last executing test programs: 7m13.757233272s ago: executing program 3 (id=71): syz_open_dev$loop(&(0x7f000000a0c0), 0x0, 0x0) r0 = socket(0xa, 0x3, 0xff) recvmmsg(r0, &(0x7f0000000040), 0x0, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4a, &(0x7f00000000c0)=0x9, 0x4) syz_emit_ethernet(0x42, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdir(&(0x7f000000a180)='./sys_mount\x00', 0x0) mount(0x0, &(0x7f000000a1c0)='./sys_mount\x00', &(0x7f000000a200)='sysfs\x00', 0x800, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000a240)='./sys_mount/block/loop0/queue/scheduler\x00', 0x2, 0x0) write(r1, &(0x7f000000a280)='bfq', 0x3) 7m13.4978261s ago: executing program 3 (id=74): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000003c0), 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x1, 0x8, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$sndseq(r0, &(0x7f00000004c0)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000500)={0x32b, @tick=0x440, 0xff}) 7m13.153592076s ago: executing program 3 (id=77): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./proc/net/rpc/auth.unix.gid/channel\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)='\\294967 -5 2\\000 0000 0\n', 0x18) 7m12.780536686s ago: executing program 3 (id=80): syz_mount_image$ext4(&(0x7f0000000c40)='ext4\x00', &(0x7f0000000c80)='./bus\x00', 0x21081e, &(0x7f0000000cc0)={[{@grpquota}, {@inode_readahead_blks={'inode_readahead_blks', 0x3d, 0x800}}, {@minixdf}]}, 0x1, 0x4fa, &(0x7f0000003640)="$eJzs3c9vG1kdAPCvnThx0uwmu+wBEOyW3YWCqjqJuxut9gDLCSFUCdEjSG1I3CiKHUexU5rQQ3rmikQlTnDkD+DcE3cuCG5cygGJHxGoQeLg1YwnqZvaTdQkdhR/PtJo3ps39fe9pvNe/U3iF8DQuhoRuxExFhF3I2I6u57LjvisfST3Pdt7uLS/93ApF63W7X/l0vbkWnT8mcSV7DWLEfGj70X8NPdy3Mb2ztpitVrZzOqzzdrGbGN758ZqbXGlslJZL5cX5hfmPrn5cfnMxvpebSwrffXpH3e/9fOkW1PZlc5xnKX20AuHcRKjEfGD8wg2ACPZeMYG3RFeSz4i3o6I99PnfzpG0q8mAHCZtVrT0ZrurAMAl10+zYHl8qUsFzAV+Xyp1M7hvROT+Wq90bx+r761vtzOlc1EIX9vtVqZy3KFM1HIJfX5tPy8Xj5SvxkRb0XEL8cn0nppqV5dHuR/fABgiF05sv7/d7y9/gMAl1xx0B0AAPrO+g8Aw8f6DwDDx/oPAMOnvf5PDLobAEAfef8PAMPH+g8AQ+WHt24lR2s/+/zr5fvbW2v1+zeWK421Um1rqbRU39wordTrK+ln9tSOe71qvb4x/1FsPZj59kajOdvY3rlTq2+tN++kn+t9p1JI79rtw8gAgF7eeu/JX3LJivzpRHpEx14OhYH2DDhv+UF3ABiYkUF3ABgYu33B8DrFe3zpAbgkumzR+4Jit18QarVarfPrEnDOrn1J/h+GVUf+308Bw5CR/4fhJf8Pw6vVyp10z/846Y0AwMUmxw/0+P7/29n5d9k3B36yfPSOx+fZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALjYDvb/LWV7gU9FPl8qRbwRETNRyN1brVbmIuLNiPjzeGE8qc8PuM8AwGnl/57L9v+6Nv3h1AtN7145LI5FxM9+fftXDxabzc0/RYzl/j1+cL35OLte7n/vAYDjHazT6bnjjfyzvYdLB0c/+/OP70ZEsR1/f28s9g/jj8Zoei5GISIm/5PL6m25jtzFaew+iogvdht/LqbSHEh759Oj8ZPYb/Q1fv6F+Pm0rX1O/i6+cAZ9gWHzJJl/Puv2/OXjanru/vwX0xnq9LL5L3mppf10Dnwe/2D+G+kx/109aYyP/vD9dmni5bZHEV8ejTiIvd8x/xzEz/WI/+EJ4//1K+++36ut9ZuIa9E9fmes2WZtY7axvXNjtba4UlmprJfLC/MLc5/c/Lg8m+aoZ3uvBv/89PqbvdqS8U/2iF88ZvxfP+H4f/v/uz/+2ivif/ODbvHz8c4r4idr4jdOGH9x8vfFXm1J/OUe4z/u63/9hPGf/m3npW3DAYDBaWzvrC1Wq5VNBYWLX0j+yV6AbnQtfKdfscaie9MvPmg/00eaWq3XitVrxjiLrBtwERw+9BHxv0F3BgAAAAAAAAAAAAAA6Kofv7E06DECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABweX0eAAD//19xzyM=") open(&(0x7f0000003b40)='./bus\x00', 0x14927e, 0x9) mount(&(0x7f0000003c00)=@loop={'/dev/loop', 0x0}, &(0x7f0000003c40)='./bus\x00', 0x0, 0x1000, 0x0) r0 = open(&(0x7f0000003c80)='./bus\x00', 0x0, 0xa27b734c1a0bc97) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000003cc0)={0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x4, 0x0, 0x0, 0x417, 0x0, "ef35af413bb901527fe4f1ce5d29c3ee5e5c3676345a41499db7aac63a01010000000000004faa2ae2c08485d90000000000007700000c00002000", "036c47c678082004cb59d654cb9b1b165263bdbcef549ba197fce47ddfdd753abd950100173400ffffff00f7ffffff000000f3e7f20000000200000000000600", "b732673e181c208227fffdf2e500000f0000000e000200", [0x40000000004]}) 7m10.935717141s ago: executing program 3 (id=89): syz_emit_ethernet(0x3e, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb88"], 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000280)={@val={0x6f01, 0x800}, @val={0x1, 0x0, 0x27, 0x0, 0x27}, @mpls={[], @ipv4=@tcp={{0x6, 0x4, 0x0, 0x0, 0x8029, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffff20, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0xb, 0x0, 0x700, 0x0, 0x18, {[@window={0x9, 0xfffffffffffffec4}, @timestamp={0x5, 0x2, 0xffffff07, 0xffc1}, @generic={0x0, 0x2, "d588380003c1"}]}}}}}}, 0xfd6c) 7m10.056427524s ago: executing program 3 (id=97): mkdirat(0xffffffffffffff9c, &(0x7f0000002540)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000002580)='./dev\x00', &(0x7f00000025c0)='devtmpfs\x00', 0x0, 0x0) mount(&(0x7f0000002640)=@filename='./dev/sda1\x00', &(0x7f0000002680)='./mnt\x00', &(0x7f00000026c0)='ext4\x00', 0x8410, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000024c0)='./mnt\x00', 0xa0000, 0x14) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f0000002740)=ANY=[@ANYBLOB="000000004c90020000000000030001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000d100000000000000ffffffffffffffff00000000000000000000393300000000000000000000000000000000000000000000000000000000ffffffff000000"]) 7m9.397211944s ago: executing program 32 (id=97): mkdirat(0xffffffffffffff9c, &(0x7f0000002540)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000002580)='./dev\x00', &(0x7f00000025c0)='devtmpfs\x00', 0x0, 0x0) mount(&(0x7f0000002640)=@filename='./dev/sda1\x00', &(0x7f0000002680)='./mnt\x00', &(0x7f00000026c0)='ext4\x00', 0x8410, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000024c0)='./mnt\x00', 0xa0000, 0x14) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f0000002740)=ANY=[@ANYBLOB="000000004c90020000000000030001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000d100000000000000ffffffffffffffff00000000000000000000393300000000000000000000000000000000000000000000000000000000ffffffff000000"]) 6m26.760573436s ago: executing program 5 (id=282): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f0000000200)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r0, &(0x7f0000000280)='\\294967 -5 2\\000 0000 0\n', 0x18) 6m26.760288686s ago: executing program 5 (id=284): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r3 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_buf(r3, 0x0, 0x8008000000010, 0x0, 0x0) 6m25.671628132s ago: executing program 5 (id=291): r0 = syz_open_dev$usbfs(0x0, 0x204, 0x2) ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000200)=@urb_type_control={0x2, {}, 0x2a1, 0x21, &(0x7f0000000240)={0x20, 0x6, 0xd}, 0x8, 0x4, 0x107f, 0x0, 0x1, 0x101, 0x0}) 6m24.948417028s ago: executing program 5 (id=293): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RELOAD(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x3c, r1, 0x1, 0x70bd27, 0x25dfdbfb, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_NETNS_PID={0x8}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4040010}, 0x30) 6m24.484083337s ago: executing program 5 (id=294): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x3, 0x4, &(0x7f00000006c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, [@call={0x85, 0x0, 0x0, 0x97}]}, &(0x7f0000000700)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x2, '\x00', 0x0, @fallback=0xb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000740)={r0, 0x0, 0x28, 0xe40, &(0x7f00000007c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000800)=""/8, 0x320e, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) 6m24.167390671s ago: executing program 5 (id=296): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffff, 0x2}, 0x6) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x40, 0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000340), 0x80000, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1f, 0x2, &(0x7f0000000180)=ANY=[@ANYBLOB="8500"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x16, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xaa1}, 0x94) pipe(0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffffffffffff, 0x200000000000000}, 0x38) recvmmsg(r0, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x5}], 0x40001af, 0x12122, 0x0) 6m9.031108962s ago: executing program 33 (id=296): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000000c0)={0x1f, 0xffff, 0x2}, 0x6) setsockopt$SO_TIMESTAMP(r0, 0x1, 0x40, 0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000340), 0x80000, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x1f, 0x2, &(0x7f0000000180)=ANY=[@ANYBLOB="8500"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x16, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xaa1}, 0x94) pipe(0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xffffffffffffffff, 0x200000000000000}, 0x38) recvmmsg(r0, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0x5}], 0x40001af, 0x12122, 0x0) 2m45.290230116s ago: executing program 0 (id=1472): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000380)='./tracing\x00', &(0x7f00000003c0)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000440)={0x0, 0x0}) sendfile(r1, r0, 0x0, 0x7ffff000) 2m45.167850299s ago: executing program 0 (id=1475): socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="120000000a0000000800000002ec4b58febb9a552ab79ffb42e2"], 0x50) r2 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$MRT6_ADD_MIF(r2, 0x29, 0xca, &(0x7f0000000080)={0x1, 0x0, 0x6, 0x0, 0x4}, 0xc) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000140)=0x6) keyctl$instantiate(0xc, 0x0, 0x0, 0x35, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000000600)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, &(0x7f0000019600)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000019640)='./sys\x00', &(0x7f0000019680)='sysfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f00000196c0)='./sys/bus/acpi/devices/PNP0501:00/status\x00', 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4d, &(0x7f0000019840)=0x8, 0x4) r5 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r5, 0x0, 0x0, 0x2409c8c1, &(0x7f0000019880)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000198c0)={{r1}, 0x0, &(0x7f0000019900)=r0}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000019940)={r1, 0x0, 0x0}, 0x20) r6 = socket$kcm(0x2b, 0x1, 0x0) setsockopt$sock_attach_bpf(r6, 0x6, 0x17, &(0x7f00000005c0)=r6, 0x21) 2m43.039102494s ago: executing program 0 (id=1477): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x6, 0x14, &(0x7f0000000240)=ANY=[@ANYBLOB="bf160000000000001801000000756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000030000008500000006000000180200000a"], &(0x7f0000000300)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r0, 0x0, 0xb, 0x0, &(0x7f00000003c0)="0011223344550011223344", 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1}, 0x50) r1 = socket$inet6(0xa, 0x2, 0x3a) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x6, 0x8a}, 0x0) setns(0xc9, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x402, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f00000001c0)={'syzkaller1\x00', @link_local}) r3 = socket$kcm(0xa, 0x2, 0x0) r4 = socket(0x2, 0x80805, 0x0) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000580)={0x84, @rand_addr=0x64010105, 0x4e20, 0x3, 'lblcr\x00', 0x30, 0x660f5380, 0x3}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r4, 0x0, 0x487, &(0x7f00000005c0)={{0x84, @broadcast, 0x4f29, 0x3, 'dh\x00', 0x5, 0xc, 0x6c}, {@rand_addr=0x64010101, 0x4e23, 0x10002, 0x1, 0x1}}, 0x44) sendmsg$sock(r3, &(0x7f0000000640)={&(0x7f0000000680)=@in6={0x2, 0x4e20, 0x10, @dev={0xfe, 0x80, '\x00', 0xfc}, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000700)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x0, 0x83, @loopback, 0x5597bac7}, 0x1c) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000400)={0xa, 0x4, &(0x7f00000004c0)=ANY=[@ANYBLOB="18000000000000000000ff0f0000000000003e00000000009500000000000000"], &(0x7f0000000500)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0xb}, 0x94) 2m43.038057414s ago: executing program 0 (id=1480): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$bind(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x2125099, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f00000002c0)='\x00', 0x9801) move_mount(r0, &(0x7f0000000300)='.\x00', 0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x0) umount2(&(0x7f0000000380)='./file0\x00', 0x9) 2m42.746629635s ago: executing program 0 (id=1481): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0xa, 0x3, &(0x7f0000000a40)=ANY=[@ANYBLOB="850000002200000007000000000000089500000000000000e26c9bd1a6361b80cdd64bdf00000000000869045aac0000659f55df08f9b90788ff7f00000010000029c21ebbcde61d8ab5920aef6c3e007fe61241638962cf0b89ef506cfd3f1d4163d3cfca3733b30070a7cf53021a9554328a702688f92b6b71569d65e33d46f8d8ae24ba69c657afac04379cb536008c219991704f11c5a01ba62ed8f2c6a503dd1b1d076f03b0f917c766f3a7598bbc00feb3bc8e88f79df517b37b56bcbc290080000000000000e675458a43b8a8935bf9cf0be7d0aeaac41405e341d13d244359718ac3dad595712a4051bb6cf826ab757193fc093b8b3353fbbb278d19000000000000007b61805ed430ef06000000000000001e93f640f159320c8b088f4d64977b2eb312d4967aff9e4c14c66c90000054ed82c7cba4c81f91d6dfed18767bf0df584b4b6c4204df411f921e3aa02a67dd324b8176020e9c024751df38c05727f82c92046bfe64babb6d7ba86526b7886a0c2481c5812812a6fa3fca3758cbd8c32b25c28be225bd1f16297baa065f5bf96330fad0aaa4388c06c0eb2ecdf829af9577fcd868cc269b740000b777d73a63246ce6f0467167626329ab91df7a13d9ec9a64e7f6b56aeab8c38f69a213c96e2d2ad7978c9d721c230f27e7025d576535198742d403ec43572d7d0baf00e882617b260627805ca44200335ea4363066944d0aa6feb9705b09ba40d4642519281151f875cbf13a582f90ad719f0eccf02a473dd508a16138904933689ea6ee02412064730700aeff2b69c2f2bf6f691c3560e068743ae8e8771280dac7fd8fdc3f7a35ea352e35753c59ebc1bd27ab6603e6afb1b3f057fbb7ed3aabe702b3c6301d3f5c295d1d69d1541d0e64631c95d6c0999e27e8d1a58f6a00f19102d2bfaf53f25a45637b1c577ae50c4c56d9abc40c64a20c14ff0b1bf4d23fe07ae90f503ba9c64bf89b26e7d8d70710b04f9ece69023acadbb4582272e5b3a0429a5675e5a9554de54945d9a270180e0545b0c824ad36f7cc8be12b3874d5a19349b0ede845e9ece24d546d3af1bae069b89f6ecf2aabb17eb1840bc8e0ed1dd8b9b7eeaf32a185d8fc9a28c6b8e00250a7f2eeb756eadafe20bbc616bc44b347abc8caf722b2c3b06884c1d1690f23b06fa4541bb2a81073b452764f04bd39008b65ee222cf697ac21b087548e9708dffaff2859e973b1e88668c8022cc6dac8548167e5798ec9c7d288a7fa7749f07513187cd8f060abbbc5e37dd1be3aab927be1b409be733b7408534e5b0951e9ecfd0a1c77e3a29be4c4093330124615056e3ce0ce6ac91b1242d3bb2e787a186dc2ec284d60e9d8a03884a22eeaa1efa497ee88c6cb565b164a260afb5157e392b1ebb1a4d4f992011ecbac4a0a6df5bdc6f7994a422bb2761edd2d8f20f5f879a88f89d48b8314f862585e4b7a9d6a6681f40e8b82cc6555dcdb951d164cc9a70e640ac8974faa2587a6e3af3b9458f7d4b4077b3002536b10ea24d73307a33090c4c270909a5322eac32cb175e68fa83457b21465c08c02c0c714c2862ddbe567755f05a1e671328d160d3752345ca1db6e74c720e42afca982ba6befd96c5575f1e88f87ff6606301c0000000000000000000000000000000000000004d0d54b4caf78018766cdb971e8b168d4763c21181f00000003d4e1d842caf457797f93db93e4f38a9dbd79f6bf5dc40b55fdbf9b856665061b2e2924f27eb2d2b5a181ccfd9eeb11dec165b6f12433f00bb06124041ffdcdcdc91f3b3b76635a689c9249cf69bcae65e9f2cc9a5129e385b883c56026d83520395b7d511f607cf2f899c7b1c75e2192f775d72247167285857588ace1115fbebfe63c16b84cf7036d41c493a63c09f2ce46c1f5995c2d7fe58c15e64bb4cb7e7f336cc22fa1ea1363bce375bd3d579be1dddb08ed5147b629e4b3f0e65783ee5e20d9270802f2a7500738bf356131ca53e9d7ba8d486fb26252d684b84fa24639089064ca7b93057c041f12d544dab4d24a4f952b4f265a69ba279929959991b7ac63786055b3c029a0e8b6e4c26497c029bb61462623a58556cd62844d4d23cc738ee5b36c71d2c010b089251d5806000b1ade92dd9f441468967c052aecd9de817394eb580240d556d0f0b4b55d06670597991f37ddc4fa19a6369d5bf76c474633a337f676ad255869881da5cadcf49ce9188129cc978977f87b32bd49457536430ffbd3e01e67ff087644f52fcf0a3c732b0586cb87972c43d2616bf4e521dc3126bf1760243d51a197d3ecfd74bd625e9f496175cfeaaa020817d33d513f3e97854ea76e04e96a8639a297871485a8609f8ca842b3321932c4d9e224a0cec5946cec9e359fd3687415cad5fb8c678136f36d9f781fade9f2469477748f4dfa0f56c3b5a620fc84e1c735647895713cbcea57b2277831f8f633f0d29371e645e5544e57010a9b76457f6ad73231a9f31f6bbb1b95248aeda5a9df9dea643a792bb0910e45fce298ab0a0298fc33a423e860d5b308d7849381b294106af25f15fec047d5b844a99f36e342165df728e381b48c20e0900f8d265157467d3494f2b96acf060f74084760d226f50edb115c2e075f3c663a4b4169b900fa0a13cf796e0d7a9dad86953c13ed6241206d68ae194c64c491de6a531e9bd45abe705f07000a82ccd41a2c1b9d5dd8bf6c28653eb84f117e476e052a9db790e0a71dac9d8b343efebdc026860000000000000000000000000000aad579302085dfdf75bea24798c680b3de341e3bd57543bf74fd58bcebdbb883c743ed43ba7f540f2c4e0310c21e7deff9e45b8bd2cf65bb584091b8e80e34b3e59185fe32d1d73dd4f62712a39b1366c71420b339ec1295f79b1516723b6b80a7e99e5aa6536982c02275fc53fa3ef14d9fccb05f9c4e69a3af0fde863af2d9a0f8a94fc571b0ab4ad714f41fa4ee0bf14a8b44e3c41a3125be95e4b23d5f05395852761bfaebe0db979d5f3991d826cc74542b85cfd0dba66bc93cfd79178ab0b79fa3b29ff9c19e0424513c91980187c9d94b8354337a1fc782505db900c47d83bd49276cfe6e242ba8365b1ea4598a21f50f5415a70990b5bb4a1f6bd8acdf2c7da3d648754767089c9b5ceb556fafa3cc5afd2f3e9a62a90262a76ff89a2751b59a744f0d3f36ca503357daa3e29ce6f357dc1e4839277d003e93fdbb955e1a1302a76aea7e73835094fb15464e94e814c77c293121d0433e80d444c4ca17abaf32b521d8686666055da023aef9c8df3e80d2ed640ed10aa19a036dcef172dbd3b3600b69d7b90c6222e167d7c76059f2b5f3b3004e8a20d1f6612efeb629573be97aa949c6016e7e56283e84986aaa4fc8a098708ebe36f377ada63d9b464c39342e0682549862de3ec75e7b031bc49f341a21417fb6375e8701481b59d1722c836961804666801678eb25750b520bf1615a4bbf30aa74d60ec6b657f2dd298b0419da43fc708a60c94a7ff2fd6a2d08005ad73c9e2d6143d2857be8fb3f12bfa6628bccb153e39172d07563d6a1dc75c347c08060304f091230bd74b49ecdd13bf480db3984622a167c8603b8c501280059a7b6123c8f8cd217f64eccc2dffe4f3a1e8c9a96a13d8126f3ea26779fbd0069d729a7764d4ddd7d9d820b0de2530969362b94b974678527f5bac7eb8d6e321b2be0b2f7534634a5ecd1248d7ad7e8e03163e92e9f1d620e28597bd881eea0981e8adfd70b670b0763ce9226f7c3e156b353e22fdea6942b577bbc539aab23cbd46bdd0ea1e67140c759f208c12dc57f3100000000000000e4965fcb6c2749955eac9476687e63b41c6282bbcb0c3d8b0c9493a3a5f6d879d7257b4b68dc7cac3d9d5f5bbe937c501866ee4042b250e516ec074559e1e551167138766eeecb6941e8305d9cde1800c821536f9d25bd14163890842a08135bdb7a90db630b18f099855a7d9de65c80fa71ff90e873361d0e11a7dfebe56ffb2000b711a0b7914d6351ff60593e48af60e1ffecba7cd6f8ab662eb3c8f3164139e994d6a706afb92722595d649a04f1ff64e5634e7cb9106173a96bf47f7085e7eecdfdc1b6507b851c4ba43312726cfec58dedece1355a087c1b60882713a6161914f09267e2ce8aa886b380add5cd92e185d345c9b2933a78a4215133e8e7247fa444aee30bfb6c17ef537fba43aad323f552c01e17514d5db387e4bf9341ccf5931fc75350f8dcef3ed3e74d674865249b879466f0e3cf0dc9e3d8720ea261e6996b844501e374a0e9878c1d02fd3d6e2ae5d7677892d7a5cdf4b7fa8f315b41552d07495f034e1fa0a2c9a34b7f66638e775dacb33e9b5cd3f4193bdebb7e86090dd265ee2b3ca9bd32d19ef229a050e910263d916670d8006067f5c0a1d8219b4a74b6092656f3b96f060000005ca3eca5d6295a1c11be907fad3bf9ccdf9898a084bbcc0a3714691c6c28fc34c44f9a46d6caf3b93d5d9ad8e3a25d34da57b203af917f5359952468fcddbf43d8fd1add972fd5d361c5be3e8b3280bbfa97e9826163537c99ff461123a1d9f93880feb5f953217f1e633bfb221a7822513278c36abcb6a4009e5037b3f56f9172bd70331817862c5e129d830d4f13e9793dad49b6bf286d2a539d089393d481931735a544f4e86b51a91106ce86d278a0712eab917d843ecc7d031e99d230689210e5afbcbb0a6cff33b40e7b637a8171d7b28fcaee54bb0fb7e2dd92c6cf2130f9fa4482512ae356c5907533108113a9a98b0508e4041df8e99b4136a66f58a6e91e2017dc7e095e8e4776d396797e089e9b42fdee33e76c28a636893510ed71166086bb4c1f3363dfd0abf0b2ea8ceba68c7d9a22a8342059862985d987083d80761bd699c3ee77473263a77ea65eac8a4c3b6b87f399575a15a2db143f6aac363644fd45372d6f43baebc7c3547780d1d079e225962733e0c0d3f364cbe9bcec7caaa8d372da63b213d4554e9ced54c2d59a97b814f1d700"/3577], &(0x7f0000001840)='GPL\x00', 0x2, 0x1000, &(0x7f0000001880)=""/4096, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000002880), 0x8, 0x10, &(0x7f00000028c0), 0x10}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000036c0)={r0, 0x3a, 0xcc0, 0xcc0, &(0x7f0000003740)="e460cdfbef2408322900119386dd6a00000000072feb311ccd3ec8a755c1e1380081ffad008036e8d50000ff010000001400000500242f09880bd320d98a61a90021e9bf", 0x0, 0x401, 0x0, 0xa8, 0x0, &(0x7f00000037c0)="59235bd7a9324ff307d87177332368fbdeefaa1544600ea1870645446c357de433206896637019b84d57c3de1ea07638e494dd701db1af6fc15db78cf79f5ab4bc7aee8553677ffe377a35b4afdb989fb7da1ff63956ffb796d51daf1c268b9f1a4a06583f8c03ec1671b151a8a495c1b006fa5f2f3a54a46aeee8005b178b9516d2b928984ccb942fa2278a2e33a0b619f2dd814fc91942e03c48fd9b7d19d9a6612b46805b267ef3132a724cbfcd1c715be67930e2ae2b9a2479c5a4b2fecd301a745a6fd67598a5e5ecc1e56e58159c47def7f9285acfedc980596377e6f9ee076fa094e5d8f838b718ed63ff8265a1dbc1549bed03e6b27b6fc2b8a07373506a1a41d5a71cbf0eaa24ec737b02a8a2d5114c3c4e5810a2c3eae3373fd341800cfb0fb35cefe04ca4da2b02a83c40126e23cdf3c817b530bbe7b431bc0b7d864e3e6dd1ab90259a8bd7ad7dd4c6366ea6da661fd016b394adcce5988fff85fbc832a927c97b89337e195f562cd284911eef1ee52e4ff033b33beedea7cf43c4d0cc0471fa91011e1e7e8733bf82c01346d6ecb49f1a84e92d063c81a7227d89be33f7273b87e29ae53a5f38dc94cf391fcb82c9432821ef1a0f6bbfe8f7d6574479a8f621e1d8f7d9bb20f3d8d469e6d232d7d7837ff12a224a65c604907e787baaf7c863ad48a5edecbe1470c20507a6ee5dee75e9ef84c71af5af800a9ce9787ebdee9e1c8189fbf66048d5c3757fb2b697ce68cfd316a7b25a385111e0cd2fddb81602e36e74c4f99b403cb304a4774e648054c0456c7869f9d97873ff80e2664c1265292941a9b767c7f40767cfccdbcaa156453d6a910fd5440f7a2bf8f4bb6d6d9fd443f2304617a684b6afa99c157dcf70e51fdb55fd0dbf5c6733841024599f8d1791a07c5dc3a4ccaf4d7c0ca3d101b2beba3a49d2378c9fe4fdb10babd95083a0c4db5a30c4490828d97efe807a13e587fbac1089843964facfd27d287262759384fe9b610f81048be430c1e8fe6327c0f2fd003021d20563ec0c7e39aec6718649c958da2e02cb3848c76924492678889c18bea02ed5ee080106e9838cbca9ad5f66c0434182225b13a236b342cf80562c10d4a3459aea17589b84904d3d2c2b", &(0x7f0000003b00)="b33620dad49cc786c86a5c5444e76c2a1ef9224fb91083d2ba4368e98a14467703e9ee585196fa95320bd53c6a76ad443b81dc833b22016aeaafb4597c06919ecf7e5ea4d0a8995feaaf9a9feb0c4b5277398049a2f5475f6ceb26bd128189f4b1b3c662d3d1630717791de0cdac3ce6e01c5719b670da5ded7dfa9dda53f04ad151cb952d708eaa69e983dcfab36b2dac3f3fe85e1d86b3d73d4879fb11cfac51f3cb669a50", 0x1, 0xfffffffd}, 0x22) 2m42.291903443s ago: executing program 0 (id=1487): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/sync_on_suspend', 0x802, 0x2) write(r0, &(0x7f0000000040)='0000:', 0x5) 2m41.84835031s ago: executing program 34 (id=1487): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/power/sync_on_suspend', 0x802, 0x2) write(r0, &(0x7f0000000040)='0000:', 0x5) 7.041106935s ago: executing program 1 (id=2633): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller0\x00', 0x1002}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000003c0)={'syzkaller0\x00', 0x0}) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000400)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r1, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000004c0)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000680)=@newtfilter={0x84, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0xe}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x54, 0x2, [@TCA_BASIC_ACT={0x50, 0x3, [@m_ife={0x4c, 0x1, 0x0, 0x0, {{0x8}, {0x24, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x6, 0x400, 0x7}, 0x1}}, @TCA_IFE_METALST={0x4}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x84}}, 0x0) write$cgroup_pid(r0, 0x0, 0x0) 3.745780643s ago: executing program 6 (id=2643): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0xa, 