last executing test programs: 1m49.993682464s ago: executing program 2 (id=82): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 1m49.765808854s ago: executing program 2 (id=86): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$packet(0x11, 0x2, 0x300) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x3, &(0x7f0000001fd8)=ANY=[@ANYBLOB="850000002e00000084000000000000009500000000000000"], &(0x7f0000000180)='GPL\x00'}, 0x48) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000000)=r2, 0x4) sendmsg$NFT_MSG_GETOBJ(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000002240)={&(0x7f0000002200)={0x14, 0x15, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x20}}, 0x14}, 0x1, 0x0, 0x0, 0x20040011}, 0x24040808) 1m49.093435603s ago: executing program 2 (id=88): mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x21c0, 0x103) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000440, 0x0, 0xff, 0x0, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000140)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) setxattr$security_capability(&(0x7f0000000240)='./file0/file1\x00', &(0x7f0000000280), 0x0, 0x0, 0x0) mount$9p_virtio(0x0, &(0x7f0000000180)='./file0/file1\x00', 0x0, 0x48, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x200000e, 0x6c2f2, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0x8, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='numa_maps\x00') bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x14, 0x90}, [@ldst={0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffff0}]}, &(0x7f0000000000)='syzkaller\x00', 0x5, 0xcab5, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x48) lseek(r0, 0x680, 0x0) 1m47.853701591s ago: executing program 2 (id=95): syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x210000, &(0x7f0000000400)={[{@nobarrier}, {@dioread_lock}, {@barrier_val}, {@nolazytime}, {@dax_inode}, {@lazytime}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x4}}, {@bh}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r0, &(0x7f0000002600)=""/4113, 0x1011) 1m47.188151239s ago: executing program 2 (id=100): r0 = socket$kcm(0xa, 0x3, 0x87) sendmsg$kcm(r0, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x5, @mcast2, 0x1}, 0x80, &(0x7f0000000980)=[{0x0}, {&(0x7f00000006c0)="af0fa5f838", 0x5}], 0x2, 0x0, 0x0, 0x900}, 0x20040004) 1m44.3260375s ago: executing program 2 (id=114): r0 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r0, 0x8914, 0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) ioctl$vim2m_VIDIOC_CREATE_BUFS(r1, 0xc100565c, &(0x7f0000000140)={0x7, 0x8001, 0x3, {0x2, @pix={0x1, 0x7ff, 0x31363553, 0x4, 0x6, 0x26c, 0x7, 0x0, 0x1, 0x8, 0x0, 0x6}}, 0x8}) timer_create(0x0, &(0x7f0000000280)={0x0, 0x21}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r3 = socket$kcm(0x23, 0x5, 0x0) listen(r3, 0x800) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r4, 0x0, 0x240040c4) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r5, &(0x7f0000000040)={0x23, 0x0, 0x58}, 0x10) sendto$phonet(r5, 0x0, 0x0, 0x80, 0x0, 0x0) accept4(r3, 0x0, 0x0, 0x80000) r6 = timerfd_create(0x1, 0x0) read(r6, &(0x7f0000002180)=""/262, 0x106) timerfd_settime(r6, 0x3, &(0x7f0000000080)={{}, {0x0, 0x989680}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x20842, 0x63) r8 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r8) r9 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80000) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r9, 0x89f0, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl0\x00', 0x0, 0x29, 0x9, 0x9, 0x5, 0x4, @empty, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x40, 0x1, 0xddc1, 0x4833e8b7}}) 1m44.284393282s ago: executing program 32 (id=114): r0 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r0, 0x8914, 0x0) r1 = syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) ioctl$vim2m_VIDIOC_CREATE_BUFS(r1, 0xc100565c, &(0x7f0000000140)={0x7, 0x8001, 0x3, {0x2, @pix={0x1, 0x7ff, 0x31363553, 0x4, 0x6, 0x26c, 0x7, 0x0, 0x1, 0x8, 0x0, 0x6}}, 0x8}) timer_create(0x0, &(0x7f0000000280)={0x0, 0x21}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r3 = socket$kcm(0x23, 0x5, 0x0) listen(r3, 0x800) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r4, 0x0, 0x240040c4) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r5, &(0x7f0000000040)={0x23, 0x0, 0x58}, 0x10) sendto$phonet(r5, 0x0, 0x0, 0x80, 0x0, 0x0) accept4(r3, 0x0, 0x0, 0x80000) r6 = timerfd_create(0x1, 0x0) read(r6, &(0x7f0000002180)=""/262, 0x106) timerfd_settime(r6, 0x3, &(0x7f0000000080)={{}, {0x0, 0x989680}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x20842, 0x63) r8 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r8) r9 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x80000) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r9, 0x89f0, &(0x7f00000001c0)={'syztnl1\x00', &(0x7f00000000c0)={'syztnl0\x00', 0x0, 0x29, 0x9, 0x9, 0x5, 0x4, @empty, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0x40, 0x1, 0xddc1, 0x4833e8b7}}) 51.951799418s ago: executing program 5 (id=343): syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000580)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x800, &(0x7f0000000440)=ANY=[@ANYBLOB="73686f72746e616d653d77696e39352c6e6f6e756d7461696c3d302c73686f72746e616d653d77696e6e742c756e695f786c6174653d312c6e66732c73686f72746e616d653d77696e6e742c726f6469722c696f636861727365743d6b6f69382d72752c73686f72746e616d653d6d697865642c757466383d302c756e695f786c6174653d312c756e695f786c6174653d312c006a4fcfcc9fc5ea902e1a6384d405e843e1dfa18259eaaba553a63617a0f84f2e66f4a8121e2cea67640f61a98cef24cdbc0121ddb0212c7365c895e70775f8c82357782f45acff678373e50747f0dbd34a6c51a45f248402fd4340c0024ca0ee5de3af9233d9e31dd6f105e2696137379613fb63ef2adfa2f785af00684cfa440b01bda2cbcd1b326a0ee91991ebfbd00ec2a75ac8d59d1e7793dfb73a16dd3b166bc6a158528f"], 0x1, 0x267, &(0x7f0000000b40)="$eJzs3U9rU1kYB+A3bTpJC0OyGCgzDMwdZjOr0HaYfYpUEAOKkoWuLDZFaWqhhYIu2u6K30G/gi7dCi7ErV9ABKmCG+uqCyESb/8kNYmtNY3o82z6cu7745yTXu6li55c+3NxYW5pZX57eyvy+Uxky1GOnUwUYyiGI7URAMCPZKfRiHeN1KDXAgCcDu9/APj59Hr/Zzb2xy6e/soAgH450d//Q31ZEgDQZ5evXD0/XanMXEqSfMTi5mp1tZr+TK9Pz8fNqEctJqIQHyIa+9L67LnKzETS9LoY+cX1oTS/vlodbs9PRiGKnfOTSSqqzdxefiTGdvMvxqIWU1GI3zrnpzrmf4l//2mZvxSFeH49lqIec9HMpvlcRKxNJsmZC5VD+dynPgAAAAAAAAAAAAAAAAAAAAAA6IdSsq/Yfv5Nen5PqdTteppvPR9otNf5QI31Q+frZOOP7GD3DgAAAAAAAAAAAAAAAAAAAN+Lldt3Fmbr9dpyr+LWswdPtnJp4IvNvYvM7rzHS2327Bk92i4OFb/+/epep0u5yB338/m6YiQiWkeS3Skf/9XHSb9V8XTrxu//rYz/360nsq0jd5tbbevpciNl+/WBvy1EdO3Jn+jGfrhXlN9/1rN3K9WWRwf9ixu/X559tPbyzVFTPR4ajeE+PIkAAAAAAAAAAAAAAAAAAICDf/od9EoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYHAOvv//uEUu2kbyXZs3Br1HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4GAAA//+HNZS6") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) syz_mount_image$vfat(&(0x7f0000000b00), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x1802a53, 0x0, 0xfa, 0x0, &(0x7f00000000c0)) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) syz_mount_image$fuse(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x275a, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_sys\x00', 0x275a, 0x0) 50.966839645s ago: executing program 5 (id=348): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000002180)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r0, 0xffffffffffffffff, 0x0) 50.7256503s ago: executing program 5 (id=350): r0 = syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='./mnt\x00', 0x0, &(0x7f0000000580)={[{@data_err_ignore}]}, 0x0, 0x236, &(0x7f0000000300)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=") ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40e8662e, &(0x7f0000000000)={0xc550, 0x40000000000002, 0x10, 0xb, 0x100005, 0x1}) 50.06307658s ago: executing program 5 (id=354): syz_open_procfs(0xffffffffffffffff, &(0x7f0000002440)='net/dev_mcast\x00') socket$key(0xf, 0x3, 0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x0, 0x0, &(0x7f0000003ff6)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$NL80211_CMD_DEL_INTERFACE(0xffffffffffffffff, 0x0, 0x40800) mkdirat(0xffffffffffffff9c, &(0x7f0000004000)='./mnt\x00', 0x1ff) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x40086607, 0x0) 47.558147159s ago: executing program 5 (id=359): r0 = socket(0x840000000002, 0x3, 0xff) sendmsg$inet(r0, &(0x7f0000000900)={&(0x7f00000006c0)={0x2, 0x4e23, @multicast1}, 0x10, 0x0}, 0x400c804) 45.073601673s ago: executing program 5 (id=367): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) capset(0x0, 0x0) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x80340, 0x168) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) getpid() recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$igmp6(0xa, 0x3, 0x2) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r3) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000100), 0x1ff, 0x301) ioctl$USBDEVFS_CONTROL(r4, 0xc0105500, &(0x7f0000000000)={0x80, 0x6, 0x301, 0x0, 0x0, 0x101, 0x0}) 29.903821468s ago: executing program 33 (id=367): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x9a5eb000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) capset(0x0, 0x0) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x80340, 0x168) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) getpid() recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$igmp6(0xa, 0x3, 0x2) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r3) mmap(0x0, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000100), 0x1ff, 0x301) ioctl$USBDEVFS_CONTROL(r4, 0xc0105500, &(0x7f0000000000)={0x80, 0x6, 0x301, 0x0, 0x0, 0x101, 0x0}) 11.914466468s ago: executing program 3 (id=481): fsopen(0x0, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x80042, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x20) r0 = openat$rtc(0xffffffffffffff9c, 0x0, 0x40800, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={0x0, 0x0}, 0x28) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000180)={0x25, 0x8, 0x6, 0x4, 0x5, 0x7, 0x0, 0xb1}) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4040850) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000001c0)=ANY=[], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x20008040) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, 0x0, 0x0) inotify_init1(0x80800) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, &(0x7f0000000000)=""/188) epoll_create1(0x0) ioctl$sock_ifreq(0xffffffffffffffff, 0x8992, 0x0) mprotect(&(0x7f0000168000/0x4000)=nil, 0x4000, 0x5) syz_clone(0xb44040, 0x0, 0x0, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) 10.073620078s ago: executing program 1 (id=486): setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2b, &(0x7f0000000180)=0x101, 0x4) add_key$user(0x0, &(0x7f0000000440), &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mmap$IORING_OFF_SQ_RING(0x0, 0x8000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000080), 0x0, 0x0, 0x0) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, 0x0, 0x0) 9.752494665s ago: executing program 4 (id=487): syz_mount_image$ext4(&(0x7f0000000080)='ext3\x00', &(0x7f0000000480)='./file0\x00', 0x0, &(0x7f00000001c0)={[{@noload}, {@stripe={'stripe', 0x3d, 0xdc}}, {@data_err_abort}, {@noload}, {@data_err_ignore}, {@noblock_validity}]}, 0xff, 0x451, &(0x7f0000000940)="$eJzs3MtvG8UfAPDvrp30/Ut+UB4tLQQKouKRNOnzwKUIJA4gIcGhiFNI0qrUbaAJEq0qKBzKEVXijjgi8RdwggsCTkhc4Y4qVaiXFiQko13vpq5rp3Hj1KX+fKRNZrzj7Hw9O/bsjDcBDKyx7EcSsTkifouIkUb2xgJjjV/Xrpyb+evKuZkk6vU3/kzyclevnJspi5bP29TI1OtFfl2b4154O2K6Vps7XeQnFk++N7Fw5uzzx09OH5s7Nndq6tChfXt3Dh+Y2t+TOLO4rm7/aH7HtlfeuvjazJGL7/z0TVbfzcX+5jh6ZMNY49Vt66keH6zftjSlk2ofK0JXKhGRNddQ3v9HohIblvaNxMuf9rVywJqq1+v1dp/PhfN14B6WRL9rAPRH+UGfXf+W2x0aetwVLh+OeP9gI/5rxdbYU420KDPUcn3bS2MRceT8319mW6zNPAQAwA2+OxwRz7Ub/6XxYFO5/xVrKKMR8f+IuC8i7o+IrRHxQERe9qGIeLjL47eukNw8/kkv3VZgK5SN/14o1raWxn//1PP4C6OVIrclj38oOXq8NreneE12x9C6LD+5zDG+f+nXzzvtax7/ZVt2/HIs2JBeqrZM0M1OL06vMuwllz+J2F5tiT+XRLmMk0TEtojY3tVfvn6FcfyZr3d0KnXr+JfRg3Wm+lcRTzfa/3y0xF9KOq5PTh48MLV/Yn3U5vZMlGfFzX7+5cLrnY6/qvh7IGv/ja3nf24p/tFkfcTCmbMn8vXahWhdIb6lC79/1vGa5nbP/+HkzTw9XDz24fTi4unJiOHk1Zsfn7r+3CJfbY5/96528af5e1wZ7SMRkZ3EOyPi0Yh4rKj74xHxRETsWib+H1988t3u419mVr6Hsvhnb9X+0dz+3ScqJ374tvv4S1n778tTu4tHVvL+t9IKrua1AwAAgP+KNP8OfJKOL6XTdHy88R3+rbExrc0vLD57dP6DU7ON78qPxlBaznSNNM2HThZzw2V+qiW/t5g3/qKyIc+Pz8zXZvsdPAy4TR36f+aPSr9rB6w592vB4NL/YXDp/zC49H8YXPo/DK52/f/jPtQDuPN8/sPg0v9hcOn/MLj0fxhIHe+NT1d1y7/EPZ+ItPtnVaOvdU66+McQd0+iutZ1Xtd2V7/fmQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHrj3wAAAP//TonqKA==") syz_open_dev$vim2m(&(0x7f0000002c80), 0x4003, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSETLED(r3, 0x4b32, 0x8) madvise(&(0x7f0000492000/0x2000)=nil, 0x2000, 0x12) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$IP_VS_SO_GET_VERSION(r4, 0x0, 0x480, &(0x7f0000000340), &(0x7f0000000380)=0x40) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000140)=@framed={{0x18, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r5}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000000)=@framed={{0x18, 0x6}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r5}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 9.115477547s ago: executing program 1 (id=488): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000000)={&(0x7f0000000000), 0x1000, 0x800}, 0x20) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000001000)=0x10, 0x4) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000001200)=0x10, 0x4) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000001300)=0x10, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) bind$xdp(r0, &(0x7f0000001400)={0x2c, 0x0, r2, 0x0, r0}, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x11, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000001500)={r3, &(0x7f0000001600), &(0x7f0000001700)=@udp=r0}, 0x20) r4 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x6, &(0x7f0000002000)=@raw=[@map_fd={0x18, 0x1, 0x1, 0x0, r3}, @generic={0xb7, 0x2}, @generic={0xb7, 0x3}, @generic={0x85, 0x0, 0x0, 0x0, 0x33}, @generic={0x95}], &(0x7f0000003000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN_LIVE(0xa, &(0x7f0000004000)={r4, 0x0, 0xe, 0x0, &(0x7f0000005000)="00112233445566778899aabbccdd", 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0}, 0x50) 8.766811242s ago: executing program 4 (id=489): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_GET(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000540)={0x14, 0x1, 0x8, 0x101, 0x0, 0x0, {0x0, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x2400c082}, 0x4) 8.089462465s ago: executing program 3 (id=490): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a03000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003"], 0xe8}, 0x1, 0x0, 0x0, 0x24044011}, 0x4008800) 7.109125561s ago: executing program 3 (id=492): r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) splice(r2, 0x0, r4, 0x0, 0x869, 0x0) read$watch_queue(r3, &(0x7f0000000040)=""/187, 0x869) write(r1, &(0x7f0000000040), 0xffffff4a) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) 6.979085677s ago: executing program 4 (id=493): r0 = socket$tipc(0x1e, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x10, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) listen(r0, 0x8) socket$tipc(0x1e, 0x5, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder1\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x84}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.test\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/usb_gadget/naa.test/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.test/tpgt_1/lun/lun_0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/usb_gadget/naa.test/tpgt_1/lun/lun_0/statistics/scsi_transport/device\x00', 0x0, 0x0) 6.038843692s ago: executing program 0 (id=494): pipe(&(0x7f0000002680)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x2) fchdir(r2) r3 = open(&(0x7f0000000200)='.