last executing test programs: 39m18.498830762s ago: executing program 0 (id=85): prlimit64(0x0, 0xe, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xbfffff, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, 0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x2}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x3938700}}, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) 39m18.245602026s ago: executing program 0 (id=88): bpf$PROG_LOAD(0x5, &(0x7f0000caefb8)={0x8, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="850000006100000054000000000000009500000000000000fde567c245f2427dc193f48934887070cc612b4a9acc173c7740448d9317ff3a0ede53f3834a8b49ec0d2875bb"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb}, 0x94) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x12, 0x7, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f0000000140)=r0}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0xfb1585202ff31891}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x10000, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r6}, &(0x7f0000000280), &(0x7f0000000240)=r3}, 0x20) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r6, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f00000000c0)=r7, 0x4) sendmsg$inet(r5, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 39m18.157782165s ago: executing program 0 (id=89): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000004c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_VENDOR(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)={0x24, r0, 0x70b, 0x70bd27, 0x25dfdbfd, {{}, {@void, @void, @void}}, [@NL80211_ATTR_VENDOR_ID={0x8}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x10}]}, 0x24}, 0x1, 0x0, 0x0, 0x400d0}, 0x0) mkdir(&(0x7f0000000400)='./my_sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./my_sys/bus/pci/devices/0000:00:01.0/config\x00', 0x81483, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xb, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="660a00000000000061114c000000000085000000270000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8}, 0x80) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000002c0), 0x1) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f0000000300)={0x1, 0x0, 0x0, 'queue1\x00'}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r3, 0x4040534e, &(0x7f0000000040)={0x32b, @tick=0x440, 0xff, {}, 0x0, 0x0, 0x4b}) sendfile(r3, r1, 0x0, 0x6) recvfrom(r2, &(0x7f0000000080)=""/22, 0x16, 0x10000, &(0x7f0000000140)=@isdn={0x22, 0x9, 0xfc, 0x3, 0x6}, 0x80) 39m18.033513711s ago: executing program 0 (id=90): socket$unix(0x1, 0x5, 0x0) fsopen(0x0, 0x1) ioctl$XFS_IOC_PATH_TO_FSHANDLE(0xffffffffffffffff, 0xc0385868, 0x0) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000000)='./file0\x00', 0x11, &(0x7f0000000100)={[{@noblock_validity}, {@stripe={'stripe', 0x3d, 0x2}}, {@norecovery}, {@min_batch_time={'min_batch_time', 0x3d, 0x71d}}, {@abort}]}, 0x1, 0x610, &(0x7f0000000a40)="$eJzs3c9rFGcfAPDvTH6avO+bKC+8rz3UQCkKrYmJWqQUau5F7I9/IDVRxGgkSaFRwQjtsfTSQ6GnHmr/i1borfTQaw+9F0FK8VCL1C2zOxs3m93Nz/3h7ucDa+aZmczznTXfPM88eWY2gJ41kf2TRhyNiJtJxFjFtv7IN06U9nv8x51L2SuJQuH935O4czdZrzxWkn8dzb/577FIfk4jjvRtrXdl7da1ucXFheW8PLV6/ebUytqtk1evz11ZuLJwY+aNmXNnz5w9N31qX+c3UGPdN189Taa//fVCEufjWR5bdl7V+w3tq+bsPZuIQsmTyvXZ+3pun8fuFH+OlX9OnkuqV9CxLud5m+XJ/2Is+ir+N8fi03fbGhzQVIUkym0U0HOSOvn/42yj3wzDTYsHaJVyP6B8bV/rOnirtMm9EqAVHs2WBqRKuT8QEeX87y+NDcZwcWxg5HGyaZwniYj9jcyVZHX89MOFT7JX1BmHA5pj/V55lLu6/U+KuTkew8XSyON0c/6vFwpp3hPI1r+3x/onqsryH1pn/V5E/D9v/wdjx/mf5rlbzv8P91i//AcAAAAAAICD82A2Il6vNf8v3Zj/M1hj/s9oRJw/gPq3//tf+jBfSKp2HTyA6qGnPZqNeKvm/N+NOb7jfXnp38X5ALeTy1cXF05FxH8i4kQMDGXl6arjVs4QPvnZkS/r1V85/y97ZfWX5wLmR3rYX3Uj7vzc6tx+zxuIeHQv4qXi/N9j+ZrN83+y9j+p0f5n+X1zh3UcefX+xXrbts9/oFkKX0ccr9n+P+9uJ42fzzFV7A9MlXsFW718+/Pv6tVfnf9NOEWgjqz9H2mc/0NJ5fN6VnZ3/Owi/fRaf6He9r32/weTD/qiYhDg47nV1eXpiMHkna3rZ3YXM3SrPB+ORZ4vWf6feKXx+N9G/78iDw9FxPoO6hveZrv+P7RPlv/zjdv/8c3t/+4XZu6Pf1+v/os7av/PFNv0E/ka439QaevzOHaaoG0JFwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABecGlE/CuSdHJjOU0nJyNGI+K/MZIuLq2svnZ56aMb89m2iPEYSMuf9DtWKiflz/8fryjPVJVPR8ThiPii71CxPHlpaXG+3ScPAAAAAAAAAAAAAAAAAAAAHWK0eM9/Yaj6/v/Mb33tjg5ouv78q3yH3tO/5+8sDB1oIEDL7T3/gRdYds2/i/wfaGYsQBvUz/8nTwtFLQ0HaCH9f+hde8x/fy6ALqD9h161wzG94WbHAbSD9h8AAAAAALrK4WMPfkkiYv3NQ8VXZjDfZrI/dLe03QEAbWMOL/Su/qV2RwC0i2t8INlY+qvmzf71Z/8nzQkIAAAAAAAAAAAAANji+FH3/0Ovanz/v7n90M0a3P9fK/k9LgC6SP2P/tD2Q7dzjQ9s19q7/x8AAAAAAAAAAAAAOsDwrWtzi4sLyytrL97C250Rxu4W1uc6IoxdLBTuRjTe51lzah+IiE55E5ZXsmhaVVf5ERxtPOU2/14CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2/BMAAP//cdEbCg==") openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x4) bind$unix(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$setregset(0x4205, r0, 0x1, &(0x7f0000000100)={&(0x7f0000000040)="dcef58b7f29c1f7c93d183044aedba283413e674c7719c33a4b17f028f68610a6c55bb2bf8282853f3e16f8394a8676ff55a3507e2ad50248c6130863b0f7433c7fbc9b978a39eae88bffd05d139cedbee444f7c040000000f64462b4b470bedced2125e0b1f38fbaa348c6d75aa1a4011e9cdae15ecb9309b0101edbf6dd6d111d6132f1821a4e4cbec8438c571a70e7ca7b0451a6cc55c", 0x98}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ptrace$setregset(0x4205, r0, 0x2, &(0x7f0000000140)={0x0, 0xef3e856242ea1fb3}) 39m17.71183481s ago: executing program 0 (id=94): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x6, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x29, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r1, 0x0, 0xc8, &(0x7f0000000100), 0x4) setsockopt$MRT_ADD_VIF(r1, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$inet_mreq(r2, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x3e, &(0x7f00000003c0)={@local, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x30, 0xfffe, 0x0, 0x80, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @dest_unreach={0x3, 0x4, 0x0, 0x0, 0x3, 0xc58, {0x5, 0x4, 0x0, 0x7, 0x0, 0x65, 0xe, 0x4e, 0x24, 0xc, @empty, @dev={0xac, 0x14, 0x14, 0x44}}}}}}}, 0x0) r3 = socket(0x10, 0x2, 0x0) write(r3, &(0x7f0000000040)="1c0000001a009b8a140000003b9b301f00"/28, 0x1c) recvmmsg(r3, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) 39m15.722534645s ago: executing program 0 (id=100): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=@base={0xa, 0x4, 0x8, 0xa, 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x50) close(0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0600000004000000040000000001"], 0x50) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x4040845) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) close(0x3) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffff8}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r3, &(0x7f00000002c0), &(0x7f0000000200)=""/166}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000611800000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000150802000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000bfa200000000000007020000f8ffffff850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r4}, 0xc) 39m15.297718816s ago: executing program 32 (id=100): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001000)=@base={0xa, 0x4, 0x8, 0xa, 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x50) close(0x3) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0600000004000000040000000001"], 0x50) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x4040845) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) close(0x3) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffff8}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r3, &(0x7f00000002c0), &(0x7f0000000200)=""/166}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000611800000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000150802000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000bfa200000000000007020000f8ffffff850000000300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0xe, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r4}, 0xc) 39m6.983889951s ago: executing program 1 (id=142): r0 = socket$vsock_stream(0x28, 0x1, 0x0) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0xc}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000100)={{&(0x7f000003c000/0x2000)=nil, 0x2000}, 0x1}) bind$vsock_stream(r0, &(0x7f0000000040)={0x28, 0x0, 0x2710}, 0x10) listen(r0, 0x6) r2 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r2, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) r3 = dup(r2) write$6lowpan_enable(r3, &(0x7f0000000000)='0', 0xfffffd2c) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r4, 0xffffffffffffffff, 0x0) 39m6.85003489s ago: executing program 1 (id=143): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000540)={'dummy0\x00', 0x0}) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/vmallocinfo\x00', 0x0, 0x0) preadv(r1, &(0x7f0000001500)=[{&(0x7f00000002c0)=""/4084, 0xff4}], 0x1, 0xf73, 0x0) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) preadv2(r3, 0x0, 0x0, 0x4, 0x6a, 0x9) connect$inet6(r2, &(0x7f0000000100)={0xa, 0xfffe, 0x3, @mcast2={0xff, 0x3}}, 0x1c) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x40090) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, 0x0, 0x0) 39m6.619819988s ago: executing program 1 (id=144): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r1, 0x0, 0xc8, &(0x7f0000000000), 0x4) setsockopt$MRT_ADD_MFC_PROXY(r1, 0x0, 0xd2, &(0x7f0000000100)={@multicast2, @multicast2, 0x0, "614af285791a63abd0f993af8077b5cd01e03d64a831683fdc3fd440829c82ae", 0x5000000}, 0x3c) setsockopt$MRT_ADD_MFC(r1, 0x0, 0xcc, &(0x7f0000000080)={@multicast2, @multicast2, 0x0, "b18c89f8ec85752dace37a71e337f670bfac54f9a317850eaa73a3eb92f19456", 0x8, 0x8, 0x8, 0x1ff}, 0x3c) setsockopt$inet_buf(r0, 0x0, 0x10, &(0x7f00000006c0)="170000000200020000ffbe8c5ee17688a2003c0003bd37864aff02a257fc5ad90200bb6a88000056c9db0000db0059100ac45761547a681f009cee4a5a479200001fb700673751adfcb87d00c88ebbf9315033bf79ac2dfc061f15003901dee2ffffffffe9000000000000000062068f5ee50ce5af9b1c568302ffff02ff2c3f6c421ace486dee362eba", 0x8a) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r2, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x3, 0xfd}, 0x8) io_setup(0x8, &(0x7f0000004200)=0x0) io_submit(r3, 0x0, &(0x7f0000004540)) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs2/binder1\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000200)={0x24, 0x0, &(0x7f00000000c0)=[@release={0x40046306, 0x3}, @register_looper, @request_death, @release], 0x0, 0x0, 0x0}) 39m6.120287326s ago: executing program 1 (id=146): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x1, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000ac0)=@base={0x6, 0x4, 0x1010, 0x89}, 0x50) syz_mount_image$squashfs(&(0x7f00000000c0), &(0x7f0000000180)='./file1\x00', 0x4, &(0x7f0000000280)=ANY=[], 0x2, 0x1be, &(0x7f0000000480)="$eJzslc9qFEEQxn8129nJeBDxpggeFN0ckkzGP1c9SR7AB3DZrDE4Qc0ENMHDeMp7iJDX8CC+ggfFSzyI4EGvIiM9XT07kyxI0Pw59Aez9dVX3V1V27s1j4pnRQz8jhhxlxo9zvJRBANcFqfdi5391nd2Qf2vxtk51V+r/aS22Np+PMzz8cZUUg2gq/TYr/ydOJYwz6G2HSupKjjaFDIlVHKsnb6POXAFJXA6ruCQ5Px/PxlFN0R0op0mJ/09t4mYjhL/64ET986riO/1LPvw4+XIkgdAVdn/Jay4R9pr7CR659YkVrto6kd6VM0aO/yscx349Wb96WKxtT2/tj5cHa+OJctu3E5vpumtbPHhWj5O3ae0UkT6g7B2DrAzNWnFZ4DPOmDPcBC+fI1Lsq98j8GVCRfN5/dWSoS3zV6d7dgz7nONWeB5KRPVF07d0jJCD1M7S6aVx/U2WwcWRk/ylR0E0ZXpLobIb9tjpnGyxjGddnfggi3tqvrLanfV7qn17yz/LjJ2BvFFvUEJfV4MNzc3lqzkWK35mp2WnStpXZDN+rPfbe5SPOVWAgICAgICAgJONf4EAAD//xHuT6Q=") mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='sysfs\x00', 0x800, 0x0) 39m4.325122629s ago: executing program 1 (id=147): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xb, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000200000000000000000850000002a0000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0x14, &(0x7f0000000500)=ANY=[@ANYRES64=r0, @ANYRES16, @ANYRESDEC=r0, @ANYBLOB="009df1ee7b25b01c3b8c68d1c60e8074345bdc6f2edab48658f3e2493816857a2f78311f5771610cf293a8b0ff2352c3d2d63994441212b9219b10fb5cf7f0b8aad807d30ca10c4dba2ca5ee0c44b0f4d2b124ec4e970aa38f2125ce57a8e59dec2b241eaba16d40d4f113d94d75c1b0b4a0a3fa27e6ab51fb43878b6f4e23066be8bc51b90f0371a71a31e0fcb60063a929a06baf3994425c4b3879188a25ac20bdab51e36ff8848c4ac726f81dc77a0083ab305b6b8245f5a9ccf2d1646cf740d2facc0e94f10811583bc7f7be45037cedec840363f34049d7e3ab9c56516c"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0xb, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) timer_gettime(0x0, &(0x7f0000000080)) pipe(&(0x7f0000000200)={0xffffffffffffffff}) sigaltstack(&(0x7f0000000040)={0x0, 0x0, 0xfffffffffffffed8}, 0x0) r3 = memfd_create(&(0x7f0000000180)='J=\t\xeb\xf8\xa7\x04\x9f\xe1hO\x8e\xd7\xb5\x93}\x8d\xed\x01L`\x93\xcd\x9b`;\x1c\xfc\xaf9\x98\x91\xe7\x00'/52, 0x0) splice(r2, 0x0, r3, 0x0, 0x400c5, 0x5) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1}, 0xc) 39m2.962487669s ago: executing program 1 (id=149): syz_io_uring_setup(0x38, &(0x7f0000000580)={0x0, 0xbbda, 0x13f00, 0xffffffff}, 0x0, 0x0, 0x0) r0 = socket$vsock_stream(0x28, 0x1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) bind$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) recvfrom(r1, &(0x7f00000001c0)=""/62, 0xfeb5, 0x10120, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x7, 0xfffffffffffffffc, 0x7, 0x4, 0x4000000000}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x40000, 0xb, 0x0, 0x0, 0x7fffffff, 0x35}, 0x0, 0x0) 39m2.559510366s ago: executing program 33 (id=149): syz_io_uring_setup(0x38, &(0x7f0000000580)={0x0, 0xbbda, 0x13f00, 0xffffffff}, 0x0, 0x0, 0x0) r0 = socket$vsock_stream(0x28, 0x1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) bind$vsock_stream(r0, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) listen(r0, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) recvfrom(r1, &(0x7f00000001c0)=""/62, 0xfeb5, 0x10120, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x7, 0xfffffffffffffffc, 0x7, 0x4, 0x4000000000}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x40000, 0xb, 0x0, 0x0, 0x7fffffff, 0x35}, 0x0, 0x0) 37m1.832264135s ago: executing program 3 (id=564): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f00000003c0)=@gcm_128={{0x303}, "77b40400", "bb6710bc8150e4a1a117d7b27caf00", "8c76287d", "3d8efa05fdffffff"}, 0x28) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001480)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$tun(r1, &(0x7f0000000340)=ANY=[], 0x141) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) recvfrom(r0, &(0x7f0000002800)=""/4071, 0x1c, 0x10115, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r0) setsockopt$sock_int(r0, 0x1, 0x7, &(0x7f00000000c0)=0xffff1884, 0x4) 37m1.494546767s ago: executing program 3 (id=568): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x1) fchdir(r2) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x8880, 0x85) lseek(r3, 0x101, 0x1) getdents(r3, &(0x7f00000002c0)=""/201, 0xc9) 37m0.235992236s ago: executing program 3 (id=573): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x19}}, 0x10) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=@newlink={0x20, 0x10, 0x403, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, r2, 0xff7f}}, 0x20}}, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000012000000140012800b00010062726964676500000400028008000a00", @ANYRES32=r5], 0x3c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) 36m58.29823697s ago: executing program 3 (id=576): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000100)='./bus\x00', 0x0, &(0x7f0000000e40)={[{@abort}, {@barrier_val={'barrier', 0x3d, 0x10001}}]}, 0x2, 0x569, &(0x7f0000000e80)="$eJzs3cFvG1kZAPBv3LhJu+mmC3sABGxZFgoqdRp3W62WA90LaLVaCbHixKGbTbxRVLuuYldsTA/pkftKVOIE/AfcOCDtiQM3biBx2MtyQCpQgbZIHIxmPEncxK69TepJ499PmnjmvfF879l582aeZb8Apta5iNiKiJMR8W5ELOTpSb7Etd6S7vfpgzsrDx/cWUmi233nn0mWn6ZF33NSz+XHnIuIH/0g4r1kf9zWZufGcr1e28i3F9uNW4utzc7F9VKeUr26dPXSa5evVA+tri81fnv/++tv/fj3v/vKJ3/a+vbP0mLN//xMltdfj13lA8dM8uPM96XNRMRbBz7y0TGT///w7Elb2+ci4uWs/S/EiezdHOnKd9/7ztMvHADwVHS7C9Fd6N8GAI679P5/PpJSJR8LmI9SqVLpjeG9GKdL9WarfWGhefvmamRjWGejXHp/vV67lI8Vno1ykm4vZeu729VHtj+sXY6IFyLiw9lTWX5lpVlfLfLCBwCm2HN7+v//zPb6/34H/xQMADhy5oouAAAwcX39/9kiywEATI77fwCYPvv7/6Ef+Y/17UAA4Ohz/w8A02e7/58vuBwAwOSMvP+/O5lyAAAT8cO3306X7sPe719v/1L3xdVa60alcXulstLcuFVZazbX6rXKSrc76nj1ZvPW0qs7m63NzvVG8/bN9vX1xvJa7XrNbwkAQPFeeOmjv6Sd/tbrp7Il+uZy0FfD8VYqugBAYU4UXQCgML7PA9NrjHt8wwBwzA2YorcnHyBIhu1wz+Sv8Kw6/0Xj/zCt9o7/v/kZnmvsAJ5tTzb+/71DLwcwefpwmF7dbmLOfwCYMrtj/LOPXhgM/UAQOG5GNffeT4TM7s+4N8bBrz1ZmQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOCom8+WpFTJ5gLfSv+WKpWIMxFxNsrJ++v12qWIeD4i/jxbnk23l4ouNABwQKW/J/n8X+cXXpnfm3sy+W826dfJiPjpL9/5xQfL7fbGUpr+r5309r00/VR7o3qyiAoAAP225938eDcp67+r+WPfjfynD+6sbC+TLOL9NyJi7lQW/2G+9HJmYiZ7nItyRJz+d5Jv96TXKycOIf7W3Yj4wnb95+KDvgjz2RhIb+bTvfHT2GcOPX7/6783fumR+payvPSxnL0Wn489hQNG+uiN3nkyb3tpE8/bXynOZY+D2/9cdoY6uPT8lzbXh/vOf6Wd89+JffGTrM2f29l+fEnuv/qHN/cldhd6eXcjvjQzKH6yEz8ZfP4tvzJmHT/+8ldfHpbX/VXE+YH1356RupGdZhfbjVuLrc3OxfXG8lptrXazWr26dPXSa5evVBezMere3z8OivGP1y88Pyx+Wv/TQ+LPPb7+8Y0x6//r/737k689Jv63vj74/X/xMfHTPvGbY8ZfPn1tblheGn91SP1HvP9xYcz4n/ytszrmrgDABLQ2OzeW6/XaxoiV9Fpz1D5Wxl9J7+13U7Zv2IspT2xFfLZnlYdmZYMSETHw6ekVdeGv/FNdSTrplXER0X9z2Acs8qwETMJuox++z18nWSAAAAAAAAAAAAAAAGCf1mbnxuzgb2sd2krRdQQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOD4+n8AAAD///1EwkM=") mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x24) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r1, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=@newlink={0x48, 0x10, 0x439, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r2, 0x21801, 0x1103}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_DIR={0x5}, @IFLA_GRE_IKEY={0x8, 0x4, 0x10000}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x410c0}, 0x4000020) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0}, 0x1, 0x0, 0x0, 0xc0}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x9, 0x0, 0x0, 0x4000000}, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f00000001c0), 0x8, &(0x7f00000002c0)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x103a42, 0x32) 36m57.157812413s ago: executing program 3 (id=580): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000340)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x1c, 0x10, 0x701, 0x0, 0xffffffff, {0xa}, [@typed={0x6, 0x1, 0x0, 0x0, @str='\x14\x00'}]}, 0x1c}}, 0x20008080) 36m54.506629339s ago: executing program 3 (id=590): r0 = socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'ip6gretap0\x00'}) socketpair$unix(0x1, 0x1, 0x0, 0x0) syz_emit_ethernet(0x36, &(0x7f00000000c0)=ANY=[], 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(r0, 0x0, 0x20002810) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x28, r3, 0x1, 0x70bd2c, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @l2={'ib', 0x3a, 'vlan0\x00'}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41c1}, 0x4040800) 36m53.970904404s ago: executing program 34 (id=590): r0 = socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'ip6gretap0\x00'}) socketpair$unix(0x1, 0x1, 0x0, 0x0) syz_emit_ethernet(0x36, &(0x7f00000000c0)=ANY=[], 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(r0, 0x0, 0x20002810) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={0x28, r3, 0x1, 0x70bd2c, 0x0, {0x3}, [@TIPC_NLA_BEARER={0x14, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_NAME={0xd, 0x1, @l2={'ib', 0x3a, 'vlan0\x00'}}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41c1}, 0x4040800) 36m26.87324518s ago: executing program 6 (id=678): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000800)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000380)=ANY=[@ANYBLOB="020101090800000000170006ffffff00030006001000000002000000e0000009f9ff0f0005000000030005007217440502000000e0000001"], 0x40}}, 0x0) sendmsg$key(r3, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0xe, @in={0x2, 0x0, @multicast1=0xe0000009}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x20, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x50}}, 0x0) 36m25.786902952s ago: executing program 6 (id=681): setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000100)='cdg', 0x3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000"], 0x1c}], 0x1, 0x0, 0x0, 0x4004000}, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x77, 0x2, 0x2, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0x5, 0x8d], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x42282, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 36m23.853721175s ago: executing program 6 (id=684): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) r2 = open(&(0x7f0000000140)='.