0x3, &(0x7f0000000a40)=ANY=[@ANYBLOB="850000002200000007000000000000089500000000000000e26c9bd1a6361b80cdd64bdf00000000000869045aac0000659f55df08f9b90788ff7f00000010000029c21ebbcde61d8ab5920aef6c3e007fe61241638962cf0b89ef506cfd3f1d4163d3cfca3733b30070a7cf53021a9554328a702688f92b6b71569d65e33d46f8d8ae24ba69c657afac04379cb536008c219991704f11c5a01ba62ed8f2c6a503dd1b1d076f03b0f917c766f3a7598bbc00feb3bc8e88f79df517b37b56bcbc290080000000000000e675458a43b8a8935bf9cf0be7d0aeaac41405e341d13d244359718ac3dad595712a4051bb6cf826ab757193fc093b8b3353fbbb278d19000000000000007b61805ed430ef06000000000000001e93f640f159320c8b088f4d64977b2eb312d4967aff9e4c14c66c90000054ed82c7cba4c81f91d6dfed18767bf0df584b4b6c4204df411f921e3aa02a67dd324b8176020e9c024751df38c05727f82c92046bfe64babb6d7ba86526b7886a0c2481c5812812a6fa3fca3758cbd8c32b25c28be225bd1f16297baa065f5bf96330fad0aaa4388c06c0eb2ecdf829af9577fcd868cc269b740000b777d73a63246ce6f0467167626329ab91df7a13d9ec9a64e7f6b56aeab8c38f69a213c96e2d2ad7978c9d721c230f27e7025d576535198742d403ec43572d7d0baf00e882617b260627805ca44200335ea4363066944d0aa6feb9705b09ba40d4642519281151f875cbf13a582f90ad719f0eccf02a473dd508a16138904933689ea6ee02412064730700aeff2b69c2f2bf6f691c3560e068743ae8e8771280dac7fd8fdc3f7a35ea352e35753c59ebc1bd27ab6603e6afb1b3f057fbb7ed3aabe702b3c6301d3f5c295d1d69d1541d0e64631c95d6c0999e27e8d1a58f6a00f19102d2bfaf53f25a45637b1c577ae50c4c56d9abc40c64a20c14ff0b1bf4d23fe07ae90f503ba9c64bf89b26e7d8d70710b04f9ece69023acadbb4582272e5b3a0429a5675e5a9554de54945d9a270180e0545b0c824ad36f7cc8be12b3874d5a19349b0ede845e9ece24d546d3af1bae069b89f6ecf2aabb17eb1840bc8e0ed1dd8b9b7eeaf32a185d8fc9a28c6b8e00250a7f2eeb756eadafe20bbc616bc44b347abc8caf722b2c3b06884c1d1690f23b06fa4541bb2a81073b452764f04bd39008b65ee222cf697ac21b087548e9708dffaff2859e973b1e88668c8022cc6dac8548167e5798ec9c7d288a7fa7749f07513187cd8f060abbbc5e37dd1be3aab927be1b409be733b7408534e5b0951e9ecfd0a1c77e3a29be4c4093330124615056e3ce0ce6ac91b1242d3bb2e787a186dc2ec284d60e9d8a03884a22eeaa1efa497ee88c6cb565b164a260afb5157e392b1ebb1a4d4f992011ecbac4a0a6df5bdc6f7994a422bb2761edd2d8f20f5f879a88f89d48b8314f862585e4b7a9d6a6681f40e8b82cc6555dcdb951d164cc9a70e640ac8974faa2587a6e3af3b9458f7d4b4077b3002536b10ea24d73307a33090c4c270909a5322eac32cb175e68fa83457b21465c08c02c0c714c2862ddbe567755f05a1e671328d160d3752345ca1db6e74c720e42afca982ba6befd96c5575f1e88f87ff6606301c0000000000000000000000000000000000000004d0d54b4caf78018766cdb971e8b168d4763c21181f00000003d4e1d842caf457797f93db93e4f38a9dbd79f6bf5dc40b55fdbf9b856665061b2e2924f27eb2d2b5a181ccfd9eeb11dec165b6f12433f00bb06124041ffdcdcdc91f3b3b76635a689c9249cf69bcae65e9f2cc9a5129e385b883c56026d83520395b7d511f607cf2f899c7b1c75e2192f775d72247167285857588ace1115fbebfe63c16b84cf7036d41c493a63c09f2ce46c1f5995c2d7fe58c15e64bb4cb7e7f336cc22fa1ea1363bce375bd3d579be1dddb08ed5147b629e4b3f0e65783ee5e20d9270802f2a7500738bf356131ca53e9d7ba8d486fb26252d684b84fa24639089064ca7b93057c041f12d544dab4d24a4f952b4f265a69ba279929959991b7ac63786055b3c029a0e8b6e4c26497c029bb61462623a58556cd62844d4d23cc738ee5b36c71d2c010b089251d5806000b1ade92dd9f441468967c052aecd9de817394eb580240d556d0f0b4b55d06670597991f37ddc4fa19a6369d5bf76c474633a337f676ad255869881da5cadcf49ce9188129cc978977f87b32bd49457536430ffbd3e01e67ff087644f52fcf0a3c732b0586cb87972c43d2616bf4e521dc3126bf1760243d51a197d3ecfd74bd625e9f496175cfeaaa020817d33d513f3e97854ea76e04e96a8639a297871485a8609f8ca842b3321932c4d9e224a0cec5946cec9e359fd3687415cad5fb8c678136f36d9f781fade9f2469477748f4dfa0f56c3b5a620fc84e1c735647895713cbcea57b2277831f8f633f0d29371e645e5544e57010a9b76457f6ad73231a9f31f6bbb1b95248aeda5a9df9dea643a792bb0910e45fce298ab0a0298fc33a423e860d5b308d7849381b294106af25f15fec047d5b844a99f36e342165df728e381b48c20e0900f8d265157467d3494f2b96acf060f74084760d226f50edb115c2e075f3c663a4b4169b900fa0a13cf796e0d7a9dad86953c13ed6241206d68ae194c64c491de6a531e9bd45abe705f07000a82ccd41a2c1b9d5dd8bf6c28653eb84f117e476e052a9db790e0a71dac9d8b343efebdc026860000000000000000000000000000aad579302085dfdf75bea24798c680b3de341e3bd57543bf74fd58bcebdbb883c743ed43ba7f540f2c4e0310c21e7deff9e45b8bd2cf65bb584091b8e80e34b3e59185fe32d1d73dd4f62712a39b1366c71420b339ec1295f79b1516723b6b80a7e99e5aa6536982c02275fc53fa3ef14d9fccb05f9c4e69a3af0fde863af2d9a0f8a94fc571b0ab4ad714f41fa4ee0bf14a8b44e3c41a3125be95e4b23d5f05395852761bfaebe0db979d5f3991d826cc74542b85cfd0dba66bc93cfd79178ab0b79fa3b29ff9c19e0424513c91980187c9d94b8354337a1fc782505db900c47d83bd49276cfe6e242ba8365b1ea4598a21f50f5415a70990b5bb4a1f6bd8acdf2c7da3d648754767089c9b5ceb556fafa3cc5afd2f3e9a62a90262a76ff89a2751b59a744f0d3f36ca503357daa3e29ce6f357dc1e4839277d003e93fdbb955e1a1302a76aea7e73835094fb15464e94e814c77c293121d0433e80d444c4ca17abaf32b521d8686666055da023aef9c8df3e80d2ed640ed10aa19a036dcef172dbd3b3600b69d7b90c6222e167d7c76059f2b5f3b3004e8a20d1f6612efeb629573be97aa949c6016e7e56283e84986aaa4fc8a098708ebe36f377ada63d9b464c39342e0682549862de3ec75e7b031bc49f341a21417fb6375e8701481b59d1722c836961804666801678eb25750b520bf1615a4bbf30aa74d60ec6b657f2dd298b0419da43fc708a60c94a7ff2fd6a2d08005ad73c9e2d6143d2857be8fb3f12bfa6628bccb153e39172d07563d6a1dc75c347c08060304f091230bd74b49ecdd13bf480db3984622a167c8603b8c501280059a7b6123c8f8cd217f64eccc2dffe4f3a1e8c9a96a13d8126f3ea26779fbd0069d729a7764d4ddd7d9d820b0de2530969362b94b974678527f5bac7eb8d6e321b2be0b2f7534634a5ecd1248d7ad7e8e03163e92e9f1d620e28597bd881eea0981e8adfd70b670b0763ce9226f7c3e156b353e22fdea6942b577bbc539aab23cbd46bdd0ea1e67140c759f208c12dc57f3100000000000000e4965fcb6c2749955eac9476687e63b41c6282bbcb0c3d8b0c9493a3a5f6d879d7257b4b68dc7cac3d9d5f5bbe937c501866ee4042b250e516ec074559e1e551167138766eeecb6941e8305d9cde1800c821536f9d25bd14163890842a08135bdb7a90db630b18f099855a7d9de65c80fa71ff90e873361d0e11a7dfebe56ffb2000b711a0b7914d6351ff60593e48af60e1ffecba7cd6f8ab662eb3c8f3164139e994d6a706afb92722595d649a04f1ff64e5634e7cb9106173a96bf47f7085e7eecdfdc1b6507b851c4ba43312726cfec58dedece1355a087c1b60882713a6161914f09267e2ce8aa886b380add5cd92e185d345c9b2933a78a4215133e8e7247fa444aee30bfb6c17ef537fba43aad323f552c01e17514d5db387e4bf9341ccf5931fc75350f8dcef3ed3e74d674865249b879466f0e3cf0dc9e3d8720ea261e6996b844501e374a0e9878c1d02fd3d6e2ae5d7677892d7a5cdf4b7fa8f315b41552d07495f034e1fa0a2c9a34b7f66638e775dacb33e9b5cd3f4193bdebb7e86090dd265ee2b3ca9bd32d19ef229a050e910263d916670d8006067f5c0a1d8219b4a74b6092656f3b96f060000005ca3eca5d6295a1c11be907fad3bf9ccdf9898a084bbcc0a3714691c6c28fc34c44f9a46d6caf3b93d5d9ad8e3a25d34da57b203af917f5359952468fcddbf43d8fd1add972fd5d361c5be3e8b3280bbfa97e9826163537c99ff461123a1d9f93880feb5f953217f1e633bfb221a7822513278c36abcb6a4009e5037b3f56f9172bd70331817862c5e129d830d4f13e9793dad49b6bf286d2a539d089393d481931735a544f4e86b51a91106ce86d278a0712eab917d843ecc7d031e99d230689210e5afbcbb0a6cff33b40e7b637a8171d7b28fcaee54bb0fb7e2dd92c6cf2130f9fa4482512ae356c5907533108113a9a98b0508e4041df8e99b4136a66f58a6e91e2017dc7e095e8e4776d396797e089e9b42fdee33e76c28a636893510ed71166086bb4c1f3363dfd0abf0b2ea8ceba68c7d9a22a8342059862985d987083d80761bd699c3ee77473263a77ea65eac8a4c3b6b87f399575a15a2db143f6aac363644fd45372d6f43baebc7c3547780d1d079e225962733e0c0d3f364cbe9bcec7caaa8d372da63b213d4554e9ced54c2d59a97b814f1d700"/3584], &(0x7f0000001840)='GPL\x00', 0x2, 0x103a, &(0x7f0000001880)=""/4096, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000002880), 0x0, 0x10, &(0x7f00000028c0), 0x2a3}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000036c0)={r0, 0x3a, 0x44, 0x0, &(0x7f0000003740)="e460cdfbef2408322900119386dd6a00000000072feb311ccd3ec8a755c1e1380081ffad008036e8d50000ff010000001400000500242f09880bd320d98a61a90021e9bf", 0x0, 0x401, 0x0, 0x327, 0x9c, &(0x7f00000037c0)="59235bd7a9324ff307d87177332368fbdeefaa1544600ea1870645446c357de433206896637019b84d57c3de1ea07638e494dd701db1af6fc15db78cf79f5ab4bc7aee8553677ffe377a35b4afdb989fb7da1ff63956ffb796d51daf1c268b9f1a4a06583f8c03ec1671b151a8a495c1b006fa5f2f3a54a46aeee8005b178b9516d2b928984ccb942fa2278a2e33a0b619f2dd814fc91942e03c48fd9b7d19d9a6612b46805b267ef3132a724cbfcd1c715be67930e2ae2b9a2479c5a4b2fecd301a745a6fd67598a5e5ecc1e56e58159c47def7f9285acfedc980596377e6f9ee076fa094e5d8f838b718ed63ff8265a1dbc1549bed03e6b27b6fc2b8a07373506a1a41d5a71cbf0eaa24ec737b02a8a2d5114c3c4e5810a2c3eae3373fd341800cfb0fb35cefe04ca4da2b02a83c40126e23cdf3c817b530bbe7b431bc0b7d864e3e6dd1ab90259a8bd7ad7dd4c6366ea6da661fd016b394adcce5988fff85fbc832a927c97b89337e195f562cd284911eef1ee52e4ff033b33beedea7cf43c4d0cc0471fa91011e1e7e8733bf82c01346d6ecb49f1a84e92d063c81a7227d89be33f7273b87e29ae53a5f38dc94cf391fcb82c9432821ef1a0f6bbfe8f7d6574479a8f621e1d8f7d9bb20f3d8d469e6d232d7d7837ff12a224a65c604907e787baaf7c863ad48a5edecbe1470c20507a6ee5dee75e9ef84c71af5af800a9ce9787ebdee9e1c8189fbf66048d5c3757fb2b697ce68cfd316a7b25a385111e0cd2fddb81602e36e74c4f99b403cb304a4774e648054c0456c7869f9d97873ff80e2664c1265292941a9b767c7f40767cfccdbcaa156453d6a910fd5440f7a2bf8f4bb6d6d9fd443f2304617a684b6afa99c157dcf70e51fdb55fd0dbf5c6733841024599f8d1791a07c5dc3a4ccaf4d7c0ca3d101b2beba3a49d2378c9fe4fdb10babd95083a0c4db5a30c4490828d97efe807a13e587fbac1089843964facfd27d287262759384fe9b610f81048be430c1e8fe6327c0f2fd003021d20563ec0c7e39aec6718649c958da2e02cb3848c76924492678889c18bea02ed5ee080106e9838cbca9ad5f66c0434182225b13a236b342cf80562c10d4a3459aea17589b84904d3d2c2b", &(0x7f0000003b00)="b33620dad49cc786c86a5c5444e76c2a1ef9224fb91083d2ba4368e98a14467703e9ee585196fa95320bd53c6a76ad443b81dc833b22016aeaafb4597c06919ecf7e5ea4d0a8995feaaf9a9feb0c4b5277398049a2f5475f6ceb26bd128189f4b1b3c662d3d1630717791de0cdac3ce6e01c5719b670da5ded7dfa9dda53f04ad151cb952d708eaa69e983dcfab36b2dac3f3fe85e1d86b3d73d4879", 0x1, 0xfffffffd}, 0x50) 2.899450613s ago: executing program 6 (id=2644): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000b40), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000b80)={'syzkaller0\x00', 0x4001}) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000e80)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000f80)={'syzkaller0\x00', 0x1}) r2 = socket$inet_sctp(0x2, 0x1, 0x84) bind(r2, &(0x7f0000000fc0)=@in={0x2, 0x3210, @rand_addr=0xac140001}, 0x10) listen(r2, 0x5) write$tun(r0, 0x0, 0x4a) 1.785409901s ago: executing program 4 (id=2645): mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000600)='./proc\x00', &(0x7f0000000640)='proc\x00', 0x4000, 0x0) write(0xffffffffffffffff, &(0x7f00000006c0)='27', 0x2) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x4000, 0x0) 1.785069991s ago: executing program 2 (id=2646): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000700)=ANY=[@ANYBLOB="3c0200001900010025bd700001000000fe8800000000000000000000000000010000000000000000000000200000000000000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000001000000000000000000000000000000900000000000000000000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000040800000000000000000000000000000002000000000000010001000000000084010500ac1414aa00000000000000000000000000000000330000000000000064010100000000000000000000000000ff340000000000000000000000000000402000007f000001000000000000000000000000000020003c00000002000000fe80000000000000000000000000000000000000000000000000000000000000000000007f000001000000000000000000000000000000006c00000000000000e00000010000000000000000000000000000000000000000000000000000000000000000ac14144300000000000000000000020000000000330000000200000000000000000000000000ffffac1414aa000000000001000000000000000000000000000020010000000000000000000000000000000004d26c00000000000000ac14142400000000000000000000000000000000000000000c0000000000000000000000ac1e0101000000000000000000000000000004d233"], 0x23c}, 0x1, 0x0, 0x0, 0x1}, 0x4000) r1 = socket$kcm(0xa, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x1c, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000000000000851000000600000018"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x20}, 0x94) sendmsg$inet(r1, 0x0, 0x40400c4) 1.784842461s ago: executing program 1 (id=2647): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f0000000480)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f00000005c0)='3', 0x4e) setns(0xc9, 0x0) 1.784060761s ago: executing program 4 (id=2650): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000440)={0x30, 0x2, 0x6, 0x5, 0x0, 0x3000000, {0x0, 0x0, 0xfffd}, [@IPSET_ATTR_TYPENAME={0xe, 0x3, 'bitmap:ip\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}]}, 0x30}}, 0x0) unshare(0x20000400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000600)={0x2, &(0x7f0000000640)=[{0x20, 0x0, 0x0, 0x6d8d}, {0x6}]}, 0x10) sendmmsg$inet(r1, &(0x7f0000000980)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000a00)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) syz_emit_ethernet(0xda, &(0x7f0000000880)=ANY=[], 0x0) write(r0, &(0x7f0000000040)="2000000014000504010000000000000023000000010000000500020008000000", 0x20) r3 = socket$phonet(0x23, 0x2, 0x1) r4 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r4, &(0x7f00000000c0)={0x23, 0x1, 0x8}, 0x10) connect$phonet_pipe(r4, &(0x7f0000000100)={0x23, 0x2, 0x8}, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x4) setsockopt$PNPIPE_ENCAP(r4, 0x113, 0x1, 0x0, 0x0) sendto$phonet(r3, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, 0x0, 0x24008000) connect$netlink(r5, 0x0, 0x0) sendto$phonet(r3, &(0x7f0000000400)="0020010000004500002800004000400600007f0000017f0000", 0x19, 0x0, &(0x7f0000000340)={0x23, 0x1, 0x8}, 0x10) 1.783817721s ago: executing program 2 (id=2651): openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing\x00', 0x0) mount(0x0, &(0x7f0000000180)='./tracing\x00', &(0x7f00000001c0)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000007c0)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r0, 0x0, 0x0) 1.783597271s ago: executing program 1 (id=2652): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) openat$tun(0xffffffffffffff9c, 0x0, 0x80200, 0x0) write$tun(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="0800080006000900000014000000458263073068a13adee45cd4079c17fec518d773d946fafccaebe449d135d8748f6ab3d5be33c1d31440ff325e00b7353ce64b0fa7fad22d8e6b6295a1926084cb8c4bbe73d7ef10632ae3f8a5315017be5c749ad156beda1f93d8"], 0xfce) 1.783406191s ago: executing program 2 (id=2653): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) bpf$MAP_CREATE(0x0, 0x0, 0x0) r1 = syz_create_resource$binfmt(&(0x7f0000000000)='./file0\x00') r2 = openat$binfmt(0xffffffffffffff9c, r1, 0x41, 0x1ff) fcntl$setlease(r2, 0x400, 0x1) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)=ANY=[@ANYBLOB="140000"], &(0x7f0000000000), 0x0) open_by_handle_at(0xffffffffffffff9c, &(0x7f00000000c0)=ANY=[], 0x0) 1.662636854s ago: executing program 6 (id=2654): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x1}) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'syzkaller1\x00', 0x0}) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', 0x1}) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@newtfilter={0x3c, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xb, 0x7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x8, 0x2, [@TCA_MATCHALL_ACT={0x4}]}}]}, 0x3c}}, 0x20044080) write(r1, &(0x7f0000000340)="000008004500001c123400004011e5c8ac141401ac141402", 0x18) 1.558191015s ago: executing program 7 (id=2655): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r1 = accept(r0, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, &(0x7f00000002c0)=0x80) sendmsg$nl_route(r1, 0x0, 0x84) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000700)={0xa, 0x4e22, 0xfffffffc, @empty, 0x7}, 0x1c) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000740), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000780)={0x0, 0x0, &(0x7f00000007c0)={&(0x7f0000000800)={0x38, r4, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e23}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @multicast1=0xac1414aa}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}]}]}, 0x38}}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xb, &(0x7f0000000200)=0x7, 0x4) getsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x6, &(0x7f0000000240)=""/19, &(0x7f0000000280)=0x13) listen(r2, 0xc) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r5, &(0x7f0000000840)={0x2, 0x4e22, @local}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0x6, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="230000000800000002"], 0x48) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x1, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0xc, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000000000000000000000000000611800000000000018110000", @ANYBLOB="0000000000000000150802000000000018110000", @ANYRES32=r8], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0x14, &(0x7f00000006c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000ac0), 0xc) sendmsg$nl_route_sched(r7, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000980), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r6, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000a40)=ANY=[@ANYBLOB, @ANYRES16=r9, @ANYBLOB="010021fa7100ffdbdf2504000400"], 0x14}, 0x1, 0x0, 0x0, 0x20048001}, 0x800) 1.339806358s ago: executing program 1 (id=2656): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r0) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000007c0)=@newqdisc={0x60, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x34, 0x2, [@TCA_TBF_PARMS={0x28, 0x1, {{0x5, 0x1, 0x5, 0xd, 0xd9, 0x10}, {0x0, 0x2, 0x5, 0x3, 0x1}, 0x2, 0x5, 0x8d0}}, @TCA_TBF_BURST={0x8, 0x6, 0x10001}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r2, {0x0, 0xd}, {0x0, 0xb}, {0xffff, 0xfff2}}, [@qdisc_kind_options=@q_blackhole={0xe}]}, 0x34}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4854) ioctl$SIOCSIFHWADDR(r0, 0x8914, 0x0) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r5, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200591114120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 1.271147336s ago: executing program 4 (id=2657): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0xc, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, [@call={0x85, 0x0, 0x0, 0xf}, @printk={@d, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xffffffff}, {0x85, 0x0, 0x0, 0x17}}]}, 0x0}, 0x94) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x6, 0xc, &(0x7f0000000140)=ANY=[], &(0x7f0000001900)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xe, 0x0, &(0x7f0000000300)="0101000071a78326c799dbe888a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 1.236474849s ago: executing program 7 (id=2658): mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x1, 0x32, 0xffffffffffffffff, 0xa2fac000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000016c0)={0x11, 0x13, &(0x7f0000001780)=ANY=[@ANYBLOB="18080000000000000000000010f00000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000200000006600020080ffffff18000000fffffffe00000000000010009500040000000000360a020000000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50afdff0000000085000000060000009500000000000000"], &(0x7f0000001840)='GPL\x00', 0x2, 0xff5c, &(0x7f0000001880)=""/222}, 0x78) 911.990404ms ago: executing program 4 (id=2659): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000001840)={0x0, 0x0, &(0x7f0000001880)=[{&(0x7f00000018c0)=ANY=[@ANYBLOB="180000001200090502000000000000000800a280040046"], 0x18}], 0x1}, 0x40040) 824.727333ms ago: executing program 6 (id=2660): setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, 0x0, 0x0) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0x19, &(0x7f0000000e80)=0x94b, 0x4) syz_emit_ethernet(0x6e, &(0x7f0000000f80)={@broadcast, @random="5aeadd61229e", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "cb8000", 0x38, 0x3a, 0xff, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x29}}, @mcast2, {[], @time_exceed={0x4, 0x2, 0x0, 0x8, '\x00', {0x0, 0x6, "f9986e", 0x800, 0x3a, 0xff, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @loopback, [], "af34000000000000"}}}}}}}, 0x0) recvmmsg(r0, &(0x7f0000000f40)=[{{0x0, 0x0, 0x0}, 0x6}], 0x1, 0x400121a0, 0x0) 817.801974ms ago: executing program 7 (id=2661): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000d00)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000000400ae"], 0x18}}, 0xc010) recvmmsg(r0, &(0x7f0000000d40)=[{{0x0, 0x0, &(0x7f0000000e40)=[{&(0x7f0000000ec0)=""/153, 0x99}, {&(0x7f0000001600)=""/4140, 0x102c}, {&(0x7f0000000000)=""/188, 0xbc}, {&(0x7f0000002700)=""/122, 0x7a}, {&(0x7f0000003840)=""/4121, 0x1019}, {&(0x7f00000037c0)=""/80, 0x50}], 0x6}, 0x401}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x38000000}, {{0x0, 0x0, 0x0}, 0x4}], 0x4, 0x40000102, 0x0) 668.05122ms ago: executing program 2 (id=2662): r0 = socket(0xa, 0x3, 0xff) setsockopt$inet6_int(r0, 0x29, 0x5, &(0x7f0000000300)=0xfffffff9, 0x4) syz_emit_ethernet(0x4e, &(0x7f0000000340)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa3986dd6c370c8900182b01fe800000000000000000000000000025fe8000000000000000000000000000aaff"], 0x0) recvmmsg(r0, &(0x7f00000003c0)=[{{0x0, 0x0, 0x0}, 0x2}], 0x1, 0x40010060, 0x0) 666.4967ms ago: executing program 4 (id=2663): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$MAP_CREATE(0x0, 0x0, 0x0) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1100000004000000040000000500000000000000", @ANYRES32, @ANYBLOB="0600"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000009fd81857b7cd2750eea3a61d5d4a6c73c4dba75bc5aa7c4afd65978f1fb1590e014242a856d9757c4aa7eede62168f4159b9538083d137ab5bace84df4fdb916e0ea877eae79ed19b6af44f26563e906cfdbf02cc94ee4bc7671c0d86ab7b6aa51ab3dfd3fef8b8162f5d5f3bc470ab7b3e5ecaa2ddfe6f2425dd6a27cdcce3044c47a30ea29301da4c7fb2f6ac26cd6522b58290f4108745e794ff830b77913bce14370ba34b2c9e9e2acb03ea7c9c2d7e3c3f1d884f08d09e0af9e135ac482307f5fa469484b510000000000"], 0x50) bind(r0, &(0x7f0000000000)=@hci={0x1f, 0xffff, 0x3}, 0x6) write(0xca, &(0x7f0000000040)="040e0c01031000ffffffffff40ffff", 0xf) write(0xca, &(0x7f0000000060)="040e0c01032000ffffffffffffffff", 0xf) write(0xca, &(0x7f0000000080)="040e0a01602000fb00", 0x9) nanosleep(0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000280)='4\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00', 0xd) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x41, &(0x7f0000000200)=0x5dbd, 0x4) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, &(0x7f00000004c0)=ANY=[@ANYRES16=r1], 0xffffffffffffff6c}, 0x0) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x0) recvmmsg(r2, &(0x7f0000000340)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=""/33, 0x21}, 0x4}], 0x3d5, 0x45833af92e4b38ff, 0x0) nanosleep(&(0x7f0000000300)={0x0, 0x989680}, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) r4 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f00000000c0)=@assoc_value={0x0}, &(0x7f0000000140)=0x4) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f00000003c0)={r5, @in={{0x2, 0x4e21, @local}}, 0x9591, 0x3, 0x40, 0xe3e, 0x96, 0x9, 0x7}, &(0x7f00000005c0)=0x9c) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000180)={r5, 0x3ff, 0x30, 0xe304, 0x1}, &(0x7f0000000380)=0x18) r6 = syz_init_net_socket$bt_hci(0x1f, 0x5, 0x8) setsockopt$sock_timeval(r6, 0x1, 0x15, &(0x7f0000000100)={0x0, 0x3e8}, 0x10) connect(r6, &(0x7f0000000200)=@un=@file={0x1f, '\x00\x00\x00\x00\x00\x00\x01\x00'}, 0xa) 567.96618ms ago: executing program 6 (id=2664): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000700)=ANY=[@ANYBLOB="3c0200001900010025bd700001000000fe8800000000000000000000000000010000000000000000000000200000000000000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000001000000000000000000000000000000900000000000000000000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000040800000000000000000000000000000002000000000000010001000000000084010500ac1414aa00000000000000000000000000000000330000000000000064010100000000000000000000000000ff340000000000000000000000000000402000007f000001000000000000000000000000000020003c00000002000000fe80000000000000000000000000000000000000000000000000000000000000000000007f000001000000000000000000000000000000006c00000000000000e00000010000000000000000000000000000000000000000000000000000000000000000ac14144300000000000000000000020000000000330000000200000000000000000000000000ffffac1414aa000000000001000000000000000000000000000020010000000000000000000000000000000004d26c00000000000000ac14142400000000000000000000000000000000000000000c0000000000000000000000ac1e0101000000000000000000000000000004d233"], 0x23c}, 0x1, 0x0, 0x0, 0x1}, 0x4000) r1 = socket$kcm(0xa, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000500)={0x1c, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000000000000851000000600000018"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x20}, 0x94) sendmsg$inet(r1, 0x0, 0x40400c4) 567.67938ms ago: executing program 1 (id=2665): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="780000001000030400000000000000", @ANYRES32=0x0, @ANYBLOB="00000000600000005800128008000100677470004c00028008000100", @ANYRES32=r1], 0x78}, 0x1, 0x0, 0x0, 0x24008040}, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) r3 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f00000005c0)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x2, 0x0, 0x2b}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x1f, 0x31, 0x66, 0x0, 0x40, 0x11, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x16}}, {0x4e20, 0x4e20, 0x1d, 0x0, @opaque="062eb58cc2bdf9b4ec5b3d17e07b8af2cdb9964232"}}}, 0x3f) 567.49814ms ago: executing program 7 (id=2666): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000180)='27', 0x2) add_key(&(0x7f0000000200)='asymmetric\x00', 0x0, &(0x7f0000000340), 0x0, 0xffffffffffffffff) 476.01108ms ago: executing program 7 (id=2667): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f0000000480)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f00000005c0)='3', 0x4e) setns(0xc9, 0x0) 431.090745ms ago: executing program 2 (id=2668): openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x42, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing\x00', 0x0) mount(0x0, &(0x7f0000000180)='./tracing\x00', &(0x7f00000001c0)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000007c0)='./tracing/uprobe_events\x00', 0x401, 0x0) write(r0, 0x0, 0x0) 293.727919ms ago: executing program 6 (id=2669): r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000740)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f00000007c0)={0x1d, r1}, 0x18) setsockopt$SO_J1939_ERRQUEUE(r0, 0x6b, 0x4, &(0x7f0000000800)=0x1, 0x4) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000840)={'vcan0\x00', 0x0}) r4 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r4, &(0x7f0000000880)={0x1d, r3, 0x0, {0x0, 0x0, 0x4}, 0xfe}, 0x18) sendmsg$can_j1939(r4, &(0x7f00000008c0)={&(0x7f0000000900), 0x18, &(0x7f0000000940)={&(0x7f0000000980)="4dfb0cf0d556f1327d", 0x9}, 0x1, 0x0, 0x0, 0x40000}, 0x4406f) sendmsg$nl_route_sched(r2, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000a40)=@newtfilter={0x24, 0x11, 0x111, 0x70bd27, 0x100000, {0x0, 0x0, 0x74, r3, {0x6, 0xc}, {0x5, 0x10}, {0x6, 0xc}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x4010}, 0xc4) 293.282239ms ago: executing program 2 (id=2670): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x1}) r2 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'syzkaller1\x00', 0x0}) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'syzkaller1\x00', 0x1}) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@newtfilter={0x68, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0xb, 0x7}, {0xfff1, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x34, 0x2, [@TCA_MATCHALL_ACT={0x30, 0x2, [@m_ct={0x2c, 0x1, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}}]}, 0x68}}, 0x20044080) write(r1, &(0x7f0000000340)="000008004500001c123400004011e5c8ac141401ac141402", 0x18) 292.404109ms ago: executing program 7 (id=2671): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) openat$tun(0xffffffffffffff9c, 0x0, 0x80200, 0x0) write$tun(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="0800080006000900000014000000458263073068a13adee45cd4079c17fec518d773d946fafccaebe449d135d8748f6ab3d5be33c1d31440ff325e00b7353ce64b0fa7fad22d8e6b6295a1926084cb8c4bbe73d7ef10632ae3f8a5315017be5c749ad156beda1f93d8"], 0xfce) 9.264329ms ago: executing program 4 (id=2672): sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000005f40)=[{&(0x7f0000000300)=ANY=[], 0x440}, {0x0}], 0x2, 0x0, 0x0, 0x14000845}, 0x48024) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8b30, &(0x7f0000000040)={'wlan0\x00'}) 0s ago: executing program 1 (id=2682): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000200)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000280), 0x651, 0x0) recvmmsg(r1, &(0x7f00000002c0), 0x10106, 0x2, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_SET(r3, 0x4b72, &(0x7f0000000300)={0x0, 0x20000, 0x8, 0x2, 0x200, &(0x7f0000000340)="1ae19337aa151f36ae49bb3f8cb95c5bf840d4f1e55efaaf098d47a70eb36a73090000000000001b0f4743f490c585108c1331c7749299a25a705f5096cb268cbc6070d680e1be250700000000000000472471ff550c0010000007f3c7b61abe4162256004ea8ca5e5b5f379c6eb3257eda08f7e6959090000004d13184d382747e035b4722525e00ade86b4c6d1e157c75d15c1f961ebc0a64d7f2a73f8979fcecacaa64f9b9069ebcc1d5b471edbc4f6c7f1b98ae74e909aa6f25b7fa77bf9cd4ed36d5c53dc519d11c3cc1c22a3b86cf3c645413f4afbcea0c99ded703699d2bb6a4a663b99b6069da5aaf64785a5887c31261d4b9e57ee07000000def6f255ca26108f11f02047d47f2d0fec30f7e92482f71496e184214a4e0c5fdc48b0af0c0478940016d8f0990a0e1090fd515380aae83c5eaeed338701574b64200a16ef2811fadcf1e0f49a514df529061e09ce45e3da03a03fe9b4a6bcfa7d04594e4f6d0714a2e14ea127ab37d64a5e0db630cd4f4a2e6c985a542ff20a9b2193f265f93a258a88dd6c9d6a926dd23d32425849c5d9210007660a617f22133b6cb5087f4c6057942aa18193172bd995fa70a1f949b196f2e2a3c175858575713be5ee3f7f4dcecc98123f9ded3afdebe13d79a7f7fcb2469ae0ac503111401612df7ee995f74fb97a63bf62d61f78c062f959119ab50c1f706a930121ebcd53ccb93d158186ed360750ca8e728150d988844b9a5cff46591ccaff416e5a8c25f9555da5ca6fdf75b86ea6171b046b856168f403b5253a5cc393430a09a4489a0895571e597ac8846f945ffb372a88d3a25978b463dc961416c80c55773f917020751ed51cfd73c1e06fbadd156d56bedc117af95d242d6dccbe2ce34dccd6005e944afa92b22ec9a698469c6edc06caa2cfcd61912607d459b4c28ebea9745bcd4697d75c9601fd333d3cd797963a3c71b7cc5fdc756da8d97207936e5f53b53b732533c2722e03002293517966611602f297de6ff5408777b7a93c45cee3ee5c5601a4e94266b295ea7a86812a7ab8896ec5ea1b12643e1844b185734528399e62bceb8700cc6cd491e4a4430d0a3ba329a5a2fa170fd0b1cc4ba8294de988cd35df2cd7344aa8a9f3432b96fb889c02f484f635a0cc3466a3c2733d45f176931b2db18dba54991a9553cedb7f585786388d4042dbae1c95b769e3d4e036e8afea0a04c04f542b152ca1fd1f8efee60425c5a122fd1b90e98635284abd9f217d9e19cb2a64b354c9d79509cc47d7305114990148a7291cb0fe2d1c773a6664b66ae04aa62c534d072ae54c2ca0d5962cc58945d8924abfc4d5af922462507430d8f2c17479a6678b0b3700000000000000000000000000000000000000000000f800"}) kernel