\x00', 0x0, 0x244) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r3, 0xc0049364, 0x0) 6.037565152s ago: executing program 3 (id=495): syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000580)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x800, &(0x7f0000000440)=ANY=[@ANYBLOB="73686f72746e616d653d77696e39352c6e6f6e756d7461696c3d302c73686f72746e616d653d77696e6e742c756e695f786c6174653d312c6e66732c73686f72746e616d653d77696e6e742c726f6469722c696f636861727365743d6b6f69382d72752c73686f72746e616d653d6d697865642c757466383d302c756e695f786c6174653d312c756e695f786c6174653d312c006a4fcfcc9fc5ea902e1a6384d405e843e1dfa18259eaaba553a63617a0f84f2e66f4a8121e2cea67640f61a98cef24cdbc0121ddb0212c7365c895e70775f8c82357782f45acff678373e50747f0dbd34a6c51a45f248402fd4340c0024ca0ee5de3af9233d9e31dd6f105e2696137379613fb63ef2adfa2f785af00684cfa440b01bda2cbcd1b326a0ee91991ebfbd00ec2a75ac8d59d1e7793dfb73a16dd3b166bc6a158528f"], 0x1, 0x267, &(0x7f0000000b40)="$eJzs3U9rU1kYB+A3bTpJC0OyGCgzDMwdZjOr0HaYfYpUEAOKkoWuLDZFaWqhhYIu2u6K30G/gi7dCi7ErV9ABKmCG+uqCyESb/8kNYmtNY3o82z6cu7745yTXu6li55c+3NxYW5pZX57eyvy+Uxky1GOnUwUYyiGI7URAMCPZKfRiHeN1KDXAgCcDu9/APj59Hr/Zzb2xy6e/soAgH450d//Q31ZEgDQZ5evXD0/XanMXEqSfMTi5mp1tZr+TK9Pz8fNqEctJqIQHyIa+9L67LnKzETS9LoY+cX1oTS/vlodbs9PRiGKnfOTSSqqzdxefiTGdvMvxqIWU1GI3zrnpzrmf4l//2mZvxSFeH49lqIec9HMpvlcRKxNJsmZC5VD+dynPgAAAAAAAAAAAAAAAAAAAAAA6IdSsq/Yfv5Nen5PqdTteppvPR9otNf5QI31Q+frZOOP7GD3DgAAAAAAAAAAAAAAAAAAAN+Lldt3Fmbr9dpyr+LWswdPtnJp4IvNvYvM7rzHS2327Bk92i4OFb/+/epep0u5yB338/m6YiQiWkeS3Skf/9XHSb9V8XTrxu//rYz/360nsq0jd5tbbevpciNl+/WBvy1EdO3Jn+jGfrhXlN9/1rN3K9WWRwf9ixu/X559tPbyzVFTPR4ajeE+PIkAAAAAAAAAAAAAAAAAAICDf/od9EoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYHAOvv//uEUu2kbyXZs3Br1HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4GAAA//+HNZS6") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) syz_mount_image$vfat(&(0x7f0000000b00), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x1802a53, 0x0, 0xfa, 0x0, &(0x7f00000000c0)) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) syz_mount_image$fuse(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x275a, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_sys\x00', 0x275a, 0x0) 5.805544025s ago: executing program 4 (id=496): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) sendmmsg$sock(0xffffffffffffffff, 0x0, 0x0, 0x0) unshare(0x60600) r3 = dup(0xffffffffffffffff) ioctl$PTP_EXTTS_REQUEST2(r3, 0x40603d10, &(0x7f00000002c0)={0x1, 0x9}) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r4, 0x6, &(0x7f0000000000)) fcntl$lock(r4, 0x7, &(0x7f0000001140)={0x1, 0x2, 0x400, 0x200}) 5.533583539s ago: executing program 1 (id=497): setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2b, &(0x7f0000000180)=0x101, 0x4) add_key$user(0x0, &(0x7f0000000440), &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mmap$IORING_OFF_SQ_RING(0x0, 0x8000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000080), 0x0, 0x0, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, 0x0, 0x0) 4.743090323s ago: executing program 3 (id=498): syz_mount_image$ext4(&(0x7f0000000080)='ext3\x00', &(0x7f0000000480)='./file0\x00', 0x0, &(0x7f00000001c0)={[{@noload}, {@stripe={'stripe', 0x3d, 0xdc}}, {@data_err_abort}, {@noload}, {@data_err_ignore}, {@noblock_validity}]}, 0xff, 0x451, &(0x7f0000000940)="$eJzs3MtvG8UfAPDvrp30/Ut+UB4tLQQKouKRNOnzwKUIJA4gIcGhiFNI0qrUbaAJEq0qKBzKEVXijjgi8RdwggsCTkhc4Y4qVaiXFiQko13vpq5rp3Hj1KX+fKRNZrzj7Hw9O/bsjDcBDKyx7EcSsTkifouIkUb2xgJjjV/Xrpyb+evKuZkk6vU3/kzyclevnJspi5bP29TI1OtFfl2b4154O2K6Vps7XeQnFk++N7Fw5uzzx09OH5s7Nndq6tChfXt3Dh+Y2t+TOLO4rm7/aH7HtlfeuvjazJGL7/z0TVbfzcX+5jh6ZMNY49Vt66keH6zftjSlk2ofK0JXKhGRNddQ3v9HohIblvaNxMuf9rVywJqq1+v1dp/PhfN14B6WRL9rAPRH+UGfXf+W2x0aetwVLh+OeP9gI/5rxdbYU420KDPUcn3bS2MRceT8319mW6zNPAQAwA2+OxwRz7Ub/6XxYFO5/xVrKKMR8f+IuC8i7o+IrRHxQERe9qGIeLjL47eukNw8/kkv3VZgK5SN/14o1raWxn//1PP4C6OVIrclj38oOXq8NreneE12x9C6LD+5zDG+f+nXzzvtax7/ZVt2/HIs2JBeqrZM0M1OL06vMuwllz+J2F5tiT+XRLmMk0TEtojY3tVfvn6FcfyZr3d0KnXr+JfRg3Wm+lcRTzfa/3y0xF9KOq5PTh48MLV/Yn3U5vZMlGfFzX7+5cLrnY6/qvh7IGv/ja3nf24p/tFkfcTCmbMn8vXahWhdIb6lC79/1vGa5nbP/+HkzTw9XDz24fTi4unJiOHk1Zsfn7r+3CJfbY5/96528af5e1wZ7SMRkZ3EOyPi0Yh4rKj74xHxRETsWib+H1988t3u419mVr6Hsvhnb9X+0dz+3ScqJ374tvv4S1n778tTu4tHVvL+t9IKrua1AwAAgP+KNP8OfJKOL6XTdHy88R3+rbExrc0vLD57dP6DU7ON78qPxlBaznSNNM2HThZzw2V+qiW/t5g3/qKyIc+Pz8zXZvsdPAy4TR36f+aPSr9rB6w592vB4NL/YXDp/zC49H8YXPo/DK52/f/jPtQDuPN8/sPg0v9hcOn/MLj0fxhIHe+NT1d1y7/EPZ+ItPtnVaOvdU66+McQd0+iutZ1Xtd2V7/fmQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHrj3wAAAP//TonqKA==") syz_open_dev$vim2m(&(0x7f0000002c80), 0x4003, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDSETLED(r3, 0x4b32, 0x8) madvise(&(0x7f0000492000/0x2000)=nil, 0x2000, 0x12) socket$inet6_sctp(0xa, 0x5, 0x84) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000140)=@framed={{0x18, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r4}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f0000000000)=@framed={{0x18, 0x6}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r4}}]}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 4.661702015s ago: executing program 4 (id=499): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) 4.474657676s ago: executing program 4 (id=500): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2000}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = socket$l2tp6(0xa, 0x2, 0x73) getsockname$l2tp6(r2, &(0x7f0000000040)={0xa, 0x0, 0x0, @local}, &(0x7f0000000080)=0x20) 4.378462982s ago: executing program 0 (id=501): r0 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) r2 = open(&(0x7f0000000280)='.\x00', 0x141080, 0x0) getdents(r2, 0x0, 0x0) 4.321477887s ago: executing program 1 (id=502): syz_mount_image$ext4(&(0x7f0000000500)='ext4\x00', &(0x7f0000000540)='./file2\x00', 0x10, &(0x7f0000000580), 0x41, 0x4e8, &(0x7f00000005c0)="$eJzs3U9oVNsZAPDvTv5YY2LSUrHVFgItVrGdmESjQilmVRAtbS100T8Sk5iISSaYCagUahCLFCpddGFx1Y1ddBO6K9IiFB681Vu4eG8hCm/1njyfPHkuXOVxJ3d0jGPyYmLuY/z94DL3nEnmfHc+7p1zhnPPBPDW6o6IIxHRFBHFiOjM6gvZFpcWt/TvTvXPj6dbEgsLJx4lkUTE0f758eprJdnjluwFvpU+XInY2/xyuzMXLp4dmpgYPZeVe8qT0z0zFy7+6Mzk0Njo2OjUwMGDhw8dGDhweP2OdfP26ze//fdjd669M/fdbVuGJ9N427Pnao9jvXRHd/aetERH7RNJxKn1bixnX8s7AFbtk8LOW3nHAABsvELW92+u9P87oykWO+v37/72cWf8sS3v+AAAAIC1W1hoyh4BAACAxpUY+wMAAECDq84DONo/P17dNmruwYOfblRLvMrDwYjoWsx/9f7uxWean93T2/KG7u/9w9OI7uh48tFPvvH/dIs3dB82X03zH+YdAXlq3Z93BORpxy/yjoA8vXc17wi4NBcRt4/U6f8na+7ztS8pJ0vKxwfT/t9fZmrr9P/eHr88kXcE5OlnA3lHQJ5uPMo7Am4PRsS+et//FSrr91Vtjoi26tp+6+RQe/r5/+/7tXUvf/4XHqxjkyzxcDDixzVrO56qyX+mqykrdVS+KmxJTp+ZGN0XEVsjYne0bErLvcu00Ttw46/16r/zJM3/P5Pq93/plrZf/S4wi+NB86YX/29kqDy01uNm0cO5iB3N9fL/vP+fZLl+Xf8tXftzvfqBPZV1RXctn3/epIV/ROyqe/4/H60ly67P2lO5HPRULwp1/OuDz67Uq//+79P8n90j//lJz/+25fNfuf4/W693ZvVtXP7fzSf16p/eSvP/t0uvc/1vTX5VCbA1qzs/VC6f641oTY69XN+3+pgbVfX9qL5faf53f6/+53+1/5dk60J3RcTXX6PNuXvTd+rVXy+k+b/xO+d/ftL8j6xw/icvnP+r35l//4c/qNf2zqtp/rt+vfL5v78SzO6sRv9vZV82QXnHCQAAAAAAAMD6KFTu00kKxWf7hUKxuDjP95vRVpgozZT3ni7NTo0s3s/TFS2F6lSvzpr5oL3Z/JBquW9JuT+bO3K1c3OlXBwuTYzkffAAAADQ4Noj7v3m8n+2b3nF+D91tzPvKAEAAIC1SMf/HffaKst5fW6cDwAAAA0pHf8//tOn74bxPwAAADSs2vE/AAAA0Nh+fvx4ui1Uf/dvqjR25uz49OG+fcXJ2eHicOncdHGsVBqrrNg3ufLrTZRK0719MXu+pzw6U+6ZuXDx5GRpdqp8svK7sSdHWzbgmICVFbd+vC3vGAAAgI2zlt/1t2PHTqPu5H1lAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgLb4IAAD//wws/WY=") chdir(&(0x7f0000000240)='./file2\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, 