last executing test programs: 3m1.66235906s ago: executing program 3 (id=373): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}, @IFLA_MASTER={0x8, 0xa, r2}]}, 0x3c}}, 0x8000) r4 = socket$igmp(0x2, 0x3, 0x2) r5 = socket(0x10, 0x803, 0x2) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r5) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$inet(r4, &(0x7f00000002c0)={&(0x7f00000000c0)={0x2, 0x4e24, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000200)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r6, @dev={0xac, 0x14, 0x14, 0x3c}, @dev={0xac, 0x14, 0x14, 0x12}}}}], 0x20}, 0x0) 3m1.474025043s ago: executing program 3 (id=378): r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000040)=@nameseq={0x1e, 0x1, 0x1, {0x42, 0x0, 0x7}}, 0x10) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, &(0x7f0000000200)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x1}, 0x10) r2 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r2, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x1, 0x2}}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10) bind$tipc(r3, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x3}}}, 0x10) r4 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r4, &(0x7f0000000380)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x4, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x4000884}, 0x4) 3m1.402014155s ago: executing program 3 (id=380): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41100, 0x19}, 0x94) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x80) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000000c0)={r1, r3, 0x16, 0x0, @void}, 0x10) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000440)={0xa, 0x4e21, 0x0, @empty, 0x4}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000540), 0x28) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000340)=@ccm_128={{0x304}, "1f5fe89b3e65d0fd", "313a19ff4c7d278bf34b54168b154d15", "1e5a7ddb", "2fd978cbd6bf3b5d"}, 0x28) setsockopt$inet6_tcp_int(r0, 0x11a, 0x4, &(0x7f0000000040), 0x44) 3m0.891053826s ago: executing program 3 (id=384): socket(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket(0x80000000000000a, 0x2, 0x0) r0 = socket(0x80000000000000a, 0x2, 0x0) syz_mount_image$hfsplus(&(0x7f0000000000), &(0x7f0000000140)='./file1\x00', 0x1008404, &(0x7f0000000180)=ANY=[], 0x85, 0x6b9, &(0x7f00000008c0)="$eJzs3c1vHGcZAPBn1uu1N5TESZM2QZViNRIgrCb+kAvm0oAQ8qFCVTlwthInsbJJg+0it0LEfBQuHHrIH1AOvnFASNwjyoUL3Hr1sRKCSy81p0Hzseu1vbte49TrTX+/aDzvzDvv+z7zzNeuN9YG8KW1OBXVp5HE4tSbG9ny9tZcY3tr7kGzHBFjEVGJqBazSD5P0/TjiJtRTHElW1l2l+zt/dG5ZunJysLbn3y2/WmxVC2nfPvKwXZd/P5xl4rNcorJiBgp58ewp79bh/U3flh3SWsPs4RdayYOBm00ItLcv58Ua3769xdaNW3qnVofeuYDQyApnpsHTEScKS/07HVA8VQsntlDbXPQAQAAAMAJOLcTO7ERZwcdBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAyT8vv/k3KqNMuTkTS//79WrouyfLpcPdrmT7+oOAAAAAAAAADgBF3diZ3YiLPN5TTJP/N/NV+4mP/8Srwba7Ecq3E9NmIp1mM9VmMmIibaOqptLK2vr860Wjb/Z8DBlrMdW84eEuhYOa8/i70GAAAAAAAAgGHzeZqmPTf4VSzufv4PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACnQZKm6eOIJIrpYjlPJqJSjYjxiKhl221G/LNZHlZXXot4OuggAAAA4BjSPrc7txM7sRFnW+2S/D3/S/n7/vF4Nx7GeqzEejRiOW7nvwso3vVXtrfmGttbcw+y6WC/3/vPkcLNe4yIkXyp08iX8y3qcSdW8jXX41a8E0lyOyp5y8zlLJbRKGI6GNcvs5iSNwqjfUZ2u5xne/5hOd+veqR97eqIv0yZyDMy2srIdBlblo3zzQx0zsQRj87+kWai0gr2YtsoWSL27cSenL/R53hnynm2P7/tkvPB2J+J2baz76XdTIx3vCq+8Zc//uRe4+H9e3fWpk7PLh202WHdSDkv7iv1MhOPdzMx15aJl3uffcOTib5M5+fEpdbyYvwwfhxTMRlvxWqsxM9iKdZjOSbjB3lpqTyfk7ZLvi1Tlbaub+4Z6K3DIqmVZ2hxsPbGFIfE9Gre9mysxI/inbgdy/F6/m82ZuLbMR/zsdB2hC/1PsL5VV/pctWnX+0Y/LVvloV6RPyunOfudrm/9nsLP7Ysr+fb8to665PiSJ7fcxfezdKFPrK0/974p96hVL9WFrIxfh17T5fBmtiXiZm2TLzYOxN/yG8ra42H91fvLT3qb7gLH5aF7Bh80Psp8Ywe0P3KzpcLrWH3nh1Z3YtFXf4apD1ftfITl6Jd5UDdpVZdcaVudr1Sa+VruIM9zeZ1L3esG8/XXG6r2/96q9F6PTTsH/4APLc+qEWc+daZWv1f9X/UP6r/pn6v/ub498e+M/ZKLUb/Nvrd6vTI1yuvJH+Oj+IXu+//AQAAAAAAAAAAAAAAAAAAAAAAAAAAAACA/9/ae+/fX2o0llf3FdI0fdylapgLza8zO8FBr7wQMahdrkXE6cj8f9M0LdckpyGe3oU0MxbpUZsnReGvEdFfq2pEdKq6Ovgk9Lhp+AIoeC7cWH/w6Mbae++/tvJg6e7y3eWHC/PzC9ML86/P3biz0lieLn4OOkrgi7D70B90JAAAAAAAAAAAAEC/TuLPCbqPPn6SuwoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMqcWpqD6NJGamr09ny9tbc41sapZ3t6xGRCUikp9HJB9H3Ixiiom27pJu4zxZWXj7k8+2P93tq9rcvtKrXX82yykmI2KknD+r/m4du7+ktYdZwq41EweD9r8AAAD//0jrDBA=") syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) pwrite64(r1, &(0x7f0000000140)='2', 0x1, 0x8000c61) setsockopt$inet6_group_source_req(r0, 0x29, 0x2a, 0x0, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file1\x00', 0xa2242, 0x4c) 3m0.333351467s ago: executing program 3 (id=388): socket$kcm(0x2, 0x200000000000001, 0x106) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x840, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x8) socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000001080), 0x101e40, 0x0) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000000)={0x12, {"a2e3ad21ed0d09f91b5b090987f70906d038e7ff7fc6e5539b0d3d0e8b089b323b6d07060890e0878f0e1ac6e7049b334a959b3e9a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070b07580936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0931a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5bcd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383701d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b6080000007a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39dd0000000039ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb06ffc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00b98e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb15da202d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d877a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="043ef50d"], 0xf8) 2m58.631505773s ago: executing program 3 (id=399): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c00018006000100d1de0000080003400000000114000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d1ff"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 2m58.610503523s ago: executing program 32 (id=399): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c00018006000100d1de0000080003400000000114000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d1ff"}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 10.349091484s ago: executing program 0 (id=1214): prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f00000014c0)=@nat={'nat\x00', 0x62, 0x5, 0x408, 0x398, 0x2a0, 0xffffffff, 0xe0, 0x188, 0x398, 0x398, 0xffffffff, 0x398, 0x398, 0x5, 0x0, {[{{@ip={@multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'veth0_to_bond\x00', 'wg1\x00'}, 0x0, 0xa8, 0xe0, 0x0, {0x22e}, [@common=@unspec=@statistic={{0x38}}]}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x0, @multicast1, @remote, @icmp_id, @icmp_id}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x0, @multicast1, @empty, @gre_key, @icmp_id}}}}, {{@ip={@broadcast, @multicast1, 0x0, 0x0, 'veth1_to_hsr\x00', 'ipvlan0\x00'}, 0x0, 0xe0, 0x118, 0x0, {}, [@common=@socket0={{0x20}}, @common=@osf={{0x50}, {'syz0\x00'}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x0, @private, @multicast2, @gre_key}}}}, {{@ip={@remote, @empty, 0x0, 0x0, 'veth1_to_batadv\x00', 'pim6reg\x00', {0xff}}, 0x0, 0x98, 0xd0, 0x0, {}, [@common=@ttl={{0x28}}]}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x16, @remote, @broadcast, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x468) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) syz_emit_ethernet(0x3f, &(0x7f0000000000)={@multicast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x1, 0x0, @local, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @loopback}, '\x00'}}}}}, 0x0) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000240)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) 9.479382382s ago: executing program 0 (id=1218): prlimit64(0x0, 0xe, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x800}, 0x1) recvfrom(r2, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x4100, 0x0, 0x0) 9.453984962s ago: executing program 2 (id=1220): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x400034f, 0x2, 0x0) quotactl$Q_SYNC(0xffffffff80000102, 0x0, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000180)='./bus\x00', 0x1400c, &(0x7f0000000840)={[{@stripe={'stripe', 0x3d, 0x3d}}, {@init_itable}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x3, 0x457, &(0x7f0000000bc0)="$eJzs281vFOUfAPDvTLvl11/BVsQ38KWKRuJLSwGVgwc1mnjAxEQPevDQtAtBFjC0JkJIBGPwZIyJd+PRf8GTXozxZOJV74aEGC6CpzWzO9PuLrtLt+x2kf18koHnmZc+3+/OPLvPzLMbwMiazf5JIrZHxO8RMV2vNu8wW//v2tXzS9evnl9Kolp9+6+ktt/fV88vFbsWx03llX1pRPpZEnvatLty9tyJxUqlfCavz6+e/HB+5ey5546fXDxWPlY+deDw4UMHF1584cDzfclzKtK89MZ7X7155Ium/Fvy6JPZbhufrFb73Nxw7WgoJ+NDDISejEVEdrpKtf4/HWOxfvKm4/VPhxocMFDVarU61XnzhSpwB0uiua7Lw6goPuiz+99iaR0EvDy44cfQXXmlfgOU5X0tX+pbxteeGJRa7m/7aTYi3r3wzzfZEoN5DgEA0OSHbPzzbDbaaR3/pXFfw3535XNDMxFxd0TsjIh74lTsioh7I2r73h8RD/TYfuskyY3jn/TyphLboGz891I+t9U8/itGfzEzltd21PIvJUePV8r766/J+/kwurzQpY0fX/vty07bGsd/2ZK1X4wF8zguj29rPmZ5cXXxVnJudOVixO7xdvknazMBSUQ8GBG7N9nG8ae/e6jTtpvn30Uf5pmq30Y8VT//F6Il/0LSfX5y/n9RKe+fL66KG/3y66W3OrV/S/n3QXb+/9/2+l/LfyZpnK9d6b2NS3983vGeZrPX/0TyTq08ka/7eHF19cxCxERypB504/oD68cW9WL/LP99e9v3/52x/krsiYjsIn44Ih6JiEfz2B+LiMcjYm+X/H9+9YkPWtdNbjj/wcryX+7p/K8XJqJ1TfvC2Imfvm9qdGa9mOd/vfv5P1Qr7cvXbOT9byNxbe5qBgAAgP+eNCK2R5LOrZXTdG6u/h3+XRFp5fTK6jNHT390arn+G4GZKKXFk67phuehC/ltfb1+MSLqXy0oth/Mnxt/PTZZq88tna4sDzt5GHFTHfp/VvlzbNjRAQPn91owunrq/8ng4gC2ns9/GF299f9tA4sD2Gqldv1/chiRAFuv3ef/J0OIA9h6Lf3ftB+MEM//YHTp/zC69H8YSSuTcfMfyXctFH9pk4ffsYUo3RZhDKwQ6W0RhsKACsN9XwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOiXfwMAAP//EBbjLA==") r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r3, 0xc0185879, &(0x7f0000000080)={@desc={0x4100, 0x0, @desc3}}) openat$autofs(0xffffffffffffff9c, 0x0, 0xe0400, 0x0) 8.035805952s ago: executing program 4 (id=1222): bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) socket$inet(0x2, 0x2, 0x0) r0 = msgget(0x2, 0x200) msgctl$IPC_RMID(r0, 0x0) r1 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, 0x0, 0x0, 0x0) msgget(0x0, 0x323) msgctl$MSG_STAT(r0, 0xb, &(0x7f0000000280)=""/180) ptrace(0x10, 0x0) wait4(0x0, 0x0, 0x20000000, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x10, &(0x7f00000000c0)=ANY=[], 0x0, 0xe, 0x0, 0x0, 0x41100, 0xd}, 0x94) msgget(0x1, 0x240) msgget(0x3, 0x606) 7.927632635s ago: executing program 4 (id=1223): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mbind(&(0x7f00001fa000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60000b, 0x9) 7.6816881s ago: executing program 2 (id=1224): r0 = fsopen(&(0x7f0000000040)='fuseblk\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000004c0)='j\x95\'\x8aC\x16\xca\\', &(0x7f0000000c40)='\xe6usek\v\xf6u%\x9b\x00\x00\xad\xeb\x00\x00\x00\x00\x01\x80\x00\x00\xcf\x9b\x9f\b\xb6\xfe\xc8\xda~-\x83w\xf9Z\xd2\xcb\xcdF\xd0#N7\x17\xfc\x1e\xf1\x97\xffxi\xe0KE}]\x8e\xca\xe3+\xc8\x98\x03\x91\x88(\bn\x7f\x0e\x85\xa5\xb4\n?^\xc9\xef\xe0Q\x01\xb6\xa5\x81t\x06\xda\x95\x935\xf1\x18\xac\x00\xf0\xff\xff\x80\x1a\xa1\x06\xfd\x01\x00\x00\x00\x0f\xf8\xe3\x8a\x1f\x9c\xf3\xc5\x1f\xf9\xbf?\xc1\rv\xd3j\r6\x7f\x00'/141, 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000140)='{:\'@-\x00', &(0x7f0000000180)='%*.\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f00000003c0)='\x00', &(0x7f0000000400)='(!\xef(.(\\-]\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000200)='^](*\r\\!\x00', &(0x7f0000000500)='{:\'@-\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r0, 0x2, &(0x7f00000001c0)='\xe6\xd2=(L\x9f\x1c&\xda\xfa\xf3}\x18\xdckL<\xa5-#\xc8\xb7\x98\f\x87\xcf', &(0x7f0000000540)="82", 0x1) fsconfig$FSCONFIG_SET_BINARY(r0, 0x2, &(0x7f0000000440)='.!@*\x00', &(0x7f0000000740)="e5", 0x1) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000b80)='\xe0\"\xef\xb1\xea\xe6\x9c\xe6\xc8M\xdb\x86\xb3\x8b\xbe\xd5\xbdB\x92\xa0\x19-+a\x13qQ\xd5f39hSr\xafbB\xe2\xe8\xcd\x1bf\x18\x7f\xf27E#\"\xab\x99\xec\x88\x8d\xd8C\x0f\x95\xff\xfeG\xf9t\xb1 \xcc\xc5\xbb\x88\xb6\xd2\xf2Jwq\xf8oG0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$kcm(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r3, 0x8b2a, &(0x7f0000000040)) 6.943203815s ago: executing program 0 (id=1226): bpf$PROG_LOAD(0x5, &(0x7f0000002f00)={0xb, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x0, 0x40}}, &(0x7f0000000180)='syzkaller\x00', 0xffff1961, 0x1000, &(0x7f0000001e40)=""/4096, 0x41100, 0x49, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000002e40)={0x2, 0x1, 0x7, 0x7fff}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0xf5d1b000) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x6b4, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/diskstats\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x106f) 6.891708016s ago: executing program 5 (id=1227): openat$damon_target_ids(0xffffffffffffff9c, 0x0, 0x42, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, 0x0) keyctl$negate(0xd, 0x0, 0x7, 0x0) 6.891280746s ago: executing program 2 (id=1228): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000002c0)=0x4) r3 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$nl_generic(r3, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001480)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c383032313100f58965f119cc126753b031a7b853d042666cf768bebe72b11c91f6e7bc6d0e32e9d47cec95a610e2a020376872c26056d965af0f902f1ef8179fd9647f3ebdaf305fbf41e7a3d2ec4189b8822a2b96befba644"], 0x20}}, 0x0) recvmmsg(r3, &(0x7f0000001b40)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)=""/189, 0xbd}, {&(0x7f00000003c0)=""/152, 0x98}, {&(0x7f0000000480)=""/4096, 0x1000}], 0x3}}], 0x7, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x800700, &(0x7f0000000740)={[{@grpquota}, {@journal_dev={'journal_dev', 0x3d, 0x101}}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x4c}}, {@discard}, {@resgid}, {@acl}, {@init_itable_val={'init_itable', 0x3d, 0x8d55}}]}, 0x0, 0x471, &(0x7f0000000200)="$eJzs28tvVFUYAPDv3j4AebQiPkDUKjFpfLS0oLJwo9HEBUYTXeCytgNpGKihNRFCpBiCGxNDomvj0sS/wJ0xMerKxK3uDQlRNqCrmnvnXmjHmUJlOrcyv18y7Tn3ns45X899nHvOTAA9ayT7kURsi4hfI2KokV1ZYKTx6/rVs9N/XT07ncTS0lt/JHm5a1fPTpdFy7/bWmRG04j0QlJUclNWbv70meNT9XrtVLFtfOHEe+Pzp888O3ti6ljtWO3k5KFDBw9MvPD85HMdiTOL69qeD+f27n7tnUuvTx+59O6PX2ft2FbsXx5Hp4xkgf+5lGve92SnK6vY9mXppL/ChrAmfRGRdddAfv4PRV/c7LyhePWjShsHrKvs3rSp/e7FJeAulkTVLQCqUd7os+ff8tWloceGcOWlxgNQFvf14tXY0x9pUWag6fm2k0Yi4sji319kr1ineQgAgOU+mf78cDzTavyXxgPLyu0o1lCGI+LeiNgZEfdFxK6IuD8iL/tgRDy0xvqbloZajH/Sy/8psNuUjf9eLNa2Vo7/ytFfDPcVue15/APJ0dl6bX/xPxmNgU1ZfmKVOr595ZdP2+1bPv7LXln95ViwaMfl/qYJupmphal8UNoBV85H7OlvFX9yYyUgiYjdEbFnbW+9o0zMPvXV3naFbh3/KjqwzrT0ZRbeYhb/YjTFX0pWX58c3xz12v7x8qj4t59+vvhmu/rvKP4OuFJr/F7W/81Fhles186vvY6Lv33c9plmDcf/hXLLzNRCOpi8nffLYLHtg6mFhVMTEYPJ4Ty/YvvkzXcr82X57Pgf3df6/N9Z/E1Wz8MRkR3Ej0TEoxHxWNH2xyPiiYjYt0r8P7zcfl8Zf6QV9f/5iJmW178bx39T/6890Xf8+2/a1X97/X8wT40WW/Lr3y20ak52uWhu4J387wAAAOD/Is0/A5+kYzfSaTo21vgM/664J63PzS88fXTu/ZMzjc/KD8dAWs50DRXzofXZem0iWSzesTE/OlnMFZfzpQeKeePP+rbk+bHpufpMxbFDr9va5vzP/N5XdeuAdbal5dbJwa43BKhA8zp6ujJ77o1uNgboKt/Xht51i/M/7VY7gO5z/4fe1er8P9eUtxYAdyf3f+hdzn/oUel3VbcAqJD7P/SkO/le/zomNm+MZlST2KidkiciykS6IdojsU6Jqq9MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAnfFPAAAA//8TGuuv") 6.113095842s ago: executing program 1 (id=1229): prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f00000014c0)=@nat={'nat\x00', 0x62, 0x5, 0x408, 0x398, 0x2a0, 0xffffffff, 0xe0, 0x188, 0x398, 0x398, 0xffffffff, 0x398, 0x398, 0x5, 0x0, {[{{@ip={@multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'veth0_to_bond\x00', 'wg1\x00'}, 0x0, 0xa8, 0xe0, 0x0, {0x22e}, [@common=@unspec=@statistic={{0x38}}]}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x0, @multicast1, @remote, @icmp_id, @icmp_id}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x0, @multicast1, @empty, @gre_key, @icmp_id}}}}, {{@ip={@broadcast, @multicast1, 0x0, 0x0, 'veth1_to_hsr\x00', 'ipvlan0\x00'}, 0x0, 0xe0, 0x118, 0x0, {}, [@common=@socket0={{0x20}}, @common=@osf={{0x50}, {'syz0\x00'}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x0, @private, @multicast2, @gre_key}}}}, {{@ip={@remote, @empty, 0x0, 0x0, 'veth1_to_batadv\x00', 'pim6reg\x00', {0xff}}, 0x0, 0x98, 0xd0, 0x0, {}, [@common=@ttl={{0x28}}]}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x16, @remote, @broadcast, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x468) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) syz_emit_ethernet(0x3f, &(0x7f0000000000)={@multicast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x1, 0x0, @local, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @loopback}, '\x00'}}}}}, 0x0) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000240)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) 6.112819892s ago: executing program 4 (id=1230): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bind$alg(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x13, 0xe, 0x0, 0x0, 0x8000000}, 0x94) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=@newsa={0x13c, 0x1a, 0x713, 0x0, 0x25dfdbff, {{@in=@multicast1, @in6=@mcast2, 0x4, 0x0, 0x4e21, 0x2, 0x0, 0x0, 0x0, 0x21, 0x0, 0xee00}, {@in6=@dev={0xfe, 0x80, '\x00', 0x37}, 0x4d2, 0x32}, @in6=@private2, {0x5, 0x0, 0x0, 0x9, 0xffffffff00000001, 0x0, 0x80000001, 0x543}, {0x4, 0x7fffffffffffffff, 0x100, 0x1}, {}, 0x70bd2c, 0x3505, 0xa, 0x4, 0x0, 0x50}, [@algo_crypt={0x4a, 0x2, {{'ecb(blowfish)\x00'}, 0x10, "a416"}}]}, 0x13c}, 0x1, 0x0, 0x0, 0x880}, 0x2014) 6.111572932s ago: executing program 0 (id=1231): prlimit64(0x0, 0xe, &(0x7f0000000180)={0x7, 0x81}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002c00)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000e4ff00000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) socket$inet6_sctp(0xa, 0x1, 0x84) 5.585180634s ago: executing program 5 (id=1232): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r3, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x7ff, @empty, 0x9}, 0x1c) recvmmsg(r3, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x20004184, &(0x7f0000000200)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) 5.365851678s ago: executing program 2 (id=1233): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$unix(0x1, 0x2, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000026c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0x1, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0xffff}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000080}, 0x48000) sendmsg$nl_route_sched(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000bc0)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0x0, 0x5}, {0xffff, 0xb}, {0x2, 