console output (not intermixed with test programs): 0007fa741e26038 R14: 00007fa741e25fa0 R15: 00007ffee326e798 [ 271.703024][ T7899] [ 271.838831][ T7885] EXT4-fs (loop0): unmounting filesystem. [ 271.898808][ T7906] loop2: detected capacity change from 0 to 512 [ 272.012982][ T7906] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 272.058496][ T7906] EXT4-fs (loop2): 1 truncate cleaned up [ 272.158015][ T7906] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 272.662116][ T26] audit: type=1326 audit(1793335419.049:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7905 comm="syz.2.922" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec9ed9f559 code=0x7ffc0000 [ 273.080061][ T26] audit: type=1326 audit(1793335419.709:53): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7905 comm="syz.2.922" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec9ed9f559 code=0x7ffc0000 [ 273.232521][ T26] audit: type=1326 audit(1793335419.709:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7905 comm="syz.2.922" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec9ed9f559 code=0x7ffc0000 [ 273.304473][ T7922] loop6: detected capacity change from 0 to 1024 [ 273.331841][ T26] audit: type=1326 audit(1793335419.709:55): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7905 comm="syz.2.922" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7fec9ed9f559 code=0x7ffc0000 [ 273.365169][ T4282] EXT4-fs (loop2): unmounting filesystem. [ 273.451792][ T7922] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 273.511973][ T7922] ext4 filesystem being mounted at /87/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 273.547360][ T26] audit: type=1326 audit(1793335419.709:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7905 comm="syz.2.922" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec9ed9f559 code=0x7ffc0000 [ 273.681822][ T26] audit: type=1326 audit(1793335419.709:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7905 comm="syz.2.922" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec9ed9f559 code=0x7ffc0000 [ 273.739737][ T5797] EXT4-fs (loop6): unmounting filesystem. [ 273.766588][ T26] audit: type=1326 audit(1793335419.709:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7905 comm="syz.2.922" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec9ed9f559 code=0x7ffc0000 [ 273.905368][ T26] audit: type=1326 audit(1793335419.709:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7905 comm="syz.2.922" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fec9ed9f559 code=0x7ffc0000 [ 274.040437][ T26] audit: type=1326 audit(1793335419.709:60): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7905 comm="syz.2.922" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=316 compat=0 ip=0x7fec9ed9f559 code=0x7ffc0000 [ 274.166637][ T26] audit: type=1326 audit(1793335419.779:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7905 comm="syz.2.922" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fec9ed5fd8e code=0x7ffc0000 [ 274.266153][ T7944] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(4) [ 274.272752][ T7944] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 274.293046][ T7944] vhci_hcd vhci_hcd.0: Device attached [ 274.491828][ T4738] vhci_hcd: vhci_device speed not set [ 274.561849][ T4738] usb 37-1: new full-speed USB device number 3 using vhci_hcd [ 274.958524][ T7945] vhci_hcd: connection reset by peer [ 274.966740][ T58] vhci_hcd: stop threads [ 274.971036][ T58] vhci_hcd: release socket [ 275.004829][ T58] vhci_hcd: disconnect device [ 275.671429][ T7986] net_ratelimit: 65 callbacks suppressed [ 275.671446][ T7986] IPVS: lblcr: FWM 3 0x00000003 - no destination available [ 276.123479][ T8000] device syzkaller0 entered promiscuous mode [ 276.144685][ T8000] tipc: Started in network mode [ 276.155370][ T8000] tipc: Node identity beb5149d7434, cluster identity 4711 [ 276.229033][ T8000] tipc: Enabled bearer , priority 0 [ 276.292553][ T7999] tipc: Resetting bearer [ 276.412679][ T7999] tipc: Disabling bearer [ 276.641664][ T8012] FAULT_INJECTION: forcing a failure. [ 276.641664][ T8012] name failslab, interval 1, probability 0, space 0, times 0 [ 276.683224][ T8012] CPU: 1 PID: 8012 Comm: syz.1.954 Not tainted syzkaller #0 [ 276.690601][ T8012] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 276.700700][ T8012] Call Trace: [ 276.704016][ T8012] [ 276.706966][ T8012] dump_stack_lvl+0x188/0x24e [ 276.711678][ T8012] ? show_regs_print_info+0x12/0x12 [ 276.711704][ T8012] ? load_image+0x410/0x410 [ 276.711737][ T8012] ? __might_sleep+0xd0/0xd0 [ 276.711761][ T8012] ? __lock_acquire+0x7ea0/0x7ea0 [ 276.721489][ T8012] ? __dynamic_pr_debug+0x196/0x240 [ 276.731142][ T8012] should_fail_ex+0x390/0x4c0 [ 276.741056][ T8012] should_failslab+0x5/0x20 [ 276.741083][ T8012] slab_pre_alloc_hook+0x59/0x300 [ 276.741117][ T8012] ? __register_sysctl_table+0xee/0xed0 [ 276.750649][ T8012] __kmem_cache_alloc_node+0x4f/0x270 [ 276.761585][ T8012] ? __register_sysctl_table+0xee/0xed0 [ 276.761630][ T8012] __kmalloc+0xa3/0x240 [ 276.771344][ T8012] __register_sysctl_table+0xee/0xed0 [ 276.771382][ T8012] ? register_net_sysctl+0x303/0x370 [ 276.782044][ T8012] neigh_sysctl_register+0x9a2/0xa80 [ 276.782080][ T8012] ? neigh_proc_dointvec_ms_jiffies+0x50/0x50 [ 276.793460][ T8012] addrconf_sysctl_register+0xac/0x1b0 [ 276.793501][ T8012] ipv6_add_dev+0xbd4/0x1110 [ 276.803575][ T8012] addrconf_notify+0x634/0xf60 [ 276.803613][ T8012] ? ip6mr_device_event+0x1dd/0x200 [ 276.813592][ T8012] ? raw_notifier_call_chain+0xa3/0x160 [ 276.819173][ T8012] raw_notifier_call_chain+0xcb/0x160 [ 276.819211][ T8012] register_netdevice+0x16a8/0x1b80 [ 276.829795][ T8012] ? netif_stacked_transfer_operstate+0x200/0x200 [ 276.829832][ T8012] ? alloc_netdev_mqs+0xb56/0xf10 [ 276.841258][ T8012] ? validate_linkmsg+0x3db/0x4c0 [ 276.841299][ T8012] ? rtnl_create_link+0x905/0xb90 [ 276.851645][ T8012] ? batadv_softif_validate+0x70/0x70 [ 276.857059][ T8012] rtnl_newlink+0x14b3/0x1f90 [ 276.861805][ T8012] ? rtnl_setlink+0x510/0x510 [ 276.866566][ T8012] ? trace_raw_output_contention_end+0xd0/0xd0 [ 276.866610][ T8012] ? rcu_is_watching+0x11/0xa0 [ 276.877538][ T8012] ? trace_contention_end+0x5f/0x170 [ 276.882852][ T8012] ? __mutex_lock+0x1ab/0xae0 [ 276.882891][ T8012] ? rcu_read_unlock+0x8c/0xa0 [ 276.892352][ T8012] ? rtnl_setlink+0x510/0x510 [ 276.892386][ T8012] rtnetlink_rcv_msg+0x863/0xfb0 [ 276.902006][ T8012] ? rtnetlink_rcv_msg+0x220/0xfb0 [ 276.902047][ T8012] ? rtnetlink_bind+0x80/0x80 [ 276.911922][ T8012] ? __local_bh_enable_ip+0x136/0x1c0 [ 276.911949][ T8012] ? lockdep_hardirqs_on+0x94/0x140 [ 276.911980][ T8012] ? __local_bh_enable_ip+0x136/0x1c0 [ 276.922537][ T8012] ? _local_bh_enable+0xa0/0xa0 [ 276.922569][ T8012] ? __dev_queue_xmit+0x281/0x3810 [ 276.932842][ T8012] ? __dev_queue_xmit+0x281/0x3810 [ 276.932873][ T8012] ? __dev_queue_xmit+0x1d84/0x3810 [ 276.932906][ T8012] ? __dev_queue_xmit+0x281/0x3810 [ 276.943147][ T8012] ? ref_tracker_free+0x682/0x830 [ 276.953485][ T8012] ? refcount_inc+0x70/0x70 [ 276.953518][ T8012] ? memcpy+0x3c/0x60 [ 276.953544][ T8012] ? __copy_skb_header+0x3ba/0x4f0 [ 276.963090][ T8012] ? __skb_clone+0x446/0x6c0 [ 276.963130][ T8012] netlink_rcv_skb+0x1ef/0x440 [ 276.972223][ T8012] ? rtnetlink_bind+0x80/0x80 [ 276.972262][ T8012] ? netlink_ack+0x1160/0x1160 [ 276.981622][ T8012] ? netlink_deliver_tap+0x2e/0x1b0 [ 276.991069][ T8012] netlink_unicast+0x7ad/0x920 [ 277.001061][ T8012] netlink_sendmsg+0x8ad/0xbd0 [ 277.001109][ T8012] ? netlink_getsockopt+0x550/0x550 [ 277.011071][ T8012] ? apparmor_socket_sendmsg+0x8a/0x330 [ 277.011112][ T8012] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 277.021946][ T8012] ? security_socket_sendmsg+0x7c/0xa0 [ 277.021982][ T8012] ? netlink_getsockopt+0x550/0x550 [ 277.032653][ T8012] ____sys_sendmsg+0x5ed/0x9a0 [ 277.032703][ T8012] ? __sys_sendmsg_sock+0x30/0x30 [ 277.042499][ T8012] ? __import_iovec+0x306/0x510 [ 277.042544][ T8012] ? import_iovec+0x6f/0xa0 [ 277.042599][ T8012] ___sys_sendmsg+0x2a2/0x360 [ 277.051951][ T8012] ? __sys_sendmsg+0x2a0/0x2a0 [ 277.052127][ T8012] __se_sys_sendmsg+0x1c3/0x2b0 [ 277.061431][ T8012] ? __x64_sys_sendmsg+0x80/0x80 [ 277.071255][ T8012] ? lockdep_hardirqs_on+0x94/0x140 [ 277.071303][ T8012] do_syscall_64+0x4c/0xa0 [ 277.080954][ T8012] ? clear_bhb_loop+0x60/0xb0 [ 277.080984][ T8012] ? clear_bhb_loop+0x60/0xb0 [ 277.090347][ T8012] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 277.090388][ T8012] RIP: 0033:0x7fa741b9f559 [ 277.100704][ T8012] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 277.100727][ T8012] RSP: 002b:00007fa742993028 EFLAGS: 00000246 [ 277.120427][ T8012] ORIG_RAX: 000000000000002e [ 277.131188][ T8012] RAX: ffffffffffffffda RBX: 00007fa741e25fa0 RCX: 00007fa741b9f559 [ 277.131210][ T8012] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000005 [ 277.147168][ T8012] RBP: 00007fa741c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 277.147187][ T8012] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 277.147202][ T8012] R13: 00007fa741e26038 R14: 00007fa741e25fa0 R15: 00007ffee326e798 [ 277.163181][ T8012] [ 277.235834][ T8015] netlink: 16 bytes leftover after parsing attributes in process `syz.6.955'. [ 277.263235][ T8015] bond0: option lp_interval: invalid value (18446744073709551612) [ 277.289097][ T8015] bond0: option lp_interval: allowed values 1 - 2147483647 [ 277.927426][ T8030] netlink: 20 bytes leftover after parsing attributes in process `syz.6.962'. [ 278.210084][ T8036] device syzkaller0 entered promiscuous mode [ 278.243812][ T8036] tipc: Enabled bearer , priority 0 [ 278.281971][ T8036] tipc: Resetting bearer [ 278.303892][ T8035] tipc: Resetting bearer [ 278.336857][ T8035] tipc: Disabling bearer [ 278.647429][ T8048] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 278.654046][ T8048] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 278.678215][ T8048] vhci_hcd vhci_hcd.0: Device attached [ 278.872082][ T4351] vhci_hcd: vhci_device speed not set [ 278.952449][ T4351] usb 35-1: new full-speed USB device number 6 using vhci_hcd [ 278.966309][ T8049] vhci_hcd: connection closed [ 278.975330][ T58] vhci_hcd: stop threads [ 278.980519][ T58] vhci_hcd: release socket [ 279.009251][ T58] vhci_hcd: disconnect device [ 279.695964][ T4738] vhci_hcd: vhci_device speed not set [ 279.705381][ T8077] Driver unsupported XDP return value 0 on prog (id 39) dev N/A, expect packet loss! [ 280.738316][ T8090] net_ratelimit: 70 callbacks suppressed [ 280.738328][ T8090] IPVS: lblcr: FWM 3 0x00000003 - no destination available [ 284.092273][ T4351] vhci_hcd: vhci_device speed not set [ 284.841631][ T8177] loop2: detected capacity change from 0 to 512 [ 284.863983][ T8177] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 284.891205][ T8177] EXT4-fs (loop2): 1 truncate cleaned up [ 284.903888][ T8177] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 285.654241][ T8200] device syzkaller0 entered promiscuous mode [ 285.695562][ T8200] tipc: Enabled bearer , priority 0 [ 285.762784][ T8199] tipc: Resetting bearer [ 285.883656][ T8199] tipc: Disabling bearer [ 286.100245][ T4282] EXT4-fs (loop2): unmounting filesystem. [ 286.332005][ C1] net_ratelimit: 45 callbacks suppressed [ 287.981230][ T8257] loop4: detected capacity change from 0 to 2048 [ 288.094262][ T8256] device syzkaller0 entered promiscuous mode [ 288.138065][ T8257] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 288.163011][ T8256] tipc: Enabled bearer , priority 0 [ 288.205595][ T8253] tipc: Resetting bearer [ 288.350913][ T8253] tipc: Disabling bearer [ 288.454890][ T4275] EXT4-fs (loop4): unmounting filesystem. [ 289.639867][ T8301] syz.4.1036 (8301): drop_caches: 2 [ 289.790043][ T8304] device syzkaller0 entered promiscuous mode [ 289.843168][ T8304] tipc: Enabled bearer , priority 0 [ 289.884343][ T8303] tipc: Resetting bearer [ 289.983907][ T8314] loop2: detected capacity change from 0 to 128 [ 289.993020][ T8303] tipc: Disabling bearer [ 290.083312][ T8314] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 290.093165][ T8314] ext4 filesystem being mounted at /226/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 290.204502][ T8314] EXT4-fs (loop2): unmounting filesystem. [ 290.598117][ T8325] device syzkaller0 entered promiscuous mode [ 290.630099][ T8325] tipc: Enabled bearer , priority 0 [ 290.684775][ T8325] tipc: Resetting bearer [ 290.720206][ T8324] tipc: Resetting bearer [ 290.838459][ T8324] tipc: Disabling bearer [ 291.745301][ C1] net_ratelimit: 67 callbacks suppressed [ 292.614360][ T8355] device syzkaller0 entered promiscuous mode [ 292.679955][ T8355] tipc: Enabled bearer , priority 0 [ 292.764867][ T8354] tipc: Resetting bearer [ 292.945802][ T8354] tipc: Disabling bearer [ 293.684015][ T8384] device syzkaller0 entered promiscuous mode [ 293.734220][ T8379] tipc: Enabled bearer , priority 0 [ 293.772285][ T50] Bluetooth: hci5: command 0x0406 tx timeout [ 293.805459][ T8381] tipc: Resetting bearer [ 293.890803][ T8377] tipc: Resetting bearer [ 293.911929][ T8388] loop0: detected capacity change from 0 to 128 [ 294.024841][ T8388] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 294.035599][ T8377] tipc: Disabling bearer [ 294.073841][ T8388] ext4 filesystem being mounted at /220/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 294.410372][ T8388] EXT4-fs (loop0): unmounting filesystem. [ 294.453308][ T8395] loop6: detected capacity change from 0 to 128 [ 295.242637][ T8415] syz.2.1077 (8415): drop_caches: 2 [ 296.212709][ T8417] device syzkaller0 entered promiscuous mode [ 296.258683][ T8417] tipc: Enabled bearer , priority 0 [ 296.801865][ C0] net_ratelimit: 70 callbacks suppressed [ 296.801882][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 296.816406][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 296.941810][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 296.950071][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 296.968660][ T8416] tipc: Resetting bearer [ 297.086876][ T8435] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 297.158115][ T8416] tipc: Disabling bearer [ 298.061270][ T8443] random: crng reseeded on system resumption [ 298.794787][ T8467] syz.0.1089 (8467): drop_caches: 2 [ 300.093280][ T8480] device syzkaller0 entered promiscuous mode [ 300.125572][ T8480] tipc: Enabled bearer , priority 0 [ 300.368326][ T8479] tipc: Resetting bearer [ 300.511545][ T8479] tipc: Disabling bearer [ 301.812401][ T8514] syz.1.1103 (8514): drop_caches: 2 [ 302.021774][ C0] net_ratelimit: 62 callbacks suppressed [ 302.743279][ T8520] FAULT_INJECTION: forcing a failure. [ 302.743279][ T8520] name failslab, interval 1, probability 0, space 0, times 0 [ 302.842348][ T8520] CPU: 1 PID: 8520 Comm: syz.4.1105 Not tainted syzkaller #0 [ 302.849866][ T8520] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 302.860000][ T8520] Call Trace: [ 302.863313][ T8520] [ 302.863326][ T8520] dump_stack_lvl+0x188/0x24e [ 302.863358][ T8520] ? show_regs_print_info+0x12/0x12 [ 302.863382][ T8520] ? load_image+0x410/0x410 [ 302.880784][ T8520] ? __might_sleep+0xd0/0xd0 [ 302.885431][ T8520] ? __lock_acquire+0x7ea0/0x7ea0 [ 302.890525][ T8520] should_fail_ex+0x390/0x4c0 [ 302.895273][ T8520] should_failslab+0x5/0x20 [ 302.899831][ T8520] slab_pre_alloc_hook+0x59/0x300 [ 302.904918][ T8520] kmem_cache_alloc+0x56/0x2f0 [ 302.909731][ T8520] ? __mpol_dup+0x76/0x320 [ 302.914226][ T8520] __mpol_dup+0x76/0x320 [ 302.918533][ T8520] ? vma_dup_policy+0xa0/0xa0 [ 302.923282][ T8520] ? mbind_range+0x3bd/0x750 [ 302.927936][ T8520] ? mbind_range+0x4cb/0x750 [ 302.932603][ T8520] vma_replace_policy+0x3b/0x2c0 [ 302.937609][ T8520] __se_sys_mbind+0x5f2/0x810 [ 302.942347][ T8520] ? __ia32_sys_get_robust_list+0x100/0x100 [ 302.948309][ T8520] ? __x64_sys_mbind+0xf0/0xf0 [ 302.953149][ T8520] ? lock_chain_count+0x20/0x20 [ 302.958070][ T8520] ? __x64_sys_mbind+0x1d/0xf0 [ 302.962881][ T8520] do_syscall_64+0x4c/0xa0 [ 302.962904][ T8520] ? clear_bhb_loop+0x60/0xb0 [ 302.962926][ T8520] ? clear_bhb_loop+0x60/0xb0 [ 302.962952][ T8520] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 302.972074][ T8520] RIP: 0033:0x7f52bcd9f559 [ 302.972097][ T8520] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 302.972120][ T8520] RSP: 002b:00007f52bdd5c028 EFLAGS: 00000246 [ 302.982797][ T8520] ORIG_RAX: 00000000000000ed [ 302.982810][ T8520] RAX: ffffffffffffffda RBX: 00007f52bd025fa0 RCX: 00007f52bcd9f559 [ 302.982828][ T8520] RDX: 0000000000000005 RSI: 0000000000600000 RDI: 0000200000000000 [ 302.982845][ T8520] RBP: 00007f52bce36b20 R08: 0000000000000008 R09: 0000000000000000 [ 303.006974][ T8520] R10: 0000200000000380 R11: 0000000000000246 R12: 0000000000000000 [ 303.006994][ T8520] R13: 00007f52bd026038 R14: 00007f52bd025fa0 R15: 00007ffc73cceb98 [ 303.007028][ T8520] [ 303.569699][ T8510] loop6: detected capacity change from 0 to 32768 [ 303.639108][ T8510] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop6 scanned by syz.6.1102 (8510) [ 303.721400][ T8510] BTRFS info (device loop6): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 303.765422][ T8510] BTRFS info (device loop6): using sha256 (sha256-avx2) checksum algorithm [ 303.816180][ T8510] BTRFS info (device loop6): using free space tree [ 304.039722][ T8510] BTRFS info (device loop6): enabling ssd optimizations [ 304.336886][ T8556] device syzkaller0 entered promiscuous mode [ 304.374467][ T8556] tipc: Enabled bearer , priority 0 [ 304.464983][ T8555] tipc: Resetting bearer [ 304.643287][ T8555] tipc: Disabling bearer [ 304.686329][ T5797] BTRFS info (device loop6): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 306.106983][ T8588] Unsupported ieee802154 address type: 0 [ 306.388553][ T8593] FAULT_INJECTION: forcing a failure. [ 306.388553][ T8593] name failslab, interval 1, probability 0, space 0, times 0 [ 306.481006][ T8593] CPU: 1 PID: 8593 Comm: syz.2.1123 Not tainted syzkaller #0 [ 306.488527][ T8593] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 306.498644][ T8593] Call Trace: [ 306.501985][ T8593] [ 306.504962][ T8593] dump_stack_lvl+0x188/0x24e [ 306.509798][ T8593] ? show_regs_print_info+0x12/0x12 [ 306.515059][ T8593] ? load_image+0x410/0x410 [ 306.519633][ T8593] ? __lock_acquire+0x7ea0/0x7ea0 [ 306.524727][ T8593] ? __prealloc_shrinker+0x6e3/0x7e0 [ 306.530087][ T8593] should_fail_ex+0x390/0x4c0 [ 306.534863][ T8593] should_failslab+0x5/0x20 [ 306.539421][ T8593] slab_pre_alloc_hook+0x59/0x300 [ 306.544548][ T8593] ? idr_alloc_u32+0x330/0x330 [ 306.549378][ T8593] ? __list_lru_init+0xb0/0x600 [ 306.554300][ T8593] __kmem_cache_alloc_node+0x4f/0x270 [ 306.559740][ T8593] ? __list_lru_init+0xb0/0x600 [ 306.564653][ T8593] __kmalloc+0xa3/0x240 [ 306.568865][ T8593] __list_lru_init+0xb0/0x600 [ 306.573614][ T8593] alloc_super+0x766/0x930 [ 306.578095][ T8593] ? kill_litter_super+0xa0/0xa0 [ 306.583092][ T8593] sget_fc+0x2d4/0x750 [ 306.587221][ T8593] ? kill_litter_super+0xa0/0xa0 [ 306.592234][ T8593] ? mqueue_get_tree+0xe0/0xe0 [ 306.597066][ T8593] get_tree_nodev+0x26/0x160 [ 306.601713][ T8593] vfs_get_tree+0x88/0x270 [ 306.606189][ T8593] fc_mount+0x18/0xa0 [ 306.610230][ T8593] mq_init_ns+0x39d/0x510 [ 306.614617][ T8593] copy_ipcs+0x2de/0x500 [ 306.618923][ T8593] create_new_namespaces+0x212/0x700 [ 306.624300][ T8593] unshare_nsproxy_namespaces+0x116/0x160 [ 306.630131][ T8593] ksys_unshare+0x4f6/0x8e0 [ 306.634701][ T8593] ? sighand_ctor+0x40/0x40 [ 306.639261][ T8593] ? lock_chain_count+0x20/0x20 [ 306.644193][ T8593] ? syscall_enter_from_user_mode+0x21/0x80 [ 306.650207][ T8593] __x64_sys_unshare+0x34/0x40 [ 306.655060][ T8593] do_syscall_64+0x4c/0xa0 [ 306.659532][ T8593] ? clear_bhb_loop+0x60/0xb0 [ 306.664270][ T8593] ? clear_bhb_loop+0x60/0xb0 [ 306.669015][ T8593] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 306.674982][ T8593] RIP: 0033:0x7fec9ed9f559 [ 306.679458][ T8593] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 306.699136][ T8593] RSP: 002b:00007fec9fc1f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 306.707616][ T8593] RAX: ffffffffffffffda RBX: 00007fec9f025fa0 RCX: 00007fec9ed9f559 [ 306.715650][ T8593] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000004a000200 [ 306.723672][ T8593] RBP: 00007fec9ee36b20 R08: 0000000000000000 R09: 0000000000000000 [ 306.731750][ T8593] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 306.739774][ T8593] R13: 00007fec9f026038 R14: 00007fec9f025fa0 R15: 00007fffd9994cf8 [ 306.747862][ T8593] [ 306.817442][ T8596] netlink: 136 bytes leftover after parsing attributes in process `syz.6.1124'. [ 307.141757][ C1] net_ratelimit: 56 callbacks suppressed [ 307.954071][ T8609] loop6: detected capacity change from 0 to 128 [ 308.974155][ T8617] device syzkaller0 entered promiscuous mode [ 309.016396][ T8617] tipc: Enabled bearer , priority 0 [ 309.064539][ T8616] tipc: Resetting bearer [ 309.193489][ T8616] tipc: Disabling bearer [ 309.654265][ T8620] syz.4.1131 (8620) used greatest stack depth: 16576 bytes left [ 310.230358][ T8611] loop2: detected capacity change from 0 to 32768 [ 310.275996][ T8636] loop1: detected capacity change from 0 to 1024 [ 310.337974][ T8611] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop2 scanned by syz.2.1128 (8611) [ 310.400612][ T8636] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (7780!=20869) [ 310.539939][ T8636] EXT4-fs (loop1): invalid journal inode [ 310.568939][ T8611] BTRFS info (device loop2): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 310.589956][ T8636] EXT4-fs (loop1): can't get journal size [ 310.621679][ T8611] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 310.701543][ T8636] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 310.721128][ T8611] BTRFS info (device loop2): using free space tree [ 311.171837][ T8636] EXT4-fs error (device loop1): ext4_readdir:263: inode #2: block 64: comm syz.1.1135: path /syzcgroup/unified/syz1: bad entry in directory: rec_len is too small for name_len - offset=0, inode=11, rec_len=12, size=1024 fake=0 [ 311.198455][ T8636] EXT4-fs error (device loop1): ext4_readdir:263: inode #2: block 73: comm syz.1.1135: path /syzcgroup/unified/syz1: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=83886080, rec_len=0, size=1024 fake=0 [ 311.238988][ T8611] BTRFS info (device loop2): enabling ssd optimizations [ 311.356969][ T8679] FAULT_INJECTION: forcing a failure. [ 311.356969][ T8679] name failslab, interval 1, probability 0, space 0, times 0 [ 311.391164][ T8679] CPU: 0 PID: 8679 Comm: syz.0.1143 Not tainted syzkaller #0 [ 311.398625][ T8679] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 311.408731][ T8679] Call Trace: [ 311.412064][ T8679] [ 311.415044][ T8679] dump_stack_lvl+0x188/0x24e [ 311.419779][ T8679] ? show_regs_print_info+0x12/0x12 [ 311.425041][ T8679] ? load_image+0x410/0x410 [ 311.429604][ T8679] ? __might_sleep+0xd0/0xd0 [ 311.434242][ T8679] ? __lock_acquire+0x7ea0/0x7ea0 [ 311.439334][ T8679] should_fail_ex+0x390/0x4c0 [ 311.444120][ T8679] should_failslab+0x5/0x20 [ 311.448669][ T8679] slab_pre_alloc_hook+0x59/0x300 [ 311.453747][ T8679] ? __split_vma+0x4f0/0x4f0 [ 311.458406][ T8679] kmem_cache_alloc+0x56/0x2f0 [ 311.463223][ T8679] ? vm_area_dup+0x23/0x1a0 [ 311.467784][ T8679] vm_area_dup+0x23/0x1a0 [ 311.472165][ T8679] __split_vma+0xb9/0x4f0 [ 311.476555][ T8679] ? split_vma+0x70/0xf0 [ 311.480857][ T8679] mlock_fixup+0x508/0x580 [ 311.485346][ T8679] apply_vma_lock_flags+0x257/0x3b0 [ 311.490608][ T8679] ? do_mlock+0x640/0x640 [ 311.494992][ T8679] ? rwsem_write_trylock+0x135/0x1c0 [ 311.500387][ T8679] ? do_mlock+0x194/0x640 [ 311.504784][ T8679] do_mlock+0x4d6/0x640 [ 311.509003][ T8679] ? lru_gen_add_folio+0xe20/0xe20 [ 311.514163][ T8679] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 311.520241][ T8679] ? lock_chain_count+0x20/0x20 [ 311.525159][ T8679] ? syscall_enter_from_user_mode+0x21/0x80 [ 311.531125][ T8679] __x64_sys_mlock+0x5c/0x70 [ 311.535776][ T8679] do_syscall_64+0x4c/0xa0 [ 311.540245][ T8679] ? clear_bhb_loop+0x60/0xb0 [ 311.544972][ T8679] ? clear_bhb_loop+0x60/0xb0 [ 311.549710][ T8679] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 311.555666][ T8679] RIP: 0033:0x7f131299f559 [ 311.560164][ T8679] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 311.579916][ T8679] RSP: 002b:00007f13137d3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000095 [ 311.588403][ T8679] RAX: ffffffffffffffda RBX: 00007f1312c25fa0 RCX: 00007f131299f559 [ 311.596434][ T8679] RDX: 0000000000000000 RSI: 0000000000c00000 RDI: 000020000009f000 [ 311.604465][ T8679] RBP: 00007f1312a36b20 R08: 0000000000000000 R09: 0000000000000000 [ 311.612493][ T8679] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 311.620522][ T8679] R13: 00007f1312c26038 R14: 00007f1312c25fa0 R15: 00007ffc7a81d688 [ 311.628563][ T8679] [ 311.995989][ T4282] BTRFS info (device loop2): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 312.199549][ T8685] loop6: detected capacity change from 0 to 512 [ 312.241994][ T8685] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 312.406655][ T8685] EXT4-fs (loop6): 1 truncate cleaned up [ 312.440960][ T8685] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 312.651822][ C1] net_ratelimit: 67 callbacks suppressed [ 312.844908][ T5797] EXT4-fs (loop6): unmounting filesystem. [ 313.000238][ T8701] loop0: detected capacity change from 0 to 128 [ 313.085806][ T8701] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 313.139213][ T8701] ext4 filesystem being mounted at /237/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 