0x0, &(0x7f00000000c0)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./config/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) write(r1, 0x0, 0x0) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/idProduct\x00', 0x1, 0x0) close(r2) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff) symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1/configs/c.1/printer.usb0\x00') sched_setscheduler(r0, 0x2, &(0x7f0000000480)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x2a6d2000) ioctl$FS_IOC_ENABLE_VERITY(0xffffffffffffffff, 0x40806685, &(0x7f0000000a80)={0x1, 0x2, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$FS_IOC_READ_VERITY_METADATA(0xffffffffffffffff, 0xc0286687, &(0x7f0000000040)={0x2, 0x200000005, 0x0, 0x0}) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(0xffffffffffffffff, 0x6, 0x16, &(0x7f0000000040)=[@window={0x3, 0x3, 0x40}, @mss={0x2, 0x6ea8f426}, @sack_perm, @timestamp, @timestamp, @timestamp, @mss={0x2, 0x101}, @sack_perm], 0x8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) 4.171475339s ago: executing program 0 (id=503): r0 = socket$tipc(0x1e, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x10, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="1800"/13], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) listen(r0, 0x8) socket$tipc(0x1e, 0x5, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder1\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x84}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.test\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/usb_gadget/naa.test/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.test/tpgt_1/lun/lun_0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/usb_gadget/naa.test/tpgt_1/lun/lun_0/statistics/scsi_transport/device\x00', 0x0, 0x0) 4.133288199s ago: executing program 6 (id=415): bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='projid_map\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket(0x2, 0xa, 0x9) symlinkat(0x0, 0xffffffffffffff9c, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x24, 0x0, 0x0) preadv(r0, &(0x7f0000002b80)=[{&(0x7f0000000180)=""/189, 0xbd}], 0x1, 0x4, 0x1) 3.792938541s ago: executing program 6 (id=504): socket$kcm(0x2, 0x200000000000001, 0x106) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmsg$unix(r1, 0x0, 0x2020) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = fsopen(0x0, 0x0) mkdir(&(0x7f0000000100)='./config\x00', 0x850e856b79c500b0) mount(0x0, &(0x7f0000000100)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./proc\x00', 0x777) mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/sys/vm/nr_hugepages\x00', 0x2, 0x0) write$cgroup_int(r4, &(0x7f0000000000)=0x7ff, 0x12) lstat(&(0x7f00000001c0)='./proc\x00', &(0x7f0000000080)) mkdir(&(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x0) mkdir(&(0x7f0000000180)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ab) mkdir(&(0x7f0000000600)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0x82) symlink(&(0x7f0000000700)='./config/usb_gadget/g1/functions/acm.usb0\x00', &(0x7f0000000800)='./config/usb_gadget/g1/configs/c.1\x00') symlinkat(&(0x7f0000000000)='./config/usb_gadget/g1/functions/acm.usb0\x00', 0xffffffffffffff9c, 0x0) r5 = dup2(r3, r3) fsconfig$FSCONFIG_SET_FD(r5, 0x5, &(0x7f0000000040)='source', 0x0, r3) r6 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000540)=@raw={'raw\x00', 0x3c1, 0x3, 0x4e0, 0x320, 0x18c, 0x203, 0x0, 0x19030000, 0x410, 0x2e0, 0x2e0, 0x410, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x2d8, 0x320, 0x7000000, {0xf0ffff}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{0x74, 0x0, 0x8, 0x20}, {}, {}, {}, {0x0, 0xfe, 0x0, 0x100}, {0x0, 0x0, 0x4}, {0x0, 0x0, 0x0, 0x5973599c}, {}, {0x0, 0x0, 0x0, 0x8}, {}, {0x0, 0x20, 0xcd, 0xe}, {0x0, 0x0, 0x0, 0x3}, {0x0, 0x0, 0x3, 0x3}, {0x2, 0x0, 0x4}, {}, {0x0, 0x0, 0x0, 0x1}, {0x0, 0x0, 0x8}, {}, {0x16}, {0x0, 0xff}, {}, {0x7}, {0x0, 0x0, 0x0, 0x4}, {0x0, 0x4, 0x0, 0x101}, {}, {0x0, 0x0, 0x5, 0x1}, {}, {0x0, 0x0, 0xfd, 0x9}, {0xfffc, 0x0, 0x0, 0x6}, {0x4, 0x0, 0x0, 0x2}, {0xfffe}, {}, {}, {}, {0xfffe, 0xfb}, {}, {0x7a04}, {0x800}, {}, {0x20, 0x6}, {}, {}, {0x0, 0x1}, {0x0, 0x0, 0x0, 0x800}, {}, {0xb8c, 0x0, 0x0, 0xf00}, {0x0, 0x1, 0x0, 0x3}, {0x3}, {0x0, 0x4b}, {}, {}, {0x0, 0x0, 0xe2}, {0x4}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {0xfc}, {0x0, 0xfd}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffd}, {0x2}, {0x0, 0xb}, {0x4}]}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x100002, 'syz0\x00', {0x8001}}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x1000b, 'syz0\x00', {0x6c8}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x540) syz_clone(0x20300000, 0x0, 0x0, 0x0, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) 3.487414874s ago: executing program 1 (id=505): r0 = socket$tipc(0x1e, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x10, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) listen(r0, 0x8) socket$tipc(0x1e, 0x5, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder1\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x84}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.test\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/usb_gadget/naa.test/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.test/tpgt_1/lun/lun_0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/usb_gadget/naa.test/tpgt_1/lun/lun_0/statistics/scsi_transport/device\x00', 0x0, 0x0) 2.131316842s ago: executing program 3 (id=506): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000380)='./file0\x00', 0x22000011, &(0x7f0000000000)={[{@user_xattr}, {@noblock_validity}, {@nodelalloc}]}, 0x86, 0x48e, &(0x7f0000000400)="$eJzs3EtvVFUcAPD/nXaKFUoLPnkoo0hsRFtaUFmYGI0mbExMdKHLWipBChioiRAiaAwujZ9AXZr4CVzpxqgrjVvdGxNi2IguzJj7KlM6rdPpTKcyv18y7Tn3dc7/nnt6H+dOA+hbtfRHErEtIn6JiNE8u3SBWv7rxvVLs39dvzSbRL3+yh9Jttyf1y/NlotuK35vLbY5XomofJjEniblnr9w8dTM/PzcuSI/uXD67cnzFy4+cfL0zIm5E3Nnpo8ePXJ46umnpp/sSJwjaV13v3d2765jr3/y0mw93vj+y7T+A8X8xjhyY+susxa1GI56vbJk6lD288C6t765jDSkk8EeVoQ1SY//tLmqWf8fjYG42Xij8eIHPa0c0FX1er2+Y9nU/KxYOZBk84HblT4O/ao846f3v+VnY69Aeuvac/kNUBr3jeKTzxmM9L49Gcvv2Ae6VP62iHjtyt+fpp9o+hwCAKCzvk6vfx5vdv1XiXsblttejA2NRcTBiNgZEXdFxN0RcU9Etux9EXH/Gsuv3ZLPy682TPlpuN3YWpFe/z1TjG0tvf5bHLUZGyhyI1n81eTNk/Nzh4p9Mh7VLWl+apUyvnnh54+zRJNIag3Xf+knLb+8Fizq8fvglqXrHJ9ZmFlv3KVr70fsHny2SfzJ4khAEhG7ImJ3G9tP99nJx77Ym6a3b10+/7/jX0UHxpnqn0c8mrf/lbgl/lKSl7TS+OTkHTE/d2iyPCqW++HHqy835huP7loWRpvxd0Da/nc2Pf6L+MtuUI7Xnl97GVd//WjFe5p2j/+h5NUsPVRMe3dmYeHcVMRQMWHJ9Omb65b5cvk0/vH9zfv/zoh/PivW2xMR6UH8QEQ8GBH7iro/FBEPR8T+VeL/7vlH3lp9D/W2/Y+v1v4RY0kRf+rc4sB964mBU99+tVL5rbX/kSw1Xkxp5e9fqxVsd78BAADA/0klG4NOKhOL6UplYiJ/h7987HKwFu+cOZ6PVY9FtVI+6RpteB46VTwbLvPTt+QPR8SO7E2j4Sw/MXt2fqTHsUO/27pC/0/91q2XXoDNY03jaEn36gFsPN/XhP7VvP939b0rYJNw/of+pf9D/2rW/y9H3OhBVYAN5vwP/av1/u+NALjdOP9D/9L/oS8t/0r8cPGvE9r5pv/NxM5j61p9rYnqBpbV4cRAl7Ycjf+0owuJqPR817WfqGyGauwrElsiotW1Lje0aXna7kYNq/M9/KMEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADQQf8GAAD//4F+194=") syz_clone(0x20b84311, 0x0, 0x0, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x5) socket$nl_xfrm(0x10, 0x3, 0x6) lremovexattr(&(0x7f0000000000)='./cgroup.net/cgroup.procs\x00', &(0x7f0000000240)=@random={'trusted.', '\x00'}) 832.863864ms ago: executing program 1 (id=507): syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000580)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x800, &(0x7f0000000440)=ANY=[@ANYBLOB="73686f72746e616d653d77696e39352c6e6f6e756d7461696c3d302c73686f72746e616d653d77696e6e742c756e695f786c6174653d312c6e66732c73686f72746e616d653d77696e6e742c726f6469722c696f636861727365743d6b6f69382d72752c73686f72746e616d653d6d697865642c757466383d302c756e695f786c6174653d312c756e695f786c6174653d312c006a4fcfcc9fc5ea902e1a6384d405e843e1dfa18259eaaba553a63617a0f84f2e66f4a8121e2cea67640f61a98cef24cdbc0121ddb0212c7365c895e70775f8c82357782f45acff678373e50747f0dbd34a6c51a45f248402fd4340c0024ca0ee5de3af9233d9e31dd6f105e2696137379613fb63ef2adfa2f785af00684cfa440b01bda2cbcd1b326a0ee91991ebfbd00ec2a75ac8d59d1e7793dfb73a16dd3b166bc6a158528f"], 