\x00', 0x8000, 0x112) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='blkio.bfq.io_service_time\x00', 0x275a, 0x0) getdents(r2, &(0x7f0000001fc0)=""/184, 0xb8) getdents(r2, &(0x7f0000001fc0)=""/184, 0xb8) 36m23.052506176s ago: executing program 6 (id=687): openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r0, &(0x7f0000000180)="707a73408b202e2f66696c65303a30", 0xf) openat(0xffffffffffffff9c, &(0x7f0000000280)='./tracing/uprobe_events\x00', 0x201, 0x0) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$dvb_demux(0x0, 0x0, 0x2000) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)={0x20, 0x3, 0x8, 0x301, 0x0, 0x0, {}, [@CTA_TIMEOUT_DATA={0x4}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x88}]}, 0x20}, 0x1, 0x0, 0x0, 0x85}, 0x4080044) ptrace(0x10, r1) epoll_pwait2(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setsig(0x4203, r1, 0x5, &(0x7f00000000c0)={0x19, 0x40, 0x7}) 36m22.05159747s ago: executing program 6 (id=691): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) setns(0xc9, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$inet(r3, &(0x7f0000000980)=[{{&(0x7f00000002c0)={0x2, 0x4e23, @private=0xa010101}, 0x10, 0x0}}], 0x1, 0x4008860) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) splice(r2, 0x0, r5, 0x0, 0xacb6, 0x8) splice(r4, 0x0, r3, 0x0, 0x7fffffffffffffff, 0x0) write(r1, &(0x7f0000000040), 0xffffff4a) 36m21.352829059s ago: executing program 6 (id=697): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000400000008000000000000000100"/48, @ANYRES32=r0, @ANYBLOB="0100000002"], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) 36m20.835599679s ago: executing program 35 (id=697): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb0100180000000000000020000000200000000400000001000000000000010400000020000000010000000000000108"], 0x0, 0x3c}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000400000008000000000000000100"/48, @ANYRES32=r0, @ANYBLOB="0100000002"], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[], 0x40) 9m46.420125271s ago: executing program 5 (id=3236): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) capset(0x0, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r3, 0x1, 0x8, 0x0, 0x0) sendmmsg(r3, &(0x7f0000008d80)=[{{0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f00000007c0)="c8b7df938dc9c0fcc8a7e84a57fa9059b9cfa4132462f9c45b583e8ce1f19a82364b01b4bc3436dcea3f3380b3269f2c986b7f8205fa231eac99a9de63cd1a85c820fc43c24662a22f18183bb042a742ac921efe546daedbd31cd4b5cda70186dd7ec44916", 0x65}], 0x1}}, {{0x0, 0x0, &(0x7f0000003300)=[{&(0x7f0000000f00)="88a69f5139292fe55d24310330d349370620dd2737877e864a0d6d86ec395b0c41", 0x21}, {&(0x7f0000002240)="321f349be984b668f593bf16c2f60e4b01783ed59dcd6a4105711458d2cf86696caad21a4387232f7ae8dbda478307058ab2ffec546f49907b7d4c54fe1fa76d99f5c80956c6769c810b895a00ab69f114794c1e3ee671204a47d3153305395d1e523e504927505590c078bc1a7d6e82b332bf141f662f26ad9ba4c11b87d5abbc3340ef989b3a8e666f8f82ca82aab6d33c953938b30b61c91cbc926b2a58d67d8198e458ed8f10ad8975356af9dab25f718147ae2a3e81187adaa46d247e3a8c437053bb01b855c6fb0ee0e7024fa61bd2af5aa1d918fcc93b3ffadf3a982efefa3b47727caafee6246ee147d676a5e2879e351f5ac51e6b62aaedb5cd03d16cb4f8bfaac498397b3dc22c063fbd87b2912647948430488fb45ca42096e08a6760c831b06d4582b7440f9123f3711a87b71a4a3a4614b2bf8dcdb84d985777893889120fb820ffe525acbf530869895f2caf84922e5a8aee6a0f887145b0d961bfa9c8f71788ccb8d2ee73676c2f68427b776f537afb9a8c97e055e35204ec09fd3f2c9a0b9f8b33ef0343ef22c99a7fe463550d074b626c1173f34fc49f1431460881ccd35b679f186dd10ac84e2f9aa370443a75938812c1b1888e57b0a79001965832e7cd8c85865081a16938fc81e72c26e686078692dad56ca4a2371a6b370268da843aa7ba9e498a7ae8a6317907b2d5114acf3d35522e4c8cb4e014c7d3f5f60c57b1293ec9956bed6abb25b5e2f90cf3eba7adc060b00dcb50480282b649e9c601bf0a400290a337e46af9be19d489e8693750a0be63313307b51db7726d4c6643f6f8ab22ce41310043728ffd414567f6e514c5e88b5614195b9ba893c8980949974f1eae80d27f7f90b251a094469561598e3dcd2bc143edd69b131595bbf776aa7583687228d8ea578f9f08ea949be49c1b087f430262968f639047eeb91c84a4cc6df66c749fb9b5b38e7e6546683df3a6ae722ea0d644256d82d8f3ba6b8bca23498a7dcc06fcda64d94f15b6bf620e7b272a476b097715f430c1d7c4c221156df5225c9fee4e580a5600713a1ce6e503c37730b5b4d3be23b212eb0ac2a05a7dc6aa88984566664086491ba3214bd9c9a4196d028f6ba448682536b40eab416ea8cf4098101af663d53110ebc2dffd88457ffd70decf1269f3fa61460593671d750ea0ab08aaac98a555a78da62b62625b550f840f34d1b02788bceb09002f615187159295d1a10e2dcfda5c1d399226047a53a1695f0af8121ad144b4dbe411d34d5e4eb4b4075e522d60d0020b2969025021bfc03062e0c8281bfa4cbce38241b53e970acc20ee903fcc81e8770f93367d7eddb95093177337475d5ef009ab799de6950d06ad68e8f9474634672657ba29df601e0be9e362197bafc25fee416a2b6d378dd31294d99317e5cc0d83827f6916ac648d638a515f823d0d784d841c31483b7d030258c62256268055286d3e773316f0f50df6411da24d8aeed75f50f49b0f6cc8672630954c1c3a1632d3497e3be53a4734619bd79aea6ffd87b8278f09775884018c70a6cf7290d5d09c6fa35a2c5fe9be746c9a4cb3e45855a12bf0c0fdeecb5a86922094b0d7b1adf0c10295e0e2ded424c476b8a15ddc44d229951e8a86d359c911e6a4baaeeb2c84cf367e92566ad2bed0c079c614f903d48cd19252c004a2f1de096d83f032d1a86bcd0b53b16668c88258d7d5ca7fc72d41b74ffe5c4a02e5b7077eddbeb77e4678a45e2983e4a1c07e7eb53ebddedca9bf2c52b84b759a88ec4cad17935e7af6c1ae2dd0ce1d37a2dcc74c336a71daf179ebddb5651a41f209b6a5ea7a001efbf74bd21f7fa3708430baddc2b24a7871f7bb443913ca59e64556d361af986aff89975fa48682bd97e707590f3d508427f6a61e293393518b620c12b6d055014a2f5744be4a16a8b39e5cb19112eb529646f83ca092c52945bd873e6dffbd22f9ba99f350689313c2acc9d4a35c182056bf029aa5fbd942a955d5627b815b658a522605fc5a993c4cc3722da94d1509a1926fe2873c02027714784d20f2765c5f299c56a18791b4ca799bf477832093222f805fa125527495975cb5f50f5ca6cba89459b85d674214ff894c33b8a2c85193d7f312de8a42f4eede4fb84ae648dffae1ec13e8ad5663b10847f9d476e1bcacff45389dee0cc7e1a84834ab7904116ef8c89705f931b42a501303da83ac9799dde0df252d0b597e78001229d9a2339bd71c6244fdaebcffc10595c09ddad42bf7cfed789817962bffec261cc1d203910c5282b7971da3eae449202e1eda1d7c7793c2c24d6e6fd6f58331e63a59900e7a0e2c959fbc6b625fd4c95cd61d72ed56a96018d0b94358f9e50fb98eec69d4fae7d5ec303bde80f0bfd17908138c1a5c9e5d805c25adf392e5be7e1eb17945ed9b4171fb776e11602c32784718884fea99446ce11847ea0e4bcb2931105425c5614280f977380c50fe12d1542fcf61c61fdf8cb63054fba443fa1ee52798881269497db04912b467a563b24dbad4b08d34ac178b9e356c1e8b372ba51f4c8ab753f69e05b78e20b97e13b472a745c9bdf625e208dee9bca82ed2bb59c9253cf70764c3c7ed8ad833b7bef106836160ed8f", 0x74b}], 0x2}}], 0x2, 0x0) 9m45.296317389s ago: executing program 5 (id=3237): openat(0xffffffffffffff9c, 0x0, 0x42, 0x184) openat(0xffffffffffffff9c, 0x0, 0x40042, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) futex(&(0x7f000000cffc)=0x1, 0xd, 0x2, 0x0, 0x0, 0x400000) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) 9m43.36065895s ago: executing program 5 (id=3238): ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) ioctl(0xffffffffffffffff, 0x3b8f, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) syz_open_procfs(0x0, 0x0) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$UBLK_U_CMD_END_USER_RECOVERY(0xffffffffffffffff, 0xc0207511, 0x0) mlockall(0x2) syz_open_dev$evdev(&(0x7f0000000080), 0x1, 0x8047) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)) 9m32.476577821s ago: executing program 5 (id=3246): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x47, &(0x7f0000000200)=0x7) futex(&(0x7f000000cffc)=0x1, 0xd, 0x20000002, 0x0, 0x0, 0x400000) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c0000001000010700000000000000000a000028060001001a"], 0x1c}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r4) 9m30.328628916s ago: executing program 5 (id=3248): bpf$TOKEN_CREATE(0x24, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() prctl$PR_SET_TIMERSLACK(0x1d, 0x621d) sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) writev(0xffffffffffffffff, &(0x7f00000002c0)=[{&(0x7f0000000080)}, {0x0}], 0x2) tkill(0x0, 0x0) listen(0xffffffffffffffff, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$hfsplus(&(0x7f0000000000), &(0x7f0000000640)='./file1\x00', 0x1008000, &(0x7f0000000180)=ANY=[@ANYRES32=0x0, @ANYRESDEC=0x0, @ANYRESHEX, @ANYRESHEX, @ANYRESOCT=0x0, @ANYRES8=0x0, @ANYRESDEC, @ANYRES16], 0x0, 0x609, &(0x7f0000000680)="$eJzs3cFvHFcdB/DvbGxnN0Wp4yZtQJWwilQhLJK1LZGUC1AKslCFKnHgbBEnsbJJK9tFbg8QEIeKU/+EAvI/gDgWKQfaAwc49WzUIxISR9+2mtnZ9drZpontZDft5yPNvvfmzbz9vd/Mjmd3ZW2Ar6yVhUzdS5GVhde3y/buznJnd2f5dr+e5HSSRtJMUpSr/5bk0+Rueku+3u8YKu/zyYfNGx+//9F7vVY5VrOY6m1fPGi/hzOIZbYXa1We1HhLxx/vwAznkswfezw4Ad2+/4zsPubrEgCYZEVyatT62eRMfcNevg/o3RX37rGfanfHHQAAAAA8Ac/uZS/bOTvuOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBpUv/+f1EvjX59PkX/9/9n6nWp60+1e8n0uGMAAAAAAAAAgOP65l72sp2z/Xa3qL7zf6lqnK8en8nb2cxaNnIp21nNVraykcUks0MDzWyvbm1tLD7Enksj91x6MvMFAAAAAAAAgC+p32dl//t/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACYBEVyqldUy/l+fTaNqSTNJDPldneTfyf52rjjPa574w4AAAAAnoBn97KX7Zztt7tF9Z7/+ep9fzNv5062sp6tdLKWa9VnAb1PABq7O8ud3Z3l2+Vy/7g/+t8jhVGNmN5nD2Xr/me+WG3RyvWsV2su5Vd5M51cS6Pas3SxH8/ouH5XxlT8oPaQkV2ry3LmP6vLyTBbZWR6kJF2HVuZjXMPzsQjHp3Dz7SYRu9ToCTnH0POz9RlOZ/XJjrnS0Nn3/MPzkQy98s/XrnZuXPr5vXNhcmZ0hEdzsTyUCZe+Eplol1l4sKgvZKf5hdZyHzeyEbW8+usZitrmc9rVW21Pp/Lx9kDmWrmUKZ+eKD1xhdFMlMfl95V9NFieqna92zW8/O8mWvVEW3nSq5kKd/LK2kfOMIXRh7h33br7r1ut5vGo73qv/Xt//+5Ww4wnWfyk6qcFGVezw3ldfiaO1v1Da/Zz9JcPzutkcMe5do49Y26Up49r07ctfHcob8S/Uw89+Arwp+qE2ezc+fWxs3Vtx7y+V6uyzIDPx5kYqpe2z11IpM6kvJ8mRvEcvDsKPueG9m3WPWdH/T1zrPGUN+FQd8XvVJn6nu44ZH6f7HKvhdG9vX2uzjUN+p+C4CJd+Y7Z2Za/239q/VB6w+tm63Xm6+evnr6xZlM/2P6+1PtUy83Xiz+mg/ym/33/wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwNFtvvPurdVOZ23jyJX+LxEddxwVlaen0spEhPEYK+O+MgGP2+Wt229d3nzn3e+u3169sXZj7c4r7atXFxcXr7QvX1/vrNWP444SADhJ+zf9444EAAAAAAAAAAAAAAD4PE/i34nHPUcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODLbWUhU/dSZLF9qV22d3eWO+XSr+9v2UxSlJW/J/k0uZvektmh4YrPe55PPmze+Pj9j97bH6tZbf/PpZOYxYFYGodiOu54S0Pj/eVIwxWDzMwnmatLGLvPAgAA///xmQQl") 9m27.363566815s ago: executing program 5 (id=3249): sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in, @in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x7, 0x0, 0x7fffffff, 0x0, 0x2}, {0xfffffffffffffffe, 0xffffffffffffffff}, 0x0, 0x0, 0x1, 0x0, 0x1, 0x3}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00', 0x2, 0x2b}, 0xa, @in6=@remote, 0x0, 0x4, 0x2, 0x0, 0x0, 0x0, 0x4000}]}]}, 0xfc}}, 0x0) mount_setattr(0xffffffffffffffff, 0x0, 0x8000, &(0x7f0000000080)={0x10001e, 0x100070}, 0x20) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r4, &(0x7f0000000380)={0x2, 0x0, @remote}, 0x10) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='bridge_slave_1\x00', 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x810) 9m10.687259895s ago: executing program 36 (id=3249): sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in, @in6=@ipv4={'\x00', '\xff\xff', @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x7, 0x0, 0x7fffffff, 0x0, 0x2}, {0xfffffffffffffffe, 0xffffffffffffffff}, 0x0, 0x0, 0x1, 0x0, 0x1, 0x3}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00', 0x2, 0x2b}, 0xa, @in6=@remote, 0x0, 0x4, 0x2, 0x0, 0x0, 0x0, 0x4000}]}]}, 0xfc}}, 0x0) mount_setattr(0xffffffffffffffff, 0x0, 0x8000, &(0x7f0000000080)={0x10001e, 0x100070}, 0x20) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r4, &(0x7f0000000380)={0x2, 0x0, @remote}, 0x10) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='bridge_slave_1\x00', 0x10) sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x810) 25.433957052s ago: executing program 4 (id=3833): getrandom(0x0, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f00000002c0)=0x80000000000003) syz_emit_ethernet(0x67, &(0x7f0000005a40)={@multicast, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "75e700", 0x31, 0x3a, 0x0, @dev, @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, "a3579e", 0x0, 0x2c, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @remote, [], 'k'}}}}}}}, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi4\x00', 0x2, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x4, 0x0, 0x0, 0x2) 23.74645074s ago: executing program 7 (id=3835): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$inet6(0xa, 0x3, 0x2) connect$inet6(r4, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) setsockopt$inet6_opts(r4, 0x29, 0x36, &(0x7f0000000000)=@hopopts={0x2}, 0x8) sendmmsg(r4, &(0x7f00000092c0), 0x4ff, 0xffd8) 19.494546283s ago: executing program 7 (id=3838): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/1/root/var\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/1/root/var/run\x00', 0x1ff) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000000880)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000340), 0x10}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x4, 0x0) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f00000001c0)=@file={0x1, './proc/1/root/var/run/gssproxy.sock\x00'}, 0x30) 15.481873154s ago: executing program 4 (id=3842): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x88800, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000040)={0x28, 0x7, r1, 0x0, &(0x7f0000800000/0x800000)=nil, 0x800000}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, r1, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r0, 0x3ba0, &(0x7f0000000080)={0x48, 0x7, r2, 0x0, 0x10001, 0x0, 0x1, 0xd6fe2, 0x11403f, 0x3f}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) nanosleep(0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, 0x0, 0x101000, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x1, 0x2) close(0x4) 10.589449513s ago: executing program 7 (id=3844): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1c, 0x0, 0x0) setns(0xc9, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) write(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x10005, 0x0, 0x0, 0x41100, 0x42, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0xffffffffffffffe2}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r4, 0x8b2a, 0x0) ioctl(r3, 0x8b1a, &(0x7f0000000040)) 8.981197704s ago: executing program 4 (id=3846): fcntl$notify(0xffffffffffffffff, 0x402, 0x8000000e) fcntl$setown(0xffffffffffffffff, 0x8, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r3, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x40006) ioperm(0x4, 0x8, 0x5) userfaultfd(0x80001) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000000340), 0x24, 0x3) timer_create(0x2, 0x0, &(0x7f0000000600)=0x0) timer_gettime(r4, &(0x7f0000000340)) mkdirat(0xffffffffffffff9c, 0x0, 0x181) 7.888098276s ago: executing program 2 (id=3847): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$inet6(0xa, 0x3, 0x2) connect$inet6(r4, &(0x7f0000000200)={0xa, 0x4e25, 0x0, @empty, 0x7}, 0x1c) setsockopt$inet6_opts(r4, 0x29, 0x36, &(0x7f0000000000)=@hopopts={0x2}, 0x8) sendmmsg(r4, &(0x7f00000092c0), 0x4ff, 0xffd8) 7.004647893s ago: executing program 4 (id=3848): prlimit64(0x0, 0xe, &(0x7f0000000100)={0x7, 0x80000001}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000180)={0x84, @remote, 0x0, 0x0, 'lblc\x00'}, 0x2c) lstat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)) sendmsg$DEVLINK_CMD_RATE_GET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x24, 0x0, 0x1, 0x70bd2c, 0x8010, {0x34}, [@DEVLINK_ATTR_PORT_INDEX={0x8, 0x73, 0x2}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x3}]}, 0x24}, 0x1, 0x0, 0x0, 0x24004004}, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680), 0x0, 0x0) r6 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000001100), 0x2, 0x0) ioctl$VIDIOC_G_CTRL(r6, 0xc008561b, &(0x7f0000001140)={0x3, 0x4}) preadv(r5, &(0x7f00000001c0)=[{0x0}], 0x1, 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a01040000000000000000020000000900010073797a300000000040000000030a01040000000000000000020000000900010073797a30000000000900030073797a3000000000140004800800014000000003080002400000000098000000060a01040000000000000000020000000900010073797a30000000000900020073797a30000000036c000480680001800a0001006d61746368000000580002800e000100686173686c696d697400000008000240000000013c0003006c8c5a5caa4d79aab8b68f677b50070078ec184795aa99ebf8f943577e9e23454cf12fab75d2c0", @ANYBLOB="20810e56"], 0x120}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 6.043449498s ago: executing program 7 (id=3849): socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) kexec_load(0x20000000, 0x0, &(0x7f0000000900), 0x2a0000) syz_mount_image$squashfs(&(0x7f0000000200), &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f00000000c0)={[{}]}, 0x1, 0x1cf, &(0x7f00000002c0)="$eJzKKC4sZmJgYPj7sSaZQYABDBgZeBguMDAysDAwMKgzQsQYmCDUeij/BZSeCZW2gfKbofRCKF1xS3vdmlN+Z0566motk2VmaPXUlkcWk0vtMXKTXMwjwcwQmnpkUXFlVXZiTk5qUfFChopbyUkVp08wsFy3v6bSLMHp8EeewyFJ00GH6YiPR9aMxhLOSVKaYmxsmQpnz3yQX8emcYTh0QrmjXWeeY11halT89LykqqyqrLmTZy4cWZjZ2Pjyol1UWl+qxhbUlw2NXUyMjlsURPYzGyoPslGe8K79lUPkxxYezz8mk8ZK71OZb5kvLBI6tSKqpkTvijNZjT8znCHp2yFhIaGk8QVCYsGE4YjdbYNriAnpjQwpCmEMSapsYm1bTkzJ4SZn81tgUJL8gmm0KMcS2dKWBwQqjr501LzrUOi24xtTx3YzvAcPs6zpqBP0Oi4BIPTQsH/MiBjEhoayjTWMi21XfClSOOvhNdqY6cMBnd7pmWwAGVpAJEroTxZsJ6E5BUeOpqaRinJCQ2bJBKS3AoMlRm27uFcLdDAgBRtKgwMDNsZYXELAddgjFEwCkbBKBgFo2AUjIJRMApGwSgYBSMCAAIAAP//8JWYxg==") r3 = openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0) getdents64(r3, &(0x7f00000002c0)=""/48, 0x30) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) connect$unix(r1, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) 5.010006017s ago: executing program 8 (id=3850): openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000580)=ANY=[@ANYBLOB="4400000001010102000000000000000002000000240002800c000280050001003a00000014000180080001000000000008000200000000000c0019800800020099080000c31884716bd30917b7057243db5d50bd48769cc22ae8485d92d2d11bff144f3d6380819d4bacb908b68817ddde5345172626eb66e65d0c28d2b85c2f871fe124f9d715cbf8691c7bead8fcb2b0587894e4c6f90061c9df87edfcea95ceedb826907a841e9f35317ac2dd776bd2d3b24b"], 0x44}}, 0x0) socket$alg(0x26, 0x5, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) sendmsg$IPSET_CMD_HEADER(r2, &(0x7f0000000100)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x38, 0xc, 0x6, 0x5, 0x0, 0x0, {0x2, 0x0, 0x3}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000080}, 0x4004) syz_mount_image$erofs(&(0x7f0000000040), &(0x7f0000000200)='./file1\x00', 0x200800c, &(0x7f0000000680)=ANY=[@ANYRES8=0x0, @ANYRESOCT, @ANYBLOB="571b320da28b242950a68c6808e7157439556e641f44e846a86fbe3d90cb1601de7ed78a94bd9eabd5a1fd0422326a7c598914c4f3e67e7003aca397013b9497b5cc666e28f0e34a6e8c3a748f8194a02c475b33a0ae49b4737267e85e18c72da28a10079d568edc050c44c82fde99e3423d6ff12450d996eb3560389e82019e", @ANYRES32=0x0, @ANYRES16], 0x1, 0x24b, &(0x7f0000000740)="$eJzsmb9rFEEUx78z++vW06CNhY2FARXxLrfXpAkSQbASIfFXpcGsojlzcreCORAJNjbaWQg2Fv4DFgFTpbDzH4hooYKg4BUWNmlW3szs3t7t5e6y2Pk+xea7b97MvPnu7ityYBjmv+Xb1z9fnp2dXYQA9mManon/sAAhtJaZ/M8vH5x6MXfu1dtPb96vTj3aTOKW+UtT4jgzQQClEfvbALbmLTxOd0pn78T4iGlzswhJ+ifpS5A4aeJXIFAx+gYkLhsdQuCa0Xczukn5lcqtO42wcrPZWCYxQ5caXQK61E2qk9TXXRdYNsE4tiAy9bfXOitLjUbYygjbjA0ZKiRSY4fgwEV3XqpasTWlKiQXrz59sk4h440P7Z+iBomaWa8OgQUTn4WXeKMtyZz/iJ2cnxwYPH/+tDvvVC4NjDtkSYu53//ELBIutDh0um9IjnhmfSJxe3DoYC4yWkhly8A6TuJfe61DatIFrWKvjhL2Lu+i6Llxxpizty3KNP3CpKd47gMo+Ex1Yd6QCp1cZK+n0MLSsw53Nz/kc77nZ3l9jsVi/BZi8venNGnxyYdY/JPx0VmRhRwbU9j2hu4f8WuB4+j1DzvTP6rRvfvVtmPuboerQVD3ymnHC2eqqh3lG1/aD33Vn/Zl1neGt0q40sXDpShq1fTVFS58RFErUPdB5rNZ2Gj+um6mRTgP4FhvWzdd0cqX5eocqXJJncgnobxLhQzDMAzDMAzDMAzDMAzDMKM4CqH+C0psH1A//SjifoKLKvo3AAD//0VRPH4=") llistxattr(&(0x7f0000000240)='./file1\x00', 0x0, 0x1d) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r3, &(0x7f0000000000)=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x4e23, 0x6, @ipv4={'\x00', '\xff\xff', @loopback}, 0xb96}}, 0x24) syz_genetlink_get_family_id$ethtool(&(0x7f00000000c0), 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) open(0x0, 0x8000, 0x50) 5.004506388s ago: executing program 4 (id=3851): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$inet6(0xa, 0x3, 0x2) connect$inet6(r4, 0x0, 0x0) setsockopt$inet6_opts(r4, 0x29, 0x36, &(0x7f0000000000)=@hopopts={0x2}, 0x8) sendmmsg(r4, &(0x7f00000092c0), 0x4ff, 0xffd8) 4.862234348s ago: executing program 7 (id=3852): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/1/root/var\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/1/root/var/run\x00', 0x1ff) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0xe, &(0x7f0000000880)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000340), 0x10}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x4, 0x0) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r3, &(0x7f00000001c0)=@file={0x1, './proc/1/root/var/run/gssproxy.sock\x00'}, 0x30) 2.125791519s ago: executing program 7 (id=3853): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000040)=0x3, 0x4) mount(0x0, 0x0, &(0x7f0000000110)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/class/block/zram0/disksize\x00', 0x1, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x101e01, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x53, &(0x7f0000000000)={0x0, 0x0}, 0x10) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000140)=0x15) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000180)=0xef) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000000)=0x7e) write(r0, &(0x7f0000000150)='33554432\x00', 0x9) syz_usb_control_io$uac2(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) 2.12307839s ago: executing program 8 (id=3861): r0 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./sys/module/usbcore/parameters/quirks\x00', 0x31042, 0x4c) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x4, 0x401d031, r0, 0x0) socket$netlink(0x10, 0x3, 0x4) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0x2, &(0x7f00000003c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) syz_open_dev$usbmon(0x0, 0x9, 0x82002) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) openat$cgroup(r0, 0x0, 0x200002, 0x0) syz_mount_image$ext4(&(0x7f0000000700)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x8052, &(0x7f0000000000)={[{@noauto_da_alloc}, {@init_itable_val={'init_itable', 0x3d, 0x4004}}, {@barrier_val={'barrier', 0x3d, 0x5}}]}, 0x43, 0x4f7, &(0x7f0000000c40)="$eJzs3U9sFNUfAPDvbP/z50d//PihIGoRjY3EFgoKBxOD0cSDJkZM1GPTFoIUatqSCEGzJAaPhsS78ejVg1f1QownE694NDEkxHABTIxrZndmu7vdLXTZdsF+Psl235vZmffevnmzb97bnQawYY2kf5JK+FpEbIuIQuMLRipPt29enLpz8+JUFEul438k5c1upfFMtpvYnEVGCxGFT5OlFTUWzl84PTk7OzOfxccXz3w4vnD+wvOnBrMlR48ePnTwyIsTL6y+UE3SS8t1a/cnc3t2vf7+lTenevPleWq15eiUkRhplpWyZzqdWJdtrQknvV3MCKuSHv9pdfWV2/+26ImVKq+4jjkD1lqpVCoNtF5dLDW6tGwJ8NBKots5ALoj/6BPr3/zR7OOQP/adD+67saxygVQWu7b2SPiyfLCfBykr+H6tpNGIuK94p9fpo9Yo3EIAIBa3x/Le4IN/b/hyszIX+euvpw+/yebQxmOiP9GxPaI+F9E7IiI/0fEzoh4JCIebdh/T0SUVki/cbS5mn51EqpwvUNFbSrt/72UzW0t9f/qMjDck8W2RuQd5pkD2XsyGn0DJ07NzhxcIY0fXv3l81bravt/6SNNP+8LZvm43tswQDc9uTjZdoEb3LgUsbu3sfxJb0RSrZskInZFxO5V7He4Jnzqua/3VCN99a+7e/nLSk3n0Towz1T6KuLZSv0Xo67+l1JM6uYnz0yenDk5c3aiOj85PhizMwfG06PgQNM0fvr58lut0r9r+b/9rXGT1458dzxrWfcvrf9NkRRrj/3N1VKXDScRSXW+dmH1aVz+9bOW1zTtHv/9yTvlcH5d+tHk4uL8wYj+5I3lyyeWts3j6XMUK+Uf3de8/W/PtknficciIj2IH4+IJ6JyhZjmfW9EPBUR+1Yo/4+vPP1B++VfW2n5pxvOf5War6v/ynx9f8zMLx0I9YEkmxusLBmqXdVzeu+1Oy1OHvdW/4fLodFsyfLzX5rDpO4UsTyDlUD+aZcu+bsj7yAAAAA8+AoRsaVmLGlLFApjY5UxoB2xqTA7t7C4/8TcubPT6bqI4egr5CNdlfHgviQf/xyuiU80xA9l48Zf9AyV42NTc7PTXS05sLnc5pPCWMS7PTXtP/V7Z4aYgQeZ32vBxrVS+0878TuvrGNmgHV175//Vz9e04wA666m/bf6hX+xje99AQ8B1//A0tfz736jH+cMePiVtGXY0FbV/ve7CSD8m/TG29Vwoas5Adab/j9sSK1+zt+ZQGmg+arBWP7iGFx5hz3RXjaGmqTVlUDas+pK6kPtbJXfTaHla6Kwuh0ORGfq9MR9vhvF+YWTOzt+8Jey78q3t3m0vGPFN+vSTpsFas8SI63+jQUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAD758AAAD//y283iw=") openat(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x143042, 0x80) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x2) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) mmap$IORING_OFF_SQES(0x0, 0x1000, 0x2, 0x4199831, 0xffffffffffffffff, 0x10000000) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x0, 0x0, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x141a80, 0x0) ioctl$RFKILL_IOCTL_NOINPUT(r2, 0x5202) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x1c) 2.12031625s ago: executing program 4 (id=3854): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x0, 0x0) futex(0x0, 0x3, 0x4, 0x0, 0x0, 0x0) r4 = gettid() semtimedop(0x0, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000000040)) timer_settime(0x0, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r5 = syz_io_uring_setup(0xec4, &(0x7f00000003c0)={0x0, 0xfffffffc, 0x2, 0x3, 0x34b}, &(0x7f0000000500), &(0x7f0000000600), &(0x7f0000000000)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) io_uring_enter(r5, 0xe7f, 0xe876, 0x3, 0x0, 0x0) 2.11897059s ago: executing program 2 (id=3855): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000900)={0x3, 0xc, &(0x7f0000000e00)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x80}, 0x94) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket(0x2, 0x80805, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000300), 0x103000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000006c0)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000200)={0xc, 0x0, 0x0}) ioctl$IOMMU_VFIO_IOAS$SET(r2, 0x3b88, &(0x7f00000002c0)={0xfffffffffffffea8, r3}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x200280d0}, 0x40) sendmsg$NFT_BATCH(r4, &(0x7f0000001940)={0x0, 0x0, &(0x7f0000001900)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a2c0000000b0a010400000000000000000a0000090900010073797a31000000000900020009000000000000002c0000000b0a010400000000000000000a0000020900010073797a31000000000c0010"], 0x80}, 0x1, 0x0, 0x0, 0x40091}, 0x40) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f0000000340)={0x28, 0x4, r3, 0x0, &(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x10}) 1.890571379s ago: executing program 8 (id=3856): syz_extract_tcp_res(0x0, 0x4, 0xfffffffe) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) r4 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) read$FUSE(r4, &(0x7f0000005180)={0x2020}, 0x2020) r5 = openat$udambuf(0xffffffffffffff9c, 0x0, 0x2) r6 = memfd_create(&(0x7f0000000540)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\"%/u\x17\xdam\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d[\v\xfc\xad\x0f\xa8\xc5\xad\x001\x8b%\xaa?