0xfff1}}, [@qdisc_kind_options=@q_pfifo_head_drop={{0x14}, {0x8}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4054815}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 5.180644012s ago: executing program 1 (id=1234): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newqdisc={0x58, 0x28, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, {0xfff3}, {0xffff, 0xffff}, {0xffef, 0x1}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x82, 0x3, 0x4, 0xffff, 0x7f, 0x7fffffff, 0x1, 0x40, 0x2}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0xdc}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x2, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) 5.132019173s ago: executing program 0 (id=1235): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f0000000480), 0x400034f, 0x2, 0x0) quotactl$Q_SYNC(0xffffffff80000102, 0x0, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000180)='./bus\x00', 0x1400c, &(0x7f0000000840)={[{@stripe={'stripe', 0x3d, 0x3d}}, {@init_itable}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0x3, 0x457, &(0x7f0000000bc0)="$eJzs281vFOUfAPDvTLvl11/BVsQ38KWKRuJLSwGVgwc1mnjAxEQPevDQtAtBFjC0JkJIBGPwZIyJd+PRf8GTXozxZOJV74aEGC6CpzWzO9PuLrtLt+x2kf18koHnmZc+3+/OPLvPzLMbwMiazf5JIrZHxO8RMV2vNu8wW//v2tXzS9evnl9Kolp9+6+ktt/fV88vFbsWx03llX1pRPpZEnvatLty9tyJxUqlfCavz6+e/HB+5ey5546fXDxWPlY+deDw4UMHF1584cDzfclzKtK89MZ7X7155Ium/Fvy6JPZbhufrFb73Nxw7WgoJ+NDDISejEVEdrpKtf4/HWOxfvKm4/VPhxocMFDVarU61XnzhSpwB0uiua7Lw6goPuiz+99iaR0EvDy44cfQXXmlfgOU5X0tX+pbxteeGJRa7m/7aTYi3r3wzzfZEoN5DgEA0OSHbPzzbDbaaR3/pXFfw3535XNDMxFxd0TsjIh74lTsioh7I2r73h8RD/TYfuskyY3jn/TyphLboGz891I+t9U8/itGfzEzltd21PIvJUePV8r766/J+/kwurzQpY0fX/vty07bGsd/2ZK1X4wF8zguj29rPmZ5cXXxVnJudOVixO7xdvknazMBSUQ8GBG7N9nG8ae/e6jTtpvn30Uf5pmq30Y8VT//F6Il/0LSfX5y/n9RKe+fL66KG/3y66W3OrV/S/n3QXb+/9/2+l/LfyZpnK9d6b2NS3983vGeZrPX/0TyTq08ka/7eHF19cxCxERypB504/oD68cW9WL/LP99e9v3/52x/krsiYjsIn44Ih6JiEfz2B+LiMcjYm+X/H9+9YkPWtdNbjj/wcryX+7p/K8XJqJ1TfvC2Imfvm9qdGa9mOd/vfv5P1Qr7cvXbOT9byNxbe5qBgAAgP+eNCK2R5LOrZXTdG6u/h3+XRFp5fTK6jNHT390arn+G4GZKKXFk67phuehC/ltfb1+MSLqXy0oth/Mnxt/PTZZq88tna4sDzt5GHFTHfp/VvlzbNjRAQPn91owunrq/8ng4gC2ns9/GF299f9tA4sD2Gqldv1/chiRAFuv3ef/J0OIA9h6Lf3ftB+MEM//YHTp/zC69H8YSSuTcfMfyXctFH9pk4ffsYUo3RZhDKwQ6W0RhsKACsN9XwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOiXfwMAAP//EBbjLA==") r3 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x0) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r3, 0xc0185879, &(0x7f0000000080)={@desc={0x4100, 0x0, @desc3}}) openat$autofs(0xffffffffffffff9c, 0x0, 0xe0400, 0x0) 4.153851124s ago: executing program 5 (id=1236): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x7a, &(0x7f0000000340)={r4, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) 4.153554673s ago: executing program 4 (id=1237): prlimit64(0x0, 0xe, &(0x7f0000000180)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="6000000002060500000000000000000000000000140007800800064020000000080013400000000005000100060000000900020073797a32000000000500040000000000050005000a00000011000300686173683a6970"], 0x60}}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) 4.153225343s ago: executing program 2 (id=1238): prlimit64(0x0, 0xe, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x1}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r3 = accept(r0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[], 0xfffffdef}, 0x1, 0x0, 0x0, 0x800}, 0x1) recvfrom(r2, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x4100, 0x0, 0x0) 3.623128535s ago: executing program 1 (id=1239): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0xfffffffd, @local, 0x2}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) 2.008352418s ago: executing program 4 (id=1240): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000001540)=""/74, 0x0, 0x5000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000016c0)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000340)=""/182, &(0x7f0000000140)=""/92}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000001500)={@my=0x1}) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e00000010b000200e00000010c00028005000100000000002400028014000180080001"], 0x64}, 0x1, 0x0, 0x0, 0x20040044}, 0x40110) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000200)={0x28, 0x0, 0xffffffff, @my=0x1}, 0x10) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=""/57, 0x0, &(0x7f0000000500)=""/4092}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001900)={0x2, 0x0, [{0x0, 0x75, &(0x7f0000000440)=""/117}, {0xdddd1000, 0x4e, &(0x7f0000001640)=""/78}]}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000020c0)=ANY=[], 0x20}}, 0x84054) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) 2.007055718s ago: executing program 5 (id=1250): prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000a80)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000280)={{r3, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000240)='%pI4 \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r4}, 0x4) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x4, 0x11, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000000000000000000000400008500000061000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000580)={r5, 0x18000000000002a0, 0x48, 0x62, &(0x7f0000000600)="b9ff03075fe9008cb89e08e086dd", 0x0, 0xfe6, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, 0x28) 1.900518901s ago: executing program 1 (id=1241): r0 = socket$inet(0x2, 0x801, 0x0) shutdown(r0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) splice(r0, 0x0, r4, 0x0, 0x7fffeffc, 0x0) 1.230392454s ago: executing program 0 (id=1242): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$setperm(0x5, r3, 0x200000) keyctl$describe(0x6, r3, 0x0, 0xffffffffffffff87) 1.019223369s ago: executing program 1 (id=1243): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000440)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x1}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$TIPC_DEST_DROPPABLE(r3, 0x10f, 0x81, &(0x7f0000000080), 0x4a) sendmmsg$inet(r3, &(0x7f0000001540)=[{{0x0, 0xfffffffffffffda1, 0x0}}], 0x40001b6, 0x0) close(r4) 1.018637909s ago: executing program 5 (id=1254): r0 = socket$inet6(0xa, 0x6, 0x0) openat$drirender128(0xffffffffffffff9c, 0x0, 0x80100, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, 0x0, 0x20) connect$inet6(r0, &(0x7f0000000280)={0xa, 0x4e20, 0x2, @ipv4={'\x00', '\xff\xff', @loopback}}, 0x1c) 16.01059ms ago: executing program 2 (id=1244): openat$damon_target_ids(0xffffffffffffff9c, 0x0, 0x42, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, 0x0) keyctl$negate(0xd, 0x0, 0x7, 0x0) 15.53183ms ago: executing program 5 (id=1245): prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f00000014c0)=@nat={'nat\x00', 0x62, 0x5, 0x408, 0x398, 0x2a0, 0xffffffff, 0xe0, 0x188, 0x398, 0x398, 0xffffffff, 0x398, 0x398, 0x5, 0x0, {[{{@ip={@multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'veth0_to_bond\x00', 'wg1\x00'}, 0x0, 0xa8, 0xe0, 0x0, {0x22e}, [@common=@unspec=@statistic={{0x38}}]}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x0, @multicast1, @remote, @icmp_id, @icmp_id}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x0, @multicast1, @empty, @gre_key, @icmp_id}}}}, {{@ip={@broadcast, @multicast1, 0x0, 0x0, 'veth1_to_hsr\x00', 'ipvlan0\x00'}, 0x0, 0xe0, 0x118, 0x0, {}, [@common=@socket0={{0x20}}, @common=@osf={{0x50}, {'syz0\x00'}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x0, @private, @multicast2, @gre_key}}}}, {{@ip={@remote, @empty, 0x0, 0x0, 'veth1_to_batadv\x00', 'pim6reg\x00', {0xff}}, 0x0, 0x98, 0xd0, 0x0, {}, [@common=@ttl={{0x28}}]}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x16, @remote, @broadcast, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x468) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) syz_emit_ethernet(0x3f, &(0x7f0000000000)={@multicast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x31, 0x0, 0x0, 0x0, 0x1, 0x0, @local, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, @loopback, @loopback}, '\x00'}}}}}, 0x0) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000240)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r4, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) 0s ago: executing program 4 (id=1246): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6364, 0x5, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x1, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x4, 0x10, 0x6, 0x8, 0xfbee}, 0x1, 0xfffffffe, 0x3, 0x5, 0xe, 0x4, 0xd, 0x18, 0x5, 0x102, {0x6, 0x8, 0xfffffffc, 0x0, 0xffffffff, 0x5}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r4, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0xa888, r6, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030212590214000600002fb96dbcf706e10500000086ddffff86ddee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) kernel console output (not intermixed with test programs): RCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 33.875847][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 33.877334][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 33.881588][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 33.883231][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.885545][ T4327] device veth0_macvtap entered promiscuous mode [ 33.892787][ T4326] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.894088][ T4326] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.895440][ T4326] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.896738][ T4326] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 33.901566][ T4337] device veth1_vlan entered promiscuous mode [ 33.907448][ T4327] device veth1_macvtap entered promiscuous mode [ 33.918083][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 33.919971][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 33.922144][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 33.923614][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 33.925053][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 33.926587][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 33.947743][ T4331] device veth0_macvtap entered promiscuous mode [ 33.955662][ T4327] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.957223][ T4327] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.958769][ T4327] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 33.961062][ T4327] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.963338][ T4327] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 33.966987][ T4373] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 33.968264][ T4373] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 33.974925][ T4331] device veth1_macvtap entered promiscuous mode [ 33.976391][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 33.977882][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 33.979385][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 33.982580][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 33.984281][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 33.992316][ T4327] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.993913][ T4327] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.995358][ T4327] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 33.996851][ T4327] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 33.998922][ T4327] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.010116][ T4390] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 34.011780][ T4390] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 34.013303][ T4390] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 34.014909][ T4390] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 34.016578][ T4331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 34.018246][ T4331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.020250][ T4331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 34.021849][ T4331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.023279][ T4331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 34.024860][ T4331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.027105][ T4331] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 34.028956][ T1668] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.030400][ T1668] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.037528][ T4337] device veth0_macvtap entered promiscuous mode [ 34.041064][ T4390] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 34.042559][ T4390] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 34.044050][ T4390] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 34.045611][ T4390] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 34.051025][ T4337] device veth1_macvtap entered promiscuous mode [ 34.053469][ T4331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.055107][ T4331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.056634][ T4331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.058208][ T4331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.059923][ T4331] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.061456][ T4331] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.063510][ T4331] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.066740][ T4390] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.067815][ T4390] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.072017][ T4327] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.073483][ T4327] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.074829][ T4327] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.076179][ T4327] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.078558][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 34.080370][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 34.082330][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 34.083806][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 34.087454][ T4373] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.088723][ T4337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 34.088798][ T4373] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.096277][ T4337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.097744][ T4337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 34.099334][ T4337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.101457][ T4337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 34.103025][ T4337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.104601][ T4337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 34.106156][ T4337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.108473][ T4337] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 34.120265][ T4390] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 34.121813][ T4390] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 34.123349][ T4390] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 34.136773][ T4331] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.138164][ T4331] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.139450][ T4331] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.147451][ T4331] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.153840][ T4337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.155522][ T4337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.157038][ T4337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.158497][ T4337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.160463][ T4337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.162137][ T4337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.163605][ T4337] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 34.165199][ T4337] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 34.167466][ T4337] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 34.193651][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 34.195192][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 34.210992][ T4337] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.212517][ T4337] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.213756][ T4337] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.215025][ T4337] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 34.217633][ T39] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.218960][ T39] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.228239][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 34.263729][ T1668] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.265115][ T1668] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.278966][ T4411] ªªªªª»: renamed from veth0_vlan [ 34.323765][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 34.379433][ T4373] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.381762][ T4373] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.383363][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 34.434110][ T4373] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.435674][ T4373] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.436952][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 34.449939][ T4373] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.451220][ T4373] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.455232][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 34.904101][ T4373] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 34.905487][ T4373] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 34.907081][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 35.092162][ T4426] process 'syz.0.7' launched './file0' with NULL argv: empty string added [ 35.131040][ T47] Bluetooth: hci4: command 0x041b tx timeout [ 35.133452][ T4333] Bluetooth: hci2: command 0x041b tx timeout [ 35.133467][ T4328] Bluetooth: hci1: command 0x041b tx timeout [ 35.134804][ T47] Bluetooth: hci0: command 0x041b tx timeout [ 35.135624][ T4328] Bluetooth: hci3: command 0x041b tx timeout [ 35.883203][ T4441] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12'. [ 35.899402][ T4441] device team1 entered promiscuous mode [ 35.903093][ T4441] netlink: 4 bytes leftover after parsing attributes in process `syz.3.12'. [ 35.904708][ T4441] team2 (uninitialized): Failed to send options change via netlink (err -105) [ 35.913534][ T4441] device team2 entered promiscuous mode [ 35.915799][ T4441] Zero length message leads to an empty skb [ 37.204361][ T4467] netlink: 20 bytes leftover after parsing attributes in process `syz.3.18'. [ 37.210376][ T4333] Bluetooth: hci3: command 0x040f tx timeout [ 37.211640][ T4330] Bluetooth: hci0: command 0x040f tx timeout [ 37.212198][ T4333] Bluetooth: hci2: command 0x040f tx timeout [ 37.212660][ T4330] Bluetooth: hci1: command 0x040f tx timeout [ 37.213755][ T4333] Bluetooth: hci4: command 0x040f tx timeout [ 37.285375][ T4464] device syzkaller0 entered promiscuous mode [ 37.379307][ T4476] loop0: detected capacity change from 0 to 16 [ 37.399196][ T4476] erofs: (device loop0): mounted with root inode @ nid 36. [ 37.476609][ T4482] loop0: detected capacity change from 0 to 256 [ 37.478948][ T4482] ======================================================= [ 37.478948][ T4482] WARNING: The mand mount option has been deprecated and [ 37.478948][ T4482] and is ignored by this kernel. Remove the mand [ 37.478948][ T4482] option from the mount to silence this warning. [ 37.478948][ T4482] ======================================================= [ 37.522401][ T4474] netlink: 'syz.3.18': attribute type 6 has an invalid length. [ 37.523812][ T4474] netlink: 20 bytes leftover after parsing attributes in process `syz.3.18'. [ 38.356220][ T4499] netlink: 4 bytes leftover after parsing attributes in process `syz.2.28'. [ 38.359978][ T4499] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 38.361427][ T4499] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 38.362771][ T4499] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 38.364105][ T4499] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 38.372486][ T4499] netlink: 4 bytes leftover after parsing attributes in process `syz.2.28'. [ 38.374454][ T4499] netlink: 4 bytes leftover after parsing attributes in process `syz.2.28'. [ 39.404596][ T4333] Bluetooth: hci4: command 0x0419 tx timeout [ 39.405649][ T4333] Bluetooth: hci2: command 0x0419 tx timeout [ 39.406582][ T4333] Bluetooth: hci0: command 0x0419 tx timeout [ 39.407553][ T4333] Bluetooth: hci3: command 0x0419 tx timeout [ 39.749893][ T4528] xt_hashlimit: size too large, truncated to 1048576 [ 39.808475][ T4531] device syzkaller0 entered promiscuous mode [ 40.830458][ T4549] device syzkaller0 entered promiscuous mode [ 41.092416][ T4553] loop2: detected capacity change from 0 to 512 [ 41.137857][ T4553] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 41.177124][ T4553] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 96 vs 65376 free clusters [ 41.184009][ T4553] EXT4-fs error (device loop2): ext4_xattr_inode_iget:401: comm syz.2.47: inode #9: comm syz.2.47: iget: illegal inode # [ 41.186720][ T4553] EXT4-fs error (device loop2): ext4_xattr_inode_iget:406: comm syz.2.47: error while reading EA inode 9 err=-117 [ 41.188752][ T4553] EXT4-fs error (device loop2): ext4_xattr_inode_iget:401: comm syz.2.47: inode #9: comm syz.2.47: iget: illegal inode # [ 41.191263][ T4553] EXT4-fs error (device loop2): ext4_xattr_inode_iget:406: comm syz.2.47: error while reading EA inode 9 err=-117 [ 41.236056][ T4335] EXT4-fs (loop2): unmounting filesystem. [ 42.373751][ T4585] netlink: 1319 bytes leftover after parsing attributes in process `syz.0.55'. [ 42.744639][ T4599] loop2: detected capacity change from 0 to 7 [ 42.747055][ T4319] Dev loop2: unable to read RDB block 7 [ 42.748120][ T4319] loop2: unable to read partition table [ 42.749146][ T4319] loop2: partition table beyond EOD, truncated [ 42.754976][ T4599] Dev loop2: unable to read RDB block 7 [ 42.756002][ T4599] loop2: unable to read partition table [ 42.757040][ T4599] loop2: partition table beyond EOD, truncated [ 42.758109][ T4599] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 42.801211][ T4594] bond0: (slave bond_slave_0): Releasing backup interface [ 43.156082][ T4604] Cannot find set identified by id 0 to match [ 43.765169][ T4618] capability: warning: `syz.2.65' uses deprecated v2 capabilities in a way that may be insecure [ 44.835608][ T4625] netlink: 'syz.2.70': attribute type 1 has an invalid length. [ 44.852698][ T4625] netlink: 4 bytes leftover after parsing attributes in process `syz.2.70'. [ 44.920821][ T4627] device syzkaller0 entered promiscuous mode [ 44.989670][ T4636] loop0: detected capacity change from 0 to 164 [ 45.014574][ T4636] rock: corrupted directory entry. extent=28, offset=16056320, size=0 [ 46.000720][ T4660] loop0: detected capacity change from 0 to 16 [ 46.008516][ T4660] erofs: (device loop0): mounted with root inode @ nid 36. [ 46.017038][ T4660] syz.0.80: attempt to access beyond end of device [ 46.017038][ T4660] loop0: rw=524288, sector=8, nr_sectors = 16 limit=16 [ 46.020198][ T4660] syz.0.80: attempt to access beyond end of device [ 46.020198][ T4660] loop0: rw=524288, sector=34359738360, nr_sectors = 8 limit=16 [ 46.297950][ T4674] sch_tbf: burst 2 is lower than device syzkaller0 mtu (1500) ! [ 46.332178][ T27] audit: type=1326 audit(46.320:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4669 comm="syz.3.84" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff92b78f68 code=0x7fc00000 [ 46.337091][ T27] audit: type=1326 audit(46.320:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4669 comm="syz.3.84" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=94 compat=0 ip=0xffff92b78f68 code=0x7fc00000 [ 46.554423][ T4683] netlink: 'syz.0.89': attribute type 1 has an invalid length. [ 47.759381][ T4720] netlink: 10 bytes leftover after parsing attributes in process `syz.4.102'. [ 47.793335][ T4722] binder: 4721:4722 tried to acquire reference to desc 0, got 1 instead [ 47.796074][ T4722] binder: 4721:4722 BC_FREE_BUFFER u0000000000000003 no match [ 47.797298][ T4722] binder: 4721:4722 unknown command 0 [ 47.798118][ T4722] binder: 4721:4722 ioctl c0306201 20004a40 returned -22 [ 47.802506][ T14] binder: release 4721:4722 transaction 5 out, still active [ 47.803731][ T14] binder: undelivered TRANSACTION_COMPLETE [ 47.811744][ T14] binder: send failed reply for transaction 5, target dead [ 47.830156][ T4724] loop4: detected capacity change from 0 to 512 [ 47.832629][ T4724] EXT4-fs: Ignoring removed nobh option [ 47.833794][ T4724] EXT4-fs: Ignoring removed orlov option [ 47.849210][ T4724] EXT4-fs error (device loop4): __ext4_iget:5102: inode #11: block 1: comm syz.4.104: invalid block [ 47.855088][ T4724] EXT4-fs error (device loop4): ext4_orphan_get:1410: comm syz.4.104: couldn't read orphan inode 11 (err -117) [ 47.857439][ T4724] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 47.876401][ T4337] EXT4-fs (loop4): unmounting filesystem. [ 48.084424][ T4738] netlink: 4 bytes leftover after parsing attributes in process `syz.2.109'. [ 48.691407][ T4761] netlink: 'syz.3.118': attribute type 2 has an invalid length. [ 49.148452][ T4772] input: syz1 as /devices/virtual/input/input2 [ 60.229388][ T4785] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 60.232942][ T4785] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 60.234089][ T4785] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 60.235870][ T4785] device bridge_slave_0 left promiscuous mode [ 60.237456][ T4785] bridge0: port 1(bridge_slave_0) entered disabled state [ 60.291668][ T4785] device bridge_slave_1 left promiscuous mode [ 60.292829][ T4785] bridge0: port 2(bridge_slave_1) entered disabled state [ 60.309941][ T4809] binder: 4808:4809 tried to acquire reference to desc 0, got 1 instead [ 60.312276][ T4809] binder: 4808:4809 got transaction with invalid offset (0, min 0 max 120) or object. [ 60.313758][ T4809] binder: 4808:4809 transaction call to 4808:0 failed 10/29201/-22, size 120-24 line 3346 [ 60.315980][ T24] binder: undelivered TRANSACTION_ERROR: 29201 [ 60.362241][ T4785] bond0: (slave bond_slave_0): Releasing backup interface [ 60.413943][ T4785] bond0: (slave bond_slave_1): Releasing backup interface [ 60.457806][ T4785] team0: Port device team_slave_0 removed [ 60.466644][ T4785] team0: Port device team_slave_1 removed [ 60.467904][ T4785] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 60.469080][ T4785] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 60.472525][ T4785] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 60.473649][ T4785] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 60.478108][ T4788] team0: Mode changed to "activebackup" [ 60.479202][ T4791] netlink: 24 bytes leftover after parsing attributes in process `syz.2.127'. [ 60.493214][ T4798] netlink: 28 bytes leftover after parsing attributes in process `syz.4.128'. [ 60.495035][ T4800] netlink: 12 bytes leftover after parsing attributes in process `syz.0.129'. [ 60.659395][ T4839] loop2: detected capacity change from 0 to 128 [ 60.662787][ T4839] EXT4-fs: Ignoring removed orlov option [ 60.665631][ T4839] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 60.826394][ T4846] loop1: detected capacity change from 0 to 8192 [ 60.893945][ T4846] loop1: p4 < > [ 61.264138][ T4335] EXT4-fs (loop2): unmounting filesystem. [ 61.295753][ T4858] loop2: detected capacity change from 0 to 256 [ 61.304675][ T4858] exfat: Deprecated parameter 'utf8' [ 61.333328][ T4858] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0xe0a6470d, utbl_chksum : 0xe619d30d) [ 61.517045][ T4867] netlink: 'syz.0.151': attribute type 1 has an invalid length. [ 61.592954][ T4326] __loop_clr_fd: partition scan of loop1 failed (rc=-16) [ 61.594233][ T4855] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 61.595859][ T4855] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 61.597245][ T4855] Buffer I/O error on dev loop1p4, logical block 0, async page read [ 61.598924][ T4855] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 61.614382][ T4855] Buffer I/O error on dev loop1p4, logical block 0, async page read [ 61.617531][ T4855] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 61.617662][ T4871] netlink: 4 bytes leftover after parsing attributes in process `syz.0.151'. [ 61.619010][ T4855] Buffer I/O error on dev loop1p4, logical block 0, async page read [ 61.623107][ T4855] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 61.624543][ T4855] Buffer I/O error on dev loop1p4, logical block 0, async page read [ 61.626127][ T4855] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 61.627491][ T4855] Buffer I/O error on dev loop1p4, logical block 0, async page read [ 61.685652][ T4855] udevd[4855]: inotify_add_watch(7, /dev/loop1p4, 10) failed: No such file or directory [ 61.696606][ T4871] bond1 (unregistering): Released all slaves [ 61.719151][ T4873] tipc: Failed to remove unknown binding: 66,0,0/0:1934716735/1934716737 [ 61.727581][ T4873] tipc: Failed to remove unknown binding: 66,0,0/0:1934716735/1934716736 [ 61.732738][ T4873] tipc: Failed to remove unknown binding: 66,0,0/0:1934716735/1934716737 [ 62.981539][ T4873] tipc: Failed to remove unknown binding: 66,0,0/0:1934716735/1934716736 [ 63.133886][ T4898] loop4: detected capacity change from 0 to 256 [ 63.135426][ T4898] exfat: Deprecated parameter 'utf8' [ 63.143132][ T4897] netlink: 'syz.0.159': attribute type 1 has an invalid length. [ 63.148003][ T4898] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0xe0a6470d, utbl_chksum : 0xe619d30d) [ 63.153870][ T4897] device bond1 entered promiscuous mode [ 63.155115][ T4897] 8021q: adding VLAN 0 to HW filter on device bond1 [ 63.211531][ T4897] netlink: 36 bytes leftover after parsing attributes in process `syz.0.159'. [ 63.229758][ T4897] device bond1 left promiscuous mode [ 63.288823][ T4897] bond1: (slave bridge1): making interface the new active one [ 63.297526][ T4897] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 63.332155][ T4911] binder: 4910:4911 tried to acquire reference to desc 0, got 1 instead [ 63.334216][ T4911] binder: 4910:4911 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 63.335930][ T22] binder: release 4910:4911 transaction 15 out, still active [ 63.337067][ T22] binder: undelivered TRANSACTION_COMPLETE [ 63.340077][ T4912] loop2: detected capacity change from 0 to 128 [ 63.360265][ T4905] 9pnet: p9_errstr2errno: server reported unknown error Àñ'IÓ$íÛ·=¼ [ 63.377611][ T22] binder: send failed reply for transaction 15, target dead [ 63.389354][ T4916] loop1: detected capacity change from 0 to 512 [ 63.436774][ T4916] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 63.475764][ T4929] netlink: 4 bytes leftover after parsing attributes in process `syz.4.174'. [ 63.479042][ T4929] device vlan2 entered promiscuous mode [ 63.480254][ T4929] device bridge0 entered promiscuous mode [ 63.486289][ T4326] EXT4-fs (loop1): unmounting filesystem. [ 63.898232][ T4953] binder: 4951:4953 ioctl c0306201 20000080 returned -14 [ 63.913628][ T4953] binder: 4951:4953 tried to acquire reference to desc 0, got 1 instead [ 63.915180][ T4953] binder: 4951:4953 ioctl c0306201 200003c0 returned -14 [ 63.916996][ T4953] binder: 4951:4953 got transaction with invalid fd, 68 [ 63.918286][ T4953] binder: 4953:4951 translate fd array failed [ 63.925392][ T4953] binder: 4951:4953 transaction call to 4951:0 failed 26/29201/-9, size 112-24 line 3486 [ 63.928499][ T7] binder: undelivered TRANSACTION_ERROR: 29201 [ 63.958199][ T4948] team0 (unregistering): Port device team_slave_0 removed [ 63.981616][ T4948] team0 (unregistering): Failed to send options change via netlink (err -105) [ 63.984653][ T4948] team0 (unregistering): Failed to send port change of device team_slave_1 via netlink (err -105) [ 63.988335][ T4948] team0 (unregistering): Port device team_slave_1 removed [ 64.027678][ T4958] tipc: Failed to remove unknown binding: 66,0,0/0:4073469553/4073469555 [ 64.032300][ T4958] tipc: Failed to remove unknown binding: 66,0,0/0:4073469553/4073469554 [ 64.036892][ T4958] tipc: Failed to remove unknown binding: 66,0,0/0:4073469553/4073469555 [ 64.040612][ T4958] tipc: Failed to remove unknown binding: 66,0,0/0:4073469553/4073469554 [ 64.241331][ T4956] loop2: detected capacity change from 0 to 40427 [ 64.252503][ T4956] F2FS-fs (loop2): invalid crc value [ 64.260165][ T4956] F2FS-fs (loop2): Found nat_bits in checkpoint [ 64.492583][ T2061] ieee802154 phy0 wpan0: encryption failed: -22 [ 64.494339][ T2061] ieee802154 phy1 wpan1: encryption failed: -22 [ 64.522933][ T2417] cfg80211: failed to load regulatory.db [ 64.562559][ T4956] F2FS-fs (loop2): Start checkpoint disabled! [ 64.570441][ T4956] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 65.115491][ T4981] netlink: 12 bytes leftover after parsing attributes in process `syz.1.192'. [ 65.124077][ T4981] 8021q: adding VLAN 0 to HW filter on device bond1 [ 65.159229][ T4984] netlink: 'syz.3.193': attribute type 1 has an invalid length. [ 65.161293][ T4984] netlink: 'syz.3.193': attribute type 4 has an invalid length. [ 65.162435][ T4984] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.193'. [ 65.166690][ T4984] netlink: 'syz.3.193': attribute type 1 has an invalid length. [ 65.168125][ T4984] netlink: 'syz.3.193': attribute type 4 has an invalid length. [ 65.169362][ T4984] netlink: 9491 bytes leftover after parsing attributes in process `syz.3.193'. [ 65.210575][ T4981] device macvlan2 entered promiscuous mode [ 65.212479][ T4981] device bond1 entered promiscuous mode [ 65.213530][ T4981] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 65.218676][ T4980] Illegal XDP return value 4294967285 on prog (id 31) dev syz_tun, expect packet loss! [ 65.232480][ T4981] device bond1 left promiscuous mode [ 65.665084][ T4999] netlink: 4 bytes leftover after parsing attributes in process `syz.3.201'. [ 65.674440][ T5003] netlink: 12 bytes leftover after parsing attributes in process `syz.3.201'. [ 65.768146][ T5006] device gretap1 entered promiscuous mode [ 65.770875][ T5008] device syzkaller0 entered promiscuous mode [ 65.772100][ T5022] syz.1.206 sent an empty control message without MSG_MORE. [ 66.104584][ T5028] binder: 5027:5028 tried to acquire reference to desc 0, got 1 instead [ 66.107311][ T5028] binder: 5027:5028 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 66.110236][ T5028] binder: 5028 RLIMIT_NICE not set [ 66.111339][ T5028] binder: 5028 RLIMIT_NICE not set [ 66.112886][ T5028] binder: 5028 RLIMIT_NICE not set [ 66.113936][ T5028] binder_alloc: 5027: binder_alloc_buf, no vma [ 66.115665][ T5028] binder: cannot allocate buffer: vma cleared, target dead or dying [ 66.115703][ T5028] binder: 5027:5028 transaction reply to 5027:5028 failed 32/29189/-3, size 0-0 line 3230 [ 66.118753][ T5028] binder: send failed reply for transaction 31 to 5027:5028 [ 66.121816][ T113] binder: undelivered TRANSACTION_COMPLETE [ 66.123221][ T113] binder: undelivered TRANSACTION_ERROR: 29189 [ 66.132088][ T113] binder: undelivered TRANSACTION_ERROR: 29190 [ 66.488922][ T5034] loop3: detected capacity change from 0 to 2048 [ 67.669583][ C1] sched: RT throttling activated [ 68.593990][ T5064] netlink: 8 bytes leftover after parsing attributes in process `syz.4.218'. [ 68.654337][ T5078] netlink: 4 bytes leftover after parsing attributes in process `syz.0.220'. [ 68.741765][ T5080] netlink: 132 bytes leftover after parsing attributes in process `syz.4.222'. [ 68.745026][ T5073] device syzkaller0 entered promiscuous mode [ 68.747960][ T5082] device veth0_macvtap left promiscuous mode [ 69.672961][ T5116] netlink: 24 bytes leftover after parsing attributes in process `syz.2.232'. [ 70.135461][ T5116] netlink: 24 bytes leftover after parsing attributes in process `syz.2.232'. [ 70.336220][ T3992] device veth0_macvtap entered promiscuous mode [ 70.829138][ T5166] netlink: 4 bytes leftover after parsing attributes in process `syz.1.246'. [ 70.950482][ T5157] loop3: detected capacity change from 0 to 40427 [ 70.964826][ T5157] F2FS-fs (loop3): build fault injection attr: rate: 19, type: 0x3ffff [ 71.046470][ T5166] team0: Port device team_slave_0 removed [ 71.642755][ T5199] IPVS: wlc: FWM 3 0x00000003 - no destination available [ 71.673028][ T5201] binder: 5200:5201 tried to acquire reference to desc 0, got 1 instead [ 71.675416][ T5201] binder: 5200:5201 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 71.677462][ T5201] binder: 5201 RLIMIT_NICE not set [ 71.678803][ T2417] binder: release 5200:5201 transaction 37 out, still active [ 71.683073][ T2417] binder: undelivered TRANSACTION_COMPLETE [ 71.693905][ T2417] binder: send failed reply for transaction 37, target dead [ 71.771833][ T5207] loop2: detected capacity change from 0 to 764 [ 73.158767][ T5255] loop4: detected capacity change from 0 to 764 [ 74.127553][ T5273] netlink: 132 bytes leftover after parsing attributes in process `syz.3.279'. [ 75.082493][ T5295] loop4: detected capacity change from 0 to 164 [ 75.104475][ T5295] rock: corrupted directory entry. extent=28, offset=16056320, size=0 [ 75.980597][ T5315] netlink: 'syz.4.287': attribute type 1 has an invalid length. [ 76.091718][ T5323] netdevsim netdevsim4 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 76.093552][ T5323] netdevsim netdevsim4 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 76.094958][ T5323] netdevsim netdevsim4 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 76.096278][ T5323] netdevsim netdevsim4 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 76.099134][ T5323] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 76.774700][ T5323] bond1 (unregistering): (slave geneve2): Releasing backup interface [ 76.878274][ T5323] netdevsim netdevsim4 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0 [ 76.880547][ T5323] netdevsim netdevsim4 netdevsim1: unset [1, 1] type 2 family 0 port 20000 - 0 [ 76.883618][ T5323] netdevsim netdevsim4 netdevsim2: unset [1, 1] type 2 family 0 port 20000 - 0 [ 76.889942][ T5323] netdevsim netdevsim4 netdevsim3: unset [1, 1] type 2 family 0 port 20000 - 0 [ 76.911548][ T5323] bond1 (unregistering): Released all slaves [ 76.923320][ T5334] device syzkaller0 entered promiscuous mode [ 76.994893][ T5341] sch_tbf: burst 2 is lower than device syzkaller0 mtu (1500) ! [ 77.174122][ T5349] netlink: 4 bytes leftover after parsing attributes in process `syz.4.299'. [ 78.200896][ T5377] netlink: 'syz.2.306': attribute type 1 has an invalid length. [ 79.195225][ T5389] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 79.196957][ T5389] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 79.198435][ T5389] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 79.203164][ T5389] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 79.211547][ T5389] bond2: (slave geneve2): Enslaving as an active interface with an up link [ 79.218565][ T5393] bond2 (unregistering): (slave geneve2): Releasing backup interface [ 79.251274][ T5393] netdevsim netdevsim1 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0 [ 79.259382][ T5393] netdevsim netdevsim1 netdevsim1: unset [1, 1] type 2 family 0 port 20000 - 0 [ 79.261281][ T5393] netdevsim netdevsim1 netdevsim2: unset [1, 1] type 2 family 0 port 20000 - 0 [ 79.266299][ T5393] netdevsim netdevsim1 netdevsim3: unset [1, 1] type 2 family 0 port 20000 - 0 [ 79.603243][ T5393] bond2 (unregistering): Released all slaves [ 79.781986][ T5408] netlink: 4 bytes leftover after parsing attributes in process `syz.1.316'. [ 80.349561][ T5419] device syzkaller0 entered promiscuous mode [ 81.687181][ T5443] device syzkaller0 entered promiscuous mode [ 83.092851][ T5460] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 83.094513][ T5460] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 83.096198][ T5460] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 83.097731][ T5460] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 83.104248][ T5460] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 83.116699][ T5460] bond1 (unregistering): (slave geneve2): Releasing backup interface [ 83.172181][ T5460] netdevsim netdevsim2 netdevsim0: unset [1, 1] type 2 family 0 port 20000 - 0 [ 83.173825][ T5460] netdevsim netdevsim2 netdevsim1: unset [1, 1] type 2 family 0 port 20000 - 0 [ 83.175451][ T5460] netdevsim netdevsim2 netdevsim2: unset [1, 1] type 2 family 0 port 20000 - 0 [ 83.177307][ T5460] netdevsim netdevsim2 netdevsim3: unset [1, 1] type 2 family 0 port 20000 - 0 [ 83.460187][ T5460] bond1 (unregistering): Released all slaves [ 83.565929][ T5485] device syzkaller0 entered promiscuous mode [ 84.371667][ T5493] device syzkaller0 entered promiscuous mode [ 84.401035][ T5501] input: syz0 as /devices/virtual/input/input3 [ 84.407032][ T5501] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 84.414665][ T5501] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 85.143783][ T5535] device syzkaller0 entered promiscuous mode [ 85.457533][ T5539] netlink: 4 bytes leftover after parsing attributes in process `syz.0.345'. [ 88.535129][ T5570] netlink: 'syz.4.359': attribute type 1 has an invalid length. [ 88.586279][ T5570] 8021q: adding VLAN 0 to HW filter on device bond1 [ 88.654689][ T5570] bond1: (slave veth0_to_bond): making interface the new active one [ 88.658135][ T5570] bond1: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 88.663078][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 88.993212][ T5584] loop4: detected capacity change from 0 to 128 [ 88.994784][ T5584] EXT4-fs: Ignoring removed oldalloc option [ 88.999235][ T5584] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 89.146773][ T4337] EXT4-fs (loop4): unmounting filesystem. [ 90.704743][ T5621] netlink: 'syz.3.373': attribute type 1 has an invalid length. [ 90.715061][ T5621] 8021q: adding VLAN 0 to HW filter on device bond1 [ 90.795158][ T5621] bond1: (slave dummy0): making interface the new active one [ 90.797737][ T5621] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 90.803388][ T4512] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 91.468135][ T5649] loop3: detected capacity change from 0 to 1024 [ 91.481288][ T5650] netlink: 12 bytes leftover after parsing attributes in process `syz.1.383'. [ 91.539296][ T5649] hfsplus: invalid length 32517 has been corrected to 255 [ 91.575294][ T5649] hfsplus: invalid length 32517 has been corrected to 255 [ 91.577476][ T5649] hfsplus: invalid length 32517 has been corrected to 255 [ 91.990397][ T5662] netlink: 104 bytes leftover after parsing attributes in process `syz.0.385'. [ 92.014361][ T4327] hfsplus: invalid length 32517 has been corrected to 255 [ 92.073779][ T5665] netlink: 'syz.1.389': attribute type 1 has an invalid length. [ 92.095971][ T5665] bond2: (slave ip6gretap1): Enslaving as a backup interface with an up link [ 92.108754][ T5665] netlink: 28 bytes leftover after parsing attributes in process `syz.1.389'. [ 92.114504][ T4511] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 92.118327][ T5665] 8021q: adding VLAN 0 to HW filter on device bond2 [ 92.230446][ T4511] bond2: Warning: No 802.3ad response from the link partner for any adapters in the bond [ 93.089909][ T5672] xt_CT: No such helper "syz0" [ 93.603985][ T4512] hfsplus: b-tree write err: -5, ino 4 [ 93.606005][ T4512] hfsplus: b-tree write err: -5, ino 2 [ 93.608354][ T4512] hfsplus: b-tree write err: -5, ino 20 [ 93.789431][ T4333] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 93.792344][ T4333] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 93.794101][ T4333] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 93.796147][ T4333] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 93.797964][ T4333] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 93.799488][ T4333] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 95.352764][ T5717] binder: 5716:5717 tried to acquire reference to desc 0, got 1 instead [ 95.369318][ T5693] chnl_net:caif_netlink_parms(): no params data found [ 95.375913][ T5717] binder: 5716:5717 got transaction with invalid data ptr [ 95.377137][ T5717] binder: 5716:5717 transaction async to 5716:0 failed 42/29201/-14, size 0-24 line 3333 [ 95.398198][ T4374] binder: undelivered TRANSACTION_ERROR: 29201 [ 95.453672][ T5693] bridge0: port 1(bridge_slave_0) entered blocking state [ 95.454998][ T5693] bridge0: port 1(bridge_slave_0) entered disabled state [ 95.456505][ T5693] device bridge_slave_0 entered promiscuous mode [ 95.458449][ T5693] bridge0: port 2(bridge_slave_1) entered blocking state [ 95.459573][ T5693] bridge0: port 2(bridge_slave_1) entered disabled state [ 95.463972][ T5693] device bridge_slave_1 entered promiscuous mode [ 95.583591][ T5693] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 95.588593][ T5693] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 95.645414][ T5693] team0: Port device team_slave_0 added [ 95.649465][ T5693] team0: Port device team_slave_1 added [ 95.657185][ T5693] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 95.658497][ T5693] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 95.666503][ T5693] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 95.670664][ T5693] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 95.671834][ T5693] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 95.676052][ T5693] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 95.755149][ T5693] device hsr_slave_0 entered promiscuous mode [ 95.956226][ T4328] Bluetooth: hci0: command 0x0409 tx timeout [ 96.217355][ T5693] device hsr_slave_1 entered promiscuous mode [ 96.260041][ T5693] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 96.264228][ T5693] Cannot create hsr debugfs directory [ 96.416086][ T5693] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 96.460918][ T5693] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 96.557172][ T5755] loop4: detected capacity change from 0 to 1024 [ 96.567194][ T5755] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 97.042965][ T39] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 97.047415][ T5693] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 97.082380][ T5693] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 97.136579][ T4337] EXT4-fs (loop4): unmounting filesystem. [ 97.171667][ T39] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 97.178755][ T5768] netlink: 'syz.4.421': attribute type 13 has an invalid length. [ 97.181498][ T5768] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 97.190967][ T5768] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 97.262107][ T39] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 97.422067][ T39] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 97.455163][ T5773] netlink: 4 bytes leftover after parsing attributes in process `syz.0.423'. [ 97.597413][ T5693] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.604871][ T4444] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 97.606413][ T4444] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 98.560140][ T4328] Bluetooth: hci0: command 0x041b tx timeout [ 98.775702][ T5693] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.798132][ T4444] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 98.807306][ T4444] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 98.808866][ T4444] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.810075][ T4444] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.902553][ T4444] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 98.904483][ T4444] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 98.906084][ T4444] bridge0: port 2(bridge_slave_1) entered blocking state [ 98.907790][ T4444] bridge0: port 2(bridge_slave_1) entered forwarding state [ 98.909145][ T4444] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 98.911562][ T4444] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 98.913599][ T4444] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 98.935090][ T5056] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 98.937141][ T5056] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 98.938594][ T5056] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 99.395876][ T5056] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 99.724825][ T5693] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 99.732879][ T5693] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 99.771106][ T5056] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 99.772706][ T5056] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 99.774255][ T5056] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 99.776216][ T5056] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 99.778994][ T5056] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 99.859348][ T5056] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 100.569678][ T4333] Bluetooth: hci0: command 0x040f tx timeout [ 100.694890][ T5693] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.696895][ T4605] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 100.698208][ T4605] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 100.743542][ T5835] netlink: 'syz.2.438': attribute type 1 has an invalid length. [ 100.756577][ T5835] 8021q: adding VLAN 0 to HW filter on device bond1 [ 101.213989][ T5835] bond1: (slave veth7): Enslaving as an active interface with a down link [ 101.773766][ T5835] bond1: (slave dummy0): making interface the new active one [ 101.776052][ T5835] device dummy0 entered promiscuous mode [ 101.777062][ T5835] bond1: (slave dummy0): Enslaving as an active interface with an up link [ 101.782244][ T5842] bond1: (slave vlan2): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 101.835821][ T5853] netlink: 12 bytes leftover after parsing attributes in process `syz.0.441'. [ 101.842402][ T5858] device bond2 entered promiscuous mode [ 101.854730][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 102.351979][ T88] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 102.353859][ T88] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 102.365409][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 102.367210][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 102.368900][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 102.371453][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 102.373130][ T5693] device veth0_vlan entered promiscuous mode [ 102.483631][ T5693] device veth1_vlan entered promiscuous mode [ 102.503373][ T4444] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 102.505112][ T4444] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 102.506690][ T4444] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 102.512672][ T4444] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 102.520479][ T5693] device veth0_macvtap entered promiscuous mode [ 102.555310][ T5693] device veth1_macvtap entered promiscuous mode [ 102.560661][ T5693] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 102.562269][ T5693] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 102.563748][ T5693] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 102.565321][ T5693] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 102.566859][ T5693] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 102.568394][ T5693] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 102.573168][ T5693] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 102.577523][ T5693] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 102.582033][ T5693] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.584725][ T88] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 102.586214][ T88] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 102.587601][ T88] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 102.589053][ T88] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 102.649922][ T4328] Bluetooth: hci0: command 0x0419 tx timeout [ 102.653407][ T5895] device syzkaller0 entered promiscuous mode [ 102.691077][ T5693] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 102.692770][ T5693] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 102.694293][ T5693] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 102.696028][ T5693] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 102.697598][ T5693] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 102.699224][ T5693] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 102.701242][ T5693] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 102.702794][ T5693] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 102.705051][ T5693] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 102.773595][ T4390] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 102.775391][ T4390] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 102.794536][ T5904] netlink: 8 bytes leftover after parsing attributes in process `syz.0.451'. [ 102.797634][ T5693] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.799077][ T5693] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.801855][ T5693] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.803121][ T5693] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 102.882573][ T4390] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 102.888777][ T4390] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 102.899226][ T4605] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 103.307293][ T1668] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.310230][ T1668] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 103.313457][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 103.376050][ T5923] netlink: 12 bytes leftover after parsing attributes in process `syz.4.453'. [ 103.421663][ T5923] bond2: (slave veth3): Enslaving as an active interface with an up link [ 105.149402][ T5926] netlink: 'syz.1.454': attribute type 4 has an invalid length. [ 105.150929][ T5926] netlink: 17 bytes leftover after parsing attributes in process `syz.1.454'. [ 105.264511][ T5977] netlink: 4 bytes leftover after parsing attributes in process `syz.1.462'. [ 105.950096][ T39] device hsr_slave_0 left promiscuous mode [ 106.370930][ T39] device hsr_slave_1 left promiscuous mode [ 106.640665][ T6021] netlink: 'syz.1.470': attribute type 3 has an invalid length. [ 107.053226][ T39] device veth1_macvtap left promiscuous mode [ 107.055121][ T39] device veth0_macvtap left promiscuous mode [ 107.056235][ T39] device veth1_vlan left promiscuous mode [ 107.057410][ T39] device veth0_vlan left promiscuous mode [ 108.109988][ T6052] syz.0.479 uses obsolete (PF_INET,SOCK_PACKET) [ 108.351580][ T39] bond1 (unregistering): (slave dummy0): Releasing active interface [ 108.400343][ T39] bond1 (unregistering): Released all slaves [ 109.227137][ T6075] binder: 6074:6075 tried to acquire reference to desc 0, got 1 instead [ 109.230532][ T113] binder: release 6074:6075 transaction 47 out, still active [ 109.270951][ T113] binder: undelivered TRANSACTION_COMPLETE [ 109.272011][ T113] binder: send failed reply for transaction 47, target dead [ 112.561208][ T39] bond0 (unregistering): Released all slaves [ 112.850509][ T6050] netlink: 'syz.4.477': attribute type 4 has an invalid length. [ 112.854125][ T6053] netlink: 'syz.4.477': attribute type 4 has an invalid length. [ 112.859966][ T6061] netlink: 'syz.4.477': attribute type 4 has an invalid length. [ 113.074110][ T6116] netlink: 24 bytes leftover after parsing attributes in process `syz.5.495'. [ 113.992289][ T6119] device syzkaller0 entered promiscuous mode [ 114.287254][ T6145] 9pnet: p9_errstr2errno: server reported