0x1, 0x267, &(0x7f0000000b40)="$eJzs3U9rU1kYB+A3bTpJC0OyGCgzDMwdZjOr0HaYfYpUEAOKkoWuLDZFaWqhhYIu2u6K30G/gi7dCi7ErV9ABKmCG+uqCyESb/8kNYmtNY3o82z6cu7745yTXu6li55c+3NxYW5pZX57eyvy+Uxky1GOnUwUYyiGI7URAMCPZKfRiHeN1KDXAgCcDu9/APj59Hr/Zzb2xy6e/soAgH450d//Q31ZEgDQZ5evXD0/XanMXEqSfMTi5mp1tZr+TK9Pz8fNqEctJqIQHyIa+9L67LnKzETS9LoY+cX1oTS/vlodbs9PRiGKnfOTSSqqzdxefiTGdvMvxqIWU1GI3zrnpzrmf4l//2mZvxSFeH49lqIec9HMpvlcRKxNJsmZC5VD+dynPgAAAAAAAAAAAAAAAAAAAAAA6IdSsq/Yfv5Nen5PqdTteppvPR9otNf5QI31Q+frZOOP7GD3DgAAAAAAAAAAAAAAAAAAAN+Lldt3Fmbr9dpyr+LWswdPtnJp4IvNvYvM7rzHS2327Bk92i4OFb/+/epep0u5yB338/m6YiQiWkeS3Skf/9XHSb9V8XTrxu//rYz/360nsq0jd5tbbevpciNl+/WBvy1EdO3Jn+jGfrhXlN9/1rN3K9WWRwf9ixu/X559tPbyzVFTPR4ajeE+PIkAAAAAAAAAAAAAAAAAAICDf/od9EoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYHAOvv//uEUu2kbyXZs3Br1HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4GAAA//+HNZS6") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) syz_mount_image$vfat(&(0x7f0000000b00), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x1802a53, 0x0, 0xfa, 0x0, &(0x7f00000000c0)) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) syz_mount_image$fuse(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.stat\x00', 0x275a, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000100)=0x6) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_sys\x00', 0x275a, 0x0) 392.944093ms ago: executing program 0 (id=508): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000180)=0x402, 0x4) 142.029811ms ago: executing program 0 (id=509): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) setns(0xc9, 0x0) r0 = socket(0x8, 0x5, 0x5) connect$netlink(r0, &(0x7f0000000240)=@proc={0x10, 0x0, 0x25dfdbff}, 0xc) 3.922099ms ago: executing program 0 (id=510): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x82c03, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0x88, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x8, 0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x58, 0x2, [@TCA_BASIC_ACT={0x54, 0x3, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x7, 0x4, 0x4, 0xb, 0xdc}, 0x2, r3}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x8080) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r5, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e0003000024c1020000ff1107c2fb7fe0400018534b4f6b3d327db412f40000000000000000", 0x2e}], 0x1}, 0x4005) 0s ago: executing program 6 (id=511): setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2b, &(0x7f0000000180)=0x101, 0x4) add_key$user(0x0, &(0x7f0000000440), &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mmap$IORING_OFF_SQ_RING(0x0, 0x8000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000080), 0x0, 0x0, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r1, 0x0, 0x0) kernel console output (not intermixed with test programs): m: link becomes ready [ 63.802850][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 63.816347][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 63.837915][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 63.846672][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 63.855242][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 63.864648][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 63.892333][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 63.909627][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 63.918700][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 63.928445][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 63.937325][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 63.946038][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 63.953593][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 63.961028][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 63.974049][ T4186] 8021q: adding VLAN 0 to HW filter on device bond0 [ 63.981714][ T4187] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 63.995871][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 64.004664][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 64.018943][ T4192] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 64.038230][ T4192] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 64.050517][ T4185] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.063155][ T4191] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.070721][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 64.080472][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 64.090130][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 64.103300][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 64.116816][ T4186] 8021q: adding VLAN 0 to HW filter on device team0 [ 64.147294][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 64.163670][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 64.187371][ T4236] bridge0: port 1(bridge_slave_0) entered blocking state [ 64.194526][ T4236] bridge0: port 1(bridge_slave_0) entered forwarding state [ 64.252864][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 64.260922][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 64.277863][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 64.286555][ T4236] bridge0: port 2(bridge_slave_1) entered blocking state [ 64.293657][ T4236] bridge0: port 2(bridge_slave_1) entered forwarding state [ 64.301938][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 64.310411][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 64.319515][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 64.329411][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 64.367012][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 64.379964][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 64.392610][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 64.400942][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 64.417454][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 64.422201][ T7] Bluetooth: hci0: command 0x041b tx timeout [ 64.430141][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 64.440305][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 64.441354][ T7] Bluetooth: hci1: command 0x041b tx timeout [ 64.455283][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 64.464238][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 64.472879][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 64.483923][ T4185] device veth0_vlan entered promiscuous mode [ 64.485493][ T7] Bluetooth: hci3: command 0x041b tx timeout [ 64.495401][ T4186] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 64.497315][ T7] Bluetooth: hci2: command 0x041b tx timeout [ 64.509912][ T4186] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 64.524701][ T7] Bluetooth: hci4: command 0x041b tx timeout [ 64.525269][ T4187] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.548355][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 64.556397][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 64.564496][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 64.572581][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 64.580839][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 64.603187][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 64.610664][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 64.634925][ T4185] device veth1_vlan entered promiscuous mode [ 64.654815][ T4192] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 