\x00\x00\x00\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc2Gj+kV', 0x2) ftruncate(r6, 0xffff) fcntl$addseals(r6, 0x409, 0x7) r7 = ioctl$UDMABUF_CREATE(r5, 0x40187542, &(0x7f0000000040)={r6, 0x0, 0x2000, 0x8000}) poll(&(0x7f00000000c0)=[{r7, 0x4010}], 0x1, 0x8) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@newlink={0x40, 0x10, 0xffffff1f, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, 0x0, 0x821, 0x5}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @sit={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x8, 0x3, @loopback}, @IFLA_IPTUN_LOCAL={0x8, 0x2, @local}]}}}]}, 0x40}}, 0x0) 1.79188804s ago: executing program 2 (id=3857): syz_open_dev$mouse(0x0, 0x0, 0x2) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x850}, 0x4040080) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_io_uring_setup(0xfff, &(0x7f0000000000)={0x0, 0x9a81, 0x400, 0x2, 0x14d}, 0x0, 0x0, &(0x7f0000000140)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = syz_open_dev$sndpcmc(&(0x7f0000000120), 0x1, 0x2) ioctl$SNDRV_PCM_IOCTL_HW_PARAMS(r2, 0xc2604111, &(0x7f0000000680)={0x1, [[0xffffffff, 0xffffffff, 0xffffffff, 0x4000001, 0xffffffff, 0xfffffffc, 0xffffffff, 0xffffffff], [0xfffffffb, 0x2, 0xfffffffd, 0xa, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], [0xffffffff, 0xffffffff, 0x2a5a, 0xffffffff, 0xffffffff, 0xffffffff, 0x3, 0xffffffff]], '\x00', [{0x10, 0x10, 0x0, 0x0, 0x1}, {0x20, 0x20, 0x0, 0x0, 0x1}, {0x2, 0x9, 0x0, 0x0, 0x1}, {0xac44, 0xac44, 0x0, 0x0, 0x1}, {0xa, 0x186a0, 0x0, 0x0, 0x1}, {0x103, 0x400, 0x0, 0x0, 0x1}, {0x400, 0x101000, 0x0, 0x0, 0x1}, {0x2, 0x9, 0x0, 0x0, 0x1}, {0x2710, 0xf4240, 0x0, 0x0, 0x1}, {0x400, 0xffd, 0x0, 0x0, 0x1}, {0x1000, 0x4000, 0x0, 0x0, 0x1}, {0x0, 0xf4240, 0x0, 0x0, 0x1}]}) ioctl$SNDRV_PCM_IOCTL_PREPARE(r2, 0x4140, 0x0) ioctl$SNDRV_PCM_IOCTL_PAUSE(r2, 0xc0844123, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) rmdir(0x0) write(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 1.65317584s ago: executing program 2 (id=3858): syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x10, &(0x7f0000000140)={[{@rodir}, {@uni_xlate}, {@utf8}, {@shortname_lower}, {@shortname_lower}, {@utf8}, {@rodir}, {@utf8}, {@fat=@tz_utc}, {@fat=@codepage={'codepage', 0x3d, '950'}}, {@fat=@check_strict}, {@iocharset={'iocharset', 0x3d, 'cp850'}}, {@utf8no}, {@numtail}, {@utf8no}, {@utf8no}]}, 0x3, 0x29e, &(0x7f0000000800)="$eJzs3c1qa1UUAOB1mn8dJANHItwDOnB0ufUJWuQKYkFQIqgDLd5ckCRcaCHQKsaOfAKfQPBtnIgv4AMoztqBeOT0JGnSnqSmlqTo9026utZe2ftk79JOsvv5a8P+sxfHz8++/jWazSR29mIvLpLoxE5MfRulfvm9PA8APHAXWRZ/ZIVGkTpZHFGL8u+rOxtZIABw7+Z//297LQDAZnz48Sfv7R8cPP0gTZsRw+9G3SSKr0V9/3l8GYPoxZNox58R2UwRv/PuwdOoprlOvDEcj7p55/Czn86LPyf2f4u47N+NdnTK+3fTwlz/eNStxUuT+fcG0Xv/h2jHK+X9b5X0R7ceb74+t/7H0Y6fv4gXMYhnk2ef9n+zm6ZvZ9+ff/Vpns37k/Go25iNm4yubHhrAAAAAAAAAAAAAAAAAAAAAAD4D3ucznQW79+ZXvxfFJuT8Qv1FfcDjefu53mSpmmWXO+vxqvVqG7ruQEAAAAAAAAAAAAAAAAAAOAhOT457R8OBr2jNYKPbpYqsZCZfqy/pD3+Wsw0ImKt2ReCR+t2RWWytEEScW1MPSJWtNeicdl5+1yV5aX8BW6UWvl6ekdJNfqHP2Z325TrQTLLtOZLj6KYK8+0imAu828nHTTjMpierv5hctvmNssOybKg8s/Xk5Ucv+Xt9bLTmysZ3Foxe/3lO711WXtJKYmI2uzNXP06tXvZwaufFAAAAAAAAAAAAAAAAAAAYMOuPvRbUjzbwoIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYAuu/v//GsF40nyjlLUjTk77WSXPVGNS2vIjAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8D/wdwAAAP//h9dhCg==") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) syz_io_uring_setup(0xefd, &(0x7f0000000300)={0x0, 0x0, 0x10000, 0x3, 0x55}, 0x0, 0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(0x0, 0x0, r0, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x20, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x0, 0x80000080, 0x1}) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r4, 0x5421, &(0x7f0000000100)=0x100000001) connect$inet6(0xffffffffffffffff, &(0x7f00000003c0)={0xa, 0xfffe, 0x3000001, @mcast2, 0x6}, 0x1c) syz_emit_ethernet(0x4e, &(0x7f0000000180)={@local, @local, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, '\x00', 0x18, 0x0, 0x1, @dev={0xfe, 0x80, '\x00', 0x2c}, @remote, {[@hopopts={0x2f, 0x1, '\x00', [@enc_lim={0x4, 0x1, 0x7f}, @jumbo={0xc2, 0x4, 0xc}]}]}}}}}, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, &(0x7f0000000080)={'ah\x00'}, 0x0) ioctl$KDSKBLED(0xffffffffffffffff, 0xc0686611, 0x20000081) close(r4) unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x0) 529.371678ms ago: executing program 2 (id=3859): r0 = openat$vcsu(0xffffff9c, &(0x7f0000000280), 0xd3e8f6c8fd92ec51, 0x0) openat$sndseq(0xffffff9c, &(0x7f0000000100), 0x40) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100}, 0x94) syz_open_dev$dri(&(0x7f00000001c0), 0x7, 0x2000) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000006c0)}, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_int(r2, 0x0, 0x18, 0x0, &(0x7f0000000040)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, 0x0}, 0x24040084) io_uring_setup(0xf06, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KDFONTOP_COPY(r0, 0x4b72, &(0x7f0000000c00)={0x3, 0x0, 0x1, 0x1f, 0x85, &(0x7f0000000800)}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="5800000002060108000000000000000000000000050005000a000040050001000700000005000400000000000900020073797a310000000014000300686173683a69702c706f72742c6970"], 0x58}, 0x1, 0x0, 0x0, 0x4000010}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r4 = socket$netlink(0x10, 0x3, 0xc) ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, 0x0) r5 = openat$uinput(0xffffffffffffff9c, 0x0, 0x802, 0x0) ioctl$UI_DEV_SETUP(r5, 0x5501, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) 527.648388ms ago: executing program 8 (id=3868): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, 0x0, 0x0, 0x0, 0x0, 0x0) shutdown(r0, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_GET(r1, 0x0, 0x20008800) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socket(0x1a, 0x3, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, 0x0, 0x200200, 0x0) syz_emit_ethernet(0x7e, &(0x7f0000000140)={@multicast, @broadcast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x48, 0x3a, 0x0, @rand_addr=' \x01\x00', @mcast2, {[], @dest_unreach={0x1, 0x3, 0x0, 0x7f, '\x00', {0x0, 0x6, "e1f588", 0x7, 0x0, 0xff, @mcast2, @mcast2, [@fragment={0x2f, 0x0, 0xf, 0x0, 0x0, 0x0, 0x65}, @hopopts={0xbe}], "01a102e9493a5d5b"}}}}}}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x3}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x9}]}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r2, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x38, 0x2, 0x3, 0x201, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFQA_CFG_PARAMS={0x9, 0x2, {0x9}}, @NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0x431}, @NFQA_CFG_MASK={0x8, 0x4, 0x1, 0x0, 0x20}, @NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x1a}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000004}, 0x804) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20041090}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r3, 0x0, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[], 0xd4}}, 0x0) sendmsg$TIPC_NL_LINK_RESET_STATS(r4, &(0x7f0000000540)={&(0x7f0000000000), 0xc, &(0x7f0000000500)={&(0x7f0000000100)={0x14, 0x0, 0x300, 0x70bd28, 0x25dfdbfc}, 0x14}}, 0x8000) 215.042915ms ago: executing program 8 (id=3860): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) getrlimit(0xd, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) ioctl$TIOCGSERIAL(0xffffffffffffffff, 0x541e, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) ioctl$USBDEVFS_REAPURB(0xffffffffffffffff, 0x4004550c, 0x0) ptrace(0x10, 0x0) ptrace$pokeuser(0x6, 0x0, 0x358, 0xffff8881f5c0a000) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x44}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000001180)={0x38, r3, 0x7, 0xfffffffc, 0x3, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}]}, 0x38}}, 0x0) 136.141051ms ago: executing program 2 (id=3862): socket$inet(0x2, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev_mnt\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./dev_mnt\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) syz_usb_connect(0x3, 0x32, &(0x7f0000000100)=ANY=[@ANYBLOB="1201100100000008460d1120000100000001090220000101"], 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x10) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) mkdir(&(0x7f0000000100)='./file1\x00', 0x13b) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0x2730, 0x40, 0x2, 0x82}, 0x0, &(0x7f00000002c0), &(0x7f0000000240)) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x34000, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) getdents64(r1, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev_mnt/ttyUSB0\x00', 0x4002, 0x0) 0s ago: executing program 8 (id=3863): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket$inet6(0xa, 0x3, 0x2) connect$inet6(r4, 0x0, 0x0) setsockopt$inet6_opts(r4, 0x29, 0x36, &(0x7f0000000000)=@hopopts={0x2}, 0x8) sendmmsg(r4, &(0x7f00000092c0), 0x4ff, 0xffd8) kernel console output (not intermixed with test programs): 425465][ T28] audit: type=1800 audit(1790871221.644:433): pid=12614 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.1539" name="zone_nr_conv" dev="configfs" ino=29728 res=0 errno=0 [ 579.417189][ T28] audit: type=1800 audit(1790871221.654:434): pid=12614 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.1539" name="power" dev="configfs" ino=29729 res=0 errno=0 [ 582.095816][T12636] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 583.289199][T12644] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1550'. [ 583.463035][T12645] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1550'. [ 584.932368][ T28] audit: type=1800 audit(1790871228.204:435): pid=12658 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1554" name="memory_backed" dev="configfs" ino=29852 res=0 errno=0 [ 584.979449][ T28] audit: type=1800 audit(1790871228.234:436): pid=12658 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1554" name="zone_nr_conv" dev="configfs" ino=29853 res=0 errno=0 [ 585.176289][ T28] audit: type=1800 audit(1790871228.244:437): pid=12658 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1554" name="power" dev="configfs" ino=29854 res=0 errno=0 [ 585.209174][T12664] syzkaller0: entered promiscuous mode [ 585.220232][T12664] syzkaller0: entered allmulticast mode [ 585.242171][T12664] 0: reclassify loop, rule prio 0, protocol 800 [ 585.306421][T12665] netlink: 12 bytes leftover after parsing attributes in process `syz.7.1544'. [ 585.454479][T12666] vlan2: entered allmulticast mode [ 585.482412][T12666] bridge3: entered allmulticast mode [ 585.627188][T12665] bridge3: port 1(erspan0) entered blocking state [ 585.639454][T12665] bridge3: port 1(erspan0) entered disabled state [ 585.648453][T12665] erspan0: entered allmulticast mode [ 585.657543][T12665] erspan0: entered promiscuous mode [ 585.664814][T12665] bridge3: port 1(erspan0) entered blocking state [ 585.671603][T12665] bridge3: port 1(erspan0) entered forwarding state [ 585.765542][T12665] erspan0: left allmulticast mode [ 585.785400][T12665] erspan0: left promiscuous mode [ 585.795480][T12665] bridge3: port 1(erspan0) entered disabled state [ 585.870788][T12665] bond1: (slave .`): Releasing active interface [ 587.335377][ C0] bridge0: port 3(syz_tun) entered forwarding state [ 587.343222][ C0] bridge0: topology change detected, propagating [ 587.421384][ T1097] net_ratelimit: 1 callbacks suppressed [ 587.610300][T12665] bridge_slave_0: left allmulticast mode [ 587.676135][T12665] bridge_slave_0: left promiscuous mode [ 587.711560][T12665] bridge0: port 1(bridge_slave_0) entered disabled state [ 587.758620][T12665] bridge_slave_1: left allmulticast mode [ 587.791158][T12665] bridge_slave_1: left promiscuous mode [ 587.791357][T12665] bridge0: port 2(bridge_slave_1) entered disabled state [ 587.819315][T12665] .`: (slave bond_slave_0): Releasing backup interface [ 587.857987][T12665] .`: (slave bond_slave_1): Releasing backup interface [ 587.893382][T12665] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 587.893496][T12665] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 587.897234][T12665] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 587.897260][T12665] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 589.310771][T12665] .`: (slave veth3): Releasing backup interface [ 589.512332][T12685] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 591.530581][T12700] syzkaller0: entered promiscuous mode [ 591.559173][T12700] syzkaller0: entered allmulticast mode [ 591.597705][T12700] netlink: 53 bytes leftover after parsing attributes in process `syz.5.1569'. [ 591.644311][T12707] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 594.977222][T12736] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1575'. [ 595.411453][T12740] vlan4: entered allmulticast mode [ 595.472995][T12740] bridge7: entered allmulticast mode [ 595.537786][T12745] bridge7: port 1(erspan0) entered blocking state [ 595.544550][T12745] bridge7: port 1(erspan0) entered disabled state [ 595.812645][T12745] erspan0: entered allmulticast mode [ 595.898841][T12752] x_tables: ip_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 595.921120][T12745] erspan0: entered promiscuous mode [ 595.933154][T12745] bridge7: port 1(erspan0) entered blocking state [ 595.939776][T12745] bridge7: port 1(erspan0) entered forwarding state [ 596.111339][T12739] syzkaller0: entered promiscuous mode [ 596.188088][T12739] syzkaller0: entered allmulticast mode [ 596.994210][T12736] erspan0: left allmulticast mode [ 597.432960][T12736] erspan0: left promiscuous mode [ 597.451705][T12736] bridge7: port 1(erspan0) entered disabled state [ 597.912124][T12759] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 598.000921][T12736] team0: left allmulticast mode [ 598.018932][T12736] team0: left promiscuous mode [ 598.037054][T12736] bridge0: port 1(team0) entered disabled state [ 598.130896][T12736] bond0: (slave geneve2): Releasing active interface [ 600.439606][ T1097] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 600.641420][T12736] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 600.998061][T12736] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 601.035555][T12736] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 601.679818][T12736] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 602.696273][T12770] loop5: detected capacity change from 0 to 4096 [ 605.338344][T12770] NILFS (loop5): error -4 creating segctord thread [ 605.388565][T12736] team0: Port device bridge3 removed [ 605.901821][ T59] net_ratelimit: 1 callbacks suppressed [ 606.571509][T12785] kvm_msr_ignored_check: 1764 callbacks suppressed [ 607.163112][T12797] netlink: 76 bytes leftover after parsing attributes in process `syz.2.1591'. [ 607.585278][T12790] loop7: detected capacity change from 0 to 128 [ 607.593157][T12805] netlink: 'syz.4.1594': attribute type 10 has an invalid length. [ 607.683010][T12805] .`: (slave bridge0): Enslaving as an active interface with an up link [ 607.709386][T12806] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1594'. [ 607.814828][T12810] x_tables: ip6_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 607.923164][T12806] .`: (slave bridge0): Releasing backup interface [ 612.865612][T12824] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 613.049760][T12827] futex_wake_op: syz.2.1598 tries to shift op by 144; fix this program [ 616.599665][T12827] futex_wake_op: syz.2.1598 tries to shift op by 144; fix this program [ 617.656209][ T59] net_ratelimit: 2 callbacks suppressed [ 617.701685][T12843] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 617.809752][T12845] loop5: detected capacity change from 0 to 8 [ 624.580545][ T42] net_ratelimit: 1 callbacks suppressed [ 624.588224][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.594535][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 626.257006][T12879] loop5: detected capacity change from 0 to 16 [ 629.516890][T12887] kvm_msr_ignored_check: 414 callbacks suppressed [ 631.502345][T12906] xt_cgroup: invalid path, errno=-2 [ 632.098665][T12902] loop7: detected capacity change from 0 to 4096 [ 632.218830][T12907] NILFS (loop7): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 635.066691][T12930] IPVS: lblc: SCTP 172.20.20.187:0 - no destination available [ 635.982369][ T12] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 636.371717][T12934] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 636.780036][T12940] sch_tbf: burst 65537 is lower than device syzkaller0 mtu (65589) ! [ 636.811699][T12940] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1624'. [ 637.369174][T12947] xt_cgroup: invalid path, errno=-2 [ 639.999304][T12962] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 641.149520][ T1097] net_ratelimit: 6 callbacks suppressed [ 646.217443][ T12] net_ratelimit: 5 callbacks suppressed [ 648.870650][T13005] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 651.692311][T13021] syzkaller0: entered promiscuous mode [ 651.699488][T13021] syzkaller0: entered allmulticast mode [ 652.249320][T13029] overlayfs: failed to clone upperpath [ 653.185516][T13040] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 653.420973][T13044] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 657.097184][ T1130] net_ratelimit: 2 callbacks suppressed [ 657.562954][ T28] audit: type=1800 audit(1790871300.834:438): pid=13065 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1663" name="c_srate" dev="configfs" ino=30904 res=0 errno=0 [ 659.938416][T13074] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 660.183392][T13077] sch_tbf: burst 65537 is lower than device syzkaller0 mtu (65589) ! [ 662.806676][T13096] netlink: 'syz.4.1672': attribute type 3 has an invalid length. [ 663.542852][T13104] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 664.448801][T13109] overlayfs: failed to clone lowerpath [ 664.720338][T13112] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 668.219864][T13134] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 668.246011][ T59] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 669.559724][T13145] vlan5: entered promiscuous mode [ 669.567126][T13145] .