unknown error 0x0000000000000009 [ 114.426113][ T6155] loop4: detected capacity change from 0 to 16 [ 114.661494][ T6155] erofs: (device loop4): mounted with root inode @ nid 36. [ 115.585245][ T5035] device dummy0 left promiscuous mode [ 118.765740][ T6185] netlink: 'syz.2.509': attribute type 4 has an invalid length. [ 118.771734][ T6185] netlink: 17 bytes leftover after parsing attributes in process `syz.2.509'. [ 119.653654][ T6230] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 119.663712][ T6230] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 119.670726][ T6230] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 119.672534][ T6230] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 119.674833][ T6234] loop1: detected capacity change from 0 to 512 [ 119.683856][ T6230] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 119.686028][ T6230] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 119.687801][ T6230] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 119.689818][ T6230] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 119.691566][ T6230] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 119.693338][ T6230] batman_adv: batadv0: adding TT local entry 66:ff:f2:fc:ff:ff to non-existent VLAN 815 [ 119.697583][ T6234] EXT4-fs (loop1): orphan cleanup on readonly fs [ 119.700889][ T6234] EXT4-fs error (device loop1): ext4_xattr_inode_iget:401: inode #11: comm syz.1.520: ea_inode with extended attributes [ 119.708985][ T6234] EXT4-fs error (device loop1): ext4_xattr_inode_iget:406: comm syz.1.520: error while reading EA inode 11 err=-117 [ 119.720031][ T6234] EXT4-fs (loop1): 1 orphan inode deleted [ 119.723380][ T6234] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 120.016353][ T4326] EXT4-fs (loop1): unmounting filesystem. [ 120.068130][ T6256] loop1: detected capacity change from 0 to 128 [ 120.111141][ T6258] loop4: detected capacity change from 0 to 512 [ 120.112531][ T6258] EXT4-fs: Ignoring removed i_version option [ 120.124124][ T6260] binder: 6259:6260 tried to acquire reference to desc 0, got 1 instead [ 120.126639][ T6258] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 120.135474][ T6256] syz.1.521: attempt to access beyond end of device [ 120.135474][ T6256] loop1: rw=2049, sector=145, nr_sectors = 95 limit=128 [ 120.147151][ T6263] netlink: 4 bytes leftover after parsing attributes in process `syz.0.525'. [ 120.153082][ T3899] binder: release 6259:6260 transaction 52 out, still active [ 120.154308][ T3899] binder: undelivered TRANSACTION_COMPLETE [ 120.172916][ T3899] binder: send failed reply for transaction 52, target dead [ 120.191635][ T6253] syz.1.521: attempt to access beyond end of device [ 120.191635][ T6253] loop1: rw=524288, sector=145, nr_sectors = 95 limit=128 [ 120.197175][ T6258] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 48 vs 41 free clusters [ 120.203470][ T6258] Quota error (device loop4): write_blk: dquota write failed [ 120.204808][ T6258] Quota error (device loop4): find_free_dqentry: Can't write quota data block 5 [ 120.206203][ T6258] Quota error (device loop4): write_blk: dquota write failed [ 120.207395][ T6258] Quota error (device loop4): qtree_write_dquot: Error -28 occurred while creating quota [ 120.208939][ T6258] EXT4-fs error (device loop4): ext4_acquire_dquot:6841: comm syz.4.523: Failed to acquire dquot type 1 [ 120.217824][ T6256] syz.1.521: attempt to access beyond end of device [ 120.217824][ T6256] loop1: rw=0, sector=145, nr_sectors = 8 limit=128 [ 120.226186][ T6258] EXT4-fs (loop4): 1 truncate cleaned up [ 120.227848][ T6258] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 120.234237][ T6256] syz.1.521: attempt to access beyond end of device [ 120.234237][ T6256] loop1: rw=0, sector=145, nr_sectors = 8 limit=128 [ 120.243584][ T6256] syz.1.521: attempt to access beyond end of device [ 120.243584][ T6256] loop1: rw=0, sector=151, nr_sectors = 1 limit=128 [ 120.464566][ T6273] binder: 6272:6273 tried to acquire reference to desc 0, got 1 instead [ 120.471382][ T6273] binder: 6272:6273 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 120.473438][ T6273] binder: 6273 RLIMIT_NICE not set [ 120.474224][ T6273] binder: 6273 RLIMIT_NICE not set [ 120.480373][ T6273] binder: 6272:6273 got new transaction with bad transaction stack, transaction 63 has target 6272:6273 [ 120.482336][ T6273] binder: 6272:6273 transaction call to 6272:0 failed 64/29201/-71, size 0-0 line 3105 [ 120.487790][ T4374] binder: release 6272:6273 transaction 63 out, still active [ 120.488889][ T4374] binder: undelivered TRANSACTION_COMPLETE [ 120.492650][ T4374] binder: undelivered TRANSACTION_ERROR: 29201 [ 120.506590][ T4374] binder: release 6272:6273 transaction 63 in, still active [ 120.507817][ T4374] binder: send failed reply for transaction 63, target dead [ 120.762668][ T6283] binder: 6282:6283 tried to acquire reference to desc 0, got 1 instead [ 120.766545][ T6283] binder: 6282:6283 BC_FREE_BUFFER u0000000020ffe000 no match [ 120.776608][ T4374] binder: send failed reply for transaction 69 to 6282:6283 [ 121.751427][ T4337] EXT4-fs (loop4): unmounting filesystem. [ 122.074628][ T6307] dummy0: Caught tx_queue_len zero misconfig [ 122.885006][ T6326] netlink: 12 bytes leftover after parsing attributes in process `syz.5.542'. [ 122.896913][ T6326] netlink: 8 bytes leftover after parsing attributes in process `syz.5.542'. [ 122.898531][ T6326] netlink: 24 bytes leftover after parsing attributes in process `syz.5.542'. [ 122.909777][ T6326] bond1: (slave veth3): Enslaving as an active interface with an up link [ 123.202995][ T6329] dns_resolver: Unsupported server list version (6) [ 123.248987][ T6336] netlink: 12 bytes leftover after parsing attributes in process `syz.2.545'. [ 123.291033][ T6336] bond2: (slave ip_vti0): The slave device specified does not support setting the MAC address [ 123.295642][ T6336] bond2: (slave ip_vti0): Error -95 calling set_mac_address [ 123.336931][ T6341] device syzkaller0 entered promiscuous mode [ 123.836349][ T6349] netlink: 12 bytes leftover after parsing attributes in process `syz.1.559'. [ 123.866085][ T6349] bridge3: port 1(dummy0) entered blocking state [ 123.870359][ T6349] bridge3: port 1(dummy0) entered disabled state [ 123.872784][ T6349] device dummy0 entered promiscuous mode [ 123.891756][ T6349] netlink: 'syz.1.559': attribute type 10 has an invalid length. [ 123.893023][ T6349] netlink: 40 bytes leftover after parsing attributes in process `syz.1.559'. [ 123.900053][ T6349] bridge3: port 1(dummy0) entered blocking state [ 123.901285][ T6349] bridge3: port 1(dummy0) entered forwarding state [ 123.902994][ T6349] bridge3: port 1(dummy0) entered disabled state [ 124.177769][ T6351] loop5: detected capacity change from 0 to 40427 [ 124.478121][ T6351] F2FS-fs (loop5): Invalid SB checksum offset: 0 [ 124.479159][ T6351] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock [ 124.482243][ T6351] F2FS-fs (loop5): invalid crc value [ 124.484930][ T6351] F2FS-fs (loop5): Disable nat_bits due to incorrect cp_ver (10241045589465957861, 585327988383614437) [ 124.522554][ T6351] F2FS-fs (loop5): Try to recover 2th superblock, ret: 0 [ 124.523845][ T6351] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5 [ 126.668281][ T2061] ieee802154 phy0 wpan0: encryption failed: -22 [ 126.669342][ T2061] ieee802154 phy1 wpan1: encryption failed: -22 [ 126.683621][ T5693] syz-executor: attempt to access beyond end of device [ 126.683621][ T5693] loop5: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 126.727041][ T6389] MPTCP: kernel_bind error, err=-99 [ 126.780127][ T6394] device syzkaller0 entered promiscuous mode [ 126.820359][ T6400] netlink: 24 bytes leftover after parsing attributes in process `syz.1.565'. [ 127.008776][ T6418] loop5: detected capacity change from 0 to 128 [ 127.049288][ T6418] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 127.062062][ T6420] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 127.082056][ T6418] syz.5.568 (pid 6418) is setting deprecated v1 encryption policy; recommend upgrading to v2. [ 127.115880][ T6426] netlink: 24 bytes leftover after parsing attributes in process `syz.2.570'. [ 127.319714][ T6418] fscrypt: Adiantum using implementation "adiantum(xchacha12-neon,aes-ce,nhpoly1305-generic)" [ 127.374977][ T5693] EXT4-fs (loop5): unmounting filesystem. [ 127.447981][ T6473] binder: 6472:6473 tried to acquire reference to desc 0, got 1 instead [ 127.452085][ T6473] binder: 6472:6473 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 127.454312][ T6473] binder: 6473 RLIMIT_NICE not set [ 127.455192][ T6473] binder: 6473 RLIMIT_NICE not set [ 127.456655][ T6473] binder: 6473 RLIMIT_NICE not set [ 127.457469][ T6473] binder: 6472:6473 sending u0000000000000001 node 72, cookie mismatch 0000000000000700 != 0000000000000000 [ 127.459400][ T6473] binder_debug: 2 callbacks suppressed [ 127.459413][ T6473] binder: 6473:6472 translate binder failed [ 127.464200][ T6473] binder: 6472:6473 transaction reply to 6472:6473 failed 75/29201/-22, size 88-24 line 3374 [ 127.466067][ T6473] binder: send failed reply for transaction 74 to 6472:6473 [ 127.484098][ T4374] binder: undelivered TRANSACTION_COMPLETE [ 127.485110][ T4374] binder: undelivered TRANSACTION_ERROR: 29201 [ 127.488791][ T4374] binder: undelivered TRANSACTION_ERROR: 29190 [ 127.633607][ T6481] netlink: 'syz.2.579': attribute type 10 has an invalid length. [ 127.640936][ T6481] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 127.678414][ T6490] netlink: 24 bytes leftover after parsing attributes in process `syz.4.580'. [ 128.564799][ T6498] netlink: 'syz.1.583': attribute type 1 has an invalid length. [ 128.616185][ T6498] 8021q: adding VLAN 0 to HW filter on device bond3 [ 128.712110][ T6509] bond3: (slave gretap1): making interface the new active one [ 128.715544][ T6509] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 128.716915][ T6514] netlink: 'syz.2.585': attribute type 2 has an invalid length. [ 128.718174][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): bond3: link becomes ready [ 128.735727][ T6525] device veth0_virt_wifi entered promiscuous mode [ 128.745140][ T6525] bond3: (slave veth0_virt_wifi): Enslaving as an active interface with an up link [ 128.763858][ T6498] bond3: (slave veth5): Enslaving as an active interface with a down link [ 128.937238][ T6533] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 128.965226][ T6533] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 129.260625][ T6533] net_ratelimit: 31420 callbacks suppressed [ 129.260632][ T6533] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 129.418974][ T4333] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 129.421425][ T4333] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 129.423096][ T4333] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 129.425274][ T4333] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 129.426972][ T4333] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 129.428438][ T4333] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 129.449227][ T6551] netlink: 'syz.4.594': attribute type 10 has an invalid length. [ 129.458611][ T6551] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 129.523515][ T6552] SET target dimension over the limit! [ 129.921182][ T6547] chnl_net:caif_netlink_parms(): no params data found [ 130.420475][ T4328] Bluetooth: hci3: command 0x0406 tx timeout [ 130.496259][ T6547] bridge0: port 1(bridge_slave_0) entered blocking state [ 130.498720][ T6547] bridge0: port 1(bridge_slave_0) entered disabled state [ 130.502538][ T6547] device bridge_slave_0 entered promiscuous mode [ 130.507102][ T6547] bridge0: port 2(bridge_slave_1) entered blocking state [ 130.508539][ T6547] bridge0: port 2(bridge_slave_1) entered disabled state [ 130.510332][ T6547] device bridge_slave_1 entered promiscuous mode [ 130.520802][ T6547] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 130.523537][ T6547] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 130.547934][ T6547] team0: Port device team_slave_0 added [ 130.556274][ T6547] team0: Port device team_slave_1 added [ 130.562599][ T6547] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 130.563791][ T6547] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 130.574472][ T6547] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 130.577163][ T6547] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 130.578297][ T6547] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 130.586044][ T6547] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 131.438196][ T6547] device hsr_slave_0 entered promiscuous mode [ 131.449741][ T4333] Bluetooth: hci1: command 0x0409 tx timeout [ 131.470994][ T6547] device hsr_slave_1 entered promiscuous mode [ 131.529883][ T6547] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 131.531333][ T6547] Cannot create hsr debugfs directory [ 131.963141][ T6547] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 132.061905][ T6547] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 132.171736][ T6547] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 132.316160][ T6547] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 132.543311][ T6547] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 132.571015][ T6547] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 132.620837][ T6547] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 132.669699][ T6547] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 132.734978][ T6547] 8021q: adding VLAN 0 to HW filter on device bond0 [ 132.739508][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 132.741335][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 132.745594][ T6547] 8021q: adding VLAN 0 to HW filter on device team0 [ 132.748211][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 132.750342][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 132.751736][ T4511] bridge0: port 1(bridge_slave_0) entered blocking state [ 132.752802][ T4511] bridge0: port 1(bridge_slave_0) entered forwarding state [ 132.754151][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 132.758095][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 132.761885][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 132.763459][ T4511] bridge0: port 2(bridge_slave_1) entered blocking state [ 132.764593][ T4511] bridge0: port 2(bridge_slave_1) entered forwarding state [ 132.769415][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 132.772538][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 132.774112][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 132.776706][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 132.781635][ T6547] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 132.783320][ T6547] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 132.790439][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 132.792138][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 132.793759][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 132.803827][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 132.805484][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 132.807105][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 132.810320][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 132.812988][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 132.846467][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 132.847781][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 132.851463][ T6547] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 132.858668][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 132.861077][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 132.872480][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 132.874073][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 132.875513][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 132.876915][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 132.880313][ T6547] device veth0_vlan entered promiscuous mode [ 132.885462][ T6547] device veth1_vlan entered promiscuous mode [ 132.898106][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 132.899760][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 132.901226][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 132.902640][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 132.906385][ T6547] device veth0_macvtap entered promiscuous mode [ 132.908858][ T6547] device veth1_macvtap entered promiscuous mode [ 132.914514][ T6547] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 132.916094][ T6547] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 132.917484][ T6547] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 132.919072][ T6547] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 132.921162][ T6547] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 132.922784][ T6547] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 132.924318][ T6547] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 132.926266][ T6547] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 132.927727][ T6547] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 132.929335][ T6547] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 132.933422][ T6547] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 132.934648][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 132.936332][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 132.937789][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 132.946391][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 132.965156][ T6547] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 132.966854][ T6547] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 132.968397][ T6547] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 132.971042][ T6547] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 132.972714][ T6547] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 132.974344][ T6547] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 132.975787][ T6547] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 132.977383][ T6547] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 132.978830][ T6547] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 132.984148][ T6547] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 132.986398][ T6547] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 132.987570][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 132.989138][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 