64.672687][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 64.680778][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 64.695540][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 64.705319][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 64.714128][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 64.759622][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 64.771345][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 64.780313][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 64.789544][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 64.800008][ T4191] device veth0_vlan entered promiscuous mode [ 64.814953][ T4187] device veth0_vlan entered promiscuous mode [ 64.834051][ T4185] device veth0_macvtap entered promiscuous mode [ 64.845635][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 64.855112][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 64.863845][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 64.875313][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 64.884221][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 64.893024][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 64.902676][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 64.910572][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 64.918529][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 64.945631][ T4185] device veth1_macvtap entered promiscuous mode [ 64.960789][ T4187] device veth1_vlan entered promiscuous mode [ 64.995782][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 65.005404][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 65.014554][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 65.022717][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 65.030154][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 65.043374][ T4186] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 65.052604][ T4191] device veth1_vlan entered promiscuous mode [ 65.063261][ T4185] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 65.074166][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 65.083658][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 65.092037][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 65.100443][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 65.118098][ T4192] device veth0_vlan entered promiscuous mode [ 65.136673][ T4192] device veth1_vlan entered promiscuous mode [ 65.143913][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 65.152197][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 65.160359][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 65.169105][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 65.177887][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 65.186751][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 65.195439][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 65.220361][ T4185] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 65.234893][ T4187] device veth0_macvtap entered promiscuous mode [ 65.243287][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 65.253415][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 65.263206][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 65.271963][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 65.280433][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 65.289339][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 65.304640][ T4185] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.314155][ T4185] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.323199][ T4185] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.332189][ T4185] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.344403][ T4187] device veth1_macvtap entered promiscuous mode [ 65.362071][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 65.370142][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 65.379305][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 65.405166][ T4191] device veth0_macvtap entered promiscuous mode [ 65.417788][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 65.428092][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 65.436406][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 65.450307][ T4192] device veth0_macvtap entered promiscuous mode [ 65.462504][ T4191] device veth1_macvtap entered promiscuous mode [ 65.470082][ T4186] device veth0_vlan entered promiscuous mode [ 65.482304][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 65.490268][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 65.498506][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 65.507611][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 65.516128][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 65.525200][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 65.538211][ T4192] device veth1_macvtap entered promiscuous mode [ 65.550158][ T4186] device veth1_vlan entered promiscuous mode [ 65.567312][ T4187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 65.578946][ T4187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.590386][ T4187] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 65.608626][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 65.623880][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.634084][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 65.644789][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.656503][ T4191] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 65.670854][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 65.679032][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 65.688333][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 65.698068][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 65.708989][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 65.717714][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 65.726356][ T4252] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 65.736946][ T4187] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 65.748211][ T4187] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.759331][ T4187] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 65.770593][ T4187] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.779436][ T4187] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.789552][ T4187] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.799814][ T4187] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 65.823456][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 65.834286][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.845034][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 65.855725][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.868814][ T4191] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 65.881923][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 65.890526][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 65.900277][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 65.909337][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 65.953586][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 65.965373][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.975436][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 65.986151][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 65.996147][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 66.006638][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.017650][ T4192] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 66.040696][ T4191] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.049580][ T4191] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.059034][ T4191] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.069645][ T4191] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.080578][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 