`: entered promiscuous mode [ 672.196489][T13186] IPVS: rr: TCP 127.0.0.1:21 - no destination available [ 673.325901][ C1] IPVS: rr: TCP 127.0.0.1:21 - no destination available [ 676.438697][T13217] siw: device registration error -23 [ 681.276272][ T12] net_ratelimit: 1 callbacks suppressed [ 684.553146][T13248] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 687.541846][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 687.548316][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 687.562206][ T59] net_ratelimit: 1 callbacks suppressed [ 690.684990][T13288] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 696.691076][T13329] syzkaller0: entered promiscuous mode [ 696.699813][T13329] syzkaller0: entered allmulticast mode [ 696.735296][T13329] tc mirred to Houston: device batadv_slave_0 is down [ 697.731252][T13337] Cannot find del_set index 4 as target [ 701.148711][T13361] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 702.416128][ T1097] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 702.569414][T13368] syz.4.1744: vmalloc error: size 16777216, failed to allocated page array size 32768, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=syz4,mems_allowed=0-1 [ 702.591536][T13368] CPU: 0 PID: 13368 Comm: syz.4.1744 Not tainted syzkaller #0 [ 702.599042][T13368] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 702.609138][T13368] Call Trace: [ 702.612433][T13368] [ 702.615379][T13368] dump_stack_lvl+0x18c/0x250 [ 702.620097][T13368] ? show_regs_print_info+0x20/0x20 [ 702.625331][T13368] ? load_image+0x420/0x420 [ 702.629862][T13368] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 702.636309][T13368] ? cpuset_print_current_mems_allowed+0x2e7/0x360 [ 702.642848][T13368] warn_alloc+0x246/0x340 [ 702.647213][T13368] ? zone_watermark_ok_safe+0x230/0x230 [ 702.652790][T13368] ? _raw_spin_unlock+0x28/0x40 [ 702.657683][T13368] __vmalloc_node_range+0x661/0x1320 [ 702.663023][T13368] ? __alloc_pages+0xae/0x460 [ 702.667730][T13368] ? free_vm_area+0x50/0x50 [ 702.672275][T13368] ? packet_set_ring+0x77d/0x2490 [ 702.677320][T13368] vzalloc+0x79/0x90 [ 702.681219][T13368] ? packet_set_ring+0x77d/0x2490 [ 702.686251][T13368] packet_set_ring+0x77d/0x2490 [ 702.691118][T13368] ? packet_mmap+0x510/0x510 [ 702.695705][T13368] ? __lock_acquire+0x7d80/0x7d80 [ 702.700725][T13368] ? __local_bh_enable_ip+0x13a/0x1c0 [ 702.706102][T13368] ? lockdep_hardirqs_on+0x98/0x150 [ 702.711299][T13368] ? __might_fault+0xaa/0x120 [ 702.715972][T13368] ? __might_fault+0xc6/0x120 [ 702.720641][T13368] ? __might_fault+0xaa/0x120 [ 702.725318][T13368] ? _copy_from_user+0xa5/0xe0 [ 702.730089][T13368] packet_setsockopt+0xdb0/0x1500 [ 702.735114][T13368] ? packet_ioctl+0x350/0x350 [ 702.739796][T13368] ? aa_sk_perm+0x83c/0x970 [ 702.744301][T13368] ? irqtime_account_irq+0x16f/0x1c0 [ 702.749589][T13368] ? __fget_files+0x28/0x460 [ 702.754185][T13368] ? aa_af_perm+0x330/0x330 [ 702.758695][T13368] ? __irq_exit_rcu+0xd3/0x190 [ 702.763466][T13368] ? __fget_files+0x28/0x460 [ 702.768058][T13368] ? aa_sock_opt_perm+0x74/0x100 [ 702.772995][T13368] ? bpf_lsm_socket_setsockopt+0x9/0x10 [ 702.778539][T13368] ? security_socket_setsockopt+0x7e/0xa0 [ 702.784256][T13368] ? packet_ioctl+0x350/0x350 [ 702.788934][T13368] do_sock_setsockopt+0x175/0x1a0 [ 702.793957][T13368] ? __fdget+0x180/0x210 [ 702.798201][T13368] __x64_sys_setsockopt+0x182/0x200 [ 702.803402][T13368] do_syscall_64+0x55/0xb0 [ 702.807832][T13368] ? clear_bhb_loop+0x40/0x90 [ 702.812515][T13368] ? clear_bhb_loop+0x40/0x90 [ 702.817193][T13368] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 702.823091][T13368] RIP: 0033:0x7f58af79e159 [ 702.827502][T13368] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 702.847109][T13368] RSP: 002b:00007f58ad9d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 702.855523][T13368] RAX: ffffffffffffffda RBX: 00007f58afa26180 RCX: 00007f58af79e159 [ 702.863491][T13368] RDX: 0000000000000005 RSI: 0000000000000107 RDI: 0000000000000005 [ 702.871458][T13368] RBP: 00007f58af83506b R08: 000000000000001c R09: 0000000000000000 [ 702.879452][T13368] R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000000 [ 702.887531][T13368] R13: 00007f58afa26218 R14: 00007f58afa26180 R15: 00007ffc1488abd8 [ 702.895641][T13368] [ 703.008863][T13378] loop5: detected capacity change from 0 to 512 [ 703.018280][T13378] EXT4-fs: Ignoring removed nobh option [ 703.031135][T13368] Mem-Info: [ 703.050453][T13378] EXT4-fs (loop5): orphan cleanup on readonly fs [ 703.068689][T13378] EXT4-fs error (device loop5): ext4_do_update_inode:5268: inode #15: comm syz.5.1748: corrupted inode contents [ 703.101350][T13378] EXT4-fs (loop5): Remounting filesystem read-only [ 703.109619][T13378] EXT4-fs (loop5): 1 orphan inode deleted [ 703.119180][T13378] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: none. [ 703.201077][T13368] active_anon:16642 inactive_anon:0 isolated_anon:0 [ 703.201077][T13368] active_file:18531 inactive_file:40248 isolated_file:0 [ 703.201077][T13368] unevictable:768 dirty:200 writeback:0 [ 703.201077][T13368] slab_reclaimable:11674 slab_unreclaimable:97307 [ 703.201077][T13368] mapped:26537 shmem:10814 pagetables:880 [ 703.201077][T13368] sec_pagetables:0 bounce:0 [ 703.201077][T13368] kernel_misc_reclaimable:0 [ 703.201077][T13368] free:1314511 free_pcp:15513 free_cma:0 [ 703.340000][ T6426] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 703.425701][T13368] Node 0 active_anon:59068kB inactive_anon:0kB active_file:74100kB inactive_file:160788kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:106148kB dirty:800kB writeback:0kB shmem:34320kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12292kB pagetables:3420kB sec_pagetables:0kB all_unreclaimable? no [ 703.742976][T13368] Node 1 active_anon:0kB inactive_anon:0kB active_file:24kB inactive_file:204kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:16kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:16kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 703.975467][T13391] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 703.994321][T13368] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 704.157651][T13368] lowmem_reserve[]: 0 2521 2522 2522 2522 [ 704.163808][T13368] Node 0 DMA32 free:1362728kB boost:0kB min:34644kB low:43304kB high:51964kB reserved_highatomic:0KB active_anon:82148kB inactive_anon:0kB active_file:74100kB inactive_file:159964kB unevictable:1536kB writepending:812kB present:3129332kB managed:2586800kB mlocked:0kB bounce:0kB free_pcp:10508kB local_pcp:896kB free_cma:0kB [ 704.251555][T13368] lowmem_reserve[]: 0 0 0 0 0 [ 704.295910][T13368] Node 0 Normal free:0kB boost:0kB min:8kB low:8kB high:8kB reserved_highatomic:0KB active_anon:40kB inactive_anon:0kB active_file:0kB inactive_file:824kB unevictable:0kB writepending:0kB present:1048576kB managed:872kB mlocked:0kB bounce:0kB free_pcp:8kB local_pcp:0kB free_cma:0kB [ 704.520429][T13368] lowmem_reserve[]: 0 [ 704.520509][T13368] 0 0 [ 704.528695][T13368] 0 0 [ 704.531739][T13368] Node 1 Normal free:3869680kB boost:0kB min:55244kB low:69052kB high:82860kB reserved_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:24kB inactive_file:204kB unevictable:1536kB writepending:0kB present:4194304kB managed:4117312kB mlocked:0kB bounce:0kB free_pcp:44576kB local_pcp:31424kB free_cma:0kB [ 704.531806][T13368] lowmem_reserve[]: 0 0 0 0 0 [ 704.594322][T13394] netlink: 27 bytes leftover after parsing attributes in process `syz.5.1751'. [ 704.609281][T13368] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 704.653721][T13368] Node 0 DMA32: 6*4kB (E) 276*8kB (UME) 429*16kB (UME) 551*32kB (UME) 300*64kB (ME) 94*128kB (M) 93*256kB (M) 77*512kB (UM) 42*1024kB (UME) 19*2048kB (M) 283*4096kB (M) = 1362280kB [ 704.699116][T13394] loop5: detected capacity change from 0 to 2048 [ 704.706212][T13368] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 704.728770][T13368] Node 1 Normal: 260*4kB (UME) 64*8kB (UE) 40*16kB (UE) 161*32kB (UME) 45*64kB (UE) 14*128kB (UME) 1*256kB (U) 2*512kB (ME) 2*1024kB (UE) 4*2048kB (UME) 939*4096kB (M) = 3869680kB [ 704.769625][T13368] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 704.818162][T13368] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 704.846708][T13368] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 704.898533][T13368] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 704.923817][T13368] 70833 total pagecache pages [ 704.957714][T13368] 0 pages in swap cache [ 704.982059][T13368] Free swap = 124612kB [ 705.009379][T13368] Total swap = 124996kB [ 705.190836][T13368] 2097051 pages RAM [ 705.261664][T13400] syzkaller0: entered promiscuous mode [ 705.267348][T13400] syzkaller0: entered allmulticast mode [ 705.314831][T13368] 0 pages HighMem/MovableOnly [ 705.321819][T13368] 416965 pages reserved [ 705.326826][T13368] 0 pages cma reserved [ 706.997816][T13408] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 710.930783][T13440] netlink: 27 bytes leftover after parsing attributes in process `syz.2.1762'. [ 711.982814][ C0] net_ratelimit: 1 callbacks suppressed [ 714.245885][T13471] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 719.459491][ T1097] net_ratelimit: 1 callbacks suppressed [ 719.828877][T13506] syzkaller0: entered promiscuous mode [ 719.853214][T13506] syzkaller0: entered allmulticast mode [ 726.503483][T13571] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 729.370461][T13590] gadgetfs: bound to dummy_udc driver [ 729.668216][ T6925] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 729.682198][ C1] gadgetfs: connected [ 729.690502][ T6925] gadgetfs: disconnected [ 731.686319][T13587] gadgetfs: suspended from state 2 [ 731.703763][ T1130] net_ratelimit: 1 callbacks suppressed [ 731.731578][ T6925] usb 2-1: device descriptor read/all, error -71 [ 731.971261][T13609] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 735.449749][T13624] overlayfs: failed to clone upperpath [ 737.760712][T13634] loop5: detected capacity change from 0 to 128 [ 738.045753][T12415] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 740.386422][T13653] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 747.754427][T13686] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 750.266115][T13708] tmpfs: Bad value for 'nr_inodes' [ 750.868947][ T59] net_ratelimit: 1 callbacks suppressed [ 753.058095][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 753.064418][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 753.918335][T13721] netdevsim netdevsim7: loading /lib/firmware// failed with error -22 [ 753.929240][T13721] netdevsim netdevsim7: Direct firmware load for / failed with error -22 [ 753.939295][T13721] netdevsim netdevsim7: Falling back to sysfs fallback for: / [ 754.488753][ T28] audit: type=1800 audit(1790871391.961:439): pid=13716 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1838" name="bus" dev="ramfs" ino=33076 res=0 errno=0 [ 755.888752][T13732] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1843'. [ 763.912498][T13783] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 767.219155][T13806] tmpfs: Bad value for 'nr_inodes' [ 768.155954][ T42] net_ratelimit: 1 callbacks suppressed [ 769.536547][T13823] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 769.833670][ T28] audit: type=1800 audit(1790871406.320:440): pid=13815 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.1864" name="bus" dev="ramfs" ino=33876 res=0 errno=0 [ 770.761997][T13826] overlayfs: failed to clone upperpath [ 772.415862][T13836] loop5: detected capacity change from 0 to 512 [ 774.006955][ T11] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 774.091708][T13836] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a803c198, mo2=0002] [ 774.481267][T13836] System zones: [ 774.484942][T13836] 1-12 [ 774.551360][T13836] EXT4-fs error (device loop5): ext4_iget_extra_inode:4752: inode #15: comm syz.5.1879: corrupted in-inode xattr: e_value size too large [ 774.646031][T13836] EXT4-fs error (device loop5): ext4_orphan_get:1413: comm syz.5.1879: couldn't read orphan inode 15 (err -117) [ 774.735303][T13836] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 775.218588][T13847] syzkaller0: entered promiscuous mode [ 775.281296][T13854] dns_resolver: Unsupported server list version (6) [ 775.522672][T13847] syzkaller0: entered allmulticast mode [ 776.253935][ T6426] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 776.376220][ T5833] usb 8-1: new full-speed USB device number 6 using dummy_hcd [ 776.781235][ T5833] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 777.067742][ T5833] usb 8-1: config 0 has no interfaces? [ 777.076093][ T5833] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a5, bcdDevice= 0.40 [ 777.085368][ T5833] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 777.094025][ T5833] usb 8-1: SerialNumber: syz [ 777.335807][ T5833] usb 8-1: config 0 descriptor?? [ 780.340870][T11168] Bluetooth: hci1: command 0x0406 tx timeout [ 780.845515][T13879] syzkaller0: entered promiscuous mode [ 780.881776][T13879] syzkaller0: entered allmulticast mode [ 783.288858][ T5812] usb 8-1: USB disconnect, device number 6 [ 785.878937][T13902] overlayfs: failed to clone lowerpath [ 786.261357][T13907] loop7: detected capacity change from 0 to 4096 [ 786.269258][T13907] EXT4-fs: inline encryption not supported [ 787.014087][T13907] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 787.055712][T13907] EXT4-fs (loop7): Test dummy encryption mode enabled [ 787.127597][T13907] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=280ec1a8, mo2=0003] [ 787.281672][T13907] System zones: 0-5 [ 787.332117][T13907] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 789.198650][T13924] syzkaller0: entered promiscuous mode [ 789.231626][T13924] syzkaller0: entered allmulticast mode [ 789.285430][T13924] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1890'. [ 789.556159][ T9078] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 790.585509][T13942] overlayfs: overlapping lowerdir path [ 792.370191][T13946] dvmrp6: entered allmulticast mode [ 794.232324][T13961] loop7: detected capacity change from 0 to 1024 [ 794.808885][T13969] vlan0: entered promiscuous mode [ 794.918756][T13970] syzkaller0: entered promiscuous mode [ 794.925479][T13970] syzkaller0: entered allmulticast mode [ 795.178066][T13974] tipc: Enabling of bearer rejected, failed to enable media [ 803.719186][T14018] overlayfs: overlapping lowerdir path [ 804.409916][T14020] overlayfs: failed to clone upperpath [ 808.641242][T12415] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 811.896101][T14059] syzkaller0: entered promiscuous mode [ 811.902900][T14059] syzkaller0: entered allmulticast mode [ 811.928018][T14059] 0: reclassify loop, rule prio 0, protocol 800 [ 818.169763][T14088] netlink: 'syz.7.1926': attribute type 3 has an invalid length. [ 819.957627][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 819.964360][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 823.052872][ T28] audit: type=1326 audit(1790871456.102:441): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14101 comm="syz.2.1934" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f943399e159 code=0x0 [ 823.211315][T14112] tipc: Enabled bearer , priority 0 [ 823.222522][T14112] syzkaller0: entered promiscuous mode [ 823.228794][T14112] syzkaller0: entered allmulticast mode [ 823.248763][T14114] netlink: 48 bytes leftover after parsing attributes in process `syz.5.1937'. [ 823.269751][T14112] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 823.361669][T14114] netlink: 'syz.5.1937': attribute type 11 has an invalid length. [ 824.836141][T14116] tipc: Resetting bearer [ 824.912606][T14111] tipc: Resetting bearer [ 824.974267][T14111] tipc: Disabling bearer [ 833.381738][ T1117] net_ratelimit: 1 callbacks suppressed [ 834.048882][T14169] netlink: 'syz.4.1949': attribute type 12 has an invalid length. [ 835.040743][T14177] loop7: detected capacity change from 0 to 164 [ 836.005711][T14178] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 836.351621][ T28] audit: type=1800 audit(1790871468.542:442): pid=14181 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1952" name="addr_trtype" dev="configfs" ino=33478 res=0 errno=0 [ 836.816195][T14181] nvmet: transport type 0 not supported [ 836.824080][ T28] audit: type=1800 audit(1790871468.627:443): pid=14181 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1952" name="addr_trsvcid" dev="configfs" ino=33479 res=0 errno=0 [ 838.990531][T14196] ip_tables: iptables: counters copy to user failed while replacing table [ 839.287667][T14199] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 839.408516][T14201] loop5: detected capacity change from 0 to 512 [ 839.475290][T14201] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 839.514154][T14201] ext4 filesystem being mounted at /414/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 839.642228][T14210] tipc: Enabling of bearer rejected, failed to enable media [ 840.727202][ T6426] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 844.043529][ T11] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 845.460728][T12417] net_ratelimit: 2 callbacks suppressed [ 846.066163][T14240] 9pnet_virtio: no channels available for device 127.0.0.1 [ 851.559457][ C0] net_ratelimit: 7 callbacks suppressed [ 853.317414][T14261] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 853.662108][T14264] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 854.119688][T14267] netlink: 'syz.2.1972': attribute type 3 has an invalid length. [ 854.776012][T14274] loop7: detected capacity change from 0 to 512 [ 854.828824][T14274] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 854.874436][T14274] ext4 filesystem being mounted at /286/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 856.189452][ T9078] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 857.720558][ T11] net_ratelimit: 3 callbacks suppressed [ 862.303818][T14330] netlink: 'syz.5.1984': attribute type 3 has an invalid length. [ 864.339729][ T12] net_ratelimit: 2 callbacks suppressed [ 867.607306][T14355] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 869.776845][ T1097] net_ratelimit: 2 callbacks suppressed [ 872.540150][T14370] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 876.159247][T14385] ubi0: attaching mtd0 [ 876.174161][T14385] ubi0: scanning is finished [ 876.178868][T14385] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 876.892141][ T12] net_ratelimit: 1 callbacks suppressed [ 876.944534][T14385] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 877.258871][T14402] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 877.949218][T14406] netlink: 'syz.5.2006': attribute type 3 has an invalid length. [ 882.358290][ T1117] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 882.370417][T12413] net_ratelimit: 2 callbacks suppressed [ 884.415441][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 884.427040][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 884.560653][T14432] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 884.918539][T14439] syzkaller0: entered promiscuous mode [ 884.925020][T14439] syzkaller0: entered allmulticast mode [ 884.941126][T14439] tipc: Enabled bearer , priority 0 [ 884.969021][T14439] tipc: Resetting bearer [ 884.991051][T14438] tipc: Resetting bearer [ 885.071340][T14438] tipc: Disabling bearer [ 887.822230][ T11] net_ratelimit: 1 callbacks suppressed [ 894.254410][T14502] ip_tables: iptables: counters copy to user failed while replacing table [ 905.315144][T12415] net_ratelimit: 1 callbacks suppressed [ 917.254819][ T42] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 917.606432][T14597] EXT4-fs warning (device sda1): verify_group_input:151: Cannot add at group 11 (only 8 groups) [ 917.683010][ T11] net_ratelimit: 1 callbacks suppressed [ 924.752538][T14620] xt_CT: You must specify a L4 protocol and not use inversions on it [ 928.361645][T14628] Unable to allocate crypto cipher with name [ecb(aes)]; rc = [-2] [ 928.446495][T14628] Error attempting to initialize key TFM cipher with name = [aes]; rc = [-2] [ 928.493710][T14628] Error attempting to initialize cipher with name = [aes] and key size = [16]; rc = [-2] [ 928.559366][T14628] Error parsing options; rc = [-22] [ 931.673140][T14652] syzkaller0: entered promiscuous mode [ 931.703509][T14652] syzkaller0: entered allmulticast mode [ 935.705303][T14681] FAULT_INJECTION: forcing a failure. [ 935.705303][T14681] name failslab, interval 1, probability 0, space 0, times 0 [ 935.718071][T14681] CPU: 1 PID: 14681 Comm: syz.5.2074 Not tainted syzkaller #0 [ 935.725581][T14681] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 935.735657][T14681] Call Trace: [ 935.738949][T14681] [ 935.741891][T14681] dump_stack_lvl+0x18c/0x250 [ 935.746592][T14681] ? show_regs_print_info+0x20/0x20 [ 935.751823][T14681] ? load_image+0x420/0x420 [ 935.756350][T14681] ? __might_sleep+0xe0/0xe0 [ 935.760960][T14681] ? __lock_acquire+0x7d80/0x7d80 [ 935.766006][T14681] ? trace_raw_output_percpu_destroy_chunk+0xc0/0xc0 [ 935.772708][T14681] should_fail_ex+0x394/0x4c0 [ 935.777419][T14681] should_failslab+0x9/0x20 [ 935.781963][T14681] slab_pre_alloc_hook+0x59/0x300 [ 935.787022][T14681] ? pcpu_alloc+0x11e7/0x1880 [ 935.791719][T14681] ? percpu_ref_init+0xc3/0x340 [ 935.796589][T14681] __kmem_cache_alloc_node+0x53/0x250 [ 935.801996][T14681] ? percpu_ref_init+0xc3/0x340 [ 935.806868][T14681] ? io_allocate_scq_urings+0x620/0x620 [ 935.812473][T14681] kmalloc_trace+0x2a/0xe0 [ 935.817019][T14681] percpu_ref_init+0xc3/0x340 [ 935.821724][T14681] io_ring_ctx_alloc+0x205/0xc10 [ 935.826692][T14681] io_uring_create+0x2df/0x1330 [ 935.831572][T14681] ? __might_fault+0xc6/0x120 [ 935.836272][T14681] ? __might_fault+0xaa/0x120 [ 935.840978][T14681] __se_sys_io_uring_setup+0x29f/0x2b0 [ 935.846473][T14681] ? __x64_sys_io_uring_setup+0x60/0x60 [ 935.852061][T14681] ? lockdep_hardirqs_on+0x98/0x150 [ 935.857283][T14681] do_syscall_64+0x55/0xb0 [ 935.861723][T14681] ? clear_bhb_loop+0x40/0x90 [ 935.866423][T14681] ? clear_bhb_loop+0x40/0x90 [ 935.871146][T14681] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 935.877099][T14681] RIP: 0033:0x7efe3579e159 [ 935.881680][T14681] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 935.901300][T14681] RSP: 002b:00007efe36662fb8 EFLAGS: 00000206 ORIG_RAX: 00000000000001a9 [ 935.909745][T14681] RAX: ffffffffffffffda RBX: 0000200000000340 RCX: 00007efe3579e159 [ 935.917735][T14681] RDX: 0000200000000040 RSI: 0000200000000340 RDI: 0000000000000021 [ 935.925721][T14681] RBP: 00007efe3583506b R08: 0000000000000000 R09: 0000000000000000 [ 935.933704][T14681] R10: 0000200000000140 R11: 0000000000000206 R12: 0000200000000040 [ 935.941690][T14681] R13: 0000200000000140 R14: 0000200000000000 R15: 00007ffcfd9c3938 [ 935.949695][T14681] [ 944.263781][T14726] syzkaller0: entered promiscuous mode [ 944.327491][T14726] syzkaller0: entered allmulticast mode [ 944.361526][T14730] tipc: Enabled bearer , priority 0 [ 944.444701][T14726] tipc: Resetting bearer [ 944.601963][T14725] tipc: Resetting bearer [ 944.773393][T14725] tipc: Disabling bearer [ 944.991742][T14744] device-mapper: ioctl: device has been removed from the dev hash table. [ 946.255297][T14760] syzkaller0: entered promiscuous mode [ 