313.210458][ T8707] loop6: detected capacity change from 0 to 512 [ 313.295053][ T8707] EXT4-fs error (device loop6): ext4_orphan_get:1409: inode #15: comm syz.6.1150: iget: bad i_size value: 38620345925642 [ 313.379959][ T8707] EXT4-fs error (device loop6): ext4_orphan_get:1414: comm syz.6.1150: couldn't read orphan inode 15 (err -117) [ 313.426603][ T8707] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 313.655430][ T4273] EXT4-fs (loop0): unmounting filesystem. [ 313.956737][ T5797] EXT4-fs (loop6): unmounting filesystem. [ 314.731973][ T26] kauditd_printk_skb: 9 callbacks suppressed [ 314.731990][ T26] audit: type=1326 audit(1793335461.459:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8737 comm="syz.6.1159" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fd735b9f559 code=0x0 [ 314.785387][ T8744] loop6: detected capacity change from 0 to 512 [ 314.793629][ T8744] EXT4-fs: Ignoring removed nomblk_io_submit option [ 314.800312][ T8744] EXT4-fs: Ignoring removed mblk_io_submit option [ 314.806957][ T8744] EXT4-fs: Ignoring removed i_version option [ 315.657775][ T8744] EXT4-fs (loop6): 1 orphan inode deleted [ 315.663908][ T8744] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 315.700444][ T8742] EXT4-fs error (device loop6): ext4_add_entry:2488: inode #2: comm syz.6.1159: Directory hole found for htree leaf block 0 [ 315.974040][ T5797] EXT4-fs (loop6): unmounting filesystem. [ 316.129437][ T8758] syz.0.1164 (8758): drop_caches: 2 [ 317.059326][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.067695][ T1281] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.701752][ C1] net_ratelimit: 61 callbacks suppressed [ 318.606605][ T8797] loop0: detected capacity change from 0 to 1024 [ 319.299050][ T8797] EXT4-fs: Ignoring removed nomblk_io_submit option [ 319.420023][ T8797] EXT4-fs: Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 319.501980][ T8797] EXT4-fs error (device loop0): ext4_map_blocks:637: inode #3: block 2: comm syz.0.1176: lblock 2 mapped to illegal pblock 2 (length 1) [ 319.615505][ T8797] Quota error (device loop0): qtree_write_dquot: dquota write failed [ 319.639504][ T8813] loop2: detected capacity change from 0 to 736 [ 319.661860][ T8797] EXT4-fs error (device loop0): ext4_map_blocks:637: inode #3: block 48: comm syz.0.1176: lblock 0 mapped to illegal pblock 48 (length 1) [ 319.730784][ T8797] Quota error (device loop0): v2_write_file_info: Can't write info structure [ 319.764185][ T8797] EXT4-fs error (device loop0): ext4_acquire_dquot:6841: comm syz.0.1176: Failed to acquire dquot type 0 [ 319.821008][ T8797] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5952: Corrupt filesystem [ 319.858853][ T8797] EXT4-fs error (device loop0): ext4_evict_inode:281: inode #11: comm syz.0.1176: mark_inode_dirty error [ 319.903480][ T8797] EXT4-fs warning (device loop0): ext4_evict_inode:284: couldn't mark inode dirty (err -117) [ 319.937847][ T8813] rock: directory entry would overflow storage [ 319.945990][ T8797] EXT4-fs (loop0): 1 orphan inode deleted [ 319.959602][ T8797] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 319.975946][ T8813] rock: sig=0x3b10, size=4, remaining=3 [ 319.989124][ T9] EXT4-fs error (device loop0): ext4_map_blocks:637: inode #3: block 1: comm kworker/u4:0: lblock 1 mapped to illegal pblock 1 (length 1) [ 320.041807][ T9] Quota error (device loop0): remove_tree: Can't read quota data block 1 [ 320.065658][ T9] EXT4-fs error (device loop0): ext4_release_dquot:6877: comm kworker/u4:0: Failed to release dquot type 0 [ 320.066015][ T8797] EXT4-fs error (device loop0): __ext4_get_inode_loc:4520: comm syz.0.1176: Invalid inode table block 1 in block_group 0 [ 320.180480][ T8822] loop4: detected capacity change from 0 to 512 [ 320.191810][ T8797] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5952: Corrupt filesystem [ 320.270136][ T8822] EXT4-fs error (device loop4): ext4_orphan_get:1409: inode #15: comm syz.4.1185: iget: bad i_size value: 38620345925642 [ 320.306377][ T8822] EXT4-fs error (device loop4): ext4_orphan_get:1414: comm syz.4.1185: couldn't read orphan inode 15 (err -117) [ 320.351354][ T8822] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 320.378843][ T4273] EXT4-fs (loop0): unmounting filesystem. [ 320.392015][ T5133] EXT4-fs error (device loop0): ext4_map_blocks:637: inode #3: block 1: comm kworker/u4:13: lblock 1 mapped to illegal pblock 1 (length 1) [ 320.471955][ T5133] Quota error (device loop0): remove_tree: Can't read quota data block 1 [ 320.492505][ T5133] EXT4-fs error (device loop0): ext4_release_dquot:6877: comm kworker/u4:13: Failed to release dquot type 0 [ 320.539448][ T4273] EXT4-fs error (device loop0): __ext4_get_inode_loc:4520: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 320.584676][ T4273] EXT4-fs error (device loop0) in ext4_reserve_inode_write:5952: Corrupt filesystem [ 320.616610][ T4273] EXT4-fs error (device loop0): ext4_quota_off:7147: inode #3: comm syz-executor: mark_inode_dirty error [ 320.660347][ T4275] EXT4-fs (loop4): unmounting filesystem. [ 322.700978][ T8853] tipc: Enabled bearer , priority 0 [ 322.749636][ T8853] tipc: Resetting bearer [ 322.900417][ T8852] tipc: Disabling bearer [ 323.131836][ C1] net_ratelimit: 63 callbacks suppressed [ 324.762560][ T8887] tipc: Enabled bearer , priority 0 [ 324.796341][ T8887] tipc: Resetting bearer [ 324.883575][ T8886] tipc: Disabling bearer [ 324.973169][ T8898] netlink: 204 bytes leftover after parsing attributes in process `syz.4.1216'. [ 325.001087][ T8898] netlink: 84 bytes leftover after parsing attributes in process `syz.4.1216'. [ 325.410040][ T8908] loop0: detected capacity change from 0 to 1024 [ 325.495730][ T8908] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (7780!=20869) [ 325.532042][ T8908] EXT4-fs (loop0): invalid journal inode [ 325.532106][ T8908] EXT4-fs (loop0): can't get journal size [ 325.556431][ T8908] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 327.556097][ T8940] loop2: detected capacity change from 0 to 512 [ 327.599503][ T8940] EXT4-fs: Ignoring removed mblk_io_submit option [ 327.629932][ T8940] EXT4-fs: Ignoring removed bh option [ 327.704526][ T8940] EXT4-fs error (device loop2): ext4_orphan_get:1409: comm syz.2.1230: inode #13: comm syz.2.1230: iget: illegal inode # [ 327.737001][ T8940] EXT4-fs error (device loop2): ext4_orphan_get:1414: comm syz.2.1230: couldn't read orphan inode 13 (err -117) [ 327.758835][ T8940] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 327.899886][ T8940] EXT4-fs error (device loop2): ext4_resize_begin:62: comm syz.2.1230: resize_inode disabled but reserved GDT blocks non-zero [ 328.047087][ T8940] EXT4-fs (loop2): unmounting filesystem. [ 328.252286][ C0] net_ratelimit: 64 callbacks suppressed [ 329.614003][ T8984] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1243'. [ 331.434719][ T9025] loop4: detected capacity change from 0 to 256 [ 333.291213][ T41] net_ratelimit: 45 callbacks suppressed [ 334.166054][ T9050] FAULT_INJECTION: forcing a failure. [ 334.166054][ T9050] name failslab, interval 1, probability 0, space 0, times 0 [ 334.217168][ T9050] CPU: 0 PID: 9050 Comm: syz.0.1267 Not tainted syzkaller #0 [ 334.224626][ T9050] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 334.234734][ T9050] Call Trace: [ 334.238057][ T9050] [ 334.241028][ T9050] dump_stack_lvl+0x188/0x24e [ 334.245769][ T9050] ? show_regs_print_info+0x12/0x12 [ 334.251064][ T9050] ? load_image+0x410/0x410 [ 334.255640][ T9050] ? __might_sleep+0xd0/0xd0 [ 334.260291][ T9050] ? __lock_acquire+0x7ea0/0x7ea0 [ 334.265396][ T9050] should_fail_ex+0x390/0x4c0 [ 334.270120][ T9050] should_failslab+0x5/0x20 [ 334.274683][ T9050] slab_pre_alloc_hook+0x59/0x300 [ 334.279766][ T9050] ? blk_mq_alloc_tag_set+0x4d6/0xd90 [ 334.285197][ T9050] __kmem_cache_alloc_node+0x4f/0x270 [ 334.290631][ T9050] ? blk_mq_alloc_tag_set+0x4d6/0xd90 [ 334.296089][ T9050] __kmalloc_node+0xa2/0x240 [ 334.300750][ T9050] ? rcu_is_watching+0x11/0xa0 [ 334.305582][ T9050] blk_mq_alloc_tag_set+0x4d6/0xd90 [ 334.310839][ T9050] loop_add+0x2ef/0x9a0 [ 334.315045][ T9050] loop_control_ioctl+0x124/0x590 [ 334.320135][ T9050] ? loop_set_hw_queue_depth+0x60/0x60 [ 334.325659][ T9050] ? bpf_lsm_file_ioctl+0x5/0x10 [ 334.330657][ T9050] ? security_file_ioctl+0x7c/0xa0 [ 334.335827][ T9050] ? loop_set_hw_queue_depth+0x60/0x60 [ 334.341348][ T9050] __se_sys_ioctl+0xfa/0x170 [ 334.346015][ T9050] do_syscall_64+0x4c/0xa0 [ 334.350496][ T9050] ? clear_bhb_loop+0x60/0xb0 [ 334.355265][ T9050] ? clear_bhb_loop+0x60/0xb0 [ 334.360008][ T9050] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 334.365976][ T9050] RIP: 0033:0x7f131299f559 [ 334.370467][ T9050] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 334.390144][ T9050] RSP: 002b:00007f13137d3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 334.398642][ T9050] RAX: ffffffffffffffda RBX: 00007f1312c25fa0 RCX: 00007f131299f559 [ 334.406679][ T9050] RDX: 00000000ffffffe4 RSI: 0000000000004c80 RDI: 0000000000000004 [ 334.414698][ T9050] RBP: 00007f1312a36b20 R08: 0000000000000000 R09: 0000000000000000 [ 334.422720][ T9050] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 334.430746][ T9050] R13: 00007f1312c26038 R14: 00007f1312c25fa0 R15: 00007ffc7a81d688 [ 334.438810][ T9050] [ 334.840398][ T9065] device-mapper: table: 248:1: striped: Invalid chunk_size (-EINVAL) [ 334.888624][ T9065] device-mapper: ioctl: error adding target to table [ 336.551289][ T9082] device syzkaller0 entered promiscuous mode [ 338.036782][ T9102] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(5) [ 338.043395][ T9102] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 338.101245][ T9102] vhci_hcd vhci_hcd.0: Device attached [ 338.130330][ T9104] vhci_hcd: connection closed [ 338.135498][ T4454] vhci_hcd: stop threads [ 338.139796][ T4454] vhci_hcd: release socket [ 338.150404][ T4454] vhci_hcd: disconnect device [ 338.891801][ C0] net_ratelimit: 62 callbacks suppressed [ 339.531827][ T4380] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 339.610444][ T9129] device-mapper: table: 248:2: striped: Invalid stripe count (-EINVAL) [ 339.630197][ T9129] device-mapper: ioctl: error adding target to table [ 339.741967][ T4380] usb 2-1: Using ep0 maxpacket: 8 [ 339.750358][ T4380] usb 2-1: config 0 has no interfaces? [ 339.764272][ T4380] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 339.782590][ T4380] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 339.830937][ T4380] usb 2-1: config 0 descriptor?? [ 341.004393][ T9088] loop0: detected capacity change from 1024 to 1023 [ 341.084184][ T14] usb 2-1: USB disconnect, device number 9 [ 341.095406][ T9148] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(5) [ 341.101992][ T9148] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 341.162851][ T9153] vhci_hcd: connection closed [ 341.170262][ T9148] vhci_hcd vhci_hcd.0: Device attached [ 341.198285][ T4454] vhci_hcd: stop threads [ 341.202820][ T4454] vhci_hcd: release socket [ 341.246523][ T4454] vhci_hcd: disconnect device [ 341.899099][ T9172] loop6: detected capacity change from 0 to 512 [ 341.957647][ T9172] EXT4-fs: Ignoring removed mblk_io_submit option [ 341.991898][ T9172] EXT4-fs: Ignoring removed bh option [ 342.082943][ T9172] EXT4-fs error (device loop6): ext4_orphan_get:1409: comm syz.6.1309: inode #13: comm syz.6.1309: iget: illegal inode # [ 342.102520][ T9172] EXT4-fs error (device loop6): ext4_orphan_get:1414: comm syz.6.1309: couldn't read orphan inode 13 (err -117) [ 342.188905][ T9172] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 342.310624][ T9179] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1310'. [ 342.442726][ T9188] device syzkaller1 entered promiscuous mode [ 343.183040][ T5797] EXT4-fs (loop6): unmounting filesystem. [ 343.931757][ C0] net_ratelimit: 77 callbacks suppressed [ 344.491804][ T9212] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(5) [ 344.498406][ T9212] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 344.532293][ T9212] vhci_hcd vhci_hcd.0: Device attached [ 344.567607][ T9217] vhci_hcd: connection closed [ 344.574583][ T8801] vhci_hcd: stop threads [ 344.578947][ T8801] vhci_hcd: release socket [ 344.591781][ T8801] vhci_hcd: disconnect device [ 344.656669][ T9223] loop2: detected capacity change from 0 to 512 [ 344.742876][ T9223] EXT4-fs error (device loop2): ext4_orphan_get:1409: inode #15: comm syz.2.1324: iget: bad i_size value: 38620345925642 [ 344.797620][ T9223] EXT4-fs error (device loop2): ext4_orphan_get:1414: comm syz.2.1324: couldn't read orphan inode 15 (err -117) [ 344.922547][ T9223] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 345.471519][ T4282] EXT4-fs (loop2): unmounting filesystem. [ 346.206933][ T9249] autofs4:pid:9249:autofs_fill_super: called with bogus options [ 346.257114][ T9252] Value of "id" is too big. [ 346.825655][ T9272] loop4: detected capacity change from 0 to 1024 [ 346.845386][ T9273] loop2: detected capacity change from 0 to 1024 [ 346.888320][ T9272] EXT4-fs: Ignoring removed oldalloc option [ 346.896584][ T9273] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (7780!=20869) [ 346.922833][ T9272] EXT4-fs: Ignoring removed orlov option [ 346.941919][ T9273] EXT4-fs (loop2): invalid journal inode [ 346.962849][ T9273] EXT4-fs (loop2): can't get journal size [ 346.988682][ T9273] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 347.143223][ T9272] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 347.184066][ T9272] ext4 filesystem being mounted at /277/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 347.378272][ T9286] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(5) [ 347.384873][ T9286] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 347.402165][ T9286] vhci_hcd vhci_hcd.0: Device attached [ 347.427604][ T4275] EXT4-fs (loop4): unmounting filesystem. [ 347.450569][ T9289] vhci_hcd: connection closed [ 347.472104][ T4454] vhci_hcd: stop threads [ 347.476430][ T4454] vhci_hcd: release socket [ 347.480891][ T4454] vhci_hcd: disconnect device [ 348.945640][ T6242] net_ratelimit: 59 callbacks suppressed [ 351.898832][ T9338] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(5) [ 351.905444][ T9338] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 352.061027][ T9338] vhci_hcd vhci_hcd.0: Device attached [ 352.097922][ T9345] vhci_hcd: connection closed [ 352.109970][ T4453] vhci_hcd: stop threads [ 352.114715][ T4453] vhci_hcd: release socket [ 352.119180][ T4453] vhci_hcd: disconnect device [ 353.319875][ T9384] loop4: detected capacity change from 0 to 1024 [ 353.356521][ T9384] EXT4-fs: Ignoring removed nobh option [ 353.377806][ T9384] EXT4-fs: Ignoring removed bh option [ 353.418474][ T9384] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=a802c028, mo2=0002] [ 353.494780][ T9384] System zones: 0-1, 3-12 [ 353.510289][ T9384] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 353.531933][ T6242] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 353.576127][ T9384] process 'syz.4.1372' launched '/dev/fd/3/./file1' with NULL argv: empty string added [ 354.091779][ C1] net_ratelimit: 72 callbacks suppressed [ 354.545445][ T4275] EXT4-fs (loop4): unmounting filesystem. [ 356.767166][ T9445] loop6: detected capacity change from 0 to 256 [ 358.411318][ T9445] FAT-fs (loop6): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 358.599216][ T9445] FAT-fs (loop6): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 359.461858][ C1] net_ratelimit: 31 callbacks suppressed [ 361.481958][ T9484] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1407'. [ 362.580468][ T9507] loop4: detected capacity change from 0 to 2048 [ 363.000760][ T9507] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 364.506557][ T4454] net_ratelimit: 33 callbacks suppressed [ 364.910742][ T9521] EXT4-fs (loop4): Online resizing not supported with bigalloc [ 365.350087][ T4275] EXT4-fs (loop4): unmounting filesystem. [ 365.602285][ T9560] syzkaller1: tun_chr_ioctl cmd 35108 [ 366.464897][ T9577] netlink: 'syz.0.1441': attribute type 10 has an invalid length. [ 367.519128][ T4368] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 367.741880][ T4368] usb 2-1: Using ep0 maxpacket: 8 [ 367.784196][ T9577] bridge0: port 3(netdevsim0) entered blocking state [ 367.792880][ T9577] bridge0: port 3(netdevsim0) entered disabled state [ 367.853980][ T9577] device netdevsim0 entered promiscuous mode [ 368.170607][ T4368] usb 2-1: device descriptor read/all, error -71 [ 368.412283][ T9585] loop4: detected capacity change from 0 to 1024 [ 368.419835][ T9585] EXT4-fs: Ignoring removed oldalloc option [ 368.516661][ T9585] EXT4-fs: inline encryption not supported [ 368.573506][ T9585] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 368.601574][ T9585] EXT4-fs error (device loop4): ext4_get_first_dir_block:3596: inode #11: comm syz.4.1445: directory missing '.' [ 369.225240][ T4275] EXT4-fs (loop4): unmounting filesystem. [ 369.531744][ C0] net_ratelimit: 71 callbacks suppressed [ 369.608308][ T9616] loop4: detected capacity change from 0 to 512 [ 369.710830][ T9616] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 369.802470][ T9616] EXT4-fs error (device loop4): __ext4_find_entry:1698: inode #2: comm syz.4.1459: checksumming directory block 0 [ 369.890739][ T9616] EXT4-fs (loop4): Remounting filesystem read-only [ 369.922103][ T9626] EXT4-fs error (device loop4): __ext4_find_entry:1698: inode #2: comm syz.4.1459: checksumming directory block 0 [ 369.980883][ T9626] EXT4-fs (loop4): Remounting filesystem read-only [ 370.084654][ T9630] IPVS: lblcr: FWM 3 0x00000003 - no destination available [ 370.125191][ T4275] EXT4-fs (loop4): unmounting filesystem. [ 370.348887][ T9635] random: crng reseeded on system resumption [ 371.611780][ T4737] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 371.807684][ T4737] usb 2-1: Using ep0 maxpacket: 8 [ 371.809920][ T4737] usb 2-1: config 0 has no interfaces? [ 371.809975][ T4737] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 371.810028][ T4737] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 373.913033][ T4737] usb 2-1: config 0 descriptor?? [ 374.085833][ T4273] EXT4-fs (loop0): unmounting filesystem. [ 374.161222][ T4737] usb 2-1: can't set config #0, error -71 [ 374.169446][ T4737] usb 2-1: USB disconnect, device number 12 [ 374.363665][ T9681] loop4: detected capacity change from 0 to 1024 [ 374.392675][ T9681] EXT4-fs: Ignoring removed nobh option [ 374.424988][ T9681] EXT4-fs: Ignoring removed bh option [ 374.513426][ T9681] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=a802c028, mo2=0002] [ 374.522264][ T9681] System zones: 0-1, 3-12 [ 374.568108][ T9681] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 374.652612][ C1] net_ratelimit: 54 callbacks suppressed [ 374.778301][ T4275] EXT4-fs (loop4): unmounting filesystem. [ 374.853688][ T4988] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 375.021225][ T4988] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 375.190610][ T4988] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 375.341118][ T4988] device netdevsim0 left promiscuous mode [ 375.391753][ T4988] bridge0: port 3(netdevsim0) entered disabled state [ 375.443471][ T4988] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 376.522068][ T4988] tipc: Left network mode [ 376.845622][ T9696] loop6: detected capacity change from 0 to 32768 [ 376.948008][ T9696] XFS (loop6): Mounting V5 Filesystem [ 377.043809][ T4283] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 377.062021][ T4289] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 377.071952][ T4289] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 377.081224][ T4289] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 377.091239][ T4289] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 377.101274][ T4289] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 377.148023][ T9733] loop4: detected capacity change from 0 to 512 [ 377.184866][ T9696] XFS (loop6): Ending clean mount [ 377.192354][ T9696] XFS (loop6): Quotacheck needed: Please wait. [ 377.279859][ T9733] EXT4-fs error (device loop4): ext4_orphan_get:1409: inode #15: comm syz.4.1498: iget: bad i_size value: 38620345925642 [ 377.311388][ T9696] XFS (loop6): Quotacheck: Done. [ 377.341074][ T9733] EXT4-fs error (device loop4): ext4_orphan_get:1414: comm syz.4.1498: couldn't read orphan inode 15 (err -117) [ 377.416885][ T9733] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 377.530350][ T9715] block device autoloading is deprecated and will be removed. [ 377.651942][ T4368] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 377.733131][ T8801] EXT4-fs error (device loop4): ext4_validate_block_bitmap:429: comm kworker/u4:19: bg 0: block 5: invalid block bitmap [ 377.780759][ T8801] EXT4-fs (loop4): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 208 with error 28 [ 377.799495][ T9729] rxe_eth0 speed is unknown, defaulting to 1000 [ 377.819832][ T8801] EXT4-fs (loop4): This should not happen!! Data will be lost [ 377.819832][ T8801] [ 377.861978][ T4368] usb 7-1: Using ep0 maxpacket: 8 [ 377.869247][ T4368] usb 7-1: config 0 has no interfaces? [ 377.881067][ T8801] EXT4-fs (loop4): Total free blocks count 0 [ 377.899748][ T4368] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 377.926074][ T8801] EXT4-fs (loop4): Free/Dirty block details [ 377.938912][ T4368] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 377.951653][ T8801] EXT4-fs (loop4): free_blocks=0 [ 377.959092][ T8801] EXT4-fs (loop4): dirty_blocks=208 [ 377.992321][ T8801] EXT4-fs (loop4): Block reservation details [ 377.999549][ T4368] usb 7-1: config 0 descriptor?? [ 378.021467][ T8801] EXT4-fs (loop4): i_reserved_data_blocks=208 [ 378.094710][ T4275] EXT4-fs (loop4): unmounting filesystem. [ 378.238144][ T4349] usb 7-1: USB disconnect, device number 2 [ 378.358748][ T9742] rxe_eth0 speed is unknown, defaulting to 1000 [ 378.373755][ T9729] ip6gre0 speed is unknown, defaulting to 1000 [ 378.496475][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.881797][ T5797] XFS (loop6): Unmounting Filesystem [ 378.999676][ T9761] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1504'. [ 379.071880][ T9742] ip6gre0 speed is unknown, defaulting to 1000 [ 379.114936][ T9762] device syzkaller1 entered promiscuous mode [ 379.211852][ T50] Bluetooth: hci0: command 0x0409 tx timeout [ 380.341737][ C1] net_ratelimit: 62 callbacks suppressed [ 380.667657][ T4377] Bluetooth: hci4: Frame reassembly failed (-84) [ 380.732263][ T4377] Bluetooth: hci4: Frame reassembly failed (-84) [ 381.010979][ T9729] chnl_net:caif_netlink_parms(): no params data found [ 381.291824][ T4289] Bluetooth: hci0: command 0x041b tx timeout [ 381.688160][ T4988] device hsr_slave_0 left promiscuous mode [ 381.715271][ T4988] device hsr_slave_1 left promiscuous mode [ 381.748235][ T4988] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 381.770415][ T4988] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 381.822809][ T4988] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 381.846392][ T4988] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 381.870132][ T4988] device bridge_slave_1 left promiscuous mode [ 381.886810][ T4988] bridge0: port 2(bridge_slave_1) entered disabled state [ 381.942340][ T4988] device bridge_slave_0 left promiscuous mode [ 381.950960][ T4988] bridge0: port 1(bridge_slave_0) entered disabled state [ 382.112843][ T4988] device veth1_macvtap left promiscuous mode [ 382.125021][ T4988] device veth0_macvtap left promiscuous mode [ 382.138005][ T4988] device veth1_vlan left promiscuous mode [ 382.160163][ T4988] device veth0_vlan left promiscuous mode [ 382.620273][ T4988] bond4 (unregistering): Released all slaves [ 382.667183][ T4988] bond3 (unregistering): Released all slaves [ 382.705341][ T4988] bond2 (unregistering): Released all slaves [ 382.731939][ T50] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 382.835906][ T4988] bond1 (unregistering): (slave veth3): Releasing backup interface [ 382.874176][ T4988] bond1 (unregistering): Released all slaves [ 383.375783][ T4289] Bluetooth: hci0: command 0x040f tx timeout [ 384.206115][ T4988] team0 (unregistering): Port device team_slave_1 removed [ 384.289474][ T4988] team0 (unregistering): Port device team_slave_0 removed [ 384.360495][ T4988] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 384.438496][ T4988] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 384.997723][ T4988] bond0 (unregistering): Released all slaves [ 385.257001][ T9812] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1515'. [ 385.452382][ T4289] Bluetooth: hci0: command 0x0419 tx timeout [ 385.531769][ C1] net_ratelimit: 75 callbacks suppressed [ 385.610521][ T9729] bridge0: port 1(bridge_slave_0) entered blocking state [ 385.648421][ T9729] bridge0: port 1(bridge_slave_0) entered disabled state [ 385.670489][ T9729] device bridge_slave_0 entered promiscuous mode [ 385.680475][ T9729] bridge0: port 2(bridge_slave_1) entered blocking state [ 385.698414][ T9729] bridge0: port 2(bridge_slave_1) entered disabled state [ 385.715739][ T9729] device bridge_slave_1 entered promiscuous mode [ 386.135873][ T9729] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 386.193648][ T9729] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 386.510975][ T9729] team0: Port device team_slave_0 added [ 386.550726][ T9729] team0: Port device team_slave_1 added [ 386.772583][ T9729] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 386.779624][ T9729] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 386.878993][ T9729] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 386.959105][ T9729] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 386.972031][ T9729] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 387.041142][ T9729] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 387.249148][ T9873] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1529'. [ 389.017167][ T9875] device syzkaller0 entered promiscuous mode [ 389.300024][ T9729] device hsr_slave_0 entered promiscuous mode [ 389.321458][ T9729] device hsr_slave_1 entered promiscuous mode [ 389.332238][ T9729] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 389.340176][ T9729] Cannot create hsr debugfs directory [ 389.468090][ T9892] bond0: (slave geneve1): Enslaving as an active interface with an up link [ 389.700269][ T9895] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 389.757714][ T9895] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 389.798528][ T9895] bond0 (unregistering): (slave geneve1): Releasing backup interface [ 389.840088][ T9895] bond0 (unregistering): Released all slaves [ 390.367393][ T9917] netlink: 964 bytes leftover after parsing attributes in process `syz.6.1542'. [ 390.981763][ C1] net_ratelimit: 62 callbacks suppressed [ 391.692974][ T9935] tipc: Enabling of bearer rejected, failed to enable media [ 391.781126][ T9936] device syzkaller1 entered promiscuous mode [ 391.802633][ T9938] netlink: 'syz.1.1548': attribute type 10 has an invalid length. [ 391.937307][ T9943] random: crng reseeded on system resumption [ 392.019289][ T9938] bridge0: port 2(bridge_slave_1) entered disabled state [ 392.026819][ T9938] bridge0: port 1(bridge_slave_0) entered disabled state [ 392.092380][ T9938] bridge0: port 2(bridge_slave_1) entered blocking state [ 392.099584][ T9938] bridge0: port 2(bridge_slave_1) entered forwarding state [ 392.108926][ T9938] bridge0: port 1(bridge_slave_0) entered blocking state [ 392.116122][ T9938] bridge0: port 1(bridge_slave_0) entered forwarding state [ 392.219119][ T9938] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 392.576999][ T9729] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 392.638066][ T9729] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 392.671548][ T9729] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 392.721132][ T9729] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 393.240664][ T9969] file system registered [ 393.248885][ T9729] 8021q: adding VLAN 0 to HW filter on device bond0 [ 393.268541][ T4988] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 393.293579][ T4988] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 393.464350][ T9729] 8021q: adding VLAN 0 to HW filter on device team0 [ 393.505794][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 393.525574][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 393.556124][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 393.563356][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 393.633464][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 393.694216][ T5133] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 393.711230][ T5133] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 393.743784][ T5133] bridge0: port 2(bridge_slave_1) entered blocking state [ 393.751036][ T5133] bridge0: port 2(bridge_slave_1) entered forwarding state [ 393.834115][ T5133] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 393.881310][ T5133] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 393.916526][ T4371] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 393.946296][ T4371] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 394.006072][ T4371] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 394.053213][ T4371] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 394.072969][ T4371] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 394.112930][ T4371] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 394.153198][ T4371] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 394.229979][ T4371] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 394.261317][ T4371] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 394.305576][ T9729] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 394.624903][T10003] random: crng reseeded on system resumption [ 395.770139][ T4988] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 395.789443][ T4988] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 395.817135][ T9729] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 396.571842][ C1] net_ratelimit: 46 callbacks suppressed [ 397.331456][ T4371] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 397.373073][ T4371] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 397.487827][ T8801] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 397.500942][ T8801] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 397.526755][ T9729] device veth0_vlan entered promiscuous mode [ 397.544195][ T8801] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 397.553540][ T8801] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 397.769001][ T9729] device veth1_vlan entered promiscuous mode [ 397.808026][ T9665] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 397.958427][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 397.968332][ T48] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 398.014352][ T9729] device veth0_macvtap entered promiscuous mode [ 398.030570][T10094] netlink: 64 bytes leftover after parsing attributes in process `syz.4.1589'. [ 398.110215][T10097] device syzkaller1 entered promiscuous mode [ 398.179334][ T9729] device veth1_macvtap entered promiscuous mode [ 398.357214][ T9729] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 398.407875][ T9729] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 398.418061][ T9729] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 398.449214][ T9729] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 398.486088][ T9729] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 398.514506][ T9729] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 398.534132][ T9729] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 398.545328][ T9729] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 398.557677][ T9729] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 398.643368][ T4453] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 398.663160][ T4453] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 398.700065][ T4453] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 398.730418][ T4453] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 398.759267][ T9729] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 398.793156][ T9729] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 398.819407][ T9729] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 398.853644][ T9729] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 398.875901][ T9729] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 398.907107][ T9729] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 398.936533][ T9729] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 398.958229][ T9729] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 398.979530][ T9729] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 399.018753][ T8801] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 399.052419][ T8801] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 399.095296][ T9729] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 399.112322][ T9729] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 399.152396][ T9729] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 399.161163][ T9729] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 399.340761][T10134] loop6: detected capacity change from 0 to 512 [ 399.446892][T10134] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 399.588670][T10142] EXT4-fs error (device loop6): __ext4_find_entry:1698: inode #2: comm syz.6.1601: checksumming directory block 0 [ 399.786351][ T4453] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 399.788155][T10142] EXT4-fs (loop6): Remounting filesystem read-only [ 399.817560][ T4453] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 399.873334][ T4371] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 400.005566][ T5797] EXT4-fs (loop6): unmounting filesystem. [ 400.059782][ T8801] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 400.121284][ T8801] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 400.223366][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 402.004970][ C0] net_ratelimit: 75 callbacks suppressed [ 402.446625][T10200] serio: Serial port ttyS3 [ 402.831998][T10212] device syzkaller0 entered promiscuous mode [ 403.607956][T10222] loop4: detected capacity change from 0 to 128 [ 405.119213][T10245] loop7: detected capacity change from 0 to 512 [ 405.329848][T10245] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 405.389155][T10245] EXT4-fs error (device loop7): __ext4_find_entry:1698: inode #2: comm syz.7.1614: checksumming directory block 0 [ 405.458488][T10245] EXT4-fs (loop7): Remounting filesystem read-only [ 405.599236][ T9729] EXT4-fs (loop7): unmounting filesystem. [ 406.405856][T10294] device syzkaller0 entered promiscuous mode [ 406.443655][T10294] tipc: Enabling of bearer rejected, failed to enable media [ 406.956847][T10312] loop7: detected capacity change from 0 to 256 [ 407.192347][T10319] netlink: 'syz.6.1654': attribute type 12 has an invalid length. [ 407.211726][ C1] net_ratelimit: 49 callbacks suppressed [ 407.220211][T10319] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1654'. [ 407.249940][T10319] 8021q: adding VLAN 0 to HW filter on device bond0 [ 407.441053][T10328] TC_ACT_REPEAT abuse ? [ 407.459221][T10324] loop7: detected capacity change from 0 to 1024 [ 407.516173][T10324] EXT4-fs (loop7): ext4_check_descriptors: Checksum for group 0 failed (7780!=20869) [ 407.556331][T10324] EXT4-fs (loop7): invalid journal inode [ 407.579159][T10324] EXT4-fs (loop7): can't get journal size [ 407.603443][T10331] FAULT_INJECTION: forcing a failure. [ 407.603443][T10331] name fail_futex, interval 1, probability 0, space 0, times 0 [ 407.636066][T10324] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 407.659897][T10331] CPU: 0 PID: 10331 Comm: syz.6.1659 Not tainted syzkaller #0 [ 407.667439][T10331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 407.677546][T10331] Call Trace: [ 407.680870][T10331] [ 407.683847][T10331] dump_stack_lvl+0x188/0x24e [ 407.688585][T10331] ? show_regs_print_info+0x12/0x12 [ 407.693855][T10331] ? load_image+0x410/0x410 [ 407.698461][T10331] ? cgroup_rstat_updated+0xce/0x350 [ 407.703804][T10331] ? rcu_read_lock_sched_held+0x86/0x110 [ 407.709500][T10331] should_fail_ex+0x390/0x4c0 [ 407.714245][T10331] get_futex_key+0x1b1/0x1000 [ 407.718987][T10331] ? futex_setup_timer+0xc0/0xc0 [ 407.723972][T10331] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 407.730012][T10331] ? __lock_acquire+0x7ea0/0x7ea0 [ 407.735141][T10331] ? lock_chain_count+0x20/0x20 [ 407.740055][T10331] futex_wait_setup+0xb8/0x270 [ 407.744893][T10331] ? futex_wait_multiple+0x920/0x920 [ 407.750222][T10331] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 407.756133][T10331] ? _raw_spin_unlock+0x40/0x40 [ 407.761043][T10331] futex_wait+0x1b8/0x5c0 [ 407.765419][T10331] ? futex_wait_setup+0x270/0x270 [ 407.770507][T10331] do_futex+0x310/0x320 [ 407.774700][T10331] ? __ia32_sys_get_robust_list+0x100/0x100 [ 407.780653][T10331] ? exc_page_fault+0x88/0x100 [ 407.785474][T10331] __se_sys_futex+0x381/0x410 [ 407.790202][T10331] ? __x64_sys_futex+0xf0/0xf0 [ 407.795021][T10331] ? __x64_sys_futex+0x1d/0xf0 [ 407.799834][T10331] do_syscall_64+0x4c/0xa0 [ 407.804292][T10331] ? clear_bhb_loop+0x60/0xb0 [ 407.809006][T10331] ? clear_bhb_loop+0x60/0xb0 [ 407.813746][T10331] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 407.819696][T10331] RIP: 0033:0x7fd735b9f559 [ 407.824153][T10331] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 407.843815][T10331] RSP: 002b:00007fd7369fb0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 407.852404][T10331] RAX: ffffffffffffffda RBX: 00007fd735e25fa8 RCX: 00007fd735b9f559 [ 407.860607][T10331] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fd735e25fa8 [ 407.868634][T10331] RBP: 00007fd735e25fa0 R08: 0000000000000000 R09: 0000000000000000 [ 407.876634][T10331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 407.876650][T10331] R13: 00007fd735e26038 R14: 00007ffe05eb3410 R15: 00007ffe05eb34f8 [ 407.876683][T10331] [ 408.556212][T10324] EXT4-fs error (device loop7): ext4_readdir:263: inode #2: block 64: comm syz.7.1656: path /syzcgroup/unified/syz7: bad entry in directory: rec_len is too small for name_len - offset=0, inode=11, rec_len=12, size=1024 fake=0 [ 408.636414][T10324] EXT4-fs error (device loop7): ext4_readdir:263: inode #2: block 73: comm syz.7.1656: path /syzcgroup/unified/syz7: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=83886080, rec_len=0, size=1024 fake=0 [ 410.022111][T10407] loop6: detected capacity change from 0 to 1024 [ 410.062094][T10407] EXT4-fs (loop6): ext4_check_descriptors: Checksum for group 0 failed (7780!=20869) [ 410.082951][T10407] EXT4-fs (loop6): invalid journal inode [ 410.088750][T10407] EXT4-fs (loop6): can't get journal size [ 410.144367][T10407] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 410.612860][T10407] EXT4-fs error (device loop6): ext4_readdir:263: inode #2: block 64: comm syz.6.1685: path /syzcgroup/unified/syz6: bad entry in directory: rec_len is too small for name_len - offset=0, inode=11, rec_len=12, size=1024 fake=0 [ 410.658710][T10407] EXT4-fs error (device loop6): ext4_readdir:263: inode #2: block 73: comm syz.6.1685: path /syzcgroup/unified/syz6: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=83886080, rec_len=0, size=1024 fake=0 [ 412.422003][ C1] net_ratelimit: 67 callbacks suppressed [ 412.491945][T10412] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1688'. [ 412.721119][T10437] loop4: detected capacity change from 0 to 1024 [ 412.802932][T10437] EXT4-fs: Ignoring removed mblk_io_submit option [ 412.843906][T10437] EXT4-fs: Ignoring removed oldalloc option [ 412.937213][T10437] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 412.952030][T10437] ext4 filesystem being mounted at /345/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 413.040282][T10437] EXT4-fs warning (device loop4): ext4_empty_dir:3158: inode #12: comm syz.4.1694: directory missing '..' [ 413.255095][ T4275] EXT4-fs (loop4): unmounting filesystem. [ 413.639857][T10475] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1708'. [ 414.470836][T10502] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1719'. [ 414.569714][ T4737] wacom 0003:056A:0042.0003: Unknown device_type for 'syz0'. Assuming pen. [ 414.594093][ T4737] wacom 0003:056A:0042.0003: hidraw0: USB HID vffffff.ff Device [syz0] on syz0 [ 414.616109][ T4737] input: Wacom Intuos2 6x8 Pen as /devices/virtual/misc/uhid/0003:056A:0042.0003/input/input6 [ 414.949327][T10514] device syzkaller0 entered promiscuous mode [ 414.969773][T10512] fido_id[10512]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 415.104514][T10520] netlink: 28 bytes leftover after parsing attributes in process `syz.7.1727'. [ 415.536671][T10531] FAULT_INJECTION: forcing a failure. [ 415.536671][T10531] name failslab, interval 1, probability 0, space 0, times 0 [ 415.553146][T10531] CPU: 0 PID: 10531 Comm: syz.1.1732 Not tainted syzkaller #0 [ 415.560677][T10531] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 415.570781][T10531] Call Trace: [ 415.574108][T10531] [ 415.577073][T10531] dump_stack_lvl+0x188/0x24e [ 415.581802][T10531] ? show_regs_print_info+0x12/0x12 [ 415.587057][T10531] ? load_image+0x410/0x410 [ 415.591623][T10531] ? __might_sleep+0xd0/0xd0 [ 415.596262][T10531] ? __lock_acquire+0x7ea0/0x7ea0 [ 415.601357][T10531] should_fail_ex+0x390/0x4c0 [ 415.606098][T10531] should_failslab+0x5/0x20 [ 415.610648][T10531] slab_pre_alloc_hook+0x59/0x300 [ 415.615722][T10531] ? slab_free_freelist_hook+0x133/0x1b0 [ 415.621412][T10531] kmem_cache_alloc+0x56/0x2f0 [ 415.626256][T10531] ? getname_flags+0xb7/0x500 [ 415.630986][T10531] getname_flags+0xb7/0x500 [ 415.635543][T10531] __x64_sys_symlinkat+0x87/0xa0 [ 415.640532][T10531] do_syscall_64+0x4c/0xa0 [ 415.645006][T10531] ? clear_bhb_loop+0x60/0xb0 [ 415.649736][T10531] ? clear_bhb_loop+0x60/0xb0 [ 415.654455][T10531] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 415.660374][T10531] RIP: 0033:0x7fa741b9f559 [ 415.664826][T10531] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 415.684475][T10531] RSP: 002b:00007fa742993028 EFLAGS: 00000246 ORIG_RAX: 000000000000010a [ 415.692904][T10531] RAX: ffffffffffffffda RBX: 00007fa741e25fa0 RCX: 00007fa741b9f559 [ 415.700896][T10531] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000000 [ 415.708987][T10531] RBP: 00007fa741c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 415.716978][T10531] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 415.724974][T10531] R13: 00007fa741e26038 R14: 00007fa741e25fa0 R15: 00007ffee326e798 [ 415.733019][T10531] [ 417.651837][ C0] net_ratelimit: 50 callbacks suppressed [ 417.662089][ T50] Bluetooth: hci4: command 0x1003 tx timeout [ 417.671042][ T4289] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 419.053546][T10602] device syzkaller0 entered promiscuous mode [ 419.672157][T10632] capability: warning: `syz.4.1769' uses 32-bit capabilities (legacy support in use) [ 419.719779][T10632] program syz.4.1769 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 420.271043][T10650] device syzkaller0 entered promiscuous mode [ 420.820686][ T50] Bluetooth: hci4: command 0x1003 tx timeout [ 420.827762][ T4289] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 422.971714][ C1] net_ratelimit: 88 callbacks suppressed [ 423.320720][T10764] device syzkaller1 entered promiscuous mode [ 423.820293][T10784] syz.7.1808 (10784): /proc/10783/oom_adj is deprecated, please use /proc/10783/oom_score_adj instead. [ 424.491944][ T4289] Bluetooth: hci4: command 0x1003 tx timeout [ 424.500963][ T50] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 424.683483][T10809] device syzkaller0 entered promiscuous mode [ 425.176739][T10827] sctp: [Deprecated]: syz.6.1823 (pid 10827) Use of int in maxseg socket option. [ 425.176739][T10827] Use struct sctp_assoc_value instead [ 425.227115][T10831] program syz.7.1824 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 425.858064][ T4453] Bluetooth: hci4: Frame reassembly failed (-84) [ 425.958420][T10856] device syzkaller0 entered promiscuous mode [ 426.012764][T10855] device syzkaller0 entered promiscuous mode [ 426.044515][T10855] tipc: Started in network mode [ 426.049806][T10855] tipc: Node identity 5e44d0214b47, cluster identity 4711 [ 426.072021][T10855] tipc: Enabled bearer , priority 0 [ 426.200691][T10857] tipc: Resetting bearer [ 426.272333][T10871] sctp: [Deprecated]: syz.7.1836 (pid 10871) Use of int in maxseg socket option. [ 426.272333][T10871] Use struct sctp_assoc_value instead [ 426.321215][T10851] tipc: Resetting bearer [ 426.389732][T10851] tipc: Disabling bearer [ 426.649563][T10884] FAULT_INJECTION: forcing a failure. [ 426.649563][T10884] name failslab, interval 1, probability 0, space 0, times 0 [ 426.706076][T10884] CPU: 1 PID: 10884 Comm: syz.6.1841 Not tainted syzkaller #0 [ 426.713628][T10884] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 426.723731][T10884] Call Trace: [ 426.727048][T10884] [ 426.730011][T10884] dump_stack_lvl+0x188/0x24e [ 426.734740][T10884] ? show_regs_print_info+0x12/0x12 [ 426.739999][T10884] ? load_image+0x410/0x410 [ 426.744563][T10884] ? __might_sleep+0xd0/0xd0 [ 426.749199][T10884] ? __lock_acquire+0x7ea0/0x7ea0 [ 426.754287][T10884] should_fail_ex+0x390/0x4c0 [ 426.759055][T10884] should_failslab+0x5/0x20 [ 426.763609][T10884] slab_pre_alloc_hook+0x59/0x300 [ 426.768700][T10884] kmem_cache_alloc+0x56/0x2f0 [ 426.773511][T10884] ? security_inode_alloc+0x30/0x110 [ 426.778857][T10884] security_inode_alloc+0x30/0x110 [ 426.784019][T10884] inode_init_always+0x910/0xc90 [ 426.789008][T10884] new_inode_pseudo+0x91/0x1c0 [ 426.793806][T10884] new_inode+0x25/0x1d0 [ 426.797995][T10884] bpf_mkobj_ops+0xdd/0x2f0 [ 426.802531][T10884] bpf_fill_super+0x366/0x6f0 [ 426.807244][T10884] ? bpf_get_tree+0x20/0x20 [ 426.811794][T10884] ? sget_fc+0x6a8/0x750 [ 426.816068][T10884] ? kill_litter_super+0xa0/0xa0 [ 426.821028][T10884] ? bpf_get_tree+0x20/0x20 [ 426.825595][T10884] get_tree_nodev+0xb0/0x160 [ 426.830221][T10884] vfs_get_tree+0x88/0x270 [ 426.834662][T10884] vfs_fsconfig_locked+0x22f/0x400 [ 426.839818][T10884] __se_sys_fsconfig+0x69e/0x7e0 [ 426.844789][T10884] ? __x64_sys_fsconfig+0xc0/0xc0 [ 426.849858][T10884] ? lockdep_hardirqs_on+0x94/0x140 [ 426.855080][T10884] ? __x64_sys_fsconfig+0x1c/0xc0 [ 426.860137][T10884] do_syscall_64+0x4c/0xa0 [ 426.864584][T10884] ? clear_bhb_loop+0x60/0xb0 [ 426.869313][T10884] ? clear_bhb_loop+0x60/0xb0 [ 426.874019][T10884] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 426.879952][T10884] RIP: 0033:0x7fd735b9f559 [ 426.884418][T10884] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 426.904078][T10884] RSP: 002b:00007fd7369fb028 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 426.912519][T10884] RAX: ffffffffffffffda RBX: 00007fd735e25fa0 RCX: 00007fd735b9f559 [ 426.920513][T10884] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 [ 426.928503][T10884] RBP: 00007fd735c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 426.936494][T10884] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 426.944482][T10884] R13: 00007fd735e26038 R14: 00007fd735e25fa0 R15: 00007ffe05eb34f8 [ 426.952497][T10884] [ 427.584270][T10907] device syzkaller0 entered promiscuous mode [ 427.619944][T10907] tipc: Enabled bearer , priority 0 [ 427.642316][T10909] device syzkaller0 entered promiscuous mode [ 427.689439][T10907] tipc: Resetting bearer [ 427.790098][T10906] tipc: Resetting bearer [ 427.867318][T10906] tipc: Disabling bearer [ 427.931939][ T4289] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 428.063832][T10924] netlink: 340 bytes leftover after parsing attributes in process `syz.6.1855'. [ 428.091815][ C0] net_ratelimit: 68 callbacks suppressed [ 428.091920][T10924] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1855'. [ 428.574779][T10940] device syzkaller0 entered promiscuous mode [ 428.775953][T10944] tipc: Started in network mode [ 428.780900][T10944] tipc: Node identity ae4118937456, cluster identity 4711 [ 428.843093][T10944] tipc: Enabled bearer , priority 0 [ 428.897286][T10944] tipc: Resetting bearer [ 429.003103][T10943] tipc: Disabling bearer [ 429.779891][T10978] device syzkaller0 entered promiscuous mode [ 430.639308][T11007] using random self ethernet address [ 430.680688][T11007] using random host ethernet address [ 430.972396][ T50] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 431.162968][T11024] device syzkaller0 entered promiscuous mode [ 431.180730][T11025] tipc: Enabled bearer , priority 0 [ 431.237489][T11016] tipc: Resetting bearer [ 431.341393][T11016] tipc: Disabling bearer [ 431.958421][T11050] autofs4:pid:11050:autofs_fill_super: called with bogus options [ 433.371828][ C1] net_ratelimit: 72 callbacks suppressed [ 434.172275][ T50] Bluetooth: hci4: command 0x1003 tx timeout [ 434.179149][ T4289] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 435.004394][T11138] sctp: [Deprecated]: syz.6.1931 (pid 11138) Use of struct sctp_assoc_value in delayed_ack socket option. [ 435.004394][T11138] Use struct sctp_sack_info instead [ 435.615055][T11151] device syzkaller0 entered promiscuous mode [ 435.657475][T11151] tipc: Enabled bearer , priority 0 [ 435.702447][T11151] tipc: Resetting bearer [ 435.723650][T11150] tipc: Resetting bearer [ 435.803168][T11150] tipc: Disabling bearer [ 435.939834][T11158] device syzkaller0 entered promiscuous mode [ 436.369866][T11172] loop4: detected capacity change from 0 to 1024 [ 436.396103][T11172] EXT4-fs: Ignoring removed nomblk_io_submit option [ 436.509532][T11172] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 436.756888][ T4275] EXT4-fs (loop4): unmounting filesystem. [ 437.451799][ T50] Bluetooth: hci4: command 0x1003 tx timeout [ 437.458722][ T4289] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 437.700032][T11202] device syzkaller0 entered promiscuous mode [ 437.736058][T11202] tipc: Enabled bearer , priority 0 [ 437.759894][T11202] tipc: Resetting bearer [ 437.774862][T11201] tipc: Resetting bearer [ 437.825543][T11201] tipc: Disabling bearer [ 437.848147][T11205] program syz.7.1952 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 438.029407][T11207] device syzkaller0 entered promiscuous mode [ 438.571698][ C1] net_ratelimit: 88 callbacks suppressed [ 438.796602][T11239] device syzkaller0 entered promiscuous mode [ 438.848210][T11239] tipc: Enabled bearer , priority 0 [ 438.905195][T11239] tipc: Resetting bearer [ 438.940079][T11238] tipc: Resetting bearer [ 439.003176][T11238] tipc: Disabling bearer [ 439.229842][T11250] netlink: 'syz.7.1968': attribute type 2 has an invalid length. [ 439.251599][T11250] netlink: 51 bytes leftover after parsing attributes in process `syz.7.1968'. [ 439.295418][T11252] sctp: [Deprecated]: syz.6.1969 (pid 11252) Use of int in max_burst socket option. [ 439.295418][T11252] Use struct sctp_assoc_value instead [ 439.465562][T11254] device syzkaller1 entered promiscuous mode [ 439.936972][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.800581][T11299] device syzkaller1 entered promiscuous mode [ 442.370997][T11348] program syz.2.2004 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 442.517095][T11339] device syzkaller1 entered promiscuous mode [ 443.768171][T11391] device syzkaller1 entered promiscuous mode [ 443.774383][ C1] net_ratelimit: 64 callbacks suppressed [ 444.951316][T11430] block device autoloading is deprecated and will be removed. [ 445.147222][T11440] printk: console [ttyS0] disabled [ 445.222395][T11447] block device autoloading is deprecated and will be removed. [ 445.427028][T11444] printk: console [ttyS0] enabled [ 445.645264][T11455] device syzkaller0 entered promiscuous mode [ 445.953684][T11465] netlink: 28 bytes leftover after parsing attributes in process `syz.7.2044'. [ 446.867265][T11490] device syzkaller1 entered promiscuous mode [ 446.971156][T11496] loop4: detected capacity change from 0 to 1024 [ 447.072200][T11496] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #3: block 2: comm syz.4.2054: lblock 2 mapped to illegal pblock 2 (length 1) [ 447.097972][T11501] device syzkaller0 entered promiscuous mode [ 447.135068][T11496] Quota error (device loop4): qtree_write_dquot: dquota write failed [ 447.160542][T11496] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #3: block 48: comm syz.4.2054: lblock 0 mapped to illegal pblock 48 (length 1) [ 447.175926][T11496] Quota error (device loop4): v2_write_file_info: Can't write info structure [ 447.188840][T11496] EXT4-fs error (device loop4): ext4_acquire_dquot:6841: comm syz.4.2054: Failed to acquire dquot type 0 [ 447.200906][T11496] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5952: Corrupt filesystem [ 447.218592][T11496] EXT4-fs error (device loop4): ext4_evict_inode:281: inode #11: comm syz.4.2054: mark_inode_dirty