66.089402][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 66.098487][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 66.108084][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 66.124335][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 66.136967][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.147125][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 66.158153][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.168161][ T4192] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 66.178619][ T4192] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.190207][ T4192] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 66.200513][ T4186] device veth0_macvtap entered promiscuous mode [ 66.210504][ T4186] device veth1_macvtap entered promiscuous mode [ 66.225852][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 66.236232][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 66.244483][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 66.253681][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 66.265484][ T4192] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.274752][ T4192] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.284339][ T4192] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.293397][ T4192] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.345939][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 66.357793][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.367739][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 66.378590][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.388656][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 66.399508][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.410045][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 66.420777][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.434180][ T4186] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 66.453201][ T154] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.458907][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 66.462631][ T154] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.469842][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 66.487567][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 66.506531][ T7] Bluetooth: hci3: command 0x040f tx timeout [ 66.512490][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 66.512544][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.512553][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 66.512563][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.512571][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 66.512581][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.512589][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 66.512600][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.513742][ T4186] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 66.551297][ T7] Bluetooth: hci1: command 0x040f tx timeout [ 66.608294][ T7] Bluetooth: hci0: command 0x040f tx timeout [ 66.615402][ T4269] Bluetooth: hci4: command 0x040f tx timeout [ 66.618937][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 66.623294][ T4269] Bluetooth: hci2: command 0x040f tx timeout [ 66.631392][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 66.646209][ T4236] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.650236][ T4186] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.665740][ T4236] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.665907][ T4186] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.682595][ T4186] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.691760][ T4186] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.738773][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 66.780214][ T4252] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.792159][ T828] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.799324][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.806146][ T828] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.828175][ T4252] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.837542][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.848096][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.856355][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.865623][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 66.875994][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 66.883984][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 66.892114][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 66.949367][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.958386][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.975466][ T828] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 67.015706][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.029547][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.051344][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 67.059340][ T4236] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.079601][ T4236] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.108377][ T154] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.134842][ T154] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.187754][ T828] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 67.256838][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 67.290487][ T4276] loop3: detected capacity change from 0 to 128 [ 67.360913][ T4274] input: syz0 as /devices/virtual/input/input5 [ 67.423429][ T4281] syz.0.1 uses obsolete (PF_INET,SOCK_PACKET) [ 67.554639][ T4282] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 67.898790][ T4282] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.948586][ T4282] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 67.998502][ T4282] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.008777][ T4282] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 68.019612][ T4282] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.030702][ T4282] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 68.044037][ T4282] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.057243][ T4282] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 68.069392][ T4282] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.070926][ T4282] device batadv_slave_0 entered promiscuous mode [ 68.183022][ T4291] loop0: detected capacity change from 0 to 8 [ 68.228100][ T4291] process 'syz.0.7' launched './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' with NULL argv: empty string added [ 68.582077][ T4232] Bluetooth: hci3: command 0x0419 tx timeout [ 68.677625][ T4232] Bluetooth: hci2: command 0x0419 tx timeout [ 68.906412][ T4232] Bluetooth: hci4: command 0x0419 tx timeout [ 69.171194][ T4232] Bluetooth: hci0: command 0x0419 tx timeout [ 69.271817][ T4232] Bluetooth: hci1: command 0x0419 tx timeout [ 69.340204][ T4322] loop4: detected capacity change from 0 to 512 [ 69.460045][ T4322] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 69.508186][ T4322] ext4 filesystem being mounted at /1/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 69.762439][ T4345] loop1: detected capacity change from 0 to 8 [ 69.776285][ T4346] loop3: detected capacity change from 0 to 512 [ 69.956832][ T4346] EXT4-fs (loop3): feature flags set on rev 0 fs, running e2fsck is recommended [ 70.442959][ T4346] EXT4-fs error (device loop3): ext4_mb_mark_diskspace_used:3894: comm syz.3.19: Allocating blocks 41-42 which overlap fs metadata [ 70.494619][ T4346] EXT4-fs (loop3): Remounting filesystem read-only [ 70.505759][ T4346] Quota error (device loop3): write_blk: dquota write failed [ 70.514426][ T4346] Quota error (device loop3): find_free_dqentry: Can't write quota data block 