946.308785][T14760] syzkaller0: entered allmulticast mode [ 950.191806][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 950.198253][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 952.873225][T14800] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2098'. [ 952.886616][T14800] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2098'. [ 952.896737][T14800] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2098'. [ 952.906653][T14800] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2098'. [ 952.916500][T14800] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2098'. [ 957.706242][T14828] tc action pedit 'at' offset 5 out of bounds [ 957.713332][T14828] tc action pedit 'at' offset 5 out of bounds [ 957.719497][T14828] tc action pedit 'at' offset 5 out of bounds [ 957.725581][T14828] tc action pedit 'at' offset 5 out of bounds [ 957.731730][T14828] tc action pedit 'at' offset 5 out of bounds [ 957.737820][T14828] tc action pedit 'at' offset 5 out of bounds [ 957.743937][T14828] tc action pedit 'at' offset 5 out of bounds [ 957.750089][T14828] tc action pedit 'at' offset 5 out of bounds [ 957.756182][T14828] tc action pedit 'at' offset 5 out of bounds [ 957.762308][T14828] tc action pedit 'at' offset 5 out of bounds [ 957.768404][T14828] 0: reclassify loop, rule prio 0, protocol 800 [ 958.297950][ T42] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 958.327636][T14835] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 964.469359][T12415] net_ratelimit: 2 callbacks suppressed [ 966.061964][T14882] tipc: Started in network mode [ 966.083186][T14882] tipc: Node identity ac1414aa, cluster identity 4711 [ 966.098110][T14882] tipc: New replicast peer: 172.20.20.187 [ 966.136964][T14882] tipc: Enabled bearer , priority 10 [ 968.122081][ T5832] tipc: Node number set to 2886997162 [ 974.452400][T14924] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2120'. [ 976.592006][T14944] overlayfs: failed to clone upperpath [ 985.208980][T10743] Bluetooth: hci1: command 0x0406 tx timeout [ 985.786823][T14990] loop5: detected capacity change from 0 to 512 [ 985.855795][T14990] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 985.931029][T14990] EXT4-fs (loop5): 1 truncate cleaned up [ 985.938031][T14990] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 987.371699][ T6426] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 987.975383][T15009] netlink: set zone limit has 8 unknown bytes [ 988.774127][T15016] xt_policy: output policy not valid in PREROUTING and INPUT [ 995.653437][ T12] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 996.922578][ T12] net_ratelimit: 2 callbacks suppressed [ 998.385064][T15044] tipc: Bearer : already 2 bearers with priority 10 [ 998.393773][T15044] tipc: Bearer : trying with adjusted priority [ 998.438626][T15044] tipc: Enabled bearer , priority 9 [ 999.647704][T15063] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1001.021815][T15077] tipc: New replicast peer: 172.20.20.187 [ 1001.034391][T15077] tipc: Enabled bearer , priority 10 [ 1002.750479][T15105] syzkaller0: entered promiscuous mode [ 1002.768860][ T59] net_ratelimit: 1 callbacks suppressed [ 1002.784521][T15105] syzkaller0: entered allmulticast mode [ 1002.800043][T15109] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1007.450116][T15132] random: crng reseeded on system resumption [ 1008.449829][T15138] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1009.986927][T15146] tipc: Enabling of bearer rejected, already enabled [ 1013.894128][ T11] net_ratelimit: 1 callbacks suppressed [ 1015.776107][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 1015.782653][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 1016.184383][T10743] Bluetooth: hci1: command 0x0406 tx timeout [ 1019.441497][T15178] net_ratelimit: 1 callbacks suppressed [ 1023.690685][T15210] futex_wake_op: syz.4.2193 tries to shift op by 144; fix this program [ 1027.235795][T15175] net_ratelimit: 4 callbacks suppressed [ 1028.901075][T15229] tipc: Enabling of bearer rejected, failed to enable media [ 1030.352829][T15251] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1031.117601][T15178] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1039.744791][T15293] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 1040.755388][T15174] net_ratelimit: 1 callbacks suppressed [ 1046.598706][T15173] net_ratelimit: 1 callbacks suppressed [ 1048.645103][T15333] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1049.004418][T13860] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 1049.144971][T15341] ip_tables: iptables: counters copy to user failed while replacing table [ 1049.209879][T15345] 9pnet_virtio: no channels available for device 127.0.0.1 [ 1050.054212][T13860] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1050.080395][T13860] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 0 [ 1050.142899][T13860] usb 6-1: New USB device found, idVendor=0471, idProduct=081e, bcdDevice= 1.00 [ 1050.161422][T15348] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2224'. [ 1050.173305][T15348] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2224'. [ 1050.182596][T15348] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2224'. [ 1050.191855][T15348] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2224'. [ 1050.200975][T15348] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2224'. [ 1050.223101][T13860] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1050.263085][T13860] spcp8x5 6-1:1.0: SPCP8x5 converter detected [ 1050.364976][T13860] usb 6-1: SPCP8x5 converter now attached to ttyUSB0 [ 1052.776527][T14561] usb 6-1: USB disconnect, device number 7 [ 1052.817909][T15173] net_ratelimit: 1 callbacks suppressed [ 1052.839516][T14561] SPCP8x5 ttyUSB0: SPCP8x5 converter now disconnected from ttyUSB0 [ 1052.879529][T14561] spcp8x5 6-1:1.0: device disconnected [ 1053.136926][T15362] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1056.827053][T15387] 9pnet_virtio: no channels available for device 127.0.0.1 [ 1058.872145][ T11] net_ratelimit: 1 callbacks suppressed [ 1058.939405][T15400] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1062.245140][T15414] syz.7.2233: attempt to access beyond end of device [ 1062.245140][T15414] nbd7: rw=4096, sector=128, nr_sectors = 8 limit=0 [ 1062.336787][T15414] gfs2: error 10 reading superblock [ 1064.494025][T15178] net_ratelimit: 1 callbacks suppressed [ 1064.860252][T15435] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1065.588422][T15440] loop7: detected capacity change from 0 to 512 [ 1065.625688][T15440] EXT4-fs (loop7): encrypted files will use data=ordered instead of data journaling mode [ 1067.008304][ T28] audit: type=1326 audit(1790871683.666:444): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15441 comm="syz.2.2249" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f943399e159 code=0x0 [ 1067.032190][T15440] EXT4-fs (loop7): 1 truncate cleaned up [ 1067.040128][T15440] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1067.150731][T15448] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1068.210187][ T9078] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1068.342824][T15455] __vm_enough_memory: pid: 15455, comm: syz.4.2252, not enough memory for the allocation [ 1068.699037][T15175] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1070.555208][T15177] net_ratelimit: 2 callbacks suppressed [ 1071.233664][T15477] netlink: set zone limit has 8 unknown bytes [ 1072.613526][T15483] syzkaller0: entered promiscuous mode [ 1072.619158][T15483] syzkaller0: entered allmulticast mode [ 1072.630959][T15483] tipc: Enabled bearer , priority 0 [ 1072.948802][T15480] block nbd5: shutting down sockets [ 1073.201718][T15487] tipc: Resetting bearer [ 1073.251368][T15482] tipc: Resetting bearer [ 1073.424257][T15482] tipc: Disabling bearer [ 1073.874175][T15494] 9pnet_virtio: no channels available for device 127.0.0.1 [ 1074.594326][T15496] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1075.924333][T15504] loop7: detected capacity change from 0 to 164 [ 1076.790547][T15506] rock: directory entry would overflow storage [ 1076.799891][T15506] rock: sig=0x4f50, size=4, remaining=3 [ 1076.806278][T15506] iso9660: Corrupted directory entry in block 5 of inode 1792 [ 1077.088500][T14963] Bluetooth: hci1: command 0x0406 tx timeout [ 1078.060888][T15520] netlink: set zone limit has 8 unknown bytes [ 1079.714825][T15530] 9pnet_virtio: no channels available for device 127.0.0.1 [ 1081.811657][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 1081.819728][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 1081.870455][T15536] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1083.502804][ C1] net_ratelimit: 1 callbacks suppressed [ 1084.404301][T15554] netlink: 'syz.5.2280': attribute type 14 has an invalid length. [ 1084.454429][T15554] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2280'. [ 1084.478006][T15554] bond0: option xmit_hash_policy: invalid value (183) [ 1085.255333][T15561] netlink: set zone limit has 8 unknown bytes [ 1087.255936][T15565] loop5: detected capacity change from 0 to 1024 [ 1087.292319][T15565] EXT4-fs (loop5): ext4_check_descriptors: Checksum for group 0 failed (62631!=20869) [ 1089.134548][T15565] EXT4-fs (loop5): stripe (65535) is not aligned with cluster size (16), stripe is disabled [ 1089.560122][T15565] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 1089.588619][ T11] net_ratelimit: 2 callbacks suppressed [ 1089.727077][ T6426] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1089.935812][T15577] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1090.755565][T15590] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1090.835476][T15591] 9pnet_virtio: no channels available for device 127.0.0.1 [ 1091.555087][T15592] loop5: detected capacity change from 0 to 32768 [ 1091.670066][T15592] XFS (loop5): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 1091.794098][T15592] XFS (loop5): Ending clean mount [ 1091.823205][T15592] XFS (loop5): Quotacheck needed: Please wait. [ 1091.891256][T15606] ip_tables: iptables: counters copy to user failed while replacing table [ 1092.078724][T15592] XFS (loop5): Quotacheck: Done. [ 1092.135541][T15611] RDS: rds_bind could not find a transport for fec0:ffff:ffff:ffff::1, load rds_tcp or rds_rdma? [ 1094.825299][T15632] netlink: 14 bytes leftover after parsing attributes in process `syz.7.2300'. [ 1095.154223][T15174] net_ratelimit: 3 callbacks suppressed [ 1095.262110][T15632] .` (unregistering): Released all slaves [ 1095.368899][T15638] 9pnet_virtio: no channels available for device 127.0.0.1 [ 1096.116521][T15641] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1097.302707][ T6426] XFS (loop5): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb [ 1097.662163][T15658] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1099.712564][T15666] syzkaller0: entered promiscuous mode [ 1099.718103][T15666] syzkaller0: entered allmulticast mode [ 1099.838111][T15673] 9pnet_virtio: no channels available for device 127.0.0.1 [ 1100.273939][T15666] tipc: Enabled bearer , priority 0 [ 1100.329136][T15666] tipc: Resetting bearer [ 1100.379264][T15665] tipc: Resetting bearer [ 1100.469996][T15665] tipc: Disabling bearer [ 1100.837717][T15679] netlink: 'syz.7.2315': attribute type 10 has an invalid length. [ 1100.878837][T15680] net_ratelimit: 1 callbacks suppressed [ 1100.878870][T15680] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1103.442079][T15698] syzkaller0: entered promiscuous mode [ 1103.466279][T15698] syzkaller0: entered allmulticast mode [ 1105.500923][T15702] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2319'. [ 1105.522727][T15178] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1105.821664][T15718] netlink: 'syz.4.2323': attribute type 1 has an invalid length. [ 1106.608496][T15724] loop5: detected capacity change from 0 to 164 [ 1106.649104][T15725] net_ratelimit: 2 callbacks suppressed [ 1106.649120][T15725] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1106.720083][T15728] 9pnet_virtio: no channels available for device 127.0.0.1 [ 1107.555288][T15729] rock: directory entry would overflow storage [ 1107.561658][T15729] rock: sig=0x4f50, size=4, remaining=3 [ 1107.567248][T15729] iso9660: Corrupted directory entry in block 5 of inode 1792 [ 1107.990729][T15731] team0: Port device xfrm0 added [ 1108.105217][T15731] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 1108.218920][T15733] kvm_msr_ignored_check: 1545 callbacks suppressed [ 1108.692210][T15733] kvm: kvm [15732]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x800100000080 [ 1108.814342][T15744] loop5: detected capacity change from 0 to 8 [ 1108.951135][T15744] SQUASHFS error: zlib decompression failed, data probably corrupt [ 1108.960809][T15744] SQUASHFS error: Failed to read block 0x9b: -5 [ 1108.967118][T15744] SQUASHFS error: Unable to read metadata cache entry [99] [ 1108.974381][T15744] SQUASHFS error: Unable to read inode 0x127 [ 1109.118779][T15744] loop5: detected capacity change from 0 to 4096 [ 1109.211252][T15749] NILFS (loop5): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1109.722118][ T28] audit: type=1326 audit(1790871724.253:445): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15751 comm="syz.4.2333" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f58af79e159 code=0x7ffc0000 [ 1109.901624][ T28] audit: type=1326 audit(1790871724.281:446): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15751 comm="syz.4.2333" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f58af79e159 code=0x7ffc0000 [ 1110.048747][T15758] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1110.057783][ T28] audit: type=1326 audit(1790871724.290:447): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15751 comm="syz.4.2333" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f58af79e159 code=0x7ffc0000 [ 1112.223003][ T28] audit: type=1326 audit(1790871724.290:448): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15751 comm="syz.4.2333" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f58af79e159 code=0x7ffc0000 [ 1112.281738][T15761] netlink: 'syz.4.2333': attribute type 30 has an invalid length. [ 1112.389468][ T28] audit: type=1326 audit(1790871724.290:449): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15751 comm="syz.4.2333" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f58af79e159 code=0x7ffc0000 [ 1112.481855][ T28] audit: type=1326 audit(1790871724.290:450): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15751 comm="syz.4.2333" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f58af79e159 code=0x7ffc0000 [ 1112.612054][ T28] audit: type=1326 audit(1790871724.290:451): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15751 comm="syz.4.2333" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f58af79e159 code=0x7ffc0000 [ 1112.702971][ T28] audit: type=1326 audit(1790871724.290:452): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15751 comm="syz.4.2333" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f58af79e159 code=0x7ffc0000 [ 1112.755300][T15770] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1112.798110][ T28] audit: type=1326 audit(1790871724.299:453): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15751 comm="syz.4.2333" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f58af79e159 code=0x7ffc0000 [ 1112.902244][ T28] audit: type=1326 audit(1790871724.309:454): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15751 comm="syz.4.2333" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f58af79e159 code=0x7ffc0000 [ 1117.749441][T15178] net_ratelimit: 1 callbacks suppressed [ 1123.779492][T15805] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1123.901112][T15806] random: crng reseeded on system resumption [ 1124.026281][T15807] loop7: detected capacity change from 0 to 128 [ 1127.327404][T15811] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1127.568597][T15817] fuse: Bad value for 'fd' [ 1129.731250][T15830] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 1130.078626][T15834] syzkaller0: entered promiscuous mode [ 1130.084371][T15834] syzkaller0: entered allmulticast mode [ 1130.094644][T15834] tipc: Enabled bearer , priority 0 [ 1130.111480][T15834] tipc: Resetting bearer [ 1130.282415][T15833] tipc: Resetting bearer [ 1130.526134][T15833] tipc: Disabling bearer [ 1135.362615][T15866] syzkaller0: entered promiscuous mode [ 1135.378229][T15866] syzkaller0: entered allmulticast mode [ 1135.409835][T15866] tipc: Enabled bearer , priority 0 [ 1135.474009][T15866] tipc: Resetting bearer [ 1135.510860][T15865] tipc: Resetting bearer [ 1135.593767][T15865] tipc: Disabling bearer [ 1136.729568][T15882] loop7: detected capacity change from 0 to 4096 [ 1136.822198][T15883] NILFS (loop7): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1137.782384][T15891] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1139.901718][ T11] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1141.350782][T15175] net_ratelimit: 1 callbacks suppressed [ 1141.898824][T15914] syzkaller0: entered promiscuous mode [ 1141.904344][T15914] syzkaller0: entered allmulticast mode [ 1146.942002][ C0] net_ratelimit: 2 callbacks suppressed [ 1147.146447][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 1147.153486][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 1147.431442][T15964] jffs2: notice: (15964) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1148.120414][T15969] loop5: detected capacity change from 0 to 256 [ 1148.273639][T15969] FAT-fs (loop5): bogus number of FAT sectors [ 1148.314281][T15969] FAT-fs (loop5): Can't find a valid FAT filesystem [ 1148.388936][T15972] team0: Port device xfrm0 removed [ 1148.411742][T15969] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2391'. [ 1149.397216][T15972] team0: Mode changed to "broadcast" [ 1150.007920][T15983] loop5: detected capacity change from 0 to 16 [ 1150.099244][T15983] erofs: (device loop5): mounted with root inode @ nid 36. [ 1150.115148][T15983] syz.5.2396: attempt to access beyond end of device [ 1150.115148][T15983] loop5: rw=524288, sector=1342177272, nr_sectors = 32 limit=16 [ 1150.131365][T15983] syz.5.2396: attempt to access beyond end of device [ 1150.131365][T15983] loop5: rw=0, sector=1342177272, nr_sectors = 32 limit=16 [ 1150.150178][ T28] kauditd_printk_skb: 19 callbacks suppressed [ 1150.150194][ T28] audit: type=1800 audit(1791396050.066:474): pid=15983 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.2396" name="file1" dev="loop5" ino=86 res=0 errno=0 [ 1150.186885][T15983] syz.5.2396: attempt to access beyond end of device [ 1150.186885][T15983] loop5: rw=524288, sector=1342180312, nr_sectors = 24 limit=16 [ 1151.664637][T16013] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1152.754641][T16026] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2405'. [ 1153.048053][T16031] overlayfs: missing 'lowerdir' [ 1155.220602][T16040] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1156.992116][T16051] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1161.675272][T16063] syz.7.2418 (16063): drop_caches: 2 [ 1163.778088][T16074] loop7: detected capacity change from 0 to 164 [ 1163.961994][T16084] netlink: 'syz.2.2421': attribute type 1 has an invalid length. [ 1164.161334][T16086] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2421'. [ 1164.209126][T16086] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1164.298288][T16088] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1164.317104][T16088] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 20004 - 0 [ 1164.343373][T16090] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1164.347639][T16088] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 20004 - 0 [ 1164.375468][T16088] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 20004 - 0 [ 1164.417177][T16088] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 20004 - 0 [ 1164.445236][T16088] bond4: (slave geneve3): making interface the new active one [ 1164.458470][T16088] bond4: (slave geneve3): Enslaving as an active interface with an up link [ 1166.482065][T16094] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1168.472990][T16113] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1175.191266][T15174] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1177.288694][T16148] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1180.101666][T16163] loop7: detected capacity change from 0 to 1024 [ 1180.123442][T16163] EXT4-fs: Ignoring removed bh option [ 1180.222921][T16163] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1180.292247][T16163] EXT4-fs warning (device loop7): ext4_expand_extra_isize_ea:2858: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 1181.319565][T16175] Could not find key with description: [syz] [ 1181.325753][T16175] process_request_key_err: No key [ 1181.333214][T16175] Could not find valid key in user session keyring for sig specified in mount option: [syz] [ 1181.344673][T16175] One or more global auth toks could not properly register; rc = [-2] [ 1181.364812][T16175] Error parsing options; rc = [-2] [ 1181.480799][T16180] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1184.042432][ T9078] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1185.644428][T16226] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 1185.982456][T16231] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1190.874708][T16260] 0x000000000000-0x000000020000 : "" [ 1191.131009][T16260] ftl_cs: FTL header not found. [ 1196.233986][T16282] kAFS: No cell specified [ 1198.604961][T16291] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1199.489723][T16300] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1203.278040][T16316] sctp: [Deprecated]: syz.2.2480 (pid 16316) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1203.278040][T16316] Use struct sctp_sack_info instead [ 1204.481411][T16321] UBIFS error (pid: 16321): cannot open "(null)", error -22 [ 