error [ 447.271531][T11496] EXT4-fs warning (device loop4): ext4_evict_inode:284: couldn't mark inode dirty (err -117) [ 447.298098][T11496] EXT4-fs (loop4): 1 orphan inode deleted [ 447.310654][T11496] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 447.329066][ T48] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #3: block 1: comm kworker/u4:3: lblock 1 mapped to illegal pblock 1 (length 1) [ 447.355309][T11505] netlink: 32 bytes leftover after parsing attributes in process `syz.7.2057'. [ 447.388124][ T48] Quota error (device loop4): remove_tree: Can't read quota data block 1 [ 447.408775][ T48] EXT4-fs error (device loop4): ext4_release_dquot:6877: comm kworker/u4:3: Failed to release dquot type 0 [ 447.513623][ T4275] EXT4-fs (loop4): unmounting filesystem. [ 447.549225][ T6571] EXT4-fs error (device loop4): ext4_map_blocks:637: inode #3: block 1: comm kworker/u4:17: lblock 1 mapped to illegal pblock 1 (length 1) [ 447.595519][T11510] netlink: 28 bytes leftover after parsing attributes in process `syz.7.2059'. [ 447.614678][ T6571] Quota error (device loop4): remove_tree: Can't read quota data block 1 [ 447.635296][ T6571] EXT4-fs error (device loop4): ext4_release_dquot:6877: comm kworker/u4:17: Failed to release dquot type 0 [ 447.661509][ T4275] EXT4-fs error (device loop4): __ext4_get_inode_loc:4520: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 447.742661][ T4275] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5952: Corrupt filesystem [ 447.815181][ T4275] EXT4-fs error (device loop4): ext4_quota_off:7147: inode #3: comm syz-executor: mark_inode_dirty error [ 448.082577][T11519] FAULT_INJECTION: forcing a failure. [ 448.082577][T11519] name failslab, interval 1, probability 0, space 0, times 0 [ 448.133016][T11519] CPU: 1 PID: 11519 Comm: syz.2.2063 Not tainted syzkaller #0 [ 448.140567][T11519] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 448.150672][T11519] Call Trace: [ 448.153990][T11519] [ 448.156959][T11519] dump_stack_lvl+0x188/0x24e [ 448.161689][T11519] ? show_regs_print_info+0x12/0x12 [ 448.166946][T11519] ? load_image+0x410/0x410 [ 448.171505][T11519] ? __might_sleep+0xd0/0xd0 [ 448.176156][T11519] ? __lock_acquire+0x7ea0/0x7ea0 [ 448.181246][T11519] should_fail_ex+0x390/0x4c0 [ 448.185968][T11519] should_failslab+0x5/0x20 [ 448.190607][T11519] slab_pre_alloc_hook+0x59/0x300 [ 448.195694][T11519] ? loop_add+0x54/0x9a0 [ 448.199999][T11519] __kmem_cache_alloc_node+0x4f/0x270 [ 448.205434][T11519] ? loop_add+0x54/0x9a0 [ 448.209733][T11519] kmalloc_trace+0x26/0xe0 [ 448.214199][T11519] loop_add+0x54/0x9a0 [ 448.218354][T11519] loop_control_ioctl+0x124/0x590 [ 448.223472][T11519] ? loop_set_hw_queue_depth+0x60/0x60 [ 448.229007][T11519] ? bpf_lsm_file_ioctl+0x5/0x10 [ 448.234025][T11519] ? security_file_ioctl+0x7c/0xa0 [ 448.239208][T11519] ? loop_set_hw_queue_depth+0x60/0x60 [ 448.244733][T11519] __se_sys_ioctl+0xfa/0x170 [ 448.249382][T11519] do_syscall_64+0x4c/0xa0 [ 448.253824][T11519] ? clear_bhb_loop+0x60/0xb0 [ 448.258532][T11519] ? clear_bhb_loop+0x60/0xb0 [ 448.263250][T11519] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 448.263290][T11519] RIP: 0033:0x7fec9ed9f559 [ 448.263314][T11519] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 448.263336][T11519] RSP: 002b:00007fec9fc1f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 448.263359][T11519] RAX: ffffffffffffffda RBX: 00007fec9f025fa0 RCX: 00007fec9ed9f559 [ 448.263375][T11519] RDX: 00000000ffffffe4 RSI: 0000000000004c80 RDI: 0000000000000004 [ 448.269618][T11519] RBP: 00007fec9ee36b20 R08: 0000000000000000 R09: 0000000000000000 [ 448.269640][T11519] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 448.269655][T11519] R13: 00007fec9f026038 R14: 00007fec9f025fa0 R15: 00007fffd9994cf8 [ 448.269689][T11519] [ 448.441469][T11525] netlink: 'syz.7.2064': attribute type 9 has an invalid length. [ 448.520161][T11525] netlink: 463 bytes leftover after parsing attributes in process `syz.7.2064'. [ 448.632528][T11532] device syzkaller1 entered promiscuous mode [ 448.759652][T11537] netlink: 32 bytes leftover after parsing attributes in process `syz.7.2069'. [ 449.051705][ C1] net_ratelimit: 68 callbacks suppressed [ 449.378717][T11556] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2074'. [ 450.177425][T11576] netlink: 32 bytes leftover after parsing attributes in process `syz.6.2081'. [ 450.259378][T11577] device syzkaller1 entered promiscuous mode [ 450.644974][T11588] autofs4:pid:11588:autofs_fill_super: called with bogus options [ 451.093957][T11593] device syzkaller0 entered promiscuous mode [ 451.126135][T11593] tipc: Enabled bearer , priority 0 [ 451.153923][T11595] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2089'. [ 451.387392][T11598] tipc: Resetting bearer [ 451.403868][T11597] device syzkaller0 entered promiscuous mode [ 451.430863][T11592] tipc: Resetting bearer [ 451.529977][T11592] tipc: Disabling bearer [ 451.904354][T11611] netlink: 388 bytes leftover after parsing attributes in process `syz.4.2095'. [ 452.129839][T11617] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2097'. [ 452.155205][T11617] netlink: 28 bytes leftover after parsing attributes in process `syz.7.2097'. [ 452.185702][T11617] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2097'. [ 452.207643][T11617] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2097'. [ 452.547252][T11632] FAULT_INJECTION: forcing a failure. [ 452.547252][T11632] name failslab, interval 1, probability 0, space 0, times 0 [ 452.602152][T11632] CPU: 1 PID: 11632 Comm: syz.1.2103 Not tainted syzkaller #0 [ 452.609687][T11632] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 452.619761][T11632] Call Trace: [ 452.619774][T11632] [ 452.619784][T11632] dump_stack_lvl+0x188/0x24e [ 452.619818][T11632] ? show_regs_print_info+0x12/0x12 [ 452.619842][T11632] ? load_image+0x410/0x410 [ 452.626124][T11632] ? __lock_acquire+0x7ea0/0x7ea0 [ 452.636350][T11632] should_fail_ex+0x390/0x4c0 [ 452.636392][T11632] should_failslab+0x5/0x20 [ 452.650732][T11632] slab_pre_alloc_hook+0x59/0x300 [ 452.660310][T11632] kmem_cache_alloc+0x56/0x2f0 [ 452.660341][T11632] ? create_new_namespaces+0x34/0x700 [ 452.670512][T11632] create_new_namespaces+0x34/0x700 [ 452.670556][T11632] ? __fget_files+0x3fc/0x460 [ 452.680469][T11632] __se_sys_setns+0x2c8/0x1600 [ 452.680527][T11632] ? __x64_sys_setns+0x60/0x60 [ 452.690112][T11632] ? lockdep_hardirqs_on+0x94/0x140 [ 452.695393][T11632] do_syscall_64+0x4c/0xa0 [ 452.699903][T11632] ? clear_bhb_loop+0x60/0xb0 [ 452.704666][T11632] ? clear_bhb_loop+0x60/0xb0 [ 452.709409][T11632] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 452.715377][T11632] RIP: 0033:0x7fa741b9f559 [ 452.719854][T11632] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 452.739494][T11632] RSP: 002b:00007fa742993028 EFLAGS: 00000246 ORIG_RAX: 0000000000000134 [ 452.739530][T11632] RAX: ffffffffffffffda RBX: 00007fa741e25fa0 RCX: 00007fa741b9f559 [ 452.739549][T11632] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000000c9 [ 452.739565][T11632] RBP: 00007fa741c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 452.739587][T11632] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 452.739604][T11632] R13: 00007fa741e26038 R14: 00007fa741e25fa0 R15: 00007ffee326e798 [ 452.739644][T11632] [ 452.943298][T11634] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(5) [ 452.949902][T11634] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 452.980525][T11634] vhci_hcd vhci_hcd.0: Device attached [ 453.008946][T11636] device syzkaller0 entered promiscuous mode [ 453.029169][T11639] vhci_hcd: connection closed [ 453.034505][ T5134] vhci_hcd: stop threads [ 453.038939][ T5134] vhci_hcd: release socket [ 453.051360][ T5134] vhci_hcd: disconnect device [ 453.533468][T11651] netlink: 388 bytes leftover after parsing attributes in process `syz.7.2108'. [ 453.641343][T11655] pim6reg0: tun_chr_ioctl cmd 3223385353 [ 453.660922][T11655] pim6reg0: tun_chr_ioctl cmd 1074025692 [ 453.884784][T11663] FAULT_INJECTION: forcing a failure. [ 453.884784][T11663] name failslab, interval 1, probability 0, space 0, times 0 [ 453.970673][T11663] CPU: 0 PID: 11663 Comm: syz.7.2111 Not tainted syzkaller #0 [ 453.978224][T11663] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 453.988329][T11663] Call Trace: [ 453.991654][T11663] [ 453.994623][T11663] dump_stack_lvl+0x188/0x24e [ 453.999344][T11663] ? show_regs_print_info+0x12/0x12 [ 454.004596][T11663] ? load_image+0x410/0x410 [ 454.009160][T11663] ? __lock_acquire+0x7ea0/0x7ea0 [ 454.014255][T11663] should_fail_ex+0x390/0x4c0 [ 454.019005][T11663] should_failslab+0x5/0x20 [ 454.023556][T11663] slab_pre_alloc_hook+0x59/0x300 [ 454.028630][T11663] ? param_get_dyndbg_classes+0x160/0x160 [ 454.034447][T11663] ? x509_fabricate_name+0x555/0x950 [ 454.039791][T11663] __kmem_cache_alloc_node+0x4f/0x270 [ 454.045220][T11663] ? x509_fabricate_name+0x555/0x950 [ 454.050547][T11663] __kmalloc+0xa3/0x240 [ 454.054780][T11663] x509_fabricate_name+0x555/0x950 [ 454.059960][T11663] asn1_ber_decoder+0x1816/0x21b0 [ 454.065056][T11663] ? __se_sys_add_key+0x34b/0x410 [ 454.070169][T11663] ? ref_tracker_free+0x830/0x830 [ 454.075277][T11663] x509_cert_parse+0x1ae/0x7a0 [ 454.080117][T11663] x509_key_preparse+0x60/0x660 [ 454.085049][T11663] ? down_read+0x1a8/0x2d0 [ 454.089546][T11663] asymmetric_key_preparse+0xa5/0x140 [ 454.094987][T11663] key_create_or_update+0x432/0xa40 [ 454.100249][T11663] ? security_key_permission+0x7c/0xa0 [ 454.105782][T11663] ? key_type_put+0x20/0x20 [ 454.110351][T11663] ? lookup_user_key_possessed+0x40/0x40 [ 454.116075][T11663] ? __might_fault+0xc2/0x120 [ 454.120811][T11663] ? __might_fault+0xa6/0x120 [ 454.125557][T11663] __se_sys_add_key+0x34b/0x410 [ 454.130476][T11663] ? __x64_sys_add_key+0xc0/0xc0 [ 454.135492][T11663] ? lockdep_hardirqs_on+0x94/0x140 [ 454.140812][T11663] ? __x64_sys_add_key+0x1c/0xc0 [ 454.145821][T11663] do_syscall_64+0x4c/0xa0 [ 454.150287][T11663] ? clear_bhb_loop+0x60/0xb0 [ 454.155019][T11663] ? clear_bhb_loop+0x60/0xb0 [ 454.159752][T11663] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 454.165706][T11663] RIP: 0033:0x7f578939f559 [ 454.170168][T11663] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 454.189832][T11663] RSP: 002b:00007f578a33d028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 454.198315][T11663] RAX: ffffffffffffffda RBX: 00007f5789625fa0 RCX: 00007f578939f559 [ 454.206346][T11663] RDX: 0000200000000340 RSI: 0000000000000000 RDI: 0000200000000200 [ 454.214372][T11663] RBP: 00007f5789436b20 R08: ffffffffffffffff R09: 0000000000000000 [ 454.222399][T11663] R10: 0000000000000559 R11: 0000000000000246 R12: 0000000000000000 [ 454.230428][T11663] R13: 00007f5789626038 R14: 00007f5789625fa0 R15: 00007ffc1f184498 [ 454.238484][T11663] [ 454.261710][ C1] net_ratelimit: 54 callbacks suppressed [ 454.340818][T11670] device syzkaller0 entered promiscuous mode [ 455.143347][T11693] device syzkaller0 entered promiscuous mode [ 455.390180][T11701] netlink: 388 bytes leftover after parsing attributes in process `syz.4.2121'. [ 455.519875][T11703] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(5) [ 455.526476][T11703] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 455.631758][T11703] vhci_hcd vhci_hcd.0: Device attached [ 455.655157][T11705] vhci_hcd: connection closed [ 455.665078][ T5134] vhci_hcd: stop threads [ 455.669470][ T5134] vhci_hcd: release socket [ 455.709385][ T5134] vhci_hcd: disconnect device [ 455.806050][T11715] loop4: detected capacity change from 0 to 512 [ 455.844328][T11715] EXT4-fs: Ignoring removed orlov option [ 455.885893][T11715] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 455.999617][T11715] EXT4-fs error (device loop4): ext4_mb_mark_diskspace_used:3861: comm syz.4.2125: Allocating blocks 41-42 which overlap fs metadata [ 456.059670][T11715] Quota error (device loop4): write_blk: dquota write failed [ 456.090271][T11724] random: crng reseeded on system resumption [ 456.092312][T11715] Quota error (device loop4): find_free_dqentry: Can't write quota data block 5 [ 456.131885][T11715] EXT4-fs error (device loop4): ext4_mb_mark_diskspace_used:3861: comm syz.4.2125: Allocating blocks 41-42 which overlap fs metadata [ 456.194453][T11715] Quota error (device loop4): write_blk: dquota write failed [ 456.233628][T11715] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 456.262174][T11715] EXT4-fs error (device loop4): ext4_acquire_dquot:6841: comm syz.4.2125: Failed to acquire dquot type 1 [ 456.312269][T11715] EXT4-fs error (device loop4): mb_free_blocks:1839: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 456.397303][T11715] EXT4-fs error (device loop4): ext4_do_update_inode:5279: inode #12: comm syz.4.2125: corrupted inode contents [ 456.419899][T11709] DRBG: could not allocate digest TFM handle: hmac(sha512) [ 456.491814][T11715] EXT4-fs error (device loop4): ext4_dirty_inode:6166: inode #12: comm syz.4.2125: mark_inode_dirty error [ 456.582092][T11715] EXT4-fs error (device loop4): ext4_do_update_inode:5279: inode #12: comm syz.4.2125: corrupted inode contents [ 456.661712][T11715] EXT4-fs error (device loop4): __ext4_ext_dirty:202: inode #12: comm syz.4.2125: mark_inode_dirty error [ 456.752063][T11715] EXT4-fs error (device loop4): ext4_do_update_inode:5279: inode #12: comm syz.4.2125: corrupted inode contents [ 456.798067][T11715] EXT4-fs error (device loop4) in ext4_orphan_del:303: Corrupt filesystem [ 456.844289][T11715] EXT4-fs error (device loop4): ext4_do_update_inode:5279: inode #12: comm syz.4.2125: corrupted inode contents [ 456.872424][T11715] EXT4-fs error (device loop4): ext4_truncate:4325: inode #12: comm syz.4.2125: mark_inode_dirty error [ 456.942235][T11715] EXT4-fs error (device loop4) in ext4_process_orphan:345: Corrupt filesystem [ 457.001943][T11715] EXT4-fs (loop4): 1 truncate cleaned up [ 457.007681][T11715] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 457.165061][T11715] EXT4-fs error (device loop4): __ext4_remount:6650: comm syz.4.2125: Abort forced by user [ 457.200144][T11715] EXT4-fs (loop4): Remounting filesystem read-only [ 457.232739][T11715] EXT4-fs (loop4): re-mounted. Quota mode: writeback. [ 457.290283][T11755] Quota error (device loop4): write_blk: dquota write failed [ 457.348074][T11755] Quota error (device loop4): qtree_write_dquot: Error -28 occurred while creating quota [ 457.402645][T11755] EXT4-fs error (device loop4): ext4_acquire_dquot:6841: comm syz.4.2125: Failed to acquire dquot type 1 [ 457.634537][ T4275] EXT4-fs (loop4): unmounting filesystem. [ 457.945276][T11768] device syzkaller0 entered promiscuous mode [ 457.971169][T11772] netlink: 388 bytes leftover after parsing attributes in process `syz.7.2135'. [ 458.035000][T11773] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2136'. [ 458.803852][T11794] device syzkaller0 entered promiscuous mode [ 459.856280][ C1] net_ratelimit: 60 callbacks suppressed [ 460.918629][T11820] program syz.2.2153 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 462.650749][T11854] device syzkaller0 entered promiscuous mode [ 462.984288][T11869] program syz.6.2170 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 463.960834][T11897] device syzkaller0 entered promiscuous mode [ 464.111806][T11904] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 464.118396][T11904] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 464.158190][T11904] vhci_hcd vhci_hcd.0: Device attached [ 464.204986][T11905] vhci_hcd: connection closed [ 464.212262][ T6571] vhci_hcd: stop threads [ 464.216605][ T6571] vhci_hcd: release socket [ 464.221059][ T6571] vhci_hcd: disconnect device [ 464.891717][ C0] net_ratelimit: 62 callbacks suppressed [ 465.456289][T11947] device syzkaller0 entered promiscuous mode [ 465.481499][T11949] program syz.6.2199 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 466.521847][T11974] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 466.528449][T11974] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 466.615485][T11974] vhci_hcd vhci_hcd.0: Device attached [ 466.634082][T11978] vhci_hcd: connection closed [ 466.649077][ T48] vhci_hcd: stop threads [ 466.671724][ T48] vhci_hcd: release socket [ 466.692792][ T48] vhci_hcd: disconnect device [ 466.991065][T11994] program syz.6.2211 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 467.500331][T12012] FAULT_INJECTION: forcing a failure. [ 467.500331][T12012] name failslab, interval 1, probability 0, space 0, times 0 [ 467.531289][T12012] CPU: 1 PID: 12012 Comm: syz.1.2217 Not tainted syzkaller #0 [ 467.538867][T12012] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 467.548977][T12012] Call Trace: [ 467.552296][T12012] [ 467.555288][T12012] dump_stack_lvl+0x188/0x24e [ 467.560065][T12012] ? show_regs_print_info+0x12/0x12 [ 467.565311][T12012] ? load_image+0x410/0x410 [ 467.569880][T12012] ? __might_sleep+0xd0/0xd0 [ 467.574527][T12012] ? __lock_acquire+0x7ea0/0x7ea0 [ 467.579611][T12012] should_fail_ex+0x390/0x4c0 [ 467.584358][T12012] should_failslab+0x5/0x20 [ 467.588936][T12012] slab_pre_alloc_hook+0x59/0x300 [ 467.594022][T12012] ? crypto_create_tfm_node+0x73/0x380 [ 467.599538][T12012] __kmem_cache_alloc_node+0x4f/0x270 [ 467.604975][T12012] ? crypto_create_tfm_node+0x73/0x380 [ 467.610491][T12012] __kmalloc_node+0xa2/0x240 [ 467.615137][T12012] crypto_create_tfm_node+0x73/0x380 [ 467.620484][T12012] crypto_spawn_tfm2+0x58/0x90 [ 467.625306][T12012] pkcs1pad_init_tfm+0x44/0x120 [ 467.630207][T12012] crypto_create_tfm_node+0x151/0x380 [ 467.635663][T12012] ? crypto_alg_mod_lookup+0x1a9/0x570 [ 467.641159][T12012] crypto_alloc_tfm_node+0x177/0x360 [ 467.646495][T12012] public_key_verify_signature+0x27b/0xd20 [ 467.646521][T12012] ? x509_cert_parse+0x53a/0x7a0 [ 467.646542][T12012] ? x509_key_preparse+0x60/0x660 [ 467.646566][T12012] ? asymmetric_key_preparse+0xa5/0x140 [ 467.646588][T12012] ? key_create_or_update+0x432/0xa40 [ 467.657348][T12012] ? do_syscall_64+0x4c/0xa0 [ 467.667915][T12012] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 467.677894][T12012] ? public_key_free+0x80/0x80 [ 467.688770][T12012] ? asymmetric_key_generate_id+0x52/0xd0 [ 467.688798][T12012] ? asymmetric_key_id_same+0x63/0xe0 [ 467.699892][T12012] x509_check_for_self_signed+0x317/0x420 [ 467.699929][T12012] x509_cert_parse+0x59c/0x7a0 [ 467.710410][T12012] x509_key_preparse+0x60/0x660 [ 467.715292][T12012] ? down_read+0x1a8/0x2d0 [ 467.715325][T12012] asymmetric_key_preparse+0xa5/0x140 [ 467.715351][T12012] key_create_or_update+0x432/0xa40 [ 467.725137][T12012] ? security_key_permission+0x7c/0xa0 [ 467.725173][T12012] ? key_type_put+0x20/0x20 [ 467.735845][T12012] ? lookup_user_key_possessed+0x40/0x40 [ 467.735892][T12012] ? __might_fault+0xc2/0x120 [ 467.746028][T12012] ? __might_fault+0xa6/0x120 [ 467.746063][T12012] __se_sys_add_key+0x34b/0x410 [ 467.755440][T12012] ? __x64_sys_add_key+0xc0/0xc0 [ 467.755481][T12012] ? lockdep_hardirqs_on+0x94/0x140 [ 467.765316][T12012] ? __x64_sys_add_key+0x1c/0xc0 [ 467.765348][T12012] do_syscall_64+0x4c/0xa0 [ 467.765370][T12012] ? clear_bhb_loop+0x60/0xb0 [ 467.775501][T12012] ? clear_bhb_loop+0x60/0xb0 [ 467.784600][T12012] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 467.784640][T12012] RIP: 0033:0x7fa741b9f559 [ 467.789341][T12012] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 467.819308][T12012] RSP: 002b:00007fa742993028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 467.819339][T12012] RAX: ffffffffffffffda RBX: 00007fa741e25fa0 RCX: 00007fa741b9f559 [ 467.819355][T12012] RDX: 0000200000000340 RSI: 0000000000000000 RDI: 0000200000000200 [ 467.819372][T12012] RBP: 00007fa741c36b20 R08: ffffffffffffffff R09: 0000000000000000 [ 467.819389][T12012] R10: 0000000000000559 R11: 0000000000000246 R12: 0000000000000000 [ 467.835784][T12012] R13: 00007fa741e26038 R14: 00007fa741e25fa0 R15: 00007ffee326e798 [ 467.835824][T12012] [ 468.478375][T12036] program syz.1.2224 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 468.908074][T12044] netlink: 88 bytes leftover after parsing attributes in process `syz.7.2227'. [ 468.949507][T12044] device syzkaller1 entered promiscuous mode [ 469.281707][T12062] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 469.288369][T12062] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 470.154636][ C1] net_ratelimit: 53 callbacks suppressed [ 470.263610][T12062] vhci_hcd vhci_hcd.0: Device attached [ 470.365377][T12060] device syzkaller0 entered promiscuous mode [ 470.441774][T12063] vhci_hcd: connection closed [ 470.451786][ T4989] vhci_hcd: stop threads [ 470.456096][ T4989] vhci_hcd: release socket [ 470.461818][ T4349] vhci_hcd: vhci_device speed not set [ 470.521845][ T4989] vhci_hcd: disconnect device [ 470.531738][ T4349] usb 35-1: new full-speed USB device number 7 using vhci_hcd [ 471.419072][T12104] device syzkaller0 entered promiscuous mode [ 472.124677][T12127] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 472.131261][T12127] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 472.151324][T12127] vhci_hcd vhci_hcd.0: Device attached [ 472.170613][T12133] vhci_hcd: connection reset by peer [ 472.179013][ T6571] vhci_hcd: stop threads [ 472.184779][ T6571] vhci_hcd: release socket [ 472.219142][ T6571] vhci_hcd: disconnect device [ 472.600347][T12147] device syzkaller0 entered promiscuous mode [ 475.028038][T12203] device syzkaller0 entered promiscuous mode [ 475.133721][T12210] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 475.140310][T12210] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 475.160254][T12210] vhci_hcd vhci_hcd.0: Device attached [ 475.188058][T12212] vhci_hcd: connection closed [ 475.200475][ T9] vhci_hcd: stop threads [ 475.207944][ T9] vhci_hcd: release socket [ 475.252610][ T9] vhci_hcd: disconnect device [ 475.371788][ C1] net_ratelimit: 71 callbacks suppressed [ 476.032094][ T4349] vhci_hcd: vhci_device speed not set [ 479.948221][T12284] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 479.954793][T12284] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 479.973332][T12284] vhci_hcd vhci_hcd.0: Device attached [ 480.173878][ T4349] vhci_hcd: vhci_device speed not set [ 480.242256][ T4349] usb 35-1: new full-speed USB device number 8 using vhci_hcd [ 480.419807][T12294] vhci_hcd: connection reset by peer [ 480.427033][ T9665] vhci_hcd: stop threads [ 480.431993][ T9665] vhci_hcd: release socket [ 480.458117][ T9665] vhci_hcd: disconnect device [ 480.971809][ C1] net_ratelimit: 51 callbacks suppressed [ 481.587280][T12334] netlink: 'syz.2.2312': attribute type 4 has an invalid length. [ 482.030680][T12339] netlink: 'syz.2.2312': attribute type 4 has an invalid length. [ 482.091769][T12340] tipc: Enabled bearer , priority 0 [ 482.448076][T12335] tipc: Disabling bearer [ 483.596387][T12378] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(5) [ 483.602978][T12378] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 483.688981][T12378] vhci_hcd vhci_hcd.0: Device attached [ 483.891765][ T6803] vhci_hcd: vhci_device speed not set [ 483.961819][ T6803] usb 41-1: new full-speed USB device number 2 using vhci_hcd [ 484.018686][T12392] netlink: 76 bytes leftover after parsing attributes in process `syz.2.2326'. [ 484.101927][T12382] vhci_hcd: connection reset by peer [ 484.108037][ T6627] vhci_hcd: stop threads [ 484.112457][ T6627] vhci_hcd: release socket [ 484.138148][ T6627] vhci_hcd: disconnect device [ 484.207405][T12392] device syzkaller1 entered promiscuous mode [ 485.371806][ T4349] vhci_hcd: vhci_device speed not set [ 485.560224][T12436] netlink: 76 bytes leftover after parsing attributes in process `syz.1.2342'. [ 485.573019][T12436] device syzkaller1 entered promiscuous mode [ 486.341315][T12475] net_ratelimit: 59 callbacks suppressed [ 486.341328][T12475] IPVS: lblcr: FWM 3 0x00000003 - no destination available [ 487.007803][T12491] netlink: 72 bytes leftover after parsing attributes in process `syz.6.2361'. [ 487.129771][T12498] device syzkaller1 entered promiscuous mode [ 488.457031][T12542] netlink: 72 bytes leftover after parsing attributes in process `syz.1.2377'. [ 488.514977][T12536] device syzkaller1 entered promiscuous mode [ 488.942576][T12557] device syzkaller0 entered promiscuous mode [ 488.973114][T12557] tipc: Enabling of bearer rejected, failed to enable media [ 489.132424][ T6803] vhci_hcd: vhci_device speed not set [ 490.167192][T12584] netlink: 72 bytes leftover after parsing attributes in process `syz.6.2393'. [ 490.238451][T12584] device syzkaller1 entered promiscuous mode [ 491.077708][T12612] loop4: detected capacity change from 0 to 1024 [ 491.097582][T12612] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (7780!