132.992540][ T6547] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 132.993998][ T6547] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 132.995341][ T6547] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 132.996580][ T6547] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 133.035974][ T88] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 133.037222][ T88] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 133.038825][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 133.048434][ T4605] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 133.050004][ T4605] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 133.052793][ T4511] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 133.102352][ T6666] loop0: detected capacity change from 0 to 128 [ 133.114757][ T6664] loop1: detected capacity change from 0 to 1024 [ 133.126493][ T6668] loop2: detected capacity change from 0 to 2048 [ 133.132047][ T6664] EXT4-fs (loop1): VFS: Can't find ext4 filesystem [ 133.138321][ T6666] FAT-fs (loop0): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 4) [ 133.176545][ T6096] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 133.190567][ T6668] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 133.299454][ T4511] FAT-fs (loop0): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 4) [ 133.305801][ T6666] FAT-fs (loop0): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 4) [ 133.320204][ T6680] device syzkaller0 entered promiscuous mode [ 133.529783][ T4328] Bluetooth: hci1: command 0x041b tx timeout [ 133.820461][ T6700] netlink: 'syz.1.608': attribute type 10 has an invalid length. [ 133.833453][ T6700] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 135.403509][ T6763] loop4: detected capacity change from 0 to 764 [ 136.054269][ T4333] Bluetooth: hci1: command 0x040f tx timeout [ 136.294070][ T6779] netlink: 24 bytes leftover after parsing attributes in process `syz.5.627'. [ 136.333896][ T6779] netlink: 20 bytes leftover after parsing attributes in process `syz.5.627'. [ 136.346217][ T6777] tipc: Failed to remove unknown binding: 66,0,0/0:478691932/478691933 [ 136.347599][ T6777] tipc: Failed to remove unknown binding: 66,0,0/0:478691932/478691933 [ 136.348994][ T6781] tipc: Failed to remove unknown binding: 66,0,0/0:1163777587/1163777589 [ 136.427686][ T6785] device syzkaller0 entered promiscuous mode [ 138.090395][ T4333] Bluetooth: hci1: command 0x0419 tx timeout [ 138.166332][ T6817] netlink: 8 bytes leftover after parsing attributes in process `syz.0.637'. [ 138.167700][ T6817] netlink: 4 bytes leftover after parsing attributes in process `syz.0.637'. [ 138.224182][ T6817] 8021q: adding VLAN 0 to HW filter on device bond0 [ 138.246509][ T6817] bond1: (slave bond0): making interface the new active one [ 138.253312][ T6817] bond1: (slave bond0): Enslaving as an active interface with an up link [ 138.256042][ T6823] overlayfs: unrecognized mount option "\']*=°¢°©æ[\1\" or missing value [ 138.287981][ T6817] netlink: 'syz.0.637': attribute type 4 has an invalid length. [ 138.289319][ T6817] netlink: 152 bytes leftover after parsing attributes in process `syz.0.637'. [ 139.093282][ T6817] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 141.025907][ T6858] netlink: 12 bytes leftover after parsing attributes in process `syz.0.649'. [ 141.985730][ T6885] loop5: detected capacity change from 0 to 512 [ 141.987414][ T6885] EXT4-fs: Ignoring removed nobh option [ 142.002510][ T6885] EXT4-fs (loop5): Cannot turn on journaled quota: type 0: error -13 [ 142.006996][ T6885] EXT4-fs error (device loop5): ext4_clear_blocks:883: inode #13: comm syz.5.656: attempt to clear invalid blocks 1 len 1 [ 142.015662][ T6885] EXT4-fs (loop5): Remounting filesystem read-only [ 142.017177][ T6885] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 142.061783][ T6885] EXT4-fs (loop5): Remounting filesystem read-only [ 142.063297][ T6885] EXT4-fs error (device loop5): ext4_free_branches:1030: inode #13: comm syz.5.656: invalid indirect mapped block 1819239214 (level 0) [ 142.066159][ T6885] EXT4-fs (loop5): Remounting filesystem read-only [ 142.067375][ T6885] EXT4-fs error (device loop5): ext4_free_branches:1030: inode #13: comm syz.5.656: invalid indirect mapped block 1819239214 (level 1) [ 142.074384][ T6885] EXT4-fs (loop5): Remounting filesystem read-only [ 142.078383][ T6885] EXT4-fs (loop5): 1 truncate cleaned up [ 142.080475][ T6885] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 142.416473][ T6885] EXT4-fs (loop5): re-mounted. Quota mode: writeback. [ 142.556109][ T5693] EXT4-fs (loop5): unmounting filesystem. [ 143.282823][ T6912] loop1: detected capacity change from 0 to 512 [ 143.324877][ T6912] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a802c018, mo2=0002] [ 143.515060][ T6912] System zones: 1-4, 20-20, 36-39 [ 143.525774][ T6912] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 143.548789][ T27] audit: type=1326 audit(143.530:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6922 comm="syz.0.663" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffffbd178f68 code=0x0 [ 143.564399][ T6912] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a802c018, mo2=0002] [ 143.567788][ T6912] EXT4-fs (loop1): re-mounted. Quota mode: writeback. [ 143.595482][ T4326] EXT4-fs (loop1): unmounting filesystem. [ 143.729095][ T6930] loop1: detected capacity change from 0 to 164 [ 144.531318][ T6947] IPVS: set_ctl: invalid protocol: 92 127.0.0.1:20003 [ 145.689815][ T6960] netlink: 20 bytes leftover after parsing attributes in process `syz.0.677'. [ 145.691811][ T6960] x_tables: ip_tables: udp match: only valid for protocol 17 [ 146.064297][ T6970] loop5: detected capacity change from 0 to 128 [ 146.088818][ T6970] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 146.944626][ T6970] EXT4-fs warning (device loop5): ext4_dirblock_csum_verify:406: inode #2: comm syz.5.673: No space for directory leaf checksum. Please run e2fsck -D. [ 146.947244][ T6970] EXT4-fs error (device loop5): htree_dirblock_to_tree:1083: inode #2: comm syz.5.673: Directory block failed checksum [ 146.954237][ T6691] udevd[6691]: incorrect ext4 checksum on /dev/loop5 [ 147.003837][ T6970] EXT4-fs warning (device loop5): ext4_dirblock_csum_verify:406: inode #2: comm syz.5.673: No space for directory leaf checksum. Please run e2fsck -D. [ 147.007315][ T6970] EXT4-fs error (device loop5): __ext4_find_entry:1696: inode #2: comm syz.5.673: checksumming directory block 0 [ 147.020926][ T6970] EXT4-fs warning (device loop5): ext4_dirblock_csum_verify:406: inode #2: comm syz.5.673: No space for directory leaf checksum. Please run e2fsck -D. [ 147.023548][ T6970] EXT4-fs error (device loop5): __ext4_find_entry:1696: inode #2: comm syz.5.673: checksumming directory block 0 [ 147.028239][ T6984] netlink: 8 bytes leftover after parsing attributes in process `syz.1.675'. [ 147.030106][ T6984] netlink: 4 bytes leftover after parsing attributes in process `syz.1.675'. [ 147.032400][ T6970] EXT4-fs warning (device loop5): ext4_dirblock_csum_verify:406: inode #2: comm syz.5.673: No space for directory leaf checksum. Please run e2fsck -D. [ 147.034682][ T6970] EXT4-fs error (device loop5): __ext4_find_entry:1696: inode #2: comm syz.5.673: checksumming directory block 0 [ 147.383612][ T6970] EXT4-fs warning (device loop5): ext4_dirblock_csum_verify:406: inode #2: comm syz.5.673: No space for directory leaf checksum. Please run e2fsck -D. [ 147.386058][ T6970] EXT4-fs error (device loop5): __ext4_find_entry:1696: inode #2: comm syz.5.673: checksumming directory block 0 [ 147.389924][ T6984] 8021q: adding VLAN 0 to HW filter on device bond0 [ 147.390449][ T6989] EXT4-fs warning (device loop5): ext4_dirblock_csum_verify:406: inode #2: comm syz.5.673: No space for directory leaf checksum. Please run e2fsck -D. [ 147.394756][ T6984] bond4: (slave bond0): making interface the new active one [ 147.396879][ T6989] EXT4-fs error (device loop5): __ext4_find_entry:1696: inode #2: comm syz.5.673: checksumming directory block 0 [ 147.398484][ T6984] bond4: (slave bond0): Enslaving as an active interface with an up link [ 147.403690][ T6992] netlink: 'syz.1.675': attribute type 4 has an invalid length. [ 147.405051][ T6992] netlink: 152 bytes leftover after parsing attributes in process `syz.1.675'. [ 147.407653][ T6993] EXT4-fs warning (device loop5): ext4_dirblock_csum_verify:406: inode #2: comm syz.5.673: No space for directory leaf checksum. Please run e2fsck -D. [ 147.416919][ T6993] EXT4-fs error (device loop5): __ext4_find_entry:1696: inode #2: comm syz.5.673: checksumming directory block 0 [ 147.429216][ T6970] EXT4-fs warning (device loop5): ext4_dirblock_csum_verify:406: inode #2: comm syz.5.673: No space for directory leaf checksum. Please run e2fsck -D. [ 147.434550][ T6992] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 147.442675][ T6970] EXT4-fs error (device loop5): __ext4_find_entry:1696: inode #2: comm syz.5.673: checksumming directory block 0 [ 147.452901][ T6970] EXT4-fs warning (device loop5): ext4_dirblock_csum_verify:406: inode #2: comm syz.5.673: No space for directory leaf checksum. Please run e2fsck -D. [ 147.460535][ T6970] EXT4-fs error (device loop5): __ext4_find_entry:1696: inode #2: comm syz.5.673: checksumming directory block 0 [ 147.470206][ T6970] EXT4-fs warning (device loop5): ext4_dirblock_csum_verify:406: inode #2: comm syz.5.673: No space for directory leaf checksum. Please run e2fsck -D. [ 147.474664][ T6995] loop4: detected capacity change from 0 to 8192 [ 147.476059][ T6970] EXT4-fs error (device loop5): __ext4_find_entry:1696: inode #2: comm syz.5.673: checksumming directory block 0 [ 147.501579][ T5693] EXT4-fs (loop5): unmounting filesystem. [ 147.539003][ T7001] bond0: (slave netdevsim0): Error: Slave device does not support XDP [ 147.549909][ T7001] netlink: 104 bytes leftover after parsing attributes in process `syz.1.684'. [ 148.040814][ T7006] bridge0: port 2(bridge_slave_1) entered disabled state [ 148.042566][ T7006] bridge0: port 1(bridge_slave_0) entered disabled state [ 149.578840][ T7006] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 149.627503][ T7006] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 150.146545][ T7006] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.148198][ T7006] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.149948][ T7006] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.151512][ T7006] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 150.350347][ T7001] netlink: 'syz.1.684': attribute type 10 has an invalid length. [ 150.371352][ T7001] bridge0: port 2(bridge_slave_1) entered disabled state [ 150.376239][ T7001] device bridge_slave_1 left promiscuous mode [ 150.377277][ T7001] bridge0: port 2(bridge_slave_1) entered disabled state [ 150.426542][ T7001] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 150.480568][ T7030] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 150.777345][ T7030] device batadv_slave_1 entered promiscuous mode [ 150.823312][ T7046] device syzkaller0 entered promiscuous mode [ 150.829158][ T7048] netlink: 'syz.2.697': attribute type 1 has an invalid length. [ 150.838253][ T7048] device bond3 entered promiscuous mode [ 150.841515][ T7048] 8021q: adding VLAN 0 to HW filter on device bond3 [ 150.877145][ T7048] bond3: (slave bridge1): making interface the new active one [ 150.878527][ T7048] device bridge1 entered promiscuous mode [ 150.894054][ T7048] bond3: (slave bridge1): Enslaving as an active interface with an up link [ 150.908778][ T6845] IPv6: ADDRCONF(NETDEV_CHANGE): bond3: link becomes ready [ 151.297012][ T7070] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 151.436196][ T7072] bridge0: port 1(bridge_slave_0) entered disabled state [ 152.361384][ T7094] netlink: 83992 bytes leftover after parsing attributes in process `syz.0.709'. [ 152.363225][ T7094] netlink: zone id is out of range [ 152.364020][ T7094] netlink: zone id is out of range [ 152.365652][ T7094] netlink: zone id is out of range [ 152.575544][ T7094] netlink: set zone limit has 8 unknown bytes [ 152.775271][ T7072] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 152.793735][ T7072] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 153.146747][ T7072] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 153.148391][ T7072] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 153.150347][ T7072] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 153.442449][ T7070] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 153.457575][ T7101] netlink: 8 bytes leftover after parsing attributes in process `syz.4.712'. [ 153.459185][ T7101] netlink: 4 bytes leftover after parsing attributes in process `syz.4.712'. [ 153.474747][ T7101] 8021q: adding VLAN 0 to HW filter on device bond0 [ 153.480725][ T7101] bond3: (slave bond0): making interface the new active one [ 153.484396][ T7101] bond3: (slave bond0): Enslaving as an active interface with an up link [ 153.486258][ T7102] netlink: 'syz.4.712': attribute type 4 has an invalid length. [ 153.500470][ T7102] netlink: 152 bytes leftover after parsing attributes in process `syz.4.712'. [ 153.509210][ T7102] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 153.583967][ T7070] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 153.610037][ T4333] Bluetooth: hci2: command 0x0406 tx timeout [ 153.611093][ T4333] Bluetooth: hci3: command 0x0406 tx timeout [ 154.741435][ T7070] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 155.525532][ T27] audit: type=1326 audit(155.510:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7127 comm="syz.4.721" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff8e778f68 code=0x7fc00000 [ 155.532162][ T27] audit: type=1326 audit(155.520:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7127 comm="syz.4.721" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=0 arch=c00000b7 syscall=94 compat=0 ip=0xffff8e778f68 code=0x7fc00000 [ 155.707896][ T7145] loop4: detected capacity change from 0 to 256 [ 155.741229][ T7145] FAT-fs (loop4): Directory bread(block 64) failed [ 155.742460][ T7145] FAT-fs (loop4): Directory bread(block 65) failed [ 155.743526][ T7145] FAT-fs (loop4): Directory bread(block 66) failed [ 155.744552][ T7145] FAT-fs (loop4): Directory bread(block 67) failed [ 155.745766][ T7145] FAT-fs (loop4): Directory bread(block 68) failed [ 155.747987][ T7145] FAT-fs (loop4): Directory bread(block 69) failed [ 155.753585][ T7145] FAT-fs (loop4): Directory bread(block 70) failed [ 155.814782][ T7145] FAT-fs (loop4): Directory bread(block 71) failed [ 155.823627][ T7145] FAT-fs (loop4): Directory bread(block 72) failed [ 155.824688][ T7145] FAT-fs (loop4): Directory bread(block 73) failed [ 155.860029][ T7140] bridge0: port 2(bridge_slave_1) entered disabled state [ 155.861418][ T7140] bridge0: port 1(bridge_slave_0) entered disabled state [ 156.740729][ T4328] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 156.742217][ T4328] Bluetooth: hci4: Injecting HCI hardware error event [ 156.744360][ T4333] Bluetooth: hci4: hardware error 0x00 [ 156.858252][ T7140] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 157.096066][ T7140] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 157.097628][ T7140] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 157.098960][ T7140] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 157.100497][ T7140] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 157.335044][ T7140] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 157.336496][ T7140] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 157.337898][ T7140] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 157.339222][ T7140] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 157.434901][ T7070] netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 157.523518][ T7159] netlink: 24 bytes leftover after parsing attributes in process `syz.1.731'. [ 157.541712][ T7070] netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 157.545753][ T7070] netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 157.548683][ T7070] netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 157.922692][ T7166] netlink: 8 bytes leftover after parsing attributes in process `syz.2.729'. [ 157.934525][ T7166] netlink: 4 bytes leftover after parsing attributes in process `syz.2.729'. [ 157.954870][ T7166] 8021q: adding VLAN 0 to HW filter on device bond0 [ 157.970891][ T7166] bond4: (slave bond0): making interface the new active one [ 157.983503][ T7166] bond4: (slave bond0): Enslaving as an active interface with an up link [ 157.985078][ T7171] netlink: 'syz.2.729': attribute type 4 has an invalid length. [ 157.989425][ T7171] netlink: 152 bytes leftover after parsing attributes in process `syz.2.729'. [ 158.004648][ T7171] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 158.899740][ T4333] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 159.311472][ T7214] netlink: 'syz.5.738': attribute type 1 has an invalid length. [ 159.322686][ T7214] device bond2 entered promiscuous mode [ 159.323966][ T7214] 8021q: adding VLAN 0 to HW filter on device bond2 [ 159.385205][ T7221] bond2: (slave bridge1): making interface the new active one [ 159.386498][ T7221] device bridge1 entered promiscuous mode [ 159.387970][ T7221] bond2: (slave bridge1): Enslaving as an active interface with an up link [ 159.389354][ T7223] tipc: Started in network mode [ 159.390403][ T7223] tipc: Node identity 7f000001, cluster identity 4711 [ 159.392136][ T7223] tipc: Enabled bearer , priority 10 [ 159.412423][ T4444] IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready [ 159.547431][ T7223] netlink: 104 bytes leftover after parsing attributes in process `syz.0.740'. [ 159.852476][ T4333] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 159.854018][ T4333] Bluetooth: hci1: Injecting HCI hardware error event [ 159.856602][ T4333] Bluetooth: hci1: hardware error 0x00 [ 160.016630][ T7223] tipc: New replicast peer: fe80:0000:0000:0000:0000:0000:0000:00bb [ 160.021924][ T7223] tipc: Enabled bearer , priority 10 [ 160.660416][ T7266] IPVS: set_ctl: invalid protocol: 92 127.0.0.1:20003 [ 161.091546][ T113] tipc: Node number set to 2130706433 [ 161.819082][ T7282] loop1: detected capacity change from 0 to 512 [ 162.586034][ T4333] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 162.588345][ T7282] EXT4-fs (loop1): external journal