1207.235453][T16334] loop5: detected capacity change from 0 to 256 [ 1208.378051][T16341] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1212.081109][T16376] loop7: detected capacity change from 0 to 256 [ 1212.291009][T16376] exFAT-fs (loop7): failed to load upcase table (idx : 0x00010000, chksum : 0x204dac4c, utbl_chksum : 0xe619d30d) [ 1212.844425][ T1097] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1212.856578][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 1212.865301][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 1213.115174][T16389] syzkaller0: entered promiscuous mode [ 1213.136054][T16389] syzkaller0: entered allmulticast mode [ 1213.230503][T16389] tipc: Enabled bearer , priority 0 [ 1213.381667][T16389] tipc: Resetting bearer [ 1213.585737][T16388] tipc: Resetting bearer [ 1214.119486][T16400] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1214.354693][T16388] tipc: Disabling bearer [ 1215.452790][T16416] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1215.953921][T16408] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1219.209793][T16433] loop5: detected capacity change from 0 to 1024 [ 1219.683450][T16433] EXT4-fs: Ignoring removed bh option [ 1220.737273][T16433] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1222.609020][T16462] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2516'. [ 1222.628015][T16462] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2516'. [ 1222.637911][T16462] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2516'. [ 1222.647249][T16462] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2516'. [ 1222.656691][T16462] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2516'. [ 1222.716213][T16463] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1224.928104][T16474] gtp0: entered allmulticast mode [ 1225.815516][ T6426] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1227.268455][T16488] loop5: detected capacity change from 0 to 2048 [ 1227.892287][T16488] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1227.993019][T16489] loop7: detected capacity change from 0 to 128 [ 1231.650883][T16504] Mass Storage Function, version: 2009/09/11 [ 1231.659442][T16504] LUN: removable file: (no medium) [ 1235.071560][T16518] xt_policy: output policy not valid in PREROUTING and INPUT [ 1236.209901][T16523] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1242.396376][T14963] Bluetooth: hci1: command 0x0406 tx timeout [ 1244.801171][T16559] loop7: detected capacity change from 0 to 1024 [ 1244.808896][T16559] EXT4-fs: Ignoring removed mblk_io_submit option [ 1245.227295][T16559] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1245.346459][T16565] loop5: detected capacity change from 0 to 512 [ 1245.481204][T16565] EXT4-fs (loop5): 1 orphan inode deleted [ 1245.566418][T12413] Quota error (device loop5): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 1245.632378][T16565] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1245.650755][T12413] EXT4-fs error (device loop5): ext4_release_dquot:6989: comm kworker/u4:5: Failed to release dquot type 1 [ 1245.658514][T16565] ext4 filesystem being mounted at /542/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1245.787010][ T9078] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1246.329600][ C1] net_ratelimit: 1 callbacks suppressed [ 1247.196187][T15177] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1248.690565][ T6426] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1249.447582][T16594] UBIFS error (pid: 16594): cannot open "(null)", error -22 [ 1257.633781][T16639] jffs2: notice: (16639) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1258.051502][T16643] loop7: detected capacity change from 0 to 256 [ 1260.962657][T16664] ip_tables: iptables: counters copy to user failed while replacing table [ 1260.994101][T16670] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1263.898595][T16681] loop7: detected capacity change from 0 to 764 [ 1265.026067][T16685] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2559'. [ 1265.758116][T14963] Bluetooth: hci1: unexpected event for opcode 0x0c7b [ 1273.041299][T16738] loop5: detected capacity change from 0 to 1024 [ 1273.050652][T16738] EXT4-fs: Ignoring removed mblk_io_submit option [ 1273.152057][T16738] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1273.486845][ T6426] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1274.581711][T16763] loop5: detected capacity change from 0 to 256 [ 1276.023966][T16763] exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0x205ab87c, utbl_chksum : 0xe619d30d) [ 1276.122934][T16762] futex_wake_op: syz.5.2571 tries to shift op by 144; fix this program [ 1276.137988][ T28] audit: type=1800 audit(1791396167.848:475): pid=16763 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.2571" name="file1" dev="loop5" ino=1048796 res=0 errno=0 [ 1276.710439][T16765] loop7: detected capacity change from 0 to 2048 [ 1278.220351][T16765] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1278.516368][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 1278.523795][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 1279.351152][ T9078] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1281.690759][ T1097] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1284.030847][T16791] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1284.081418][T16791] bond2: (slave macvlan2): Enslaving as an active interface with a down link [ 1284.127156][T16792] netlink: 14 bytes leftover after parsing attributes in process `syz.2.2580'. [ 1286.283318][T16792] .` (unregistering): Released all slaves [ 1289.273841][T16814] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1291.886512][T16835] ip_tables: iptables: counters copy to user failed while replacing table [ 1292.862528][T16838] netlink: 'syz.5.2590': attribute type 12 has an invalid length. [ 1294.465713][ T28] audit: type=1326 audit(1791396185.081:476): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16847 comm="syz.7.2593" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd999f9e159 code=0x7ffc0000 [ 1294.626782][ T28] audit: type=1326 audit(1791396185.081:477): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16847 comm="syz.7.2593" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd999f9e159 code=0x7ffc0000 [ 1294.717427][ T28] audit: type=1326 audit(1791396185.155:478): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16847 comm="syz.7.2593" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fd999f9e159 code=0x7ffc0000 [ 1294.798870][ T28] audit: type=1326 audit(1791396185.155:479): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16847 comm="syz.7.2593" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd999f9e159 code=0x7ffc0000 [ 1294.912455][ T28] audit: type=1326 audit(1791396185.155:480): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16847 comm="syz.7.2593" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd999f9e159 code=0x7ffc0000 [ 1294.936911][T13860] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 1294.998027][T14963] Bluetooth: hci1: command 0x0406 tx timeout [ 1295.051604][ T28] audit: type=1326 audit(1791396185.155:481): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16847 comm="syz.7.2593" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fd999f9e159 code=0x7ffc0000 [ 1295.099102][ T28] audit: type=1326 audit(1791396185.155:482): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16847 comm="syz.7.2593" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd999f9e159 code=0x7ffc0000 [ 1295.134306][ T28] audit: type=1326 audit(1791396185.155:483): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16847 comm="syz.7.2593" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd999f9e159 code=0x7ffc0000 [ 1295.162275][ T28] audit: type=1326 audit(1791396185.165:484): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16847 comm="syz.7.2593" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fd999f9e159 code=0x7ffc0000 [ 1295.192902][ T28] audit: type=1326 audit(1791396185.165:485): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16847 comm="syz.7.2593" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd999f9e159 code=0x7ffc0000 [ 1295.455258][T13860] usb 8-1: New USB device found, idVendor=0711, idProduct=0550, bcdDevice= 0.00 [ 1295.464546][T13860] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1295.472696][T13860] usb 8-1: Product: syz [ 1295.476881][T13860] usb 8-1: Manufacturer: syz [ 1295.481567][T13860] usb 8-1: SerialNumber: syz [ 1296.113034][T13860] usb 8-1: USB2VGA dongle found at address 7 [ 1296.123278][T13860] usb 8-1: Allocated 8 output buffers [ 1298.240854][T16871] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1298.503725][T13860] usb 8-1: Failed to early initialize device [ 1298.620662][T13860] usb 8-1: USB disconnect, device number 7 [ 1316.659219][T15173] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1319.067222][ T28] kauditd_printk_skb: 46 callbacks suppressed [ 1319.067259][ T28] audit: type=1326 audit(1791396208.094:532): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16967 comm="syz.5.2622" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe3579e159 code=0x7ffc0000 [ 1319.355365][ T28] audit: type=1326 audit(1791396208.132:533): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16967 comm="syz.5.2622" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe3579e159 code=0x7ffc0000 [ 1319.626054][ T6925] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 1319.859063][ T6925] usb 6-1: New USB device found, idVendor=0711, idProduct=0550, bcdDevice= 0.00 [ 1319.882528][ T6925] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1319.905966][ T6925] usb 6-1: Product: syz [ 1319.910175][ T6925] usb 6-1: Manufacturer: syz [ 1319.928427][ T6925] usb 6-1: SerialNumber: syz [ 1319.985412][ T6925] usb 6-1: USB2VGA dongle found at address 8 [ 1320.036085][ T6925] usb 6-1: Allocated 8 output buffers [ 1320.313700][ T28] audit: type=1326 audit(1791396209.254:534): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16967 comm="syz.5.2622" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7efe3579e159 code=0x7ffc0000 [ 1320.419560][T16979] netlink: 'syz.5.2622': attribute type 30 has an invalid length. [ 1320.445482][ T28] audit: type=1326 audit(1791396209.385:535): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16967 comm="syz.5.2622" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe3579e159 code=0x7ffc0000 [ 1320.580330][ T28] audit: type=1326 audit(1791396209.385:536): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16967 comm="syz.5.2622" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efe3579e159 code=0x7ffc0000 [ 1320.803683][T16983] jffs2: notice: (16983) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1321.229515][ T6925] usb 6-1: Failed to early initialize device [ 1321.289304][ T6925] usb 6-1: USB disconnect, device number 8 [ 1323.413420][T16994] netlink: 'syz.2.2634': attribute type 12 has an invalid length. [ 1325.668652][T17006] kAFS: No cell specified [ 1329.636013][T17044] jffs2: notice: (17044) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1330.005479][T17044] jffs2: fork failed for JFFS2 garbage collect thread: 4 [ 1344.620396][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 1344.627737][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 1348.872736][T14963] Bluetooth: hci1: command 0x0406 tx timeout [ 1351.699467][ T1097] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1352.301732][T17124] jffs2: notice: (17124) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1358.296604][T17151] futex_wake_op: syz.2.2663 tries to shift op by 144; fix this program [ 1361.354529][T17171] jffs2: notice: (17171) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1369.506978][T17211] kAFS: No cell specified [ 1371.215949][T17223] jffs2: notice: (17223) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1371.382030][T17223] jffs2: fork failed for JFFS2 garbage collect thread: 4 [ 1374.903910][T17238] tipc: Enabling of bearer rejected, failed to enable media [ 1378.624618][T17270] syzkaller0: entered promiscuous mode [ 1378.633936][T17270] syzkaller0: entered allmulticast mode [ 1384.273442][T17303] loop5: detected capacity change from 0 to 40427 [ 1384.616911][T17303] F2FS-fs (loop5): invalid crc value [ 1384.669161][T17303] F2FS-fs (loop5): Found nat_bits in checkpoint [ 1384.739697][T17303] F2FS-fs (loop5): Start checkpoint disabled! [ 1384.875330][T17303] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e6 [ 1385.166679][T17303] syz.5.2696: attempt to access beyond end of device [ 1385.166679][T17303] loop5: rw=2049, sector=45096, nr_sectors = 8 limit=40427 [ 1385.780846][T17317] syz.5.2696: attempt to access beyond end of device [ 1385.780846][T17317] loop5: rw=2049, sector=45104, nr_sectors = 8 limit=40427 [ 1385.798606][T17317] syz.5.2696: attempt to access beyond end of device [ 1385.798606][T17317] loop5: rw=2049, sector=45112, nr_sectors = 8 limit=40427 [ 1385.814236][T17317] syz.5.2696: attempt to access beyond end of device [ 1385.814236][T17317] loop5: rw=2049, sector=45120, nr_sectors = 8 limit=40427 [ 1385.829299][T17317] syz.5.2696: attempt to access beyond end of device [ 1385.829299][T17317] loop5: rw=2049, sector=45128, nr_sectors = 8 limit=40427 [ 1385.843691][T17317] syz.5.2696: attempt to access beyond end of device [ 1385.843691][T17317] loop5: rw=2049, sector=45136, nr_sectors = 8 limit=40427 [ 1385.858775][T17317] syz.5.2696: attempt to access beyond end of device [ 1385.858775][T17317] loop5: rw=2049, sector=45144, nr_sectors = 8 limit=40427 [ 1385.873412][T17317] syz.5.2696: attempt to access beyond end of device [ 1385.873412][T17317] loop5: rw=2049, sector=45152, nr_sectors = 8 limit=40427 [ 1385.887698][T17317] syz.5.2696: attempt to access beyond end of device [ 1385.887698][T17317] loop5: rw=2049, sector=45160, nr_sectors = 8 limit=40427 [ 1385.904688][T17317] syz.5.2696: attempt to access beyond end of device [ 1385.904688][T17317] loop5: rw=2049, sector=45168, nr_sectors = 8 limit=40427 [ 1386.579133][T15178] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1387.094242][T17321] kernel profiling enabled (shift: 23) [ 1387.662114][T15176] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 1387.699939][T15176] F2FS-fs (loop5): Stopped filesystem due to reason: 3 [ 1394.980405][T17351] nvmet: adding nsid 1 to subsystem testsubsys [ 1395.391783][T14963] Bluetooth: hci1: ISO packet for unknown connection handle 1588 [ 1409.592226][T17409] futex_wake_op: syz.4.2722 tries to shift op by 144; fix this program [ 1411.052748][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 1411.060232][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 1412.930505][T17426] tipc: Enabling of bearer rejected, failed to enable media [ 1420.404017][T17472] netlink: 'syz.4.2738': attribute type 10 has an invalid length. [ 1420.502026][T17474] netlink: 112 bytes leftover after parsing attributes in process `syz.7.2737'. [ 1420.789952][T15176] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1428.788015][ T14] rcu_tasks_wait_gp: rcu_tasks grace period number 17 (since boot) is 1193 jiffies old. [ 1428.908961][T17511] bridge0: port 3(syz_tun) entered disabled state [ 1428.960521][T17511] bridge_slave_0: left allmulticast mode [ 1428.966486][T17511] bridge0: port 1(bridge_slave_0) entered disabled state [ 1429.080023][T17511] bridge_slave_1: left allmulticast mode [ 1429.087791][T17511] bridge0: port 2(bridge_slave_1) entered disabled state [ 1429.118951][T17511] bond0: (slave veth0_to_bond): Releasing active interface [ 1429.202790][T17511] .`: (slave bond_slave_0): Releasing backup interface [ 1429.272120][T17511] .`: (slave bond_slave_1): Releasing backup interface [ 1429.397481][T17511] team0: Port device team_slave_0 removed [ 1429.454346][T17511] team0: Port device team_slave_1 removed [ 1429.485606][T17511] bond1: (slave wireguard0): Releasing backup interface [ 1429.514681][T17511] bond1: (slave wireguard1): making interface the new active one [ 1429.550437][T17511] bond1: (slave wireguard1): Releasing backup interface [ 1429.564470][T17511] bond2: (slave bond3): Releasing active interface [ 1429.669783][T17511] bond2: (slave bond3): the permanent HWaddr of slave - ee:0c:38:2d:c3:a4 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 1429.862852][T17511] bond2: (slave gretap1): Releasing active interface [ 1430.011583][T17511] bond4: (slave bridge1): Releasing active interface [ 1430.155929][T17511] bond5: (slave bond0): Releasing backup interface [ 1430.750421][T17511] bond0: (slave veth3): Releasing active interface [ 1432.265935][T17514] team0: Port device xfrm0 added [ 1432.272808][T17515] tipc: Enabled bearer , priority 0 [ 1438.589051][T17569] sctp: [Deprecated]: syz.5.2762 (pid 17569) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1438.589051][T17569] Use struct sctp_sack_info instead [ 1441.593992][T17588] loop5: detected capacity change from 0 to 1024 [ 1441.625334][T17588] EXT4-fs: Ignoring removed bh option [ 1441.711925][T17588] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1445.376960][ T6426] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1447.292071][T14963] Bluetooth: hci1: command 0x0406 tx timeout [ 1447.621140][T17615] FAULT_INJECTION: forcing a failure. [ 1447.621140][T17615] name failslab, interval 1, probability 0, space 0, times 0 [ 1447.699947][T17615] CPU: 1 PID: 17615 Comm: syz.5.2773 Not tainted syzkaller #0 [ 1447.707480][T17615] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1447.717567][T17615] Call Trace: [ 1447.720871][T17615] [ 1447.723825][T17615] dump_stack_lvl+0x18c/0x250 [ 1447.728542][T17615] ? show_regs_print_info+0x20/0x20 [ 1447.733774][T17615] ? load_image+0x420/0x420 [ 1447.738310][T17615] ? __might_sleep+0xe0/0xe0 [ 1447.742934][T17615] ? __lock_acquire+0x7d80/0x7d80 [ 1447.748002][T17615] should_fail_ex+0x394/0x4c0 [ 1447.752722][T17615] should_failslab+0x9/0x20 [ 1447.757264][T17615] slab_pre_alloc_hook+0x59/0x300 [ 1447.762328][T17615] ? mempool_create+0x5e/0xc0 [ 1447.767037][T17615] ? ceph_msgpool_init+0x180/0x180 [ 1447.772175][T17615] __kmem_cache_alloc_node+0x53/0x250 [ 1447.777601][T17615] ? mempool_create+0x5e/0xc0 [ 1447.782311][T17615] ? ceph_msgpool_init+0x180/0x180 [ 1447.787430][T17615] kmalloc_node_trace+0x26/0xe0 [ 1447.792326][T17615] ? msgpool_alloc+0x1b0/0x1b0 [ 1447.792411][T17615] ? ceph_msgpool_init+0x180/0x180 [ 1447.792431][T17615] mempool_create+0x5e/0xc0 [ 1447.792459][T17615] ceph_msgpool_init+0xa7/0x180 [ 1447.792485][T17615] ceph_osdc_init+0x54f/0x8c0 [ 1447.792521][T17615] ceph_create_client+0x246/0x300 [ 1447.792554][T17615] ceph_get_tree+0x1ca/0x1800 [ 1447.792585][T17615] ? bpf_lsm_capable+0x9/0x10 [ 1447.792603][T17615] ? security_capable+0x89/0xb0 [ 1447.792631][T17615] vfs_get_tree+0x8c/0x280 [ 1447.792657][T17615] vfs_cmd_create+0xe3/0x230 [ 1447.792689][T17615] __se_sys_fsconfig+0x70a/0x850 [ 1447.792723][T17615] ? __x64_sys_fsconfig+0xc0/0xc0 [ 1447.792761][T17615] ? lockdep_hardirqs_on+0x98/0x150 [ 1447.792781][T17615] ? __x64_sys_fsconfig+0x20/0xc0 [ 1447.792811][T17615] do_syscall_64+0x55/0xb0 [ 1447.792835][T17615] ? clear_bhb_loop+0x40/0x90 [ 1447.792861][T17615] ? clear_bhb_loop+0x40/0x90 [ 1447.792890][T17615] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1447.792916][T17615] RIP: 0033:0x7efe3579e159 [ 1447.792936][T17615] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1447.792954][T17615] RSP: 002b:00007efe36663028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 1447.792977][T17615] RAX: ffffffffffffffda RBX: 00007efe35a25fa0 RCX: 00007efe3579e159 [ 1447.792993][T17615] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000004 [ 1447.793007][T17615] RBP: 00007efe3583506b R08: 0000000000000000 R09: 0000000000000000 [ 1447.793021][T17615] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1447.793034][T17615] R13: 00007efe35a26038 R14: 00007efe35a25fa0 R15: 00007ffcfd9c3938 [ 1447.793065][T17615] [ 1456.353673][T15177] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1457.465772][T11168] Bluetooth: hci1: command 0x0406 tx timeout [ 1459.172290][T17669] sctp: [Deprecated]: syz.7.2782 (pid 17669) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1459.172290][T17669] Use struct sctp_sack_info instead [ 1460.908284][ T14] rcu_tasks_wait_gp: rcu_tasks grace period number 17 (since boot) is 4198 jiffies old. [ 1461.900243][T17690] RDS: rds_bind could not find a transport for ::ffff:172.20.20.170, load rds_tcp or rds_rdma? [ 1464.783393][T17701] loop6: detected capacity change from 0 to 6 [ 1465.003686][T17701] Dev loop6: unable to read RDB block 6 [ 1465.011485][T17701] loop6: unable to read partition table [ 1465.024339][T17701] loop6: partition table beyond EOD, truncated [ 1465.032336][T17701] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1466.443433][T11168] Bluetooth: hci1: command 0x0406 tx timeout [ 1467.508415][T17718] netdevsim netdevsim10 eth0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1473.149220][T17738] netlink: 112 bytes leftover after parsing attributes in process `syz.4.2800'. [ 1475.251726][T11168] Bluetooth: hci1: command 0x0406 tx timeout [ 1475.596297][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 1475.603081][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 1484.090777][T17794] loop7: detected capacity change from 0 to 128 [ 1490.753320][T12417] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1492.777180][T17825] loop7: detected capacity change from 0 to 164 [ 1493.494190][T17828] rock: directory entry would overflow storage [ 1493.502174][T17828] rock: sig=0x4f50, size=4, remaining=3 [ 1493.509462][T17828] iso9660: Corrupted directory entry in block 5 of inode 1792 [ 1494.415021][T17830] loop7: detected capacity change from 0 to 64 [ 1504.326198][T11168] Bluetooth: hci1: command 0x0406 tx timeout [ 1509.020338][T17914] loop5: detected capacity change from 0 to 512 [ 