12: 0000000000080000 [ 348.573671][T13008] x11: 0000000000005ba5 x10: ffff8000285da000 x9 : d4cc5b040482e600 [ 348.575145][T13008] x8 : d4cc5b040482e600 x7 : ffff80000825ab48 x6 : 0000000000000000 [ 348.576556][T13008] x5 : 0000000000000080 x4 : 0000000000000001 x3 : ffff80000a929b3c [ 348.577891][T13008] x2 : ffff00019f390d10 x1 : 0000000100000000 x0 : 0000000000000034 [ 348.579252][T13008] Call trace: [ 348.579844][T13008] rxrpc_cleanup_call+0x1b0/0x1c8 [ 348.580721][T13008] rxrpc_service_prealloc_one+0x878/0xe80 [ 348.581703][T13008] rxrpc_user_charge_accept+0xc0/0x114 [ 348.582593][T13008] rxrpc_do_sendmsg+0x70c/0xeb4 [ 348.583404][T13008] rxrpc_sendmsg+0x490/0x70c [ 348.584184][T13008] ____sys_sendmsg+0x588/0x90c [ 348.585062][T13008] __sys_sendmsg+0x288/0x374 [ 348.585924][T13008] __arm64_sys_sendmsg+0x80/0x94 [ 348.586840][T13008] invoke_syscall+0x98/0x290 [ 348.587654][T13008] el0_svc_common+0x13c/0x258 [ 348.588502][T13008] do_el0_svc+0x5c/0x134 [ 348.589258][T13008] el0_svc+0x58/0x128 [ 348.589968][T13008] el0t_64_sync_handler+0x84/0xf0 [ 348.590882][T13008] el0t_64_sync+0x18c/0x190 [ 348.591684][T13008] Code: aa1403e2 52800164 52800165 942c2c9d (d4210000) [ 348.592928][T13008] ---[ end trace 0000000000000000 ]--- [ 348.891926][T13008] Kernel panic - not syncing: Oops - BUG: Fatal exception [ 348.893211][T13008] SMP: stopping secondary CPUs [ 348.894022][T13008] Kernel Offset: disabled [ 348.894742][T13008] CPU features: 0x0a0000,000f0097,a65bfea7 [ 348.895758][T13008] Memory Limit: none [ 349.176597][T13008] Rebooting in 86400 seconds..