device major/minor numbers have changed [ 162.589878][ T7282] EXT4-fs (loop1): failed to open journal device unknown-block(8,1) -6 [ 162.673257][ T4333] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 162.675089][ T4333] CPU: 1 PID: 4333 Comm: kworker/u5:3 Not tainted syzkaller #0 [ 162.676466][ T4333] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 162.678239][ T4333] Workqueue: hci0 hci_rx_work [ 162.679015][ T4333] Call trace: [ 162.679568][ T4333] dump_backtrace+0x1c4/0x1f0 [ 162.680336][ T4333] show_stack+0x2c/0x3c [ 162.680972][ T4333] __dump_stack+0x30/0x40 [ 162.681668][ T4333] dump_stack_lvl+0xf4/0x15c [ 162.682434][ T4333] dump_stack+0x1c/0x5c [ 162.683110][ T4333] sysfs_create_dir_ns+0x244/0x264 [ 162.683888][ T4333] kobject_add_internal+0x5a8/0xb18 [ 162.684707][ T4333] kobject_add+0x144/0x20c [ 162.685441][ T4333] device_add+0x3dc/0xe4c [ 162.686126][ T4333] hci_conn_add_sysfs+0xb8/0x1bc [ 162.686898][ T4333] le_conn_complete_evt+0xcd4/0x127c [ 162.687780][ T4333] hci_le_conn_complete_evt+0x114/0x3b8 [ 162.688673][ T4333] hci_le_meta_evt+0x2c0/0x4a8 [ 162.689419][ T4333] hci_event_packet+0x64c/0xe60 [ 162.690232][ T4333] hci_rx_work+0x320/0xa94 [ 162.690903][ T4333] process_one_work+0x7e4/0x13bc [ 162.691695][ T4333] worker_thread+0x8cc/0xfe8 [ 162.692488][ T4333] kthread+0x254/0x2e0 [ 162.693162][ T4333] ret_from_fork+0x10/0x20 [ 162.693889][ C1] vkms_vblank_simulate: vblank timer overrun [ 162.695579][ T4333] kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 162.697708][ T4333] Bluetooth: hci0: failed to register connection device [ 162.719777][ T7292] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 162.721440][ T7292] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 162.845660][ T7305] netlink: 'syz.4.753': attribute type 16 has an invalid length. [ 162.846978][ T7305] netlink: 'syz.4.753': attribute type 17 has an invalid length. [ 162.848485][ T7305] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 162.853708][ T7305] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 162.860211][ T7305] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 162.861776][ T7305] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 162.863837][ T7305] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 162.871599][ T7305] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 162.873520][ T7305] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 162.875972][ T7305] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 162.877905][ T7305] IPv6: ADDRCONF(NETDEV_CHANGE): sit0: link becomes ready [ 162.881717][ T7305] IPv6: ADDRCONF(NETDEV_CHANGE): ip6tnl0: link becomes ready [ 162.883632][ T7305] IPv6: ADDRCONF(NETDEV_CHANGE): ip6gre0: link becomes ready [ 162.885557][ T7305] IPv6: ADDRCONF(NETDEV_CHANGE): syz_tun: link becomes ready [ 162.887476][ T7305] IPv6: ADDRCONF(NETDEV_CHANGE): ip6gretap0: link becomes ready [ 162.890839][ T7305] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 162.892250][ T7305] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 162.894188][ T7305] IPv6: ADDRCONF(NETDEV_CHANGE): dummy0: link becomes ready [ 162.896750][ T7305] IPv6: ADDRCONF(NETDEV_CHANGE): nlmon0: link becomes ready [ 162.930104][ T7305] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 162.932758][ T7308] netlink: 'syz.0.761': attribute type 1 has an invalid length. [ 162.946625][ T7308] device bond2 entered promiscuous mode [ 162.947608][ T7308] 8021q: adding VLAN 0 to HW filter on device bond2 [ 163.497405][ T7308] bond2: (slave bridge1): making interface the new active one [ 163.498940][ T7308] device bridge1 entered promiscuous mode [ 163.502198][ T7308] bond2: (slave bridge1): Enslaving as an active interface with an up link [ 163.504148][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready [ 164.412839][ T7322] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 164.414644][ T7322] device batadv_slave_1 entered promiscuous mode [ 164.987904][ T88] device hsr_slave_0 left promiscuous mode [ 165.070355][ T88] device hsr_slave_1 left promiscuous mode [ 165.084412][ T7352] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 165.084412][ T7352] The task syz.5.771 (7352) triggered the difference, watch for misbehavior. [ 165.420020][ T88] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 165.421360][ T88] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 165.427435][ T88] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 165.434623][ T88] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 165.437196][ T88] device bridge_slave_1 left promiscuous mode [ 165.440633][ T88] bridge0: port 2(bridge_slave_1) entered disabled state [ 165.455175][ T7358] loop4: detected capacity change from 0 to 256 [ 165.463899][ T88] device bridge_slave_0 left promiscuous mode [ 165.466463][ T88] bridge0: port 1(bridge_slave_0) entered disabled state [ 165.471985][ T7358] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0xf4000b1f, utbl_chksum : 0xe619d30d) [ 165.589779][ T88] device veth1_macvtap left promiscuous mode [ 165.591587][ T88] device veth0_macvtap left promiscuous mode [ 165.592766][ T88] device veth1_vlan left promiscuous mode [ 165.593919][ T88] device veth0_vlan left promiscuous mode [ 165.769059][ T88] bond2 (unregistering): Released all slaves [ 165.844465][ T7362] binder: BINDER_SET_CONTEXT_MGR already set [ 165.845764][ T7362] binder: 7361:7362 ioctl 4018620d 20004a80 returned -16 [ 165.854646][ T7362] binder: tried to use weak ref as strong ref [ 165.855693][ T7362] binder: 7361:7362 Acquire 1 refcount change on invalid ref 0 ret -22 [ 165.861375][ T7362] binder: 7361:7362 got transaction to invalid handle, 1 [ 165.862445][ T7362] binder: 7362:7361 cannot find target node [ 165.863471][ T7362] binder: 7361:7362 transaction call to 0:0 failed 78/29201/-22, size 0-0 line 3045 [ 165.887151][ T7362] binder: 7361:7362 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 165.893835][ T7362] binder: 7362 RLIMIT_NICE not set [ 165.953340][ T7367] binder: 7361:7367 got reply transaction with no transaction stack [ 165.955002][ T7367] binder: 7361:7367 transaction reply to 0:0 failed 79/29201/-71, size 88-24 line 2946 [ 166.213956][ T88] bond1 (unregistering): (slave bridge1): Releasing backup interface [ 166.665321][ T7084] binder: undelivered TRANSACTION_ERROR: 29201 [ 166.666525][ T7084] binder: undelivered TRANSACTION_ERROR: 29201 [ 167.050969][ T88] bond1 (unregistering): Released all slaves [ 168.809799][ T4333] Bluetooth: hci0: command 0x0406 tx timeout [ 169.044053][ T88] team0 (unregistering): Port device team_slave_1 removed [ 169.240861][ T88] team0 (unregistering): Port device team_slave_0 removed [ 169.410814][ T88] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 170.910623][ T88] bond0 (unregistering): Released all slaves [ 171.141482][ T7360] netlink: 'syz.4.776': attribute type 1 has an invalid length. [ 172.149847][ T7405] loop5: detected capacity change from 0 to 512 [ 172.166956][ T7405] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 172.239176][ T7405] EXT4-fs (loop5): required journal recovery suppressed and not mounted read-only [ 172.694602][ T7416] Invalid ELF header magic: != ELF [ 173.600989][ T7427] binder: 7426:7427 tried to acquire reference to desc 0, got 1 instead [ 173.604378][ T7427] binder_alloc: 7426: pid 7426 spamming oneway? 2 buffers allocated for a total size of 5120 [ 173.621256][ T4379] binder: undelivered TRANSACTION_COMPLETE [ 173.622302][ T4379] binder: undelivered TRANSACTION_COMPLETE [ 173.646191][ T4375] binder: undelivered transaction 85, process died. [ 173.647555][ T4375] binder: undelivered transaction 84, process died. [ 174.128500][ T7439] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 174.143211][ T7439] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 174.146900][ T7439] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 175.718564][ T7470] netlink: 'syz.4.810': attribute type 1 has an invalid length. [ 176.040752][ T7475] netlink: 'syz.2.811': attribute type 1 has an invalid length. [ 176.055791][ T7475] device bond5 entered promiscuous mode [ 176.057001][ T7475] 8021q: adding VLAN 0 to HW filter on device bond5 [ 176.067468][ T7470] bond4: (slave gretap1): making interface the new active one [ 176.071590][ T7470] bond4: (slave gretap1): Enslaving as an active interface with an up link [ 176.119255][ T7470] bond4: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 176.173881][ T7475] bond5: (slave bridge2): making interface the new active one [ 176.175376][ T7475] device bridge2 entered promiscuous mode [ 176.177865][ T7475] bond5: (slave bridge2): Enslaving as an active interface with an up link [ 176.179533][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): bond5: link becomes ready [ 176.193305][ T7488] bond1: option mode: unable to set because the bond device has slaves [ 176.204972][ T7488] bond1: (slave ip6gretap1): Enslaving as an active interface with an up link [ 176.344277][ T7492] IPv6: ADDRCONF(NETDEV_CHANGE): gre1: link becomes ready [ 177.860288][ T7522] netlink: 'syz.4.827': attribute type 10 has an invalid length. [ 177.861965][ T7522] wlan1: mtu less than device minimum [ 177.867208][ T7522] bond0: (slave wlan1): Error -22 calling dev_set_mtu [ 178.480863][ T7543] bridge0: port 3(macvlan2) entered blocking state [ 178.482328][ T7543] bridge0: port 3(macvlan2) entered disabled state [ 179.054360][ T7543] device macvlan2 entered promiscuous mode [ 179.160223][ T7543] bridge0: port 3(macvlan2) entered blocking state [ 179.161519][ T7543] bridge0: port 3(macvlan2) entered forwarding state [ 179.163986][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 179.166607][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): vlan2: link becomes ready [ 179.168271][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0.257: link becomes ready [ 179.690636][ T7553] Soft offlining pfn 0x1421a2 at process virtual address 0x20000000 [ 179.695044][ T7553] Soft offlining pfn 0x1421a3 at process virtual address 0x20001000 [ 179.696504][ T7553] Soft offlining pfn 0x1445aa at process virtual address 0x20002000 [ 179.697825][ T7553] Soft offlining pfn 0x1445ab at process virtual address 0x20003000 [ 179.699197][ T7553] Soft offlining pfn 0x1430b4 at process virtual address 0x20004000 [ 179.700643][ T7553] Soft offlining pfn 0x1430b5 at process virtual address 0x20005000 [ 179.701918][ T7553] Soft offlining pfn 0x1429fc at process virtual address 0x20006000 [ 179.703151][ T7553] Soft offlining pfn 0x1429fd at process virtual address 0x20007000 [ 179.704482][ T7553] Soft offlining pfn 0x11de78 at process virtual address 0x20008000 [ 179.705887][ T7553] Soft offlining pfn 0x11de79 at process virtual address 0x20009000 [ 179.707266][ T7553] Soft offlining pfn 0x142a4c at process virtual address 0x2000a000 [ 179.708576][ T7553] Soft offlining pfn 0x142a4d at process virtual address 0x2000b000 [ 179.709979][ T7553] Soft offlining pfn 0x139444 at process virtual address 0x2000c000 [ 179.711263][ T7553] Soft offlining pfn 0x139445 at process virtual address 0x2000d000 [ 179.712588][ T7553] Soft offlining pfn 0x14a09a at process virtual address 0x2000e000 [ 179.713977][ T7553] Soft offlining pfn 0x14a09b at process virtual address 0x2000f000 [ 179.715272][ T7553] Soft offlining pfn 0x121592 at process virtual address 0x20010000 [ 179.716655][ T7553] Soft offlining pfn 0x121593 at process virtual address 0x20011000 [ 180.190262][ T7566] netlink: 4 bytes leftover after parsing attributes in process `syz.0.843'. [ 181.288527][ T7583] netlink: 12 bytes leftover after parsing attributes in process `syz.0.846'. [ 181.314062][ T7583] bridge2: port 1(veth0_to_bond) entered blocking state [ 181.315381][ T7583] bridge2: port 1(veth0_to_bond) entered disabled state [ 181.317135][ T7583] device veth0_to_bond entered promiscuous mode [ 181.582210][ T7586] netlink: 8 bytes leftover after parsing attributes in process `syz.4.845'. [ 183.687092][ T7685] Soft offlining pfn 0x13ba5c at process virtual address 0x20000000 [ 183.689538][ T7685] Soft offlining pfn 0x144be5 at process virtual address 0x20001000 [ 183.691184][ T7685] Soft offlining pfn 0x144182 at process virtual address 0x20002000 [ 183.692527][ T7685] Soft offlining pfn 0x144be4 at process virtual address 0x20003000 [ 183.693900][ T7685] Soft offlining pfn 0x13ba5a at process virtual address 0x20004000 [ 183.695246][ T7685] Soft offlining pfn 0x13e452 at process virtual address 0x20005000 [ 183.696565][ T7685] Soft offlining pfn 0x143efc at process virtual address 0x20006000 [ 183.697841][ T7685] Soft offlining pfn 0x144549 at process virtual address 0x20007000 [ 183.699066][ T7685] Soft offlining pfn 0x144548 at process virtual address 0x20008000 [ 183.700488][ T7685] Soft offlining pfn 0x1443eb at process virtual address 0x20009000 [ 183.701853][ T7685] Soft offlining pfn 0x121ff9 at process virtual address 0x2000a000 [ 183.703090][ T7685] Soft offlining pfn 0x1443ea at process virtual address 0x2000b000 [ 183.704426][ T7685] Soft offlining pfn 0x1458f1 at process virtual address 0x2000c000 [ 183.705679][ T7685] Soft offlining pfn 0x14354b at process virtual address 0x2000d000 [ 183.706994][ T7685] Soft offlining pfn 0x1458f0 at process virtual address 0x2000e000 [ 183.708313][ T7685] Soft offlining pfn 0x145374 at process virtual address 0x2000f000 [ 183.709661][ T7685] Soft offlining pfn 0x145373 at process virtual address 0x20010000 [ 183.710948][ T7685] Soft offlining pfn 0x145372 at process virtual address 0x20011000 [ 184.124097][ T7693] 8021q: adding VLAN 0 to HW filter on device bond3 [ 184.137748][ T7693] device veth0 entered promiscuous mode [ 184.139569][ T7693] bond3: (slave macvlan2): making interface the new active one [ 184.787122][ T7693] bond3: (slave macvlan2): Enslaving as an active interface with an up link [ 184.794436][ T4512] IPv6: ADDRCONF(NETDEV_CHANGE): bond3: link becomes ready [ 184.838820][ T7695] netlink: 4 bytes leftover after parsing attributes in process `syz.0.855'. [ 185.288775][ T7720] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 185.291721][ T7720] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 185.311776][ T7720] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 185.314650][ T7720] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 185.317321][ T7714] loop4: detected capacity change from 0 to 2048 [ 185.333186][ T7723] overlayfs: failed to clone upperpath [ 185.896404][ T7742] sctp: [Deprecated]: syz.1.868 (pid 7742) Use of struct sctp_assoc_value in delayed_ack socket option. [ 185.896404][ T7742] Use struct sctp_sack_info instead [ 186.582199][ T7754] netlink: 12 bytes leftover after parsing attributes in process `syz.2.872'. [ 187.903894][ T7767] netlink: 4 bytes leftover after parsing attributes in process `syz.1.874'. [ 188.021864][ T7768] overlayfs: failed to clone upperpath [ 188.039825][ T2061] ieee802154 phy0 wpan0: encryption failed: -22 [ 188.040914][ T2061] ieee802154 phy1 wpan1: encryption failed: -22 [ 188.634389][ T7781] netlink: 12 bytes leftover after parsing attributes in process `syz.1.882'. [ 188.664803][ T7781] 8021q: adding VLAN 0 to HW filter on device bond5 [ 189.285785][ T7779] block device autoloading is deprecated and will be removed. [ 189.303776][ T7781] device macvlan2 entered promiscuous mode [ 189.360995][ T7790] loop5: detected capacity change from 0 to 128 [ 189.412338][ T7781] bond5: (slave vti0): refused to change device type [ 189.426813][ T7795] loop4: detected capacity change from 0 to 256 [ 189.436213][ T7790] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 189.495473][ T7798] netlink: 20 bytes leftover after parsing attributes in process `syz.2.883'. [ 189.720244][ T7795] FAT-fs (loop4): Directory bread(block 64) failed [ 189.739810][ T7795] FAT-fs (loop4): Directory bread(block 65) failed [ 189.741550][ T7795] FAT-fs (loop4): Directory bread(block 66) failed [ 189.742609][ T7795] FAT-fs (loop4): Directory bread(block 67) failed [ 189.743641][ T7795] FAT-fs (loop4): Directory bread(block 68) failed [ 189.744597][ T7795] FAT-fs (loop4): Directory bread(block 69) failed [ 189.745603][ T7795] FAT-fs (loop4): Directory bread(block 70) failed [ 189.746663][ T7795] FAT-fs (loop4): Directory bread(block 71) failed [ 189.747693][ T7795] FAT-fs (loop4): Directory bread(block 72) failed [ 189.762633][ T7795] FAT-fs (loop4): Directory bread(block 73) failed [ 189.907486][ T7803] PKCS7: Unknown OID: [4] 0.0 [ 189.908763][ T7803] PKCS7: Only support pkcs7_signedData type [ 190.324000][ T5693] EXT4-fs (loop5): unmounting filesystem. [ 190.742714][ T7814] netlink: 4 bytes leftover after parsing attributes in process `syz.5.891'. [ 190.868906][ T7829] netlink: 'syz.2.907': attribute type 10 has an invalid length. [ 191.943224][ T7850] PKCS7: Unknown OID: [4] 0.0 [ 191.944193][ T7850] PKCS7: Only support pkcs7_signedData type [ 192.099264][ T7861] tipc: Started in network mode [ 192.100240][ T7861] tipc: Node identity 4, cluster identity 4711 [ 192.101340][ T7861] tipc: Node number set to 4 [ 192.626494][ T7874] loop4: detected capacity change from 0 to 1024 [ 192.630346][ T7874] EXT4-fs: Ignoring removed bh option [ 192.631432][ T7874] EXT4-fs: Ignoring removed oldalloc option [ 192.632464][ T7874] EXT4-fs: Ignoring removed nomblk_io_submit option [ 192.638710][ T7874] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 192.728362][ T7874] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e841c01c, mo2=0003] [ 192.730103][ T7874] System zones: 0-1, 3-36 [ 192.823206][ T7874] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 193.410764][ T7877] 9pnet: p9_errstr2errno: server reported unknown error ÈVmI®LÓâ—…N [ 193.686327][ T4337] EXT4-fs (loop4): unmounting filesystem. [ 194.004434][ T27] audit: type=1326 audit(193.990:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7882 comm="syz.1.914" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffffb0778f68 code=0x0 [ 196.421170][ T7930] loop1: detected capacity change from 0 to 4096 [ 196.461370][ T7933] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 196.464175][ T7710] udevd[7710]: incorrect nilfs2 checksum on /dev/loop1 [ 196.576488][ T7938] netlink: 'syz.5.931': attribute type 4 has an invalid length. [ 196.603106][ T7938] netlink: 'syz.5.931': attribute type 4 has an invalid length. [ 197.068546][ T7949] loop5: detected capacity change from 0 to 128 [ 197.094717][ T7949] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 