1509.134498][T17914] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1509.218134][T17914] EXT4-fs error (device loop5): ext4_validate_block_bitmap:421: comm syz.5.2839: bg 0: bad block bitmap checksum [ 1509.999340][ T6426] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1512.487515][ T14] rcu_tasks_wait_gp: rcu_tasks grace period number 21 (since boot) is 1170 jiffies old. [ 1520.835022][T11168] Bluetooth: hci1: command 0x0406 tx timeout [ 1521.043585][T17969] netlink: 'syz.2.2853': attribute type 10 has an invalid length. [ 1522.402661][T14718] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 1526.303931][T14718] usb 8-1: Using ep0 maxpacket: 8 [ 1526.400112][T14718] usb 8-1: device descriptor read/all, error -71 [ 1528.106673][T15178] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1529.648220][T18025] loop7: detected capacity change from 0 to 1024 [ 1533.243777][T18042] loop7: detected capacity change from 0 to 512 [ 1533.290492][T18042] ext4: Unknown parameter 'smackfstransmute' [ 1535.296353][T18055] tipc: Enabling of bearer rejected, max 3 bearers permitted [ 1535.430044][T18055] sch_tbf: burst 255 is lower than device syzkaller0 mtu (65589) ! [ 1536.032290][T18063] loop7: detected capacity change from 0 to 512 [ 1536.097128][T18063] EXT4-fs: Ignoring removed orlov option [ 1536.152678][T18063] EXT4-fs (loop7): 1 truncate cleaned up [ 1536.162165][T18063] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1536.196791][T18062] sch_tbf: burst 8 is lower than device syzkaller0 mtu (65589) ! [ 1536.219892][T18059] EXT4-fs error (device loop7): ext4_lookup:1864: inode #2: comm syz.7.2871: deleted inode referenced: 15 [ 1536.271004][T18059] EXT4-fs (loop7): Remounting filesystem read-only [ 1536.645589][ T9078] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1538.447238][T18073] netlink: 'syz.2.2874': attribute type 39 has an invalid length. [ 1542.062431][T11168] Bluetooth: hci1: command 0x0406 tx timeout [ 1542.072804][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 1542.080433][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 1544.977798][ T14] rcu_tasks_wait_gp: rcu_tasks grace period number 21 (since boot) is 4210 jiffies old. [ 1553.243202][T18129] loop6: detected capacity change from 0 to 6 [ 1554.168384][T18129] Dev loop6: unable to read RDB block 6 [ 1554.175073][T18129] loop6: unable to read partition table [ 1554.183067][T18129] loop6: partition table beyond EOD, truncated [ 1554.190287][T18129] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1561.848994][T14963] Bluetooth: hci1: command 0x0406 tx timeout [ 1565.344566][ T1097] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1568.535180][T18204] overlayfs: failed to clone upperpath [ 1570.981437][T18218] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2908'. [ 1572.492034][T14963] Bluetooth: hci1: command 0x0406 tx timeout [ 1579.323431][T18283] loop7: detected capacity change from 0 to 2048 [ 1579.395080][T18283] UDF-fs: error (device loop7): udf_process_sequence: Primary Volume Descriptor not found! [ 1579.464083][T18283] UDF-fs: warning (device loop7): udf_load_logicalvol: Damaged or missing LVID, forcing readonly mount [ 1580.808795][T14963] Bluetooth: hci1: command 0x0406 tx timeout [ 1588.185268][T18315] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 1591.192986][T18329] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2923'. [ 1591.225362][T18329] dummy0: Caught tx_queue_len zero misconfig [ 1591.807968][T14963] Bluetooth: hci1: command 0x0406 tx timeout [ 1600.614176][T18376] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 1600.641214][T18376] CIFS: Attempting to mount //127.0.0.1/share [ 1600.795778][T18376] CIFS: VFS: Error connecting to socket. Aborting operation. [ 1600.803451][T18376] CIFS: VFS: cifs_mount failed w/return code = -4 [ 1602.764541][ T12] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1606.923346][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 1606.929810][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 1614.400183][T18475] netlink: 'syz.4.2965': attribute type 10 has an invalid length. [ 1615.362444][T18478] loop5: detected capacity change from 0 to 4096 [ 1617.706824][T18478] ntfs3: loop5: Failed to read $AttrDef (-4). [ 1621.327180][T18509] sd 0:0:1:0: PR command failed: 1026 [ 1621.332912][T18509] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 1621.339711][T18509] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 1624.746258][T18522] overlayfs: failed to clone lowerpath [ 1624.802109][T18523] overlayfs: failed to clone lowerpath [ 1625.768352][T18529] loop7: detected capacity change from 0 to 512 [ 1625.782585][T18529] EXT4-fs (loop7): Test dummy encryption mode enabled [ 1625.790590][T18529] EXT4-fs (loop7): encrypted files will use data=ordered instead of data journaling mode [ 1626.453830][T18529] EXT4-fs (loop7): 1 truncate cleaned up [ 1626.463014][T18529] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1629.062615][ T9078] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1631.732654][T18554] Console: switching to colour VGA+ 80x25 [ 1631.858289][T18555] Console: switching to colour frame buffer device 128x48 [ 1635.165166][T18566] tc action pedit offset must be on 32 bit boundaries [ 1639.194907][ T2910] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1641.493233][T18612] loop7: detected capacity change from 0 to 512 [ 1641.500706][T14963] Bluetooth: hci1: command 0x0406 tx timeout [ 1641.518926][T18612] EXT4-fs (loop7): Test dummy encryption mode enabled [ 1641.529964][T18612] EXT4-fs (loop7): encrypted files will use data=ordered instead of data journaling mode [ 1641.592639][T18612] EXT4-fs (loop7): 1 truncate cleaned up [ 1641.601424][T18612] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1642.108566][T18622] ip6t_REJECT: ECHOREPLY is not supported [ 1642.691153][ T9078] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1642.830664][T18624] CIFS: Attempting to mount //127.0.0.1/share [ 1644.383239][T18624] CIFS: VFS: Error connecting to socket. Aborting operation. [ 1644.391224][T18624] CIFS: VFS: cifs_mount failed w/return code = -4 [ 1655.529810][T18686] sd 0:0:1:0: PR command failed: 1026 [ 1655.535379][T18686] sd 0:0:1:0: Sense Key : Illegal Request [current] [ 1655.542531][T18686] sd 0:0:1:0: Add. Sense: Invalid command operation code [ 1655.894730][T14963] Bluetooth: hci1: command 0x0406 tx timeout [ 1656.520575][T18688] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3018'. [ 1665.049362][T18734] loop5: detected capacity change from 0 to 128 [ 1668.952775][T18748] futex_wake_op: syz.5.3029 tries to shift op by 144; fix this program [ 1672.962957][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 1673.011854][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 1675.043694][T18772] netlink: 'syz.5.3037': attribute type 10 has an invalid length. [ 1675.140193][T18772] bridge0: left promiscuous mode [ 1675.236846][T18775] netlink: 'syz.5.3037': attribute type 10 has an invalid length. [ 1675.271259][T12417] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1675.299141][T18775] .`: left promiscuous mode [ 1675.348856][T18775] 8021q: adding VLAN 0 to HW filter on device .` [ 1675.388708][T18775] .`: entered promiscuous mode [ 1675.393711][T18775] team0: Device .` is of different type [ 1681.779867][T18806] Console: switching to colour VGA+ 80x25 [ 1681.900282][T18807] Console: switching to colour frame buffer device 128x48 [ 1684.057732][T18820] loop5: detected capacity change from 0 to 1024 [ 1684.093944][T18820] EXT4-fs (loop5): stripe (4) is not aligned with cluster size (4096), stripe is disabled [ 1684.279462][T18820] EXT4-fs error (device loop5): ext4_map_blocks:610: inode #3: block 2: comm syz.5.3049: lblock 2 mapped to illegal pblock 2 (length 1) [ 1684.295020][T18820] Quota error (device loop5): qtree_write_dquot: dquota write failed [ 1684.303496][T18820] EXT4-fs error (device loop5): ext4_map_blocks:610: inode #3: block 48: comm syz.5.3049: lblock 0 mapped to illegal pblock 48 (length 1) [ 1684.328176][T18820] Quota error (device loop5): v2_write_file_info: Can't write info structure [ 1684.340265][T18820] EXT4-fs error (device loop5): ext4_acquire_dquot:6953: comm syz.5.3049: Failed to acquire dquot type 0 [ 1684.357812][T18820] EXT4-fs error (device loop5) in ext4_reserve_inode_write:5952: Corrupt filesystem [ 1684.372028][T18820] EXT4-fs error (device loop5): ext4_evict_inode:254: inode #11: comm syz.5.3049: mark_inode_dirty error [ 1684.384635][T18820] EXT4-fs warning (device loop5): ext4_evict_inode:257: couldn't mark inode dirty (err -117) [ 1684.395250][T18820] EXT4-fs (loop5): 1 orphan inode deleted [ 1684.412742][T18820] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1685.092467][ T6426] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1685.112816][ T2910] EXT4-fs error (device loop5): ext4_map_blocks:610: inode #3: block 1: comm kworker/u4:10: lblock 1 mapped to illegal pblock 1 (length 1) [ 1685.228407][ T2910] Quota error (device loop5): remove_tree: Can't read quota data block 1 [ 1685.254181][ T2910] EXT4-fs error (device loop5): ext4_release_dquot:6989: comm kworker/u4:10: Failed to release dquot type 0 [ 1685.855055][ T6426] EXT4-fs error (device loop5): __ext4_get_inode_loc:4509: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 1686.168149][ T6426] EXT4-fs error (device loop5) in ext4_reserve_inode_write:5952: Corrupt filesystem [ 1686.218487][ T6426] EXT4-fs error (device loop5): ext4_quota_off:7237: inode #3: comm syz-executor: mark_inode_dirty error [ 1693.727886][T18852] overlayfs: failed to clone upperpath [ 1704.262427][T14963] Bluetooth: hci1: command 0x0406 tx timeout [ 1706.001600][T18905] CIFS: Attempting to mount //127.0.0.1/share [ 1706.027103][T18905] CIFS: VFS: Error connecting to socket. Aborting operation. [ 1706.036552][T18905] CIFS: VFS: cifs_mount failed w/return code = -101 [ 1709.481915][ T1097] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1716.219530][T18946] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 [ 1716.325523][T18946] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 [ 1716.346309][T18953] loop5: detected capacity change from 0 to 512 [ 1716.629614][T18953] ext4: Unknown parameter 'smackfstransmute' [ 1717.326492][T18949] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1717.881910][T18961] ip6t_REJECT: ECHOREPLY is not supported [ 1723.846984][T18993] CIFS: Attempting to mount //127.0.0.1/share [ 1724.774791][T18993] CIFS: VFS: Error connecting to socket. Aborting operation. [ 1724.782508][T18993] CIFS: VFS: cifs_mount failed w/return code = -4 [ 1736.543736][T19042] CIFS: Attempting to mount //127.0.0.1/share [ 1738.425760][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 1738.433111][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 1738.443594][T19042] CIFS: VFS: Error connecting to socket. Aborting operation. [ 1738.451642][T19042] CIFS: VFS: cifs_mount failed w/return code = -4 [ 1740.659221][T11168] Bluetooth: hci1: command 0x0406 tx timeout [ 1745.165813][ T1097] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1751.560797][T11168] Bluetooth: hci1: command 0x0406 tx timeout [ 1756.041679][T19125] netlink: 'syz.4.3122': attribute type 1 has an invalid length. [ 1756.077472][T19125] netlink: 'syz.4.3122': attribute type 2 has an invalid length. [ 1756.153316][T19125] tipc: New replicast peer: 255.255.255.255 [ 1756.179825][T19125] tipc: Enabled bearer , priority 10 [ 1763.817784][T19152] loop5: detected capacity change from 0 to 512 [ 1764.047985][T19152] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1764.824863][ T6426] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1780.774300][T19223] file system registered [ 1782.687201][ T1117] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1786.919194][T19255] overlayfs: failed to clone upperpath [ 1787.591939][T19259] tipc: Resetting bearer [ 1787.616539][T19259] tipc: Resetting bearer [ 1796.562550][T19309] overlayfs: workdir and upperdir must be separate subtrees [ 1804.031022][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 1804.038122][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 1819.263316][T12417] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1826.078316][T19449] team0: Port device xfrm0 removed [ 1826.115032][T19452] team0: Port device xfrm0 added [ 1826.157795][T19453] tipc: Enabling of bearer rejected, already enabled [ 1828.609949][T14963] Bluetooth: hci1: command 0x0406 tx timeout [ 1840.631366][T19501] overlayfs: workdir and upperdir must be separate subtrees [ 1843.512595][T19517] ptrace attach of "ci2-linux-6-6-kasan/syz-executor exec"[6196] was attempted by "ci2-linux-6-6-kasan/syz-executor exec"[19517] [ 1854.505486][ T3519] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1854.680300][T19551] xfrm0: left allmulticast mode [ 1854.721673][T19551] team0: Port device xfrm0 added [ 1854.743273][T19552] tipc: Enabled bearer , priority 0 [ 1862.672691][T19590] loop5: detected capacity change from 0 to 2048 [ 1862.700434][T19590] UDF-fs: error (device loop5): udf_process_sequence: Primary Volume Descriptor not found! [ 1862.754873][T19590] UDF-fs: warning (device loop5): udf_load_logicalvol: Damaged or missing LVID, forcing readonly mount [ 1864.770151][T19604] overlayfs: workdir and upperdir must be separate subtrees [ 1870.832711][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 1870.839062][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 1883.369814][T19662] loop5: detected capacity change from 0 to 1024 [ 1884.066431][T19662] hfsplus: invalid btree flag [ 1884.071721][T19662] hfsplus: failed to load catalog file [ 1888.036011][ T3519] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1905.543734][T19686] syz_tun (unregistering): left allmulticast mode [ 1905.944690][T19720] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1905.959017][T19720] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1905.969214][T19720] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1906.003233][T19720] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1906.019054][T19720] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 1906.027124][T19720] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1908.214282][T19720] Bluetooth: hci0: command tx timeout [ 1908.891432][T19718] chnl_net:caif_netlink_parms(): no params data found [ 1909.883805][T19718] bridge0: port 1(bridge_slave_0) entered blocking state [ 1909.926401][T19718] bridge0: port 1(bridge_slave_0) entered disabled state [ 1909.933753][T19718] bridge_slave_0: entered allmulticast mode [ 1909.983544][T19718] bridge_slave_0: entered promiscuous mode [ 1910.057457][T19718] bridge0: port 2(bridge_slave_1) entered blocking state [ 1910.106113][T19718] bridge0: port 2(bridge_slave_1) entered disabled state [ 1910.113492][T19718] bridge_slave_1: entered allmulticast mode [ 1910.171791][T19718] bridge_slave_1: entered promiscuous mode [ 1910.437584][T19720] Bluetooth: hci0: command tx timeout [ 1910.507753][T19718] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1910.556748][T19718] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1910.867809][T19718] team0: Port device team_slave_0 added [ 1910.901574][T19718] team0: Port device team_slave_1 added [ 1911.394404][T19718] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1911.428984][T19718] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1911.630029][T19718] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1911.703306][T19718] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1911.719827][T19718] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1911.832560][T19718] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1912.216945][T19718] hsr_slave_0: entered promiscuous mode [ 1912.244724][T19718] hsr_slave_1: entered promiscuous mode [ 1912.286512][T19718] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1912.318924][T19718] Cannot create hsr debugfs directory [ 1912.661079][T19720] Bluetooth: hci0: command tx timeout [ 1913.520000][T19718] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 1913.549391][T19718] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 1913.578541][T19718] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 1913.635387][T19718] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 1913.930225][T19718] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1913.967120][T19718] 8021q: adding VLAN 0 to HW filter on device team0 [ 1913.996296][T15178] bridge0: port 1(bridge_slave_0) entered blocking state [ 1914.003656][T15178] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1914.015295][T15178] bridge0: port 2(bridge_slave_1) entered blocking state [ 1914.022516][T15178] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1914.106569][T19718] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1914.353914][T19718] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1914.656743][T19718] veth0_vlan: entered promiscuous mode [ 1914.697695][T19718] veth1_vlan: entered promiscuous mode [ 1914.754915][T19718] veth0_macvtap: entered promiscuous mode [ 1914.769330][T19718] veth1_macvtap: entered promiscuous mode [ 1914.795612][T19718] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1914.822919][T19718] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1914.846495][T19718] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1914.856778][T19718] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1914.868329][T19718] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1914.877738][T19718] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1914.884302][T19720] Bluetooth: hci0: command tx timeout [ 1915.051943][T15173] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1915.077670][T15173] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1915.153787][ T1097] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1915.167986][ T1097] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1915.395206][T19752] bridge0: port 1(syz_tun) entered blocking state [ 1915.414639][T19752] bridge0: port 1(syz_tun) entered disabled state [ 1915.434100][T19752] syz_tun: entered allmulticast mode [ 1915.445277][T19752] syz_tun: entered promiscuous mode [ 1915.522976][T19752] tipc: Resetting bearer [ 1916.092206][ C0] net_ratelimit: 31 callbacks suppressed [ 1919.612819][T19764] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input8 [ 1921.538355][ T1097] net_ratelimit: 5 callbacks suppressed [ 1922.281791][T19777] overlayfs: workdir and upperdir must be separate subtrees [ 1922.597209][ T1117] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1926.947782][T19793] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input9 [ 1927.081030][ C0] net_ratelimit: 16 callbacks suppressed [ 1932.511721][ C0] net_ratelimit: 10 callbacks suppressed [ 1935.252631][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 1935.259220][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 1938.486164][ C1] net_ratelimit: 8 callbacks suppressed [ 1939.986103][T19842] wlan0 speed is unknown, defaulting to 1000 [ 1939.994609][T19842] wlan0 speed is unknown, defaulting to 1000 [ 1940.001618][T19842] wlan0 speed is unknown, defaulting to 1000 [ 1940.018681][T19842] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 1940.045299][T19842] wlan0 speed is unknown, defaulting to 1000 [ 1940.056778][T19842] wlan0 speed is unknown, defaulting to 1000 [ 1940.064692][T19842] wlan0 speed is unknown, defaulting to 1000 [ 1940.074633][T19842] wlan0 speed is unknown, defaulting to 1000 [ 1940.082476][T19842] wlan0 speed is unknown, defaulting to 1000 [ 1944.041055][ C1] net_ratelimit: 9 callbacks suppressed [ 1949.603946][ T12] net_ratelimit: 9 callbacks suppressed [ 1951.755919][T19883] ptrace attach of "ci2-linux-6-6-kasan/syz-executor exec"[19718] was attempted by "ci2-linux-6-6-kasan/syz-executor exec"[19883] [ 1955.551947][T19894] A link change request failed with some changes committed already. Interface wg2 may have been left with an inconsistent configuration, please check. [ 1959.572817][ T1097] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1960.527885][T19907] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input10 [ 1960.634737][ C0] net_ratelimit: 12 callbacks suppressed [ 1966.610509][ C1] net_ratelimit: 24 callbacks suppressed [ 1972.135938][T19952] syz.8.3300 (19952): drop_caches: 2 [ 1972.485102][T19972] loop8: detected capacity change from 0 to 512 [ 1972.863477][ C0] net_ratelimit: 7 callbacks suppressed [ 1974.221240][T19984] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input11 [ 1978.340254][ C1] net_ratelimit: 5 callbacks suppressed [ 1982.331154][T20029] loop8: detected capacity change from 0 to 16 [ 1982.371122][T20029] erofs: (device loop8): mounted with root inode @ nid 36. [ 1984.010586][ T59] net_ratelimit: 1 callbacks suppressed [ 1989.378726][ C0] net_ratelimit: 12 callbacks suppressed [ 1992.555629][T20077] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci0/hci0:200/input12 [ 1995.730630][T19961] net_ratelimit: 9 callbacks suppressed [ 1995.752210][T19642] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 1998.494795][T20104] loop7: detected capacity change from 0 to 512 [ 1998.533820][T20104] ext4: Bad value for 'data' [ 2001.088040][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 2001.094780][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 2001.120522][ T1286] net_ratelimit: 9 callbacks suppressed [ 2005.268991][T20148] sctp: [Deprecated]: syz.7.3336 (pid 20148) Use of int in maxseg socket option. [ 2005.268991][T20148] Use struct sctp_assoc_value instead [ 2007.422504][ C0] net_ratelimit: 10 callbacks suppressed [ 2013.646056][T19961] net_ratelimit: 4 callbacks suppressed [ 2015.555639][T20185] xt_CT: You must specify a L4 protocol and not use inversions on it [ 2016.724729][T20187] netlink: 'syz.2.3347': attribute type 1 has an invalid length. [ 2016.938060][T20189] netdevsim netdevsim2 netdevsim0: set [1, 1] type 2 family 0 port 