=20869) [ 491.116462][T12612] EXT4-fs (loop4): invalid journal inode [ 491.131574][T12612] EXT4-fs (loop4): can't get journal size [ 491.160302][T12612] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 491.177525][T12610] device syzkaller0 entered promiscuous mode [ 491.414420][T12612] EXT4-fs error (device loop4): ext4_readdir:263: inode #2: block 64: comm syz.4.2402: path /syzcgroup/unified/syz4: bad entry in directory: rec_len is too small for name_len - offset=0, inode=11, rec_len=12, size=1024 fake=0 [ 491.438928][T12612] EXT4-fs error (device loop4): ext4_readdir:263: inode #2: block 73: comm syz.4.2402: path /syzcgroup/unified/syz4: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=83886080, rec_len=0, size=1024 fake=0 [ 491.783758][T12629] net_ratelimit: 65 callbacks suppressed [ 491.783770][T12629] IPVS: lblcr: FWM 3 0x00000003 - no destination available [ 491.887211][T12631] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2408'. [ 491.911587][T12631] device syzkaller1 entered promiscuous mode [ 492.455910][T12645] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2415'. [ 492.953110][T12651] device syzkaller0 entered promiscuous mode [ 493.031737][T12651] tipc: Enabling of bearer rejected, failed to enable media [ 493.875559][T12667] netlink: 64 bytes leftover after parsing attributes in process `syz.7.2425'. [ 493.907248][T12667] device syzkaller1 entered promiscuous mode [ 494.604477][T12678] netlink: 24 bytes leftover after parsing attributes in process `syz.6.2427'. [ 494.953485][T12691] device syzkaller0 entered promiscuous mode [ 494.998469][T12691] tipc: Enabling of bearer rejected, failed to enable media [ 495.713583][T12709] netlink: 64 bytes leftover after parsing attributes in process `syz.1.2438'. [ 495.756284][T12709] device syzkaller1 entered promiscuous mode [ 496.830160][T12723] device syzkaller0 entered promiscuous mode [ 497.145987][T12726] tipc: Enabling of bearer rejected, failed to enable media [ 497.202892][ C0] net_ratelimit: 68 callbacks suppressed [ 497.631255][T12745] IPVS: lblcr: FWM 3 0x00000003 - no destination available [ 498.064582][T12757] device syzkaller1 entered promiscuous mode [ 499.163178][T12777] device syzkaller0 entered promiscuous mode [ 499.192756][T12777] tipc: Enabling of bearer rejected, failed to enable media [ 499.894275][T12801] device syzkaller1 entered promiscuous mode [ 501.375996][ T1281] ieee802154 phy0 wpan0: encryption failed: -22 [ 502.571698][ C1] net_ratelimit: 48 callbacks suppressed [ 503.577537][ T50] Bluetooth: hci0: command 0x0406 tx timeout [ 504.974701][T12863] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(5) [ 504.981287][T12863] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 506.305028][T12876] vhci_hcd: connection closed [ 506.354186][T12863] vhci_hcd vhci_hcd.0: Device attached [ 506.365070][ T48] vhci_hcd: stop threads [ 506.371703][ T48] vhci_hcd: release socket [ 506.376244][ T48] vhci_hcd: disconnect device [ 507.623458][T12905] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2504'. [ 508.411674][ C1] net_ratelimit: 63 callbacks suppressed [ 508.703089][T12919] FAULT_INJECTION: forcing a failure. [ 508.703089][T12919] name failslab, interval 1, probability 0, space 0, times 0 [ 508.741739][T12919] CPU: 1 PID: 12919 Comm: syz.7.2507 Not tainted syzkaller #0 [ 508.749273][T12919] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 508.759367][T12919] Call Trace: [ 508.762682][T12919] [ 508.765653][T12919] dump_stack_lvl+0x188/0x24e [ 508.770410][T12919] ? show_regs_print_info+0x12/0x12 [ 508.775650][T12919] ? load_image+0x410/0x410 [ 508.780239][T12919] ? __might_sleep+0xd0/0xd0 [ 508.784958][T12919] ? __lock_acquire+0x7ea0/0x7ea0 [ 508.790070][T12919] should_fail_ex+0x390/0x4c0 [ 508.794901][T12919] should_failslab+0x5/0x20 [ 508.799493][T12919] slab_pre_alloc_hook+0x59/0x300 [ 508.804599][T12919] ? loop_add+0x54/0x9a0 [ 508.809219][T12919] __kmem_cache_alloc_node+0x4f/0x270 [ 508.814642][T12919] ? loop_add+0x54/0x9a0 [ 508.818938][T12919] kmalloc_trace+0x26/0xe0 [ 508.823405][T12919] loop_add+0x54/0x9a0 [ 508.827540][T12919] loop_control_ioctl+0x124/0x590 [ 508.832629][T12919] ? loop_set_hw_queue_depth+0x60/0x60 [ 508.838153][T12919] ? bpf_lsm_file_ioctl+0x5/0x10 [ 508.843251][T12919] ? security_file_ioctl+0x7c/0xa0 [ 508.848463][T12919] ? loop_set_hw_queue_depth+0x60/0x60 [ 508.854048][T12919] __se_sys_ioctl+0xfa/0x170 [ 508.858722][T12919] do_syscall_64+0x4c/0xa0 [ 508.863203][T12919] ? clear_bhb_loop+0x60/0xb0 [ 508.867963][T12919] ? clear_bhb_loop+0x60/0xb0 [ 508.872677][T12919] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 508.878651][T12919] RIP: 0033:0x7f578939f559 [ 508.886752][T12919] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 508.906409][T12919] RSP: 002b:00007f578a33d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 508.914871][T12919] RAX: ffffffffffffffda RBX: 00007f5789625fa0 RCX: 00007f578939f559 [ 508.922937][T12919] RDX: 00000000ffffffe4 RSI: 0000000000004c80 RDI: 0000000000000004 [ 508.930949][T12919] RBP: 00007f5789436b20 R08: 0000000000000000 R09: 0000000000000000 [ 508.938954][T12919] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 508.946955][T12919] R13: 00007f5789626038 R14: 00007f5789625fa0 R15: 00007ffc1f184498 [ 508.954973][T12919] [ 511.585630][T12968] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2519'. [ 511.673011][T12966] device syzkaller1 entered promiscuous mode [ 511.736908][T12981] FAULT_INJECTION: forcing a failure. [ 511.736908][T12981] name failslab, interval 1, probability 0, space 0, times 0 [ 511.812354][T12981] CPU: 0 PID: 12981 Comm: syz.1.2522 Not tainted syzkaller #0 [ 511.819905][T12981] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 511.830016][T12981] Call Trace: [ 511.833339][T12981] [ 511.836320][T12981] dump_stack_lvl+0x188/0x24e [ 511.841070][T12981] ? show_regs_print_info+0x12/0x12 [ 511.846344][T12981] ? load_image+0x410/0x410 [ 511.850921][T12981] ? __might_sleep+0xd0/0xd0 [ 511.855574][T12981] ? __lock_acquire+0x7ea0/0x7ea0 [ 511.860673][T12981] ? mod_objcg_state+0x51d/0x8b0 [ 511.865823][T12981] should_fail_ex+0x390/0x4c0 [ 511.870584][T12981] should_failslab+0x5/0x20 [ 511.875155][T12981] slab_pre_alloc_hook+0x59/0x300 [ 511.880272][T12981] kmem_cache_alloc_lru+0x49/0x2e0 [ 511.885469][T12981] ? __d_alloc+0x2e/0x6e0 [ 511.889907][T12981] __d_alloc+0x2e/0x6e0 [ 511.894128][T12981] d_alloc_name+0xb7/0x320 [ 511.898609][T12981] ? clear_nonspinnable+0x60/0x60 [ 511.903706][T12981] ? do_raw_spin_lock+0x128/0x2f0 [ 511.908791][T12981] ? d_alloc_pseudo+0x70/0x70 [ 511.913541][T12981] proc_setup_self+0xab/0x2d0 [ 511.918323][T12981] ? _raw_spin_unlock+0x24/0x40 [ 511.923245][T12981] proc_fill_super+0x4ea/0x730 [ 511.928066][T12981] ? proc_reconfigure+0x370/0x370 [ 511.933180][T12981] get_tree_nodev+0xb0/0x160 [ 511.937935][T12981] vfs_get_tree+0x88/0x270 [ 511.942420][T12981] do_new_mount+0x247/0xa40 [ 511.947070][T12981] __se_sys_mount+0x2e3/0x3d0 [ 511.951827][T12981] ? __x64_sys_mount+0xc0/0xc0 [ 511.956661][T12981] ? lockdep_hardirqs_on+0x94/0x140 [ 511.961921][T12981] ? __x64_sys_mount+0x1c/0xc0 [ 511.966754][T12981] do_syscall_64+0x4c/0xa0 [ 511.971229][T12981] ? clear_bhb_loop+0x60/0xb0 [ 511.975974][T12981] ? clear_bhb_loop+0x60/0xb0 [ 511.980712][T12981] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 511.986678][T12981] RIP: 0033:0x7fa741b9f559 [ 511.991148][T12981] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 512.010821][T12981] RSP: 002b:00007fa742993028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 512.019328][T12981] RAX: ffffffffffffffda RBX: 00007fa741e25fa0 RCX: 00007fa741b9f559 [ 512.027358][T12981] RDX: 0000200000000180 RSI: 0000200000000140 RDI: 0000000000000000 [ 512.037578][T12981] RBP: 00007fa741c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 512.045606][T12981] R10: 0000000000004000 R11: 0000000000000246 R12: 0000000000000000 [ 512.053614][T12981] R13: 00007fa741e26038 R14: 00007fa741e25fa0 R15: 00007ffee326e798 [ 512.053693][T12981] [ 512.133496][T12981] proc_fill_super: can't allocate /proc/self [ 513.934333][ C1] net_ratelimit: 50 callbacks suppressed [ 515.321922][T13015] FAULT_INJECTION: forcing a failure. [ 515.321922][T13015] name failslab, interval 1, probability 0, space 0, times 0 [ 515.428813][T13015] CPU: 1 PID: 13015 Comm: syz.4.2529 Not tainted syzkaller #0 [ 515.436367][T13015] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 515.446464][T13015] Call Trace: [ 515.449784][T13015] [ 515.452750][T13015] dump_stack_lvl+0x188/0x24e [ 515.457473][T13015] ? show_regs_print_info+0x12/0x12 [ 515.462715][T13015] ? load_image+0x410/0x410 [ 515.467272][T13015] ? __might_sleep+0xd0/0xd0 [ 515.471905][T13015] ? __lock_acquire+0x7ea0/0x7ea0 [ 515.477024][T13015] should_fail_ex+0x390/0x4c0 [ 515.481763][T13015] should_failslab+0x5/0x20 [ 515.486312][T13015] slab_pre_alloc_hook+0x59/0x300 [ 515.491387][T13015] ? loop_add+0x54/0x9a0 [ 515.495679][T13015] __kmem_cache_alloc_node+0x4f/0x270 [ 515.501101][T13015] ? loop_add+0x54/0x9a0 [ 515.505391][T13015] kmalloc_trace+0x26/0xe0 [ 515.509852][T13015] loop_add+0x54/0x9a0 [ 515.513978][T13015] loop_control_ioctl+0x124/0x590 [ 515.519055][T13015] ? loop_set_hw_queue_depth+0x60/0x60 [ 515.524573][T13015] ? bpf_lsm_file_ioctl+0x5/0x10 [ 515.529571][T13015] ? security_file_ioctl+0x7c/0xa0 [ 515.534728][T13015] ? loop_set_hw_queue_depth+0x60/0x60 [ 515.540237][T13015] __se_sys_ioctl+0xfa/0x170 [ 515.544882][T13015] do_syscall_64+0x4c/0xa0 [ 515.549338][T13015] ? clear_bhb_loop+0x60/0xb0 [ 515.554058][T13015] ? clear_bhb_loop+0x60/0xb0 [ 515.558790][T13015] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 515.564739][T13015] RIP: 0033:0x7f52bcd9f559 [ 515.569200][T13015] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 515.588860][T13015] RSP: 002b:00007f52bdd5c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 515.597331][T13015] RAX: ffffffffffffffda RBX: 00007f52bd025fa0 RCX: 00007f52bcd9f559 [ 515.605353][T13015] RDX: 00000000ffffffe4 RSI: 0000000000004c80 RDI: 0000000000000004 [ 515.613367][T13015] RBP: 00007f52bce36b20 R08: 0000000000000000 R09: 0000000000000000 [ 515.621375][T13015] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 515.629471][T13015] R13: 00007f52bd026038 R14: 00007f52bd025fa0 R15: 00007ffc73cceb98 [ 515.637506][T13015] [ 516.453373][T13040] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2536'. [ 518.457635][T13076] device syzkaller1 entered promiscuous mode [ 518.705367][T13087] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2550'. [ 519.077554][T13092] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2551'. [ 519.207260][T13098] FAULT_INJECTION: forcing a failure. [ 519.207260][T13098] name failslab, interval 1, probability 0, space 0, times 0 [ 519.277038][T13094] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2552'. [ 519.351828][T13098] CPU: 0 PID: 13098 Comm: syz.2.2553 Not tainted syzkaller #0 [ 519.359349][T13098] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 519.359366][T13098] Call Trace: [ 519.359376][T13098] [ 519.359387][T13098] dump_stack_lvl+0x188/0x24e [ 519.380450][T13098] ? show_regs_print_info+0x12/0x12 [ 519.380483][T13098] ? load_image+0x410/0x410 [ 519.380517][T13098] ? __might_sleep+0xd0/0xd0 [ 519.380542][T13098] ? __lock_acquire+0x7ea0/0x7ea0 [ 519.380571][T13098] ? mod_objcg_state+0x51d/0x8b0 [ 519.380601][T13098] should_fail_ex+0x390/0x4c0 [ 519.386693][T13098] should_failslab+0x5/0x20 [ 519.386725][T13098] slab_pre_alloc_hook+0x59/0x300 [ 519.386762][T13098] kmem_cache_alloc_lru+0x49/0x2e0 [ 519.386784][T13098] ? __d_alloc+0x2e/0x6e0 [ 519.397134][T13098] __d_alloc+0x2e/0x6e0 [ 519.407558][T13098] d_alloc_name+0xb7/0x320 [ 519.407591][T13098] ? clear_nonspinnable+0x60/0x60 [ 519.407619][T13098] ? do_raw_spin_lock+0x128/0x2f0 [ 519.452510][T13098] ? d_alloc_pseudo+0x70/0x70 [ 519.457268][T13098] proc_setup_self+0xab/0x2d0 [ 519.462074][T13098] ? _raw_spin_unlock+0x24/0x40 [ 519.467048][T13098] proc_fill_super+0x4ea/0x730 [ 519.472043][T13098] ? proc_reconfigure+0x370/0x370 [ 519.477621][T13098] get_tree_nodev+0xb0/0x160 [ 519.482421][T13098] vfs_get_tree+0x88/0x270 [ 519.486961][T13098] do_new_mount+0x247/0xa40 [ 519.491932][T13098] __se_sys_mount+0x2e3/0x3d0 [ 519.496906][T13098] ? __x64_sys_mount+0xc0/0xc0 [ 519.501796][T13098] ? lockdep_hardirqs_on+0x94/0x140 [ 519.507035][T13098] ? __x64_sys_mount+0x1c/0xc0 [ 519.512025][T13098] do_syscall_64+0x4c/0xa0 [ 519.516664][T13098] ? clear_bhb_loop+0x60/0xb0 [ 519.521590][T13098] ? clear_bhb_loop+0x60/0xb0 [ 519.526584][T13098] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 519.532703][T13098] RIP: 0033:0x7fec9ed9f559 [ 519.537161][T13098] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 519.558024][T13098] RSP: 002b:00007fec9fc1f028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 519.567175][T13098] RAX: ffffffffffffffda RBX: 00007fec9f025fa0 RCX: 00007fec9ed9f559 [ 519.575182][T13098] RDX: 0000200000000180 RSI: 0000200000000140 RDI: 0000000000000000 [ 519.583553][T13098] RBP: 00007fec9ee36b20 R08: 0000000000000000 R09: 0000000000000000 [ 519.591574][T13098] R10: 0000000000004000 R11: 0000000000000246 R12: 0000000000000000 [ 519.599573][T13098] R13: 00007fec9f026038 R14: 00007fec9f025fa0 R15: 00007fffd9994cf8 [ 519.607584][T13098] [ 519.669038][T13098] proc_fill_super: can't allocate /proc/self [ 519.781708][ C1] net_ratelimit: 81 callbacks suppressed [ 522.603715][T13155] IPv6: Can't replace route, no match found [ 522.891042][T13162] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2577'. [ 524.628143][T13206] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2593'. [ 524.811750][ C1] net_ratelimit: 41 callbacks suppressed [ 525.941745][T13250] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2609'. [ 526.237570][T13257] device syzkaller0 entered promiscuous mode [ 526.956634][T13295] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2623'. [ 529.612084][T13311] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2628'. [ 529.765269][T13313] device syzkaller0 entered promiscuous mode [ 530.011821][ C0] net_ratelimit: 60 callbacks suppressed [ 530.438602][T13348] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2638'. [ 533.027806][T13355] netlink: 88 bytes leftover after parsing attributes in process `syz.2.2639'. [ 533.057322][T13358] device syzkaller1 entered promiscuous mode [ 533.269384][T13369] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2641'. [ 534.636291][T13390] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2649'. [ 535.124952][ C1] net_ratelimit: 68 callbacks suppressed [ 536.369253][ T50] Bluetooth: hci2: unexpected cc 0x2060 length: 3 < 7 [ 536.404958][T13431] Bluetooth: MGMT ver 1.22 [ 536.553525][T13444] netlink: 88 bytes leftover after parsing attributes in process `syz.1.2665'. [ 536.576158][T13445] sctp: [Deprecated]: syz.4.2663 (pid 13445) Use of int in max_burst socket option. [ 536.576158][T13445] Use struct sctp_assoc_value instead [ 536.615054][T13439] device syzkaller1 entered promiscuous mode [ 536.729997][T13447] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2669'. [ 537.047245][T13462] [ 537.049642][T13462] ================================================ [ 537.056177][T13462] WARNING: lock held when returning to user space! [ 537.062720][T13462] syzkaller #0 Not tainted [ 537.067162][T13462] ------------------------------------------------ [ 537.073688][T13462] syz.4.2672/13462 is leaving the kernel with locks still held! [ 537.081382][T13462] 1 lock held by syz.4.2672/13462: [ 537.086522][T13462] #0: ffff88802802cd40 (&wdev->mtx){+.+.}-{3:3}, at: cfg80211_wext_siwgenie+0xd4/0x3f0 [ 537.109555][T13465] kcov: kcov_start: t = ffff88802af6bc00, size = 524288, area = ffffc9000defb000 [ 537.111542][ C0] virtqueue callback for ffff8880267da600 (ffffffff858ab770) [ 537.120775][T13464] async_waiting @ 13464 [ 537.126247][ C0] virtqueue callback for ffff888141641400 (ffffffff84767210) [ 537.137787][ C0] virtqueue interrupt with no work for ffff888141641200 [ 537.140668][T13464] async_continuing @ 13464 after 1 usec [ 537.144744][ C0] virtqueue interrupt with no work for ffff888141641000 [ 537.144848][ C0] No more buffers in queue [ 537.144880][ C0] Receiving skb proto 0x0800 len 52 type 0 [ 537.144909][ C0] No more buffers in queue [ 537.144945][ C0] tcp_conntracks: [ 537.144954][ C0] syn=0 ack=1 fin=1 rst=0 old=3 new=4 [ 537.146610][ T14] Added buffer head 0 to ffff888141641400 [ 537.191658][ C0] nf_conntrack: normal packet for ffff888028430180 [ 537.198254][ C0] tcp_conntracks: [ 537.198272][ C0] syn=0 ack=1 fin=0 rst=0 old=4 new=5 [ 537.207546][ C0] No more buffers in queue [ 537.212025][ C0] eth0: xmit ffff8880309b1780 42:01:0a:80:00:01 [ 537.218329][ C0] Added buffer head 0 to ffff8880267da800 [ 537.224110][ C0] virtqueue callback for ffff8880267da800 (ffffffff858ab860) [ 537.225136][ C1] geneve1: no route to fc00:0000:0000:0000:0000:0000:0000:0001 [ 537.235931][ C0] Sent skb ffff8880309b1780 [ 537.243733][ C0] No more buffers in queue [ 537.261815][ T4737] nf_conntrack: normal packet for ffff88807690b980 [ 537.270761][T13461] sock ffff888073906600, sk ffff888058f1b000 [ 537.278972][T13461] parent ffff888058f1b000 state BT_OPEN [ 537.285080][T13461] parent ffff888058f1b000 [ 537.289639][T13466] async_waiting @ 13466 [ 537.297662][T13461] sock ffff888073906600, sk ffff888058f1b000, how 2 [ 537.304668][T13466] async_continuing @ 13466 after 1 usec [ 537.310821][T13461] Handling sock shutdown [ 537.317485][T13461] chan ffff888058f1c000 orig refcnt 1 [ 537.323294][T13461] chan ffff888058f1c000 state BT_OPEN [ 537.328867][T13461] chan ffff888058f1c000 state BT_OPEN [ 537.336839][T13461] chan ffff888058f1c000 state BT_OPEN [ 537.342654][T13461] chan ffff888058f1c000 orig refcnt 2 [ 537.360319][T13461] Sock shutdown complete err: 0 [ 537.373681][T13461] chan ffff888058f1c000 orig refcnt 1 [ 537.385923][T13461] sk ffff888058f1b000 state BT_OPEN [ 537.393592][T13467] kcov: kcov_start: t = ffff88805ed40000, size = 524288, area = ffffc9000f33b000 [ 537.403154][ C1] sctp: sctp_addr_wq_timeout_handler: the first ent in wq:ffff88807e96e318 is addr:172.20.20.13 for cmd:2 at entry:ffff8880284cad80 [ 537.420506][ T4380] nf_conntrack: normal packet for ffff88807ce73080 [ 537.429113][ T4737] nf_conntrack: normal packet for ffff88807690b080 [ 537.435786][T13461] chan ffff888058f1c000 orig refcnt 2 [ 537.443433][T13461] sk ffff888058f1b000 [ 537.447441][T13468] async_waiting @ 13468 [ 537.447470][T13468] async_continuing @ 13468 after 1 usec [ 537.447746][T13461] chan ffff888058f1c000 orig refcnt 1 [ 537.465244][T13461] chan ffff888058f1c000 [ 537.469640][T13462] kcov: kcov_task_exit: t = ffff88807b3c3c00, kcov->t = ffff88807b3c3c00 [ 537.525684][T13469] kcov: kcov_start: t = ffff88807a8a5a00, size = 524288, area = ffffc90010b41000 [ 537.748198][T13451] syzkaller1 (unregistering): bond_netdev_event received NETDEV_UNREGISTER [ 537.800798][ T6571] sd 0:0:1:0: cmd ffff8880288c8820 CDB: 0x2a [ 537.866779][ T6571] Added buffer head 347 to ffff8880248e8e00 [ 537.900468][T13451] net syzkaller1: siw: event 6 [ 537.975719][ T6571] sd 0:0:1:0: cmd ffff8880288c8be0 CDB: 0x2a [ 537.981845][ T6571] Added buffer head 419 to ffff8880248e8e00 [ 537.987839][ T6571] sd 0:0:1:0: cmd ffff8880288c8fa0 CDB: 0x2a [ 537.993963][ T6571] Added buffer head 321 to ffff8880248e8e00 [ 538.000342][T13465] kcov: kcov_task_exit: t = ffff88802af6bc00, kcov->t = ffff88802af6bc00 [ 538.000675][T13467] kcov: kcov_task_exit: t = ffff88805ed40000, kcov->t = ffff88805ed40000 [ 538.009625][T13469] kcov: kcov_task_exit: t = ffff88807a8a5a00, kcov->t = ffff88807a8a5a00 [ 538.035145][ T6571] sd 0:0:1:0: cmd ffff8880288c9360 CDB: 0x2a [ 538.066108][ T6571] Added buffer head 332 to ffff8880248e8e00 [ 538.096483][ T6571] sd 0:0:1:0: cmd ffff8880288c9720 CDB: 0x2a [ 538.112844][ T6571] Added buffer head 329 to ffff8880248e8e00 [ 538.118933][ T6571] sd 0:0:1:0: cmd ffff8880288c9ae0 CDB: 0x2a [ 538.124120][ C0] virtqueue callback for ffff888141641400 (ffffffff84767210) [ 538.132067][ T6571] Added buffer head 382 to ffff8880248e8e00 [ 538.132535][ C0] virtqueue interrupt with no work for ffff888141641200 [ 538.139803][ C1] virtqueue callback for ffff8880248e8e00 (ffffffff85445d80) [ 538.145280][ C0] virtqueue interrupt with no work for ffff888141641000 [ 538.152662][ C1] sd 0:0:1:0: cmd ffff8880288c9360 response 0 status 0x0 sense_len 0 [ 538.161455][ T6241] Added buffer head 0 to ffff888141641400 [ 538.167708][ C1] sd 0:0:1:0: cmd ffff8880288c8820 response 0 status 0x0 sense_len 0 [ 538.167729][ C1] No more buffers in queue [ 538.167835][ C1] vkms_vblank_simulate: vblank timer overrun [ 538.175982][ C1] virtqueue callback for ffff8880248e8e00 (ffffffff85445d80) [ 538.183029][T13451] kobject: 'rx-0' (ffff88802419be50): kobject_cleanup, parent ffff88802423bf50 [ 538.187019][ C1] sd 0:0:1:0: cmd ffff8880288c8be0 response 0 status 0x0 sense_len 0 [ 538.209846][ T4737] nf_conntrack: normal packet for ffff88807ce72f00 [ 538.217439][ C1] sd 0:0:1:0: cmd ffff8880288c9720 response 0 status 0x0 sense_len 0 [ 538.217466][ C1] sd 0:0:1:0: cmd ffff8880288c9ae0 response 0 status 0x0 sense_len 0 [ 538.217489][ C1] sd 0:0:1:0: cmd ffff8880288c8fa0 response 0 status 0x0 sense_len 0 [ 538.225482][ T14] nf_conntrack: normal packet for ffff88802f28b500 [ 538.232066][ C1] No more buffers in queue [ 538.232173][ C1] vkms_vblank_simulate: vblank timer overrun [ 538.265281][ C1] vkms_vblank_simulate: vblank timer overrun [ 538.271586][ T6242] nf_conntrack: normal packet for ffff88802f28a480 [ 538.278381][T13451] kobject: 'rx-0' (ffff88802419be50): auto cleanup kobject_del [ 538.287320][T13451] kernfs rps_cpus: removing [ 538.296253][T13451] kernfs rps_flow_cnt: removing [ 538.301255][T13451] kobject: 'rx-0' (ffff88802419be50): auto cleanup 'remove' event [ 538.325691][T13451] kobject: 'rx-0' (ffff88802419be50): kobject_uevent_env [ 538.333446][T13451] kobject: 'rx-0' (ffff88802419be50): fill_kobj_path: path = '/devices/virtual/net/syzkaller1/queues/rx-0' [ 538.345169][T13451] kernfs rx-0: removing [ 538.349473][T13451] kobject: 'rx-0' (ffff88802419be50): calling ktype release [ 538.349681][ T6571] sd 0:0:1:0: cmd ffff8880288ab8e0 CDB: 0x2a [ 538.357666][T13451] kobject: 'rx-0': free name [ 538.367432][ T6571] Added buffer head 321 to ffff8880248e8e00 [ 538.368769][T13451] kernfs limit: removing [ 538.377118][ T6571] sd 0:0:1:0: cmd ffff8880288abca0 CDB: 0x2a [ 538.380686][T13451] kernfs limit_max: removing [ 538.389147][ T6571] Added buffer head 418 to ffff8880248e8e00 [ 538.389622][T13451] kernfs limit_min: removing [ 538.398921][ T6571] sd 0:0:1:0: cmd ffff8880288ac060 CDB: 0x2a [ 538.400802][T13451] kernfs hold_time: removing [ 538.410470][ T6571] Added buffer head 395 to ffff8880248e8e00 [ 538.410530][ T6571] sd 0:0:1:0: cmd ffff8880288ac420 CDB: 0x2a [ 538.418779][T13451] kernfs inflight: removing [ 538.427361][T13451] kernfs byte_queue_limits: removing [ 538.433201][ T6571] Added buffer head 375 to ffff8880248e8e00 [ 538.434280][T13451] kobject: 'tx-0' (ffff888059ac1420): kobject_cleanup, parent ffff88802423bf50 [ 538.439306][ T6571] sd 0:0:1:0: cmd ffff8880288ac7e0 CDB: 0x2a [ 538.448772][T13451] kobject: 'tx-0' (ffff888059ac1420): auto cleanup kobject_del [ 538.458986][ T6571] Added buffer head 396 to ffff8880248e8e00 [ 538.462912][T13451] kernfs tx_timeout: removing [ 538.467927][ T6571] sd 0:0:1:0: cmd ffff8880288acba0 CDB: 0x2a [ 538.473293][T13451] kernfs traffic_class: removing [ 538.484416][T13451] kernfs xps_cpus: removing [ 538.486539][ T6571] Added buffer head 382 to ffff8880248e8e00 [ 538.489201][T13451] kernfs xps_rxqs: removing [ 538.497416][ T6571] sd 0:0:1:0: cmd ffff8880288acf60 CDB: 0x2a [ 538.500579][T13451] kernfs tx_maxrate: removing [ 538.510946][ T4380] nf_conntrack: normal packet for ffff88807ce73080 [ 538.513057][ T6571] Added buffer head 365 to ffff8880248e8e00 [ 538.519503][T13451] kobject: 'tx-0' (ffff888059ac1420): auto cleanup 'remove' event [ 538.527785][ T6571] sd 0:0:1:0: cmd ffff8880288ad320 CDB: 0x2a [ 538.532702][T13451] kobject: 'tx-0' (ffff888059ac1420): kobject_uevent_env [ 538.546299][ T6571] Added buffer head 336 to ffff8880248e8e00 [ 538.548220][T13451] kobject: 'tx-0' (ffff888059ac1420): fill_kobj_path: path = '/devices/virtual/net/syzkaller1/queues/tx-0' [ 538.564048][T13451] kernfs tx-0: removing [ 538.567314][ T6571] sd 0:0:1:0: cmd ffff8880288ad6e0 CDB: 0x2a [ 538.568539][T13451] kobject: 'tx-0' (ffff888059ac1420): calling ktype release [ 538.582345][T13451] kobject: 'tx-0': free name [ 538.586986][ T6571] Added buffer head 72 to ffff8880248e8e00 [ 538.587171][T13451] kernfs queues: removing [ 538.592907][ T6571] sd 0:0:1:0: cmd ffff8880288adaa0 CDB: 0x2a [ 538.599072][T13451] kobject: 'queues' (ffff88802423bf50): kobject_cleanup, parent 0000000000000000 [ 538.608021][ T6571] Added buffer head 384 to ffff8880248e8e00 [ 538.613450][T13451] kobject: 'queues' (ffff88802423bf50): calling ktype release [ 538.626347][ T6571] sd 0:0:1:0: cmd ffff8880288ade60 CDB: 0x2a [ 538.626400][T13451] kobject: 'queues' (ffff88802423bf50): kset_release [ 538.632523][ T6571] Added buffer head 415 to ffff8880248e8e00 [ 538.640085][T13451] kobject: 'queues': free name [ 538.650099][T13451] kernfs runtime_status: removing [ 538.650416][ T6571] sd 0:0:1:0: cmd ffff8880288a0c60 CDB: 0x2a [ 538.655666][T13451] kernfs control: removing [ 538.666697][T13451] kernfs runtime_suspended_time: removing [ 538.669836][ T6571] Added buffer head 362 to ffff8880248e8e00 [ 538.673274][T13451] kernfs runtime_active_time: removing [ 538.678515][ T6571] sd 0:0:1:0: cmd ffff8880288a1020 CDB: 0x2a [ 538.684606][T13451] kernfs autosuspend_delay_ms: removing [ 538.684644][T13451] kernfs power: removing [ 538.684666][T13451] kernfs subsystem: removing [ 538.684692][T13451] kernfs syzkaller1: removing [ 538.684726][T13451] kernfs uevent: removing [ 538.700710][ T6571] Added buffer head 319 to ffff8880248e8e00 [ 538.706927][T13451] kernfs tun_flags: removing [ 538.718510][ T6571] sd 0:0:1:0: cmd ffff8880288a13e0 CDB: 0x2a [ 538.721259][T13451] kernfs owner: removing [ 538.727530][ T6571] Added buffer head 344 to ffff8880248e8e00 [ 538.731805][T13451] kernfs group: removing [ 538.741395][ T6571] sd 0:0:1:0: cmd ffff8880288a17a0 CDB: 0x2a [ 538.746701][T13451] kernfs rx_packets: removing [ 538.751324][ T6571] Added buffer head 63 to ffff8880248e8e00 [ 538.751384][ T6571] sd 0:0:1:0: cmd ffff8880288a1b60 CDB: 0x2a [ 538.756935][T13451] kernfs tx_packets: removing [ 538.767719][ T6571] Added buffer head 357 to ffff8880248e8e00 [ 538.768999][T13451] kernfs rx_bytes: removing [ 538.778891][ T6571] sd 0:0:1:0: cmd ffff8880288a1f20 CDB: 0x2a [ 538.785370][T13451] kernfs tx_bytes: removing [ 538.795052][T13451] kernfs rx_errors: removing [ 538.795873][ T6571] Added buffer head 330 to ffff8880248e8e00 [ 538.800044][T13451] kernfs tx_errors: removing [ 538.806657][ T6571] sd 0:0:1:0: cmd ffff8880288a22e0 CDB: 0x2a [ 538.811535][T13451] kernfs rx_dropped: removing [ 538.820766][ T6571] Added buffer head 406 to ffff8880248e8e00 [ 538.827668][T13451] kernfs tx_dropped: removing [ 538.828137][ T6571] sd 0:0:1:0: cmd ffff8880288a26a0 CDB: 0x2a [ 538.833069][T13451] kernfs multicast: removing [ 538.843210][ T6571] Added buffer head 414 to ffff8880248e8e00 [ 538.844011][T13451] kernfs collisions: removing [ 538.849162][ T6571] sd 0:0:1:0: cmd ffff8880288a2a60 CDB: 0x2a [ 538.855125][T13451] kernfs rx_length_errors: removing [ 538.863702][ T6571] Added buffer head 358 to ffff8880248e8e00 [ 538.866077][T13451] kernfs rx_over_errors: removing [ 538.871007][ T6571] sd 0:0:1:0: cmd ffff8880288a2e20 CDB: 0x2a [ 538.876718][T13451] kernfs rx_crc_errors: removing [ 538.888087][T13451] kernfs rx_frame_errors: removing [ 538.893643][T13451] kernfs rx_fifo_errors: removing [ 538.898834][T13451] kernfs rx_missed_errors: removing [ 538.898841][ T6571] Added buffer head 399 to ffff8880248e8e00 [ 538.905011][T13451] kernfs tx_aborted_errors: removing [ 538.911102][ T6571] sd 0:0:1:0: cmd ffff8880288a31e0 CDB: 0x2a [ 538.916125][T13451] kernfs tx_carrier_errors: removing [ 538.921878][ T6571] Added buffer head 351 to ffff8880248e8e00 [ 538.927741][T13451] kernfs tx_fifo_errors: removing [ 