197.372108][ T5693] EXT4-fs (loop5): unmounting filesystem. [ 197.413407][ T7962] device syzkaller0 entered promiscuous mode [ 197.474398][ T7966] netlink: 24 bytes leftover after parsing attributes in process `syz.2.948'. [ 199.720854][ T8020] netlink: 'syz.1.954': attribute type 1 has an invalid length. [ 199.740982][ T8020] 8021q: adding VLAN 0 to HW filter on device bond6 [ 199.751143][ T8020] device gretap2 entered promiscuous mode [ 199.755341][ T8020] bond6: (slave gretap2): making interface the new active one [ 199.757362][ T8020] bond6: (slave gretap2): Enslaving as an active interface with an up link [ 199.759542][ T8023] netlink: 'syz.0.955': attribute type 1 has an invalid length. [ 199.771474][ T8023] 8021q: adding VLAN 0 to HW filter on device bond3 [ 199.773554][ T1668] IPv6: ADDRCONF(NETDEV_CHANGE): bond6: link becomes ready [ 199.924695][ T8020] device macvlan3 entered promiscuous mode [ 200.148319][ T8020] device bond6 entered promiscuous mode [ 200.150000][ T8020] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 200.152150][ T8020] bond6: (slave macvlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 200.154934][ T8020] device bond6 left promiscuous mode [ 200.600945][ T8023] bond3: (slave dummy0): making interface the new active one [ 200.607607][ T8023] bond3: (slave dummy0): Enslaving as an active interface with an up link [ 200.617689][ T6319] IPv6: ADDRCONF(NETDEV_CHANGE): bond3: link becomes ready [ 203.264596][ T8070] binder: 8068:8070 tried to acquire reference to desc 0, got 1 instead [ 203.273284][ T8070] binder: 8068:8070 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 203.278612][ T8072] netlink: 24 bytes leftover after parsing attributes in process `syz.0.969'. [ 203.281187][ T8070] binder: 8070 RLIMIT_NICE not set [ 203.282003][ T8070] binder: 8070 RLIMIT_NICE not set [ 203.285689][ T8070] binder: release 8068:8070 transaction 90 in, still active [ 203.292496][ T8070] binder: send failed reply for transaction 90 to 8068:8070 [ 203.298194][ T22] binder: release 8068:8070 transaction 91 out, still active [ 203.299477][ T22] binder: undelivered TRANSACTION_COMPLETE [ 203.300585][ T22] binder: undelivered TRANSACTION_ERROR: 29189 [ 203.301519][ T22] binder: undelivered TRANSACTION_COMPLETE [ 203.317913][ T4375] binder: send failed reply for transaction 91, target dead [ 203.688426][ T8081] netlink: 20 bytes leftover after parsing attributes in process `syz.0.971'. [ 203.711547][ T8083] loop1: detected capacity change from 0 to 128 [ 203.738288][ T8083] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 204.404330][ T4326] EXT4-fs (loop1): unmounting filesystem. [ 206.476896][ T8116] binder: 8115:8116 tried to acquire reference to desc 0, got 1 instead [ 206.490516][ T8116] binder: 8115:8116 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 206.498971][ T8116] binder: 8116 RLIMIT_NICE not set [ 207.064634][ T8116] binder: 8116 RLIMIT_NICE not set [ 207.066013][ T8116] binder: release 8115:8116 transaction 96 out, still active [ 207.080409][ T8116] binder: undelivered TRANSACTION_COMPLETE [ 207.099409][ T22] binder: send failed reply for transaction 103 to 8115:8119 [ 207.526056][ T8133] device syzkaller0 entered promiscuous mode [ 208.274981][ T8147] netlink: 20 bytes leftover after parsing attributes in process `syz.5.988'. [ 211.865794][ T8176] netlink: 156 bytes leftover after parsing attributes in process `syz.2.1001'. [ 211.873393][ T8176] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1001'. [ 211.956514][ T8196] loop5: detected capacity change from 0 to 1024 [ 211.978579][ T8196] syz.5.1005: attempt to access beyond end of device [ 211.978579][ T8196] loop5: rw=0, sector=393346, nr_sectors = 2 limit=1024 [ 211.981820][ T8196] syz.5.1005: attempt to access beyond end of device [ 211.981820][ T8196] loop5: rw=2049, sector=393220, nr_sectors = 2 limit=1024 [ 211.984127][ T8196] Buffer I/O error on dev loop5, logical block 196610, lost async page write [ 211.986745][ T8196] syz.5.1005: attempt to access beyond end of device [ 211.986745][ T8196] loop5: rw=2049, sector=393222, nr_sectors = 120 limit=1024 [ 211.995116][ T8196] syz.5.1005: attempt to access beyond end of device [ 211.995116][ T8196] loop5: rw=0, sector=5778, nr_sectors = 2 limit=1024 [ 212.000467][ T8196] syz.5.1005: attempt to access beyond end of device [ 212.000467][ T8196] loop5: rw=0, sector=5778, nr_sectors = 2 limit=1024 [ 212.606910][ T8211] netlink: 'syz.5.1009': attribute type 1 has an invalid length. [ 212.615279][ T8211] 8021q: adding VLAN 0 to HW filter on device bond4 [ 212.639969][ T8207] capability: warning: `syz.1.1008' uses 32-bit capabilities (legacy support in use) [ 212.652079][ T8211] bond4: (slave gretap2): making interface the new active one [ 212.654509][ T8211] bond4: (slave gretap2): Enslaving as an active interface with an up link [ 212.656363][ T4373] IPv6: ADDRCONF(NETDEV_CHANGE): bond4: link becomes ready [ 214.535663][ T27] audit: type=1326 audit(214.520:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8236 comm="syz.0.1017" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffffbd178f68 code=0x0 [ 214.655335][ T8238] 9p: Unknown Cache mode readahead [ 215.088688][ T8249] loop1: detected capacity change from 0 to 256 [ 215.117168][ T8249] exFAT-fs (loop1): failed to load upcase table (idx : 0x0000fd4f, chksum : 0x3963664b, utbl_chksum : 0xe619d30d) [ 215.142010][ T8249] exFAT-fs (loop1): hint_cluster is invalid (17) [ 215.713041][ T8255] netlink: 'syz.4.1022': attribute type 1 has an invalid length. [ 215.739425][ T8255] 8021q: adding VLAN 0 to HW filter on device bond5 [ 215.780683][ T8255] device macvlan3 entered promiscuous mode [ 215.784670][ T8255] device bond5 entered promiscuous mode [ 215.792047][ T8255] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 215.830053][ T8255] device bond5 left promiscuous mode [ 219.352599][ T27] audit: type=1326 audit(219.340:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8274 comm="syz.4.1027" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffff8e778f68 code=0x0 [ 219.547434][ T8301] loop5: detected capacity change from 0 to 512 [ 219.551769][ T8301] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 220.729818][ T8301] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 220.731981][ T8301] EXT4-fs warning (device loop5): ext4_multi_mount_protect:298: Invalid MMP block in superblock [ 221.209737][ T4333] Bluetooth: hci0: command 0x0406 tx timeout [ 222.175667][ T8322] loop5: detected capacity change from 0 to 512 [ 222.323343][ T8322] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 222.664282][ T8322] EXT4-fs error (device loop5): ext4_orphan_get:1431: comm syz.5.1041: bad orphan inode 131083 [ 222.667593][ T8322] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 223.092548][ T8329] device bridge_slave_1 left promiscuous mode [ 223.095285][ T8329] bridge0: port 2(bridge_slave_1) entered disabled state [ 223.155192][ T8329] device bridge_slave_0 left promiscuous mode [ 223.156410][ T8329] bridge0: port 1(bridge_slave_0) entered disabled state [ 223.635590][ T5693] EXT4-fs (loop5): unmounting filesystem. [ 224.140568][ T8350] loop4: detected capacity change from 0 to 1024 [ 224.634976][ T8366] netlink: 'syz.5.1057': attribute type 39 has an invalid length. [ 225.040028][ T8357] netlink: 156 bytes leftover after parsing attributes in process `syz.4.1054'. [ 225.093296][ T8362] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1054'. [ 226.246768][ T8384] loop4: detected capacity change from 0 to 256 [ 231.422390][ T8441] overlayfs: failed to clone lowerpath [ 231.431584][ T8441] overlayfs: failed to clone lowerpath [ 231.546091][ T8452] netlink: 'syz.0.1079': attribute type 1 has an invalid length. [ 231.567214][ T8452] 8021q: adding VLAN 0 to HW filter on device bond4 [ 231.629354][ T8452] bond3: (slave dummy0): Releasing active interface [ 231.730564][ T8452] bond4: (slave dummy0): making interface the new active one [ 231.738737][ T8452] bond4: (slave dummy0): Enslaving as an active interface with an up link [ 231.744606][ T7670] IPv6: ADDRCONF(NETDEV_CHANGE): bond4: link becomes ready [ 235.757136][ T8514] netlink: 1355 bytes leftover after parsing attributes in process `syz.2.1098'. [ 237.803575][ T8544] device bridge_slave_0 left promiscuous mode [ 237.804842][ T8544] bridge0: port 1(bridge_slave_0) entered disabled state [ 238.674016][ T8551] device syzkaller0 entered promiscuous mode [ 240.343746][ T8588] loop4: detected capacity change from 0 to 1024 [ 240.563401][ T8588] hfsplus: invalid length 65281 has been corrected to 255 [ 240.565273][ T8588] hfsplus: invalid length 65281 has been corrected to 255 [ 240.783943][ T7644] hfsplus: invalid length 65281 has been corrected to 255 [ 240.831240][ T8604] binder: 8603:8604 tried to acquire reference to desc 0, got 1 instead [ 240.864712][ T8604] binder: 8603:8604 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 240.882391][ T8604] binder_debug: 4 callbacks suppressed [ 240.882408][ T8604] binder: send failed reply for transaction 108 to 8603:8604 [ 240.884445][ T8604] binder: 8603:8604 ioctl c0306201 20000180 returned -14 [ 241.321140][ T4375] binder: undelivered TRANSACTION_COMPLETE [ 241.322246][ T4375] binder: undelivered TRANSACTION_ERROR: 29201 [ 244.569845][ T8676] netlink: 'syz.4.1144': attribute type 1 has an invalid length. [ 244.730421][ T8676] 8021q: adding VLAN 0 to HW filter on device bond6 [ 244.761070][ T8680] bond6: (slave dummy0): making interface the new active one [ 244.766355][ T8687] sock: sock_set_timeout: `syz.0.1147' (pid 8687) tries to set negative timeout [ 244.844434][ T8680] bond6: (slave dummy0): Enslaving as an active interface with an up link [ 244.848982][ T7632] IPv6: ADDRCONF(NETDEV_CHANGE): bond6: link becomes ready [ 248.480518][ T8730] binder: 8726:8730 tried to acquire reference to desc 0, got 1 instead [ 248.691595][ T8737] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1160'. [ 248.896908][ T2061] ieee802154 phy0 wpan0: encryption failed: -22 [ 248.898411][ T2061] ieee802154 phy1 wpan1: encryption failed: -22 [ 249.633258][ T4376] binder: release 8726:8730 transaction 113 out, still active [ 249.660365][ T7084] binder: send failed reply for transaction 113, target dead [ 251.357682][ T8790] netlink: 84 bytes leftover after parsing attributes in process `syz.1.1181'. [ 252.371265][ T8801] usb usb8: usbfs: process 8801 (syz.5.1175) did not claim interface 0 before use [ 253.164741][ T8808] loop4: detected capacity change from 0 to 128 [ 253.331659][ T8821] binder: 8820:8821 tried to acquire reference to desc 0, got 1 instead [ 253.337681][ T8821] binder: 8820:8821 ERROR: Thread waiting for process work before calling BC_REGISTER_LOOPER or BC_ENTER_LOOPER (state 10) [ 253.340858][ T8821] binder: 8821 RLIMIT_NICE not set [ 253.341778][ T8821] binder: 8821 RLIMIT_NICE not set [ 253.342793][ T8821] binder: 8821 RLIMIT_NICE not set [ 253.343879][ T8821] binder: undelivered TRANSACTION_COMPLETE [ 253.344763][ T8821] binder: undelivered transaction 125, process died. [ 253.588815][ T8822] loop5: detected capacity change from 0 to 512 [ 253.601108][ T8822] EXT4-fs error (device loop5): ext4_xattr_inode_iget:401: comm syz.5.1182: inode #2214592512: comm syz.5.1182: iget: illegal inode # [ 253.605658][ T8822] EXT4-fs error (device loop5): ext4_xattr_inode_iget:406: comm syz.5.1182: error while reading EA inode 2214592512 err=-117 [ 253.607867][ T8822] EXT4-fs warning (device loop5): ext4_expand_extra_isize_ea:2802: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 253.609855][ T8822] EXT4-fs error (device loop5): ext4_xattr_inode_iget:401: comm syz.5.1182: inode #2214592512: comm syz.5.1182: iget: illegal inode # [ 253.613473][ T8822] EXT4-fs error (device loop5): ext4_xattr_inode_iget:406: comm syz.5.1182: error while reading EA inode 2214592512 err=-117 [ 253.615676][ T8822] EXT4-fs error (device loop5): ext4_xattr_inode_iget:401: comm syz.5.1182: inode #1: comm syz.5.1182: iget: illegal inode # [ 253.617184][ T4382] binder: undelivered TRANSACTION_COMPLETE [ 253.618225][ T8822] EXT4-fs error (device loop5): ext4_xattr_inode_iget:406: comm syz.5.1182: error while reading EA inode 1 err=-117 [ 253.622567][ T8822] EXT4-fs (loop5): 1 orphan inode deleted [ 253.623572][ T8822] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 253.713371][ T8832] 9pnet: p9_errstr2errno: server reported unknown error @cƒF S+¼ [ 255.771017][ T5693] EXT4-fs (loop5): unmounting filesystem. [ 259.133783][ T8877] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1200'. [ 260.212014][ T8893] loop4: detected capacity change from 0 to 512 [ 260.376457][ T8893] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 260.500082][ T8893] EXT4-fs error (device loop4): ext4_orphan_get:1431: comm syz.4.1202: bad orphan inode 131083 [ 260.502138][ T8893] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 261.492012][ T4337] EXT4-fs (loop4): unmounting filesystem. [ 261.639747][ T8903] netlink: 'syz.5.1206': attribute type 1 has an invalid length. [ 261.935500][ T8916] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1210'. [ 261.947644][ T8922] bridge0: port 1(erspan0) entered blocking state [ 261.951203][ T8922] bridge0: port 1(erspan0) entered disabled state [ 261.953830][ T8922] device erspan0 entered promiscuous mode [ 262.796779][ T27] audit: type=1326 audit(262.780:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8930 comm="syz.5.1213" exe="/root/ci2-linux-6-1-kasan-arm64/syz-executor" sig=31 arch=c00000b7 syscall=98 compat=0 ip=0xffffb4d78f68 code=0x0 [ 266.660121][ T8997] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1231'. [ 267.174066][ T9005] tipc: Started in network mode [ 267.174957][ T9005] tipc: Node identity 080211, cluster identity 4711 [ 267.176123][ T9005] tipc: Enabled bearer , priority 0 [ 268.714097][ T4382] tipc: Node number set to 134353152 [ 272.364518][ T9067] ================================================================== [ 272.365907][ T9067] BUG: KASAN: use-after-free in ieee80211_monitor_select_queue+0x210/0x214 [ 272.367275][ T9067] Read of size 2 at addr ffff0000e9fcadfb by task syz.4.1246/9067 [ 272.368653][ T9067] [ 272.369093][ T9067] CPU: 1 PID: 9067 Comm: syz.4.1246 Not tainted syzkaller #0 [ 272.370280][ T9067] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 [ 272.371822][ T9067] Call trace: [ 272.372336][ T9067] dump_backtrace+0x1c4/0x1f0 [ 272.373078][ T9067] show_stack+0x2c/0x3c [ 272.373773][ T9067] __dump_stack+0x30/0x40 [ 272.374482][ T9067] dump_stack_lvl+0xf4/0x15c [ 272.375302][ T9067] print_address_description+0x88/0x218 [ 272.376143][ T9067] print_report+0x50/0x68 [ 272.376803][ T9067] kasan_report+0xa8/0xfc [ 272.377496][ T9067] __asan_report_load2_noabort+0x2c/0x38 [ 272.378468][ T9067] ieee80211_monitor_select_queue+0x210/0x214 [ 272.379419][ T9067] netdev_core_pick_tx+0x130/0x320 [ 272.380251][ T9067] __dev_queue_xmit+0x730/0x3154 [ 272.381103][ T9067] dev_queue_xmit+0x24/0x34 [ 272.381811][ T9067] packet_sendmsg+0x3034/0x40ac [ 272.382676][ T9067] ____sys_sendmsg+0x588/0x90c [ 272.383387][ T9067] __sys_sendmsg+0x288/0x374 [ 272.384176][ T9067] __arm64_sys_sendmsg+0x80/0x94 [ 272.385021][ T9067] invoke_syscall+0x98/0x290 [ 272.385800][ T9067] el0_svc_common+0x13c/0x258 [ 272.386611][ T9067] do_el0_svc+0x5c/0x134 [ 272.387338][ T9067] el0_svc+0x58/0x128 [ 272.388046][ T9067] el0t_64_sync_handler+0x84/0xf0 [ 272.388917][ T9067] el0t_64_sync+0x18c/0x190 [ 272.389694][ T9067] [ 272.390067][ T9067] Allocated by task 7672: [ 272.390764][ T9067] kasan_set_track+0x4c/0x80 [ 272.391515][ T9067] kasan_save_alloc_info+0x24/0x30 [ 272.392374][ T9067] __kasan_kmalloc+0xa0/0xb8 [ 272.393122][ T9067] __kmalloc_node_track_caller+0xcc/0x174 [ 272.394110][ T9067] __alloc_skb+0x260/0x728 [ 272.394856][ T9067] nsim_dev_trap_report_work+0x204/0x94c [ 272.395745][ T9067] process_one_work+0x7e4/0x13bc [ 272.396571][ T9067] worker_thread+0x8cc/0xfe8 [ 272.397328][ T9067] kthread+0x254/0x2e0 [ 272.398011][ T9067] ret_from_fork+0x10/0x20 [ 272.398740][ T9067] [ 272.399096][ T9067] Freed by task 7672: [ 272.399743][ T9067] kasan_set_track+0x4c/0x80 [ 272.400501][ T9067] kasan_save_free_info+0x38/0x5c [ 272.401407][ T9067] ____kasan_slab_free+0x148/0x1b0 [ 272.402270][ T9067] __kasan_slab_free+0x18/0x28 [ 272.403059][ T9067] slab_free_freelist_hook+0x16c/0x1e8 [ 272.403984][ T9067] __kmem_cache_free+0xbc/0x21c [ 272.404800][ T9067] kfree+0xd0/0x1a8 [ 272.405421][ T9067] skb_release_data+0x3d8/0x63c [ 272.406227][ T9067] consume_skb+0xa0/0x104 [ 272.406969][ T9067] nsim_dev_trap_report_work+0x618/0x94c [ 272.407926][ T9067] process_one_work+0x7e4/0x13bc [ 272.408701][ T9067] worker_thread+0x8cc/0xfe8 [ 272.409426][ T9067] kthread+0x254/0x2e0 [ 272.410107][ T9067] ret_from_fork+0x10/0x20 [ 272.410829][ T9067] [ 272.411202][ T9067] The buggy address belongs to the object at ffff0000e9fca000 [ 272.411202][ T9067] which belongs to the cache kmalloc-4k of size 4096 [ 272.413496][ T9067] The buggy address is located 3579 bytes inside of [ 272.413496][ T9067] 4096-byte region [ffff0000e9fca000, ffff0000e9fcb000) [ 272.415686][ T9067] [ 272.416070][ T9067] The buggy address belongs to the physical page: [ 272.417165][ T9067] page:00000000e2347ef0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x129fc8 [ 272.418733][ T9067] head:00000000e2347ef0 order:3 compound_mapcount:0 compound_pincount:0 [ 272.420091][ T9067] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 272.421423][ T9067] raw: 05ffc00000010200 0000000000000000 dead000000000122 ffff0000c0002a80 [ 272.422800][ T9067] raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 [ 272.424185][ T9067] page dumped because: kasan: bad access detected [ 272.425255][ T9067] [ 272.425632][ T9067] Memory state around the buggy address: [ 272.426485][ T9067] ffff0000e9fcac80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 272.427696][ T9067] ffff0000e9fcad00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 272.429049][ T9067] >ffff0000e9fcad80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 272.430276][ T9067] ^ [ 272.431645][ T9067] ffff0000e9fcae00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 272.432945][ T9067] ffff0000e9fcae80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 272.434192][ T9067] ================================================================== [ 272.435614][ T9067] Disabling lock debugging due to kernel taint