20000 - 0 [ 2016.968634][T20189] netdevsim netdevsim2 netdevsim1: set [1, 1] type 2 family 0 port 20000 - 0 [ 2016.977486][T20189] netdevsim netdevsim2 netdevsim2: set [1, 1] type 2 family 0 port 20000 - 0 [ 2017.040722][T20189] netdevsim netdevsim2 netdevsim3: set [1, 1] type 2 family 0 port 20000 - 0 [ 2017.098078][T20189] bond5: (slave geneve4): making interface the new active one [ 2017.137808][T20189] bond5: (slave geneve4): Enslaving as an active interface with an up link [ 2017.224712][T20187] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3347'. [ 2017.253033][T20192] loop8: detected capacity change from 0 to 2048 [ 2017.280722][T20187] bond5: entered promiscuous mode [ 2017.286611][T20187] geneve4: entered promiscuous mode [ 2017.367794][T20193] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 2017.385565][T20187] bond5: entered allmulticast mode [ 2017.390732][T20187] geneve4: entered allmulticast mode [ 2017.440542][T20187] 8021q: adding VLAN 0 to HW filter on device bond5 [ 2019.742902][ T59] net_ratelimit: 11 callbacks suppressed [ 2024.792142][T20228] wlan0 speed is unknown, defaulting to 1000 [ 2025.812226][T19954] net_ratelimit: 8 callbacks suppressed [ 2031.302051][ C1] net_ratelimit: 8 callbacks suppressed [ 2031.698800][ T59] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2037.117317][ C0] net_ratelimit: 9 callbacks suppressed [ 2039.812598][T20276] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3359'. [ 2042.922385][ C1] net_ratelimit: 7 callbacks suppressed [ 2048.891877][ C1] net_ratelimit: 8 callbacks suppressed [ 2054.541670][ C0] net_ratelimit: 6 callbacks suppressed [ 2060.356715][ C0] net_ratelimit: 8 callbacks suppressed [ 2061.572990][T20372] overlayfs: option "workdir=./file0" is useless in a non-upper mount, ignore [ 2061.583983][T20372] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 2065.927642][ C1] net_ratelimit: 13 callbacks suppressed [ 2066.058210][T20393] netlink: 'syz.8.3397': attribute type 10 has an invalid length. [ 2066.100772][T20393] bridge0: port 2(bridge_slave_1) entered disabled state [ 2066.108646][T20393] bridge0: port 1(bridge_slave_0) entered disabled state [ 2066.211275][T20396] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3398'. [ 2066.309534][T20393] bridge0: port 2(bridge_slave_1) entered blocking state [ 2066.316810][T20393] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2066.324498][T20393] bridge0: port 1(bridge_slave_0) entered blocking state [ 2066.331689][T20393] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2066.572802][T20393] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 2066.592871][T12417] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2066.612083][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 2066.631168][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 2067.369094][T20397] netlink: 'syz.8.3397': attribute type 10 has an invalid length. [ 2067.630931][T20397] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2067.726026][T20397] team0: Port device bond0 added [ 2071.380240][ T59] net_ratelimit: 7 callbacks suppressed [ 2072.253087][T20433] loop7: detected capacity change from 0 to 16 [ 2072.933552][T20433] erofs: (device loop7): mounted with root inode @ nid 36. [ 2075.389570][T20452] 9pnet_virtio: no channels available for device syz [ 2077.046577][T19961] net_ratelimit: 7 callbacks suppressed [ 2082.419813][ C0] net_ratelimit: 4 callbacks suppressed [ 2086.159645][T20498] af_packet: tpacket_rcv: packet too big, clamped from 324 to 4294967272. macoff=96 [ 2088.143879][T15176] net_ratelimit: 9 callbacks suppressed [ 2093.526198][ C0] net_ratelimit: 11 callbacks suppressed [ 2099.084722][ C0] net_ratelimit: 8 callbacks suppressed [ 2103.174154][ T59] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2104.728801][ C0] net_ratelimit: 8 callbacks suppressed [ 2108.676800][T20589] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2108.685217][T20589] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2108.695492][T20589] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2108.703473][T20589] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2110.826788][T12417] net_ratelimit: 5 callbacks suppressed [ 2113.368121][T20613] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2116.431175][ C1] net_ratelimit: 6 callbacks suppressed [ 2122.662821][ C0] net_ratelimit: 8 callbacks suppressed [ 2125.038907][T20680] futex_wake_op: syz.8.3467 tries to shift op by 144; fix this program [ 2128.163308][ C1] net_ratelimit: 8 callbacks suppressed [ 2133.078675][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 2133.086070][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 2134.243298][ C0] net_ratelimit: 10 callbacks suppressed [ 2137.914504][T20742] sch_tbf: burst 65537 is lower than device syzkaller0 mtu (65589) ! [ 2139.619391][ C0] net_ratelimit: 8 callbacks suppressed [ 2139.767174][T20750] netlink: 'syz.2.3482': attribute type 1 has an invalid length. [ 2139.961976][T11168] Bluetooth: hci0: command 0x0406 tx timeout [ 2140.204209][T20750] 8021q: adding VLAN 0 to HW filter on device bond6 [ 2141.571182][T20753] 8021q: adding VLAN 0 to HW filter on device bond6 [ 2141.611966][T20753] bond6: (slave gre1): The slave device specified does not support setting the MAC address [ 2141.678481][T20753] bond6: (slave gre1): Error -95 calling set_mac_address [ 2141.845040][T19961] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2141.977454][T20754] gretap1: entered promiscuous mode [ 2142.044686][T20754] bond6: (slave gretap1): making interface the new active one [ 2142.083412][T20754] bond6: (slave gretap1): Enslaving as an active interface with an up link [ 2142.200538][T20756] macvlan3: entered promiscuous mode [ 2142.207218][T20756] macvlan3: entered allmulticast mode [ 2142.215912][T20756] bond6: entered promiscuous mode [ 2142.223677][T20756] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 2142.244535][T20756] bond6: (slave macvlan3): the slave hw address is in use by the bond; giving it the hw address of gretap1 [ 2142.275982][T20756] bond6: left promiscuous mode [ 2145.776539][ C0] net_ratelimit: 10 callbacks suppressed [ 2151.848155][ C0] net_ratelimit: 30 callbacks suppressed [ 2157.834160][ C0] net_ratelimit: 7 callbacks suppressed [ 2163.820321][ C0] net_ratelimit: 8 callbacks suppressed [ 2169.126047][T20877] xt_NFQUEUE: number of queues (5) out of range (got 65536) [ 2169.208118][ C0] net_ratelimit: 5 callbacks suppressed [ 2170.522731][T20888] futex_wake_op: syz.2.3516 tries to shift op by 144; fix this program [ 2173.716026][T20902] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3517'. [ 2173.726730][T20902] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3517'. [ 2173.736350][T20902] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3517'. [ 2173.747555][T20902] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3517'. [ 2175.397076][T19954] net_ratelimit: 6 callbacks suppressed [ 2176.645067][T19961] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2180.934187][ C0] net_ratelimit: 6 callbacks suppressed [ 2186.492717][ C0] net_ratelimit: 6 callbacks suppressed [ 2192.041444][ C0] net_ratelimit: 8 callbacks suppressed [ 2194.873414][ T28] audit: type=1326 audit(1791397026.980:537): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21001 comm="syz.8.3552" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f166879e159 code=0x0 [ 2197.770164][ C0] net_ratelimit: 9 callbacks suppressed [ 2199.055630][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 2199.062240][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 2203.421301][ C0] net_ratelimit: 9 callbacks suppressed [ 2204.452622][T21046] xt_TCPMSS: Only works on TCP SYN packets [ 2205.732651][T19211] IPVS: starting estimator thread 0... [ 2205.883890][T21048] IPVS: using max 19 ests per chain, 45600 per kthread [ 2209.154541][ C0] net_ratelimit: 9 callbacks suppressed [ 2213.154779][T19954] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2214.518817][ C0] net_ratelimit: 7 callbacks suppressed [ 2220.525775][ T59] net_ratelimit: 7 callbacks suppressed [ 2220.666133][T21134] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3575'. [ 2226.161506][ C0] net_ratelimit: 8 callbacks suppressed [ 2229.246637][T21180] netlink: 4 bytes leftover after parsing attributes in process `syz.8.3591'. [ 2231.720087][ C0] net_ratelimit: 7 callbacks suppressed [ 2238.410098][T21206] jffs2: notice: (21206) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 2238.978926][T21209] netlink: 'syz.4.3597': attribute type 10 has an invalid length. [ 2243.437297][T15178] net_ratelimit: 9 callbacks suppressed [ 2249.155513][T21282] autofs4:pid:21282:autofs_fill_super: called with bogus options [ 2249.165336][ C1] net_ratelimit: 9 callbacks suppressed [ 2250.619325][T19954] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2254.723908][ C0] net_ratelimit: 8 callbacks suppressed [ 2259.505342][T21323] ip6t_srh: unknown srh match flags 4000 [ 2260.111406][ C1] net_ratelimit: 7 callbacks suppressed [ 2261.523534][T21327] overlayfs: failed to clone upperpath [ 2262.222753][T21335] bridge0: port 1(bridge_slave_0) entered disabled state [ 2262.234759][T21335] bridge0: port 2(bridge_slave_1) entered disabled state [ 2263.627399][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 2263.639972][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 2265.485592][ C0] net_ratelimit: 8 callbacks suppressed [ 2270.886528][ C0] net_ratelimit: 21 callbacks suppressed [ 2274.969028][T21408] fuse: Bad value for 'fd' [ 2276.441410][ C0] net_ratelimit: 7 callbacks suppressed [ 2281.932843][ C1] net_ratelimit: 9 callbacks suppressed [ 2285.950034][T21452] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 2287.035141][T12417] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2287.606018][ C1] net_ratelimit: 8 callbacks suppressed [ 2292.767940][T21496] No source specified [ 2293.196582][T15173] net_ratelimit: 9 callbacks suppressed [ 2298.142899][T21526] tipc: Started in network mode [ 2298.149622][T21526] tipc: Node identity aaaaaaaaaaaa, cluster identity 4711 [ 2298.158722][T21526] tipc: Enabled bearer , priority 0 [ 2298.679244][ C0] net_ratelimit: 11 callbacks suppressed [ 2299.235962][T19746] tipc: Node number set to 43690 [ 2304.932669][ C0] net_ratelimit: 11 callbacks suppressed [ 2309.577687][T21568] tipc: Resetting bearer [ 2310.737056][ C1] net_ratelimit: 3 callbacks suppressed [ 2316.210163][ C0] net_ratelimit: 11 callbacks suppressed [ 2316.971627][T21592] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3702'. [ 2318.901667][T21597] overlayfs: missing 'lowerdir' [ 2321.182699][T21610] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3706'. [ 2321.717834][ C1] net_ratelimit: 13 callbacks suppressed [ 2324.992857][T15173] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2327.156175][ C0] net_ratelimit: 18 callbacks suppressed [ 2329.301018][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 2329.307837][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 2332.232578][ T28] audit: type=1326 audit(1791397155.630:538): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21653 comm="syz.4.3717" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f58af79e159 code=0x7ffc0000 [ 2332.419968][ T28] audit: type=1326 audit(1791397155.648:539): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21653 comm="syz.4.3717" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f58af79e159 code=0x7ffc0000 [ 2332.522395][ T28] audit: type=1326 audit(1791397155.676:540): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21653 comm="syz.4.3717" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f58af79e159 code=0x7ffc0000 [ 2332.890305][T15173] net_ratelimit: 23 callbacks suppressed [ 2334.181630][ T28] audit: type=1326 audit(1791397155.686:541): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21653 comm="syz.4.3717" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f58af75e98e code=0x7ffc0000 [ 2334.466779][ T28] audit: type=1326 audit(1791397155.714:542): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21653 comm="syz.4.3717" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f58af79e159 code=0x7ffc0000 [ 2334.580064][ T28] audit: type=1326 audit(1791397155.723:543): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21653 comm="syz.4.3717" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f58af79e159 code=0x7ffc0000 [ 2334.817626][ T28] audit: type=1326 audit(1791397155.751:544): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21653 comm="syz.4.3717" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f58af79e159 code=0x7ffc0000 [ 2336.328583][ T28] audit: type=1326 audit(1791397155.761:545): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21653 comm="syz.4.3717" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f58af79e159 code=0x7ffc0000 [ 2336.366042][ T28] audit: type=1326 audit(1791397155.770:546): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21653 comm="syz.4.3717" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f58af79e159 code=0x7ffc0000 [ 2337.376639][ T28] audit: type=1326 audit(1791397155.789:547): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21653 comm="syz.4.3717" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=216 compat=0 ip=0x7f58af79e159 code=0x7ffc0000 [ 2340.409163][T21692] xt_socket: unknown flags 0x4c [ 2342.436986][T21703] netdevsim netdevsim7: loading /lib/firmware/. failed with error -22 [ 2342.446015][T21703] netdevsim netdevsim7: Direct firmware load for . failed with error -22 [ 2342.455343][T21703] netdevsim netdevsim7: Falling back to sysfs fallback for: . [ 2343.878913][T12417] net_ratelimit: 11 callbacks suppressed [ 2345.033452][T21721] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3734'. [ 2349.626666][T21745] overlayfs: failed to clone upperpath [ 2349.906102][ C0] net_ratelimit: 8 callbacks suppressed [ 2353.401783][T21760] SET target dimension over the limit! [ 2353.422857][T21763] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3745'. [ 2353.459433][T21763] tipc: Resetting bearer [ 2353.766428][T21763] tipc: Disabling bearer [ 2353.891619][T21763] team0 (unregistering): Port device xfrm0 removed [ 2355.387288][ C0] net_ratelimit: 8 callbacks suppressed [ 2359.432623][T21783] netlink: 32 bytes leftover after parsing attributes in process `syz.7.3746'. [ 2361.192238][ C1] net_ratelimit: 8 callbacks suppressed [ 2366.588600][T21837] netlink: 4 bytes leftover after parsing attributes in process `syz.8.3763'. [ 2367.434405][ C0] net_ratelimit: 12 callbacks suppressed [ 2369.304058][T21845] futex_wake_op: syz.7.3764 tries to shift op by 144; fix this program [ 2369.373337][T21844] Cannot find set identified by id 0 to match [ 2373.267123][T15173] net_ratelimit: 8 callbacks suppressed [ 2374.551579][T21882] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3775'. [ 2379.150180][ C0] net_ratelimit: 10 callbacks suppressed [ 2385.061491][ C0] net_ratelimit: 9 callbacks suppressed [ 2391.379054][ C0] net_ratelimit: 8 callbacks suppressed [ 2391.551242][T20222] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2392.790056][T21953] ip_tables: iptables: counters copy to user failed while replacing table [ 2395.063967][ T1286] ieee802154 phy0 wpan0: encryption failed: -22 [ 2395.070409][ T1286] ieee802154 phy1 wpan1: encryption failed: -22 [ 2397.023154][ C1] net_ratelimit: 9 callbacks suppressed [ 2403.180295][ C1] net_ratelimit: 5 callbacks suppressed [ 2408.891771][T22041] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3809'. [ 2409.203042][ C1] net_ratelimit: 8 callbacks suppressed [ 2409.977811][T22053] netlink: 'syz.7.3805': attribute type 10 has an invalid length. [ 2414.724975][ C1] net_ratelimit: 8 callbacks suppressed [ 2420.892913][ C0] net_ratelimit: 9 callbacks suppressed [ 2426.355224][ C1] net_ratelimit: 7 callbacks suppressed [ 2427.656726][T22148] ip_tables: iptables: counters copy to user failed while replacing table [ 2429.682275][T15173] wlan1: No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge) [ 2431.934985][ C0] net_ratelimit: 11 callbacks suppressed [ 2438.701860][ C1] net_ratelimit: 8 callbacks suppressed [ 2441.724483][T22183] netlink: 12 bytes leftover after parsing attributes in process `syz.8.3845'. [ 2444.286000][T19954] net_ratelimit: 13 callbacks suppressed [ 2445.227211][T22204] xt_hashlimit: size too large, truncated to 1048576 [ 2445.235901][T22204] xt_hashlimit: max too large, truncated to 1048576 [ 2445.244076][T22204] xt_hashlimit: Unknown mode mask 4718EC78, kernel too old? [ 2449.727550][ C0] net_ratelimit: 20 callbacks suppressed [ 2451.296682][T22238] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3859'. [ 2451.720446][T22243] jffs2: notice: (22243) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 2452.203155][T15176] ------------[ cut here ]------------ [ 2452.209663][T15176] WARNING: CPU: 1 PID: 15176 at io_uring/io_uring.c:3214 io_ring_exit_work+0x3b9/0x830 [ 2452.219743][T15176] Modules linked in: [ 2452.223710][T15176] CPU: 1 PID: 15176 Comm: kworker/u4:15 Not tainted syzkaller #0 [ 2452.231549][T15176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2452.241710][T15176] Workqueue: iou_exit io_ring_exit_work [ 2452.247340][T15176] RIP: 0010:io_ring_exit_work+0x3b9/0x830 [ 2452.253083][T15176] Code: fd 48 8b 7c 24 40 48 8b 74 24 10 e8 31 02 11 00 48 85 c0 41 bf 00 20 00 00 75 1d e8 e1 c9 fe f6 e9 b1 fd ff ff e8 d7 c9 fe f6 <0f> 0b b8 70 17 00 00 48 89 44 24 10 eb c1 c7 84 24 90 00 00 00 00 [ 2452.272824][T15176] RSP: 0018:ffffc9000bba7a40 EFLAGS: 00010293 [ 2452.278992][T15176] RAX: ffffffff8a88c179 RBX: ffff888075750000 RCX: ffff88802d41da00 [ 2452.279074][T15176] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000000 [ 2452.279088][T15176] RBP: ffffc9000bba7bb0 R08: ffffc9000bba79c7 R09: 1ffff92001774f38 [ 2452.279104][T15176] R10: dffffc0000000000 R11: fffff52001774f39 R12: dffffc0000000000 [ 2452.279119][T15176] R13: 0000000100031ae9 R14: 0000000100031aea R15: ffff888075750510 [ 2452.288251][ C0] Receiving skb proto 0x0800 len 52 type 0 [ 2452.295141][T15176] FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 2452.295162][T15176] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2452.295177][T15176] CR2: 00007f707d681a3c CR3: 000000006174c000 CR4: 00000000003506e0 [ 2452.295196][T15176] Call Trace: [ 2452.295206][T15176] [ 2452.295226][T15176] ? io_ring_ctx_wait_and_kill+0x2b0/0x2b0 [ 2452.295268][T15176] ? _raw_spin_unlock_irq+0x23/0x50 [ 2452.295291][T15176] ? process_scheduled_works+0x975/0x1600 [ 2452.295314][T15176] ? process_scheduled_works+0x975/0x1600 [ 2452.295340][T15176] process_scheduled_works+0xa60/0x1600 [ 2452.295391][T15176] ? worker_attach_to_pool+0x370/0x370 [ 2452.295421][T15176] ? assign_work+0x3cc/0x5d0 [ 2452.295449][T15176] worker_thread+0xa5e/0xfe0 [ 2452.295499][T15176] kthread+0x2fa/0x390 [ 2452.295518][T15176] ? pr_cont_work+0x550/0x550 [ 2452.295541][T15176] ? kthread_blkcg+0xd0/0xd0 [ 2452.295561][T15176] ret_from_fork+0x48/0x80 [ 2452.295583][T15176] ? kthread_blkcg+0xd0/0xd0 [ 2452.295604][T15176] ret_from_fork_asm+0x11/0x20 [ 2452.295642][T15176] [ 2452.295653][T15176] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 2452.295662][T15176] CPU: 1 PID: 15176 Comm: kworker/u4:15 Not tainted syzkaller #0 [ 2452.295681][T15176] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 2452.295692][T15176] Workqueue: iou_exit io_ring_exit_work [ 2452.295712][T15176] Call Trace: [ 2452.295719][T15176] [ 2452.295726][T15176] dump_stack_lvl+0x18c/0x250 [ 2452.295752][T15176] ? show_regs_print_info+0x20/0x20 [ 2452.295774][T15176] ? load_image+0x420/0x420 [ 2452.295806][T15176] panic+0x2ca/0x720 [ 2452.295830][T15176] ? bpf_jit_dump+0xd0/0xd0 [ 2452.295859][T15176] ? ret_from_fork_asm+0x11/0x20 [ 2452.295885][T15176] __warn+0x2e0/0x470 [ 2452.295902][T15176] ? io_ring_exit_work+0x3b9/0x830 [ 2452.295922][T15176] ? io_ring_exit_work+0x3b9/0x830 [ 2452.295941][T15176] report_bug+0x2be/0x4f0 [ 2452.295964][T15176] ? io_ring_exit_work+0x3b9/0x830 [ 2452.295984][T15176] ? io_ring_exit_work+0x3b9/0x830 [ 2452.296002][T15176] ? io_ring_exit_work+0x3bb/0x830 [ 2452.296028][T15176] handle_bug+0xcf/0x120 [ 2452.296050][T15176] exc_invalid_op+0x1a/0x50 [ 2452.296072][T15176] asm_exc_invalid_op+0x1a/0x20 [ 2452.296093][T15176] RIP: 0010:io_ring_exit_work+0x3b9/0x830 [ 2452.296111][T15176] Code: fd 48 8b 7c 24 40 48 8b 74 24 10 e8 31 02 11 00 48 85 c0 41 bf 00 20 00 00 75 1d e8 e1 c9 fe f6 e9 b1 fd ff ff e8 d7 c9 fe f6 <0f> 0b b8 70 17 00 00 48 89 44 24 10 eb c1 c7 84 24 90 00 00 00 00 [ 2452.296127][T15176] RSP: 0018:ffffc9000bba7a40 EFLAGS: 00010293 [ 2452.296142][T15176] RAX: ffffffff8a88c179 RBX: ffff888075750000 RCX: ffff88802d41da00 [ 2452.296155][T15176] RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000000 [ 2452.296166][T15176] RBP: ffffc9000bba7bb0 R08: ffffc9000bba79c7 R09: 1ffff92001774f38 [ 2452.296180][T15176] R10: dffffc0000000000 R11: fffff52001774f39 R12: dffffc0000000000 [ 2452.296193][T15176] R13: 0000000100031ae9 R14: 0000000100031aea R15: ffff888075750510 [ 2452.296212][T15176] ? io_ring_exit_work+0x3b9/0x830 [ 2452.296245][T15176] ? io_ring_ctx_wait_and_kill+0x2b0/0x2b0 [ 2452.296277][T15176] ? _raw_spin_unlock_irq+0x23/0x50 [ 2452.296296][T15176] ? process_scheduled_works+0x975/0x1600 [ 2452.296316][T15176] ? process_scheduled_works+0x975/0x1600 [ 2452.296339][T15176] process_scheduled_works+0xa60/0x1600 [ 2452.296384][T15176] ? worker_attach_to_pool+0x370/0x370 [ 2452.296410][T15176] ? assign_work+0x3cc/0x5d0 [ 2452.296436][T15176] worker_thread+0xa5e/0xfe0 [ 2452.296479][T15176] kthread+0x2fa/0x390 [ 2452.296494][T15176] ? pr_cont_work+0x550/0x550 [ 2452.296515][T15176] ? kthread_blkcg+0xd0/0xd0 [ 2452.296532][T15176] ret_from_fork+0x48/0x80 [ 2452.296550][T15176] ? kthread_blkcg+0xd0/0xd0 [ 2452.296568][T15176] ret_from_fork_asm+0x11/0x20 [ 2452.296601][T15176] [ 2452.304266][T15176] Kernel Offset: disabled