538.938162][T13451] kernfs tx_heartbeat_errors: removing [ 538.941408][ T6571] sd 0:0:1:0: cmd ffff8880288c9ea0 CDB: 0x2a [ 538.943679][ C1] virtqueue callback for ffff8880248e8e00 (ffffffff85445d80) [ 538.943702][ C1] sd 0:0:1:0: cmd ffff8880288acf60 response 0 status 0x0 sense_len 0 [ 538.943727][ C1] sd 0:0:1:0: cmd ffff8880288a31e0 response 0 status 0x0 sense_len 0 [ 538.943750][ C1] sd 0:0:1:0: cmd ffff8880288ab8e0 response 0 status 0x0 sense_len 0 [ 538.943772][ C1] sd 0:0:1:0: cmd ffff8880288ac7e0 response 0 status 0x0 sense_len 0 [ 538.943794][ C1] sd 0:0:1:0: cmd ffff8880288ad6e0 response 0 status 0x0 sense_len 0 [ 538.943816][ C1] sd 0:0:1:0: cmd ffff8880288adaa0 response 0 status 0x0 sense_len 0 [ 538.943838][ C1] sd 0:0:1:0: cmd ffff8880288a1020 response 0 status 0x0 sense_len 0 [ 538.943860][ C1] sd 0:0:1:0: cmd ffff8880288abca0 response 0 status 0x0 sense_len 0 [ 538.943882][ C1] sd 0:0:1:0: cmd ffff8880288ad320 response 0 status 0x0 sense_len 0 [ 538.943904][ C1] sd 0:0:1:0: cmd ffff8880288a22e0 response 0 status 0x0 sense_len 0 [ 538.943926][ C1] sd 0:0:1:0: cmd ffff8880288ac060 response 0 status 0x0 sense_len 0 [ 539.045830][ C1] sd 0:0:1:0: cmd ffff8880288a0c60 response 0 status 0x0 sense_len 0 [ 539.053904][ C1] sd 0:0:1:0: cmd ffff8880288a26a0 response 0 status 0x0 sense_len 0 [ 539.061972][ C1] sd 0:0:1:0: cmd ffff8880288ac420 response 0 status 0x0 sense_len 0 [ 539.070051][ C1] sd 0:0:1:0: cmd ffff8880288a2e20 response 0 status 0x0 sense_len 0 [ 539.078115][ C1] sd 0:0:1:0: cmd ffff8880288a1b60 response 0 status 0x0 sense_len 0 [ 539.086196][ C1] sd 0:0:1:0: cmd ffff8880288a1f20 response 0 status 0x0 sense_len 0 [ 539.094259][ C1] sd 0:0:1:0: cmd ffff8880288acba0 response 0 status 0x0 sense_len 0 [ 539.102325][ C1] sd 0:0:1:0: cmd ffff8880288ade60 response 0 status 0x0 sense_len 0 [ 539.110388][ C1] sd 0:0:1:0: cmd ffff8880288a2a60 response 0 status 0x0 sense_len 0 [ 539.118452][ C1] sd 0:0:1:0: cmd ffff8880288a13e0 response 0 status 0x0 sense_len 0 [ 539.126515][ C1] sd 0:0:1:0: cmd ffff8880288a17a0 response 0 status 0x0 sense_len 0 [ 539.134579][ C1] No more buffers in queue [ 539.139028][ T6571] Added buffer head 63 to ffff8880248e8e00 [ 539.139094][ C1] vkms_vblank_simulate: vblank timer overrun [ 539.145016][ C0] virtqueue callback for ffff888141641400 (ffffffff84767210) [ 539.158280][ C0] virtqueue interrupt with no work for ffff888141641200 [ 539.165247][ C0] virtqueue interrupt with no work for ffff888141641000 [ 539.175718][ T4737] Added buffer head 0 to ffff888141641400 [ 539.177586][ T6571] sd 0:0:1:0: cmd ffff8880288cbca0 CDB: 0x2a [ 539.182659][T13451] kernfs tx_window_errors: removing [ 539.194279][T13451] kernfs rx_compressed: removing [ 539.196418][ T6571] Added buffer head 320 to ffff8880248e8e00 [ 539.199615][T13451] kernfs tx_compressed: removing [ 539.205414][ T6571] sd 0:0:1:0: cmd ffff8880288cc060 CDB: 0x2a [ 539.216516][ T6571] Added buffer head 387 to ffff8880248e8e00 [ 539.220668][T13451] kernfs rx_nohandler: removing [ 539.222648][ T6571] sd 0:0:1:0: cmd ffff8880288ca260 CDB: 0x2a [ 539.228760][T13451] kernfs statistics: removing [ 539.233806][ T6571] Added buffer head 373 to ffff8880248e8e00 [ 539.233875][ T6571] sd 0:0:1:0: cmd ffff8880288ca620 CDB: 0x2a [ 539.233896][ T6571] Added buffer head 417 to ffff8880248e8e00 [ 539.243928][T13451] kernfs netdev_group: removing [ 539.245136][ T6571] sd 0:0:1:0: cmd ffff8880288ca9e0 CDB: 0x2a [ 539.250759][T13451] kernfs type: removing [ 539.257449][ T6571] Added buffer head 411 to ffff8880248e8e00 [ 539.267718][T13451] kernfs dev_id: removing [ 539.272477][ T6571] sd 0:0:1:0: cmd ffff8880288cb8e0 CDB: 0x2a [ 539.278128][T13451] kernfs dev_port: removing [ 539.294109][ T6571] Added buffer head 414 to ffff8880248e8e00 [ 539.295890][T13451] kernfs iflink: removing [ 539.302838][ T6571] sd 0:0:1:0: cmd ffff8880288cb160 CDB: 0x2a [ 539.304542][T13451] kernfs ifindex: removing [ 539.310914][ T6571] Added buffer head 339 to ffff8880248e8e00 [ 539.315254][T13451] kernfs name_assign_type: removing [ 539.326213][T13451] kernfs addr_assign_type: removing [ 539.331463][T13451] kernfs addr_len: removing [ 539.336184][T13451] kernfs link_mode: removing [ 539.336617][ T6571] sd 0:0:1:0: cmd ffff8880288cb520 CDB: 0x2a [ 539.341030][T13451] kernfs address: removing [ 539.351418][T13451] kernfs broadcast: removing [ 539.353012][ T6571] Added buffer head 364 to ffff8880248e8e00 [ 539.356932][T13451] kernfs speed: removing [ 539.366527][T13451] kernfs duplex: removing [ 539.366863][ T6571] sd 0:0:1:0: cmd ffff8880288cada0 CDB: 0x2a [ 539.370894][T13451] kernfs dormant: removing [ 539.370947][T13451] kernfs testing: removing [ 539.386575][ T6571] Added buffer head 380 to ffff8880248e8e00 [ 539.388589][T13451] kernfs operstate: removing [ 539.394333][ C1] virtqueue callback for ffff8880248e8e00 (ffffffff85445d80) [ 539.404573][ C1] sd 0:0:1:0: cmd ffff8880288cb160 response 0 status 0x0 sense_len 0 [ 539.410818][T13451] kernfs carrier_changes: removing [ 539.412677][ C1] sd 0:0:1:0: cmd ffff8880288cc060 response 0 status 0x0 sense_len 0 [ 539.412703][ C1] sd 0:0:1:0: cmd ffff8880288c9ea0 response 0 status 0x0 sense_len 0 [ 539.412725][ C1] sd 0:0:1:0: cmd ffff8880288ca260 response 0 status 0x0 sense_len 0 [ 539.412746][ C1] sd 0:0:1:0: cmd ffff8880288cbca0 response 0 status 0x0 sense_len 0 [ 539.412769][ C1] sd 0:0:1:0: cmd ffff8880288cb8e0 response 0 status 0x0 sense_len 0 [ 539.419671][T13451] kernfs ifalias: removing [ 539.425941][ C1] sd 0:0:1:0: cmd ffff8880288cada0 response 0 status 0x0 sense_len 0 [ 539.425966][ C1] sd 0:0:1:0: cmd ffff8880288cb520 response 0 status 0x0 sense_len 0 [ 539.425989][ C1] sd 0:0:1:0: cmd ffff8880288ca620 response 0 status 0x0 sense_len 0 [ 539.426011][ C1] sd 0:0:1:0: cmd ffff8880288ca9e0 response 0 status 0x0 sense_len 0 [ 539.436747][T13451] kernfs carrier: removing [ 539.442140][ C1] No more buffers in queue [ 539.442178][ C1] vkms_vblank_simulate: vblank timer overrun [ 539.463320][ T6571] sd 0:0:1:0: cmd ffff8880288cc420 CDB: 0x2a [ 539.472497][T13451] kernfs mtu: removing [ 539.484421][ T6571] Added buffer head 411 to ffff8880248e8e00 [ 539.488155][T13451] kernfs flags: removing [ 539.495804][ T6571] sd 0:0:1:0: cmd ffff8880288c8fa0 CDB: 0x2a [ 539.511510][T13451] kernfs tx_queue_len: removing [ 539.525411][ T6571] Added buffer head 337 to ffff8880248e8e00 [ 539.536260][T13451] kernfs gro_flush_timeout: removing [ 539.541355][ T6571] sd 0:0:1:0: cmd ffff8880288c9360 CDB: 0x2a [ 539.543792][T13451] kernfs napi_defer_hard_irqs: removing [ 539.548424][ T6803] nf_conntrack: normal packet for ffff88807ce73080 [ 539.554262][T13451] kernfs phys_port_id: removing [ 539.563677][ T6571] Added buffer head 361 to ffff8880248e8e00 [ 539.565549][T13451] kernfs phys_port_name: removing [ 539.576227][ T6571] sd 0:0:1:0: cmd ffff8880288c9720 CDB: 0x2a [ 539.587098][T13451] kernfs phys_switch_id: removing [ 539.598428][ T6571] Added buffer head 331 to ffff8880248e8e00 [ 539.598522][ T6571] sd 0:0:1:0: cmd ffff8880288ccf60 CDB: 0x2a [ 539.611155][ T6571] Added buffer head 398 to ffff8880248e8e00 [ 539.614696][ T14] nf_conntrack: normal packet for ffff88807ce72780 [ 539.617317][ T6571] sd 0:0:1:0: cmd ffff8880288c9ae0 CDB: 0x2a [ 539.631288][T13451] kernfs proto_down: removing [ 539.633962][ T6571] Added buffer head 406 to ffff8880248e8e00 [ 539.636632][T13451] kernfs carrier_up_count: removing [ 539.646496][ T6571] sd 0:0:1:0: cmd ffff8880288cc7e0 CDB: 0x2a [ 539.647976][T13451] kernfs carrier_down_count: removing [ 539.653752][ T6571] Added buffer head 336 to ffff8880248e8e00 [ 539.659164][T13451] kernfs threaded: removing [ 539.669288][ T6571] sd 0:0:1:0: cmd ffff8880288ccba0 CDB: 0x2a [ 539.669770][T13451] PM: Removing info for No Bus:syzkaller1 [ 539.675759][ T6571] Added buffer head 418 to ffff8880248e8e00 [ 539.681873][T13451] kobject: 'syzkaller1' (ffff88807c514688): kobject_uevent_env [ 539.691951][ T6571] sd 0:0:1:0: cmd ffff8880288be220 CDB: 0x2a [ 539.695325][T13451] kobject: 'syzkaller1' (ffff88807c514688): fill_kobj_path: path = '/devices/virtual/net/syzkaller1' [ 539.701116][T13457] kcov: kcov_task_exit: t = ffff88805ed41e00, kcov->t = ffff88805ed41e00 [ 539.714106][T13450] kcov: kcov_task_exit: t = ffff88801e3a9e00, kcov->t = ffff88801e3a9e00 [ 539.728496][T13455] kcov: kcov_task_exit: t = ffff88805ed45a00, kcov->t = ffff88805ed45a00 [ 539.730051][T13452] kcov: kcov_task_exit: t = ffff88801e3a8000, kcov->t = ffff88801e3a8000 [ 539.746568][ T6571] Added buffer head 320 to ffff8880248e8e00 [ 539.747728][T13460] kcov: kcov_task_exit: t = ffff88802bd11e00, kcov->t = ffff88802bd11e00 [ 539.753307][ T6571] sd 0:0:1:0: cmd ffff8880288a35a0 CDB: 0x2a [ 539.760913][ C1] virtqueue callback for ffff8880248e8e00 (ffffffff85445d80) [ 539.760938][ C1] sd 0:0:1:0: cmd ffff8880288c9ae0 response 0 status 0x0 sense_len 0 [ 539.760963][ C1] sd 0:0:1:0: cmd ffff8880288cc420 response 0 status 0x0 sense_len 0 [ 539.760985][ C1] sd 0:0:1:0: cmd ffff8880288be220 response 0 status 0x0 sense_len 0 [ 539.761007][ C1] sd 0:0:1:0: cmd ffff8880288ccf60 response 0 status 0x0 sense_len 0 [ 539.761029][ C1] sd 0:0:1:0: cmd ffff8880288c9720 response 0 status 0x0 sense_len 0 [ 539.761050][ C1] sd 0:0:1:0: cmd ffff8880288c9360 response 0 status 0x0 sense_len 0 [ 539.761074][ C1] sd 0:0:1:0: cmd ffff8880288c8fa0 response 0 status 0x0 sense_len 0 [ 539.761099][ C1] sd 0:0:1:0: cmd ffff8880288cc7e0 response 0 status 0x0 sense_len 0 [ 539.761124][ C1] sd 0:0:1:0: cmd ffff8880288ccba0 response 0 status 0x0 sense_len 0 [ 539.761145][ C1] No more buffers in queue [ 539.773621][T13451] kernfs syzkaller1: removing [ 539.775998][ T6571] Added buffer head 418 to ffff8880248e8e00 [ 539.862793][ C1] vkms_vblank_simulate: vblank timer overrun [ 539.872691][T13449] syzkaller1 (unregistering): bond_netdev_event received NETDEV_UNREGISTER [ 539.881322][ C1] virtqueue callback for ffff8880248e8e00 (ffffffff85445d80) [ 539.881347][ C1] sd 0:0:1:0: cmd ffff8880288a35a0 response 0 status 0x0 sense_len 0 [ 539.881366][ C1] No more buffers in queue [ 539.901530][T13449] net syzkaller1: siw: event 6 [ 539.907306][T13449] kobject: 'rx-0' (ffff8880559b9550): kobject_cleanup, parent ffff888019af9e50 [ 539.916641][T13449] kobject: 'rx-0' (ffff8880559b9550): auto cleanup kobject_del [ 539.924512][T13449] kernfs rps_cpus: removing [ 539.924632][T13451] kobject: 'syzkaller1' (ffff88807c514688): kobject_cleanup, parent 0000000000000000 [ 539.929057][T13449] kernfs rps_flow_cnt: removing [ 539.943631][T13449] kobject: 'rx-0' (ffff8880559b9550): auto cleanup 'remove' event [ 539.948507][T13451] kobject: 'syzkaller1' (ffff88807c514688): calling ktype release [ 539.954493][T13449] kobject: 'rx-0' (ffff8880559b9550): kobject_uevent_env [ 539.966682][T13451] kobject: 'syzkaller1': free name [ 539.967439][T13449] kobject: 'rx-0' (ffff8880559b9550): fill_kobj_path: path = '/devices/virtual/net/syzkaller1/queues/rx-0' [ 539.986451][T13449] kernfs rx-0: removing [ 539.990726][T13449] kobject: 'rx-0' (ffff8880559b9550): calling ktype release [ 539.998184][T13449] kobject: 'rx-0': free name [ 540.002924][T13449] kernfs limit: removing [ 540.007242][T13449] kernfs limit_max: removing [ 540.012259][T13449] kernfs limit_min: removing [ 540.016911][T13449] kernfs hold_time: removing [ 540.021519][T13449] kernfs inflight: removing [ 540.026392][T13449] kernfs byte_queue_limits: removing [ 540.031868][T13449] kobject: 'tx-0' (ffff888055975820): kobject_cleanup, parent ffff888019af9e50 [ 540.040874][T13449] kobject: 'tx-0' (ffff888055975820): auto cleanup kobject_del [ 540.048477][T13449] kernfs tx_timeout: removing [ 540.053218][T13449] kernfs traffic_class: removing [ 540.058181][T13449] kernfs xps_cpus: removing [ 540.062792][T13449] kernfs xps_rxqs: removing [ 540.067363][T13449] kernfs tx_maxrate: removing [ 540.072154][T13449] kobject: 'tx-0' (ffff888055975820): auto cleanup 'remove' event [ 540.080014][T13449] kobject: 'tx-0' (ffff888055975820): kobject_uevent_env [ 540.087272][T13449] kobject: 'tx-0' (ffff888055975820): fill_kobj_path: path = '/devices/virtual/net/syzkaller1/queues/tx-0' [ 540.099589][T13449] kernfs tx-0: removing [ 540.103959][T13449] kobject: 'tx-0' (ffff888055975820): calling ktype release [ 540.111281][T13449] kobject: 'tx-0': free name [ 540.116416][T13449] kernfs queues: removing [ 540.120840][T13449] kobject: 'queues' (ffff888019af9e50): kobject_cleanup, parent 0000000000000000 [ 540.130024][ C0] virtqueue callback for ffff888141641400 (ffffffff84767210) [ 540.130083][ C0] virtqueue interrupt with no work for ffff888141641200 [ 540.130094][ C0] virtqueue interrupt with no work for ffff888141641000 [ 540.151738][ T14] Added buffer head 0 to ffff888141641400 [ 540.157535][T13449] kobject: 'queues' (ffff888019af9e50): calling ktype release [ 540.165082][T13449] kobject: 'queues' (ffff888019af9e50): kset_release [ 540.171842][T13449] kobject: 'queues': free name [ 540.176637][T13449] kernfs runtime_status: removing [ 540.181781][T13449] kernfs control: removing [ 540.186275][T13449] kernfs runtime_suspended_time: removing [ 540.192083][T13449] kernfs runtime_active_time: removing [ 540.197581][T13449] kernfs autosuspend_delay_ms: removing [ 540.203489][T13449] kernfs power: removing [ 540.207803][T13449] kernfs subsystem: removing [ 540.212498][T13449] kernfs syzkaller1: removing [ 540.218014][T13449] kernfs uevent: removing [ 540.222443][T13449] kernfs tun_flags: removing [ 540.227075][T13449] kernfs owner: removing [ 540.231339][T13449] kernfs group: removing [ 540.235663][T13449] kernfs rx_packets: removing [ 540.240385][T13449] kernfs tx_packets: removing [ 540.245144][T13449] kernfs rx_bytes: removing [ 540.249681][T13449] kernfs tx_bytes: removing [ 540.254302][T13449] kernfs rx_errors: removing [ 540.258931][T13449] kernfs tx_errors: removing [ 540.263631][T13449] kernfs rx_dropped: removing [ 540.268361][T13449] kernfs tx_dropped: removing [ 540.273133][T13449] kernfs multicast: removing [ 540.277764][T13449] kernfs collisions: removing [ 540.282530][T13449] kernfs rx_length_errors: removing [ 540.287778][T13449] kernfs rx_over_errors: removing [ 540.292898][T13449] kernfs rx_crc_errors: removing [ 540.297870][T13449] kernfs rx_frame_errors: removing [ 540.303093][T13449] kernfs rx_fifo_errors: removing [ 540.308160][T13449] kernfs rx_missed_errors: removing [ 540.313625][T13449] kernfs tx_aborted_errors: removing [ 540.320036][T13449] kernfs tx_carrier_errors: removing [ 540.325496][T13449] kernfs tx_fifo_errors: removing [ 540.330599][T13449] kernfs tx_heartbeat_errors: removing [ 540.336322][T13449] kernfs tx_window_errors: removing [ 540.341580][T13449] kernfs rx_compressed: removing [ 540.346779][T13449] kernfs tx_compressed: removing [ 540.351815][T13449] kernfs rx_nohandler: removing [ 540.356723][T13449] kernfs statistics: removing [ 540.361417][T13449] kernfs netdev_group: removing [ 540.366361][T13449] kernfs type: removing [ 540.370552][T13449] kernfs dev_id: removing [ 540.375099][T13449] kernfs dev_port: removing [ 540.379664][T13449] kernfs iflink: removing [ 540.384116][T13449] kernfs ifindex: removing [ 540.388564][T13449] kernfs name_assign_type: removing [ 540.393860][T13449] kernfs addr_assign_type: removing [ 540.399103][T13449] kernfs addr_len: removing [ 540.403689][T13449] kernfs link_mode: removing [ 540.408316][T13449] kernfs address: removing [ 540.412934][T13449] kernfs broadcast: removing [ 540.417612][T13449] kernfs speed: removing [ 540.424045][T13449] kernfs duplex: removing [ 540.428442][T13449] kernfs dormant: removing [ 540.432958][T13449] kernfs testing: removing [ 540.437407][T13449] kernfs operstate: removing [ 540.442086][T13449] kernfs carrier_changes: removing [ 540.447239][T13449] kernfs ifalias: removing [ 540.451746][T13449] kernfs carrier: removing [ 540.456221][T13449] kernfs mtu: removing [ 540.460342][T13449] kernfs flags: removing [ 540.464666][T13449] kernfs tx_queue_len: removing [ 540.469566][T13449] kernfs gro_flush_timeout: removing [ 540.474953][T13449] kernfs napi_defer_hard_irqs: removing [ 540.480533][T13449] kernfs phys_port_id: removing [ 540.485464][T13449] kernfs phys_port_name: removing [ 540.490543][T13449] kernfs phys_switch_id: removing [ 540.495662][ C0] net_ratelimit: 79 callbacks suppressed [ 540.495675][ C0] wireguard: wg0: Sending keepalive packet to peer 44 ([::1]:20003/0%0) [ 540.509845][ T14] nf_conntrack: normal packet for ffff88807690b080 [ 540.510541][T13449] kernfs proto_down: removing [ 540.516827][ C0] wireguard: wg2: Receiving keepalive packet from peer 47 ([::1]:20001/0%0) [ 540.523918][T13449] kernfs carrier_up_count: removing [ 540.538398][T13449] kernfs carrier_down_count: removing [ 540.543903][T13449] kernfs threaded: removing [ 540.548458][T13449] PM: Removing info for No Bus:syzkaller1 [ 540.554295][T13449] kobject: 'syzkaller1' (ffff888064a54688): kobject_uevent_env [ 540.561951][T13449] kobject: 'syzkaller1' (ffff888064a54688): fill_kobj_path: path = '/devices/virtual/net/syzkaller1' [ 540.573027][T13449] kernfs syzkaller1: removing [ 540.578084][T13458] kcov: kcov_task_exit: t = ffff88802f273c00, kcov->t = ffff88802f273c00 [ 540.581734][ C1] wireguard: wg0: Sending keepalive packet to peer 1 ([::1]:20002/0%0) [ 540.594923][ C1] wireguard: wg0: Sending keepalive packet to peer 37 (127.0.0.1:20002) [ 540.603379][ C1] wireguard: wg0: Sending keepalive packet to peer 19 ([::1]:20002/0%0) [ 540.611820][ C1] wireguard: wg0: Sending keepalive packet to peer 43 ([::1]:20002/0%0) [ 540.620260][ C1] wireguard: wg0: Sending keepalive packet to peer 25 ([::1]:20002/0%0) [ 540.629372][ T6803] nf_conntrack: normal packet for ffff88807ce73080 [ 540.637385][ C0] wireguard: wg1: Receiving keepalive packet from peer 3 ([::1]:20001/0%0) [ 540.646124][ C1] wireguard: wg1: Receiving keepalive packet from peer 21 ([::1]:20001/0%0) [ 540.649459][ C0] wireguard: wg1: Receiving keepalive packet from peer 39 (127.0.0.1:20001) [ 540.660964][T13453] kcov: kcov_task_exit: t = ffff88802d5f1e00, kcov->t = ffff88802d5f1e00 [ 540.672232][T13449] kobject: 'syzkaller1' (ffff888064a54688): kobject_cleanup, parent 0000000000000000 [ 540.681861][T13449] kobject: 'syzkaller1' (ffff888064a54688): calling ktype release [ 540.689737][T13449] kobject: 'syzkaller1': free name [ 541.051984][ T3603] sd 0:0:1:0: cmd ffff8880288be5e0 CDB: 0x2a [ 541.058053][ T3603] Added buffer head 418 to ffff8880248e8e00 [ 541.065640][ C1] virtqueue callback for ffff8880248e8e00 (ffffffff85445d80) [ 541.073070][ C1] sd 0:0:1:0: cmd ffff8880288be5e0 response 0 status 0x0 sense_len 0 [ 541.081182][ C1] No more buffers in queue [ 541.086150][ T95] sd 0:0:1:0: cmd ffff888027912120 CDB: 0x35 [ 541.092246][ T95] Added buffer head 418 to ffff8880248e8e00 [ 541.098256][ C1] virtqueue callback for ffff8880248e8e00 (ffffffff85445d80) [ 541.105667][ C1] sd 0:0:1:0: cmd ffff888027912120 response 0 status 0x0 sense_len 0 [ 541.113770][ C1] No more buffers in queue [ 541.118221][ C1] vkms_vblank_simulate: vblank timer overrun [ 541.123950][ C0] virtqueue callback for ffff888141641400 (ffffffff84767210) [ 541.129246][ T95] sd 0:0:1:0: cmd ffff8880288be9a0 CDB: 0x2a [ 541.131683][ C0] virtqueue interrupt with no work for ffff888141641200 [ 541.138742][ T95] Added buffer head 418 to ffff8880248e8e00 [ 541.144531][ C0] virtqueue interrupt with no work for ffff888141641000 [ 541.152581][ C1] virtqueue callback for ffff8880248e8e00 (ffffffff85445d80) [ 541.164651][ T4737] Added buffer head 0 to ffff888141641400 [ 541.164759][ C1] sd 0:0:1:0: cmd ffff8880288be9a0 response 0 status 0x0 sense_len 0 [ 541.178631][ C1] No more buffers in queue [ 541.183106][ C1] vkms_vblank_simulate: vblank timer overrun [ 541.211793][ T4737] nf_conntrack: normal packet for ffff88807ce72f00 [ 541.292170][ T14] nf_conntrack: normal packet for ffff88802f28b500 [ 541.298962][ T6241] nf_conntrack: normal packet for ffff88802f28a480 [ 541.306635][ T6241] nf_conntrack: normal packet for ffff88802f28a480 [ 541.702321][ T6803] nf_conntrack: normal packet for ffff88807ce73080 [ 542.123900][ C0] virtqueue callback for ffff888141641400 (ffffffff84767210) [ 542.131331][ C0] virtqueue interrupt with no work for ffff888141641200 [ 542.138271][ C0] virtqueue interrupt with no work for ffff888141641000 [ 542.145419][ T14] Added buffer head 0 to ffff888141641400 [ 542.651898][ T14] nf_conntrack: normal packet for ffff88807ce72780 [ 542.732103][ T6803] nf_conntrack: normal packet for ffff88807ce73080 [ 542.977651][ C1] virtqueue callback for ffff8880267daa00 (ffffffff858ab770) [ 542.985147][ C1] No more buffers in queue [ 542.989622][ C1] Receiving skb proto 0x0806 len 28 type 1 [ 542.995530][ C1] No more buffers in queue [ 542.999967][ C1] Added buffer head 3430 to ffff8880267daa00 [ 543.006009][ C1] Added buffer head 3429 to ffff8880267daa00 [ 543.012057][ C1] Added buffer head 3428 to ffff8880267daa00 [ 543.018060][ C1] Added buffer head 3427 to ffff8880267daa00 [ 543.024104][ C1] Added buffer head 3426 to ffff8880267daa00 [ 543.030111][ C1] Added buffer head 3425 to ffff8880267daa00 [ 543.036145][ C1] Added buffer head 3424 to ffff8880267daa00 [ 543.042167][ C1] Added buffer head 3423 to ffff8880267daa00 [ 543.048164][ C1] Added buffer head 3422 to ffff8880267daa00 [ 543.054205][ C1] Added buffer head 3421 to ffff8880267daa00 [ 543.060217][ C1] Added buffer head 3420 to ffff8880267daa00 [ 543.066250][ C1] Added buffer head 3419 to ffff8880267daa00 [ 543.072268][ C1] Added buffer head 3418 to ffff8880267daa00 [ 543.078251][ C1] Added buffer head 3417 to ffff8880267daa00 [ 543.085073][ C1] Added buffer head 3416 to ffff8880267daa00 [ 543.091087][ C1] Added buffer head 3415 to ffff8880267daa00 [ 543.097126][ C1] Added buffer head 3414 to ffff8880267daa00 [ 543.103145][ C1] Added buffer head 3413 to ffff8880267daa00 [ 543.109168][ C1] Added buffer head 3412 to ffff8880267daa00 [ 543.115200][ C1] Added buffer head 3411 to ffff8880267daa00 [ 543.121217][ C1] Added buffer head 3410 to ffff8880267daa00 [ 543.123838][ C0] virtqueue callback for ffff888141641400 (ffffffff84767210) [ 543.127251][ C1] Added buffer head 3409 to ffff8880267daa00 [ 543.134620][ C0] virtqueue interrupt with no work for ffff888141641200 [ 543.140563][ C1] Added buffer head 3408 to ffff8880267daa00 [ 543.147502][ C0] virtqueue interrupt with no work for ffff888141641000 [ 543.147916][ T14] Added buffer head 0 to ffff888141641400 [ 543.153523][ C1] Added buffer head 3407 to ffff8880267daa00 [ 543.172296][ C1] Added buffer head 3406 to ffff8880267daa00 [ 543.178282][ C1] Added buffer head 3405 to ffff8880267daa00 [ 543.184306][ C1] Added buffer head 3404 to ffff8880267daa00 [ 543.190306][ C1] Added buffer head 3403 to ffff8880267daa00 [ 543.196338][ C1] Added buffer head 3402 to ffff8880267daa00 [ 543.202365][ C1] Added buffer head 3401 to ffff8880267daa00 [ 543.208356][ C1] Added buffer head 3400 to ffff8880267daa00 [ 543.214397][ C1] Added buffer head 3399 to ffff8880267daa00 [ 543.220402][ C1] Added buffer head 3398 to ffff8880267daa00 [ 543.226566][ C1] No more buffers in queue [ 543.231007][ C1] eth0: xmit ffff88805fce58c0 42:01:0a:80:00:01 [ 543.237308][ C1] Added buffer head 13 to ffff8880267dac00 [ 543.243167][ C1] virtqueue callback for ffff8880267dac00 (ffffffff858ab860) [ 543.250800][ C1] Sent skb ffff88805fce58c0 [ 543.255411][ C1] No more buffers in queue [ 543.541953][ T14] nf_conntrack: normal packet for ffff88807690b080 [ 543.772265][ T6803] nf_conntrack: normal packet for ffff88807ce73080 [ 544.123789][ C0] virtqueue callback for ffff888141641400 (ffffffff84767210) [ 544.131225][ C0] virtqueue interrupt with no work for ffff888141641200 [ 544.138164][ C0] virtqueue interrupt with no work for ffff888141641000 [ 544.145340][ T6241] Added buffer head 0 to ffff888141641400 [ 544.252072][ T6241] nf_conntrack: normal packet for ffff88807ce72900 [ 544.258851][ T6241] nf_conntrack: normal packet for ffff888028431c80 [ 544.265625][ T14] nf_conntrack: normal packet for ffff88807ce72c00 [ 544.272328][ T4737] nf_conntrack: normal packet for ffff88807ce72f00 [ 544.331849][ T6241] nf_conntrack: normal packet for ffff88802f28a480 [ 544.338550][ T6241] nf_conntrack: normal packet for ffff88802f28b500 [ 544.812414][ T6803] nf_conntrack: normal packet for ffff88807ce73080 [ 544.892949][ T6571] sd 0:0:1:0: cmd ffff8880288a3960 CDB: 0x2a [ 544.899003][ T6571] Added buffer head 418 to ffff8880248e8e00 [ 544.906282][ C1] virtqueue callback for ffff8880248e8e00 (ffffffff85445d80) [ 544.913681][ C1] sd 0:0:1:0: cmd ffff8880288a3960 response 0 status 0x0 sense_len 0 [ 544.921762][ C1] No more buffers in queue [ 545.123743][ C0] virtqueue callback for ffff888141641400 (ffffffff84767210) [ 545.131196][ C0] virtqueue interrupt with no work for ffff888141641200 [ 545.138137][ C0] virtqueue interrupt with no work for ffff888141641000 [ 545.145860][ T6241] Added buffer head 0 to ffff888141641400 [ 545.691702][ C0] net_ratelimit: 74 callbacks suppressed [ 545.691718][ C0] wireguard: wg0: Sending keepalive packet to peer 26 ([::1]:20003/0%0) [ 545.710707][ T6241] nf_conntrack: normal packet for ffff88807ce72780 [ 545.717585][ C1] wireguard: wg2: Receiving keepalive packet from peer 29 ([::1]:20001/0%0) [ 545.851676][ C1] wireguard: wg0: Sending keepalive packet to peer 19 ([::1]:20002/0%0) [ 545.860136][ C1] wireguard: wg0: Sending keepalive packet to peer 37 (127.0.0.1:20002) [ 545.868598][ C1] wireguard: wg0: Sending keepalive packet to peer 1 ([::1]:20002/0%0) [ 545.876981][ C1] wireguard: wg0: Sending keepalive packet to peer 43 ([::1]:20002/0%0) [ 545.885447][ C1] wireguard: wg0: Sending keepalive packet to peer 25 ([::1]:20002/0%0) [ 545.894130][ T6803] nf_conntrack: normal packet for ffff88807ce73080 [ 545.900986][ C0] wireguard: wg1: Receiving keepalive packet from peer 21 ([::1]:20001/0%0) [ 545.901227][ C1] wireguard: wg1: Receiving keepalive packet from peer 39 (127.0.0.1:20001) [ 545.910226][ C0] wireguard: wg1: Receiving keepalive packet from peer 3 ([::1]:20001/0%0) [ 546.123682][ C0] virtqueue callback for ffff888141641400 (ffffffff84767210) [ 546.131112][ C0] virtqueue interrupt with no work for ffff888141641200 [ 546.138055][ C0] virtqueue interrupt with no work for ffff888141641000 [ 546.145311][ T6241] Added buffer head 0 to ffff888141641400 [ 546.571905][ T6241] nf_conntrack: normal packet for ffff88807690b080 [ 546.812074][ T6241] nf_conntrack: normal packet for ffff88807690b980 [ 546.982269][ T4368] nf_conntrack: normal packet for ffff88807ce73080