5 [ 70.547563][ T4346] Quota error (device loop3): qtree_write_dquot: Error -117 occurred while creating quota [ 70.593185][ T4346] EXT4-fs error (device loop3): ext4_acquire_dquot:6236: comm syz.3.19: Failed to acquire dquot type 1 [ 70.663207][ T4362] input: syz0 as /devices/virtual/input/input6 [ 70.742375][ T4346] EXT4-fs (loop3): Remounting filesystem read-only [ 70.749339][ T4346] EXT4-fs error (device loop3): mb_free_blocks:1889: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 71.235690][ T1420] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.242296][ T1420] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.371419][ T4346] EXT4-fs (loop3): Remounting filesystem read-only [ 71.378285][ T4346] EXT4-fs error (device loop3): ext4_do_update_inode:5229: inode #12: comm syz.3.19: corrupted inode contents [ 71.384213][ T4376] device syzkaller0 entered promiscuous mode [ 71.402065][ T4346] EXT4-fs (loop3): Remounting filesystem read-only [ 71.415658][ T4346] EXT4-fs error (device loop3): ext4_dirty_inode:6087: inode #12: comm syz.3.19: mark_inode_dirty error [ 71.436372][ T4346] EXT4-fs (loop3): Remounting filesystem read-only [ 71.452776][ T4346] EXT4-fs error (device loop3): ext4_do_update_inode:5229: inode #12: comm syz.3.19: corrupted inode contents [ 71.475506][ T4346] EXT4-fs (loop3): Remounting filesystem read-only [ 71.561380][ T4346] EXT4-fs error (device loop3): __ext4_ext_dirty:183: inode #12: comm syz.3.19: mark_inode_dirty error [ 71.587271][ T4346] EXT4-fs (loop3): Remounting filesystem read-only [ 71.614474][ T4346] EXT4-fs error (device loop3): ext4_do_update_inode:5229: inode #12: comm syz.3.19: corrupted inode contents [ 71.641898][ T4383] loop0: detected capacity change from 0 to 128 [ 71.666056][ T4346] EXT4-fs (loop3): Remounting filesystem read-only [ 71.682113][ T4346] EXT4-fs error (device loop3) in ext4_orphan_del:303: Corrupt filesystem [ 71.694674][ T4346] EXT4-fs (loop3): Remounting filesystem read-only [ 71.704134][ T4385] loop2: detected capacity change from 0 to 256 [ 71.710976][ T4346] EXT4-fs error (device loop3): ext4_do_update_inode:5229: inode #12: comm syz.3.19: corrupted inode contents [ 71.738521][ T4346] EXT4-fs (loop3): Remounting filesystem read-only [ 71.751903][ T4346] EXT4-fs error (device loop3): ext4_truncate:4286: inode #12: comm syz.3.19: mark_inode_dirty error [ 71.798080][ T4383] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 71.802500][ T4346] EXT4-fs (loop3): Remounting filesystem read-only [ 71.819163][ T4383] ext4 filesystem being mounted at /4/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 71.850461][ T4346] EXT4-fs error (device loop3) in ext4_process_orphan:345: Corrupt filesystem [ 71.992079][ T4346] EXT4-fs (loop3): Remounting filesystem read-only [ 72.026200][ T4346] EXT4-fs (loop3): 1 truncate cleaned up [ 72.061332][ T4346] EXT4-fs (loop3): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000000800000,noblock_validity,inode_readahead_blks=0x0000000000200000,errors=remount-ro,noinit_itable,abort,noauto_da_alloc,init_itable,resgid=0x00000000000000002. Quota mode: writeback. [ 72.573297][ T4393] device-mapper: ioctl: ioctl interface mismatch: kernel(4.45.0), user(4.50.0), cmd(4) [ 72.672537][ T4393] device-mapper: ioctl: ioctl interface mismatch: kernel(4.45.0), user(4.50.0), cmd(3) [ 72.722262][ T4393] device-mapper: ioctl: ioctl interface mismatch: kernel(4.45.0), user(4.50.0), cmd(9) [ 72.861853][ T4393] device-mapper: ioctl: ioctl interface mismatch: kernel(4.45.0), user(4.50.0), cmd(6) [ 73.501626][ T4408] loop2: detected capacity change from 0 to 8 [ 73.610930][ T4416] loop3: detected capacity change from 0 to 512 [ 73.632507][ T4415] input: syz0 as /devices/virtual/input/input7 [ 73.730497][ T4416] EXT4-fs (loop3): Quota format mount options ignored when QUOTA feature is enabled [ 74.220264][ T4416] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpid,jqfmt=vfsv0,,errors=continue. Quota mode: writeback. [ 74.280926][ T4416] ext4 filesystem being mounted at /6/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 74.902752][ T4433] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 75.346137][ T4444] loop4: detected capacity change from 0 to 512 [ 75.389859][ T4444] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 75.402546][ T4449] tipc: Started in network mode [ 75.408220][ T4449] tipc: Node identity 4, cluster identity 4711 [ 75.414459][ T4449] tipc: Node number set to 4 [ 75.486062][ T4453] input: syz0 as /devices/virtual/input/input8 [ 75.533042][ T4374] udevd[4374]: setting mode of /dev/input/event4 to 020660 failed: No such file or directory [ 75.547062][ T4374] udevd[4374]: setting owner of /dev/input/event4 to uid=0, gid=104 failed: No such file or directory [ 75.560755][ T4444] EXT4-fs error (device loop4): ext4_mb_mark_diskspace_used:3894: comm syz.4.48: Allocating blocks 41-42 which overlap fs metadata [ 75.576000][ T4444] EXT4-fs (loop4): Remounting filesystem read-only [ 75.655722][ T4444] Quota error (device loop4): write_blk: dquota write failed [ 75.688598][ T4444] Quota error (device loop4): find_free_dqentry: Can't write quota data block 5 [ 75.755269][ T4444] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 75.792056][ T4444] EXT4-fs error (device loop4): ext4_acquire_dquot:6236: comm syz.4.48: Failed to acquire dquot type 1 [ 75.814597][ T4444] EXT4-fs (loop4): Remounting filesystem read-only [ 75.821284][ T4444] EXT4-fs error (device loop4): mb_free_blocks:1889: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 75.843451][ T4444] EXT4-fs (loop4): Remounting filesystem read-only [ 75.850028][ T4444] EXT4-fs error (device loop4): ext4_do_update_inode:5229: inode #12: comm syz.4.48: corrupted inode contents [ 75.870426][ T4444] EXT4-fs (loop4): Remounting filesystem read-only [ 75.877167][ T4444] EXT4-fs error (device loop4): ext4_dirty_inode:6087: inode #12: comm syz.4.48: mark_inode_dirty error [ 76.049033][ T4444] EXT4-fs (loop4): Remounting filesystem read-only [ 76.284986][ T4444] EXT4-fs error (device loop4): ext4_do_update_inode:5229: inode #12: comm syz.4.48: corrupted inode contents [ 76.344528][ T4444] EXT4-fs (loop4): Remounting filesystem read-only [ 76.351147][ T4444] EXT4-fs error (device loop4): __ext4_ext_dirty:183: inode #12: comm syz.4.48: mark_inode_dirty error [ 76.364247][ T4444] EXT4-fs (loop4): Remounting filesystem read-only [ 76.370922][ T4444] EXT4-fs error (device loop4): ext4_do_update_inode:5229: inode #12: comm syz.4.48: corrupted inode contents [ 76.433572][ T4444] EXT4-fs (loop4): Remounting filesystem read-only [ 76.440284][ T4444] EXT4-fs error (device loop4) in ext4_orphan_del:303: Corrupt filesystem [ 76.457480][ T4444] EXT4-fs (loop4): Remounting filesystem read-only [ 76.465745][ T4444] EXT4-fs error (device loop4): ext4_do_update_inode:5229: inode #12: comm syz.4.48: corrupted inode contents [ 76.587217][ T4444] EXT4-fs (loop4): Remounting filesystem read-only [ 76.612083][ T4444] EXT4-fs error (device loop4): ext4_truncate:4286: inode #12: comm syz.4.48: mark_inode_dirty error [ 76.797090][ T4444] EXT4-fs (loop4): Remounting filesystem read-only [ 76.822421][ T4444] EXT4-fs error (device loop4) in ext4_process_orphan:345: Corrupt filesystem [ 76.911851][ T4444] EXT4-fs (loop4): Remounting filesystem read-only [ 76.989819][ T4444] EXT4-fs (loop4): 1 truncate cleaned up [ 77.038108][ T4444] EXT4-fs (loop4): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000000800000,noblock_validity,inode_readahead_blks=0x0000000000200000,errors=remount-ro,noinit_itable,abort,noauto_da_alloc,init_itable,resgid=0x00000000000000002. Quota mode: writeback. [ 77.205099][ T4501] input: syz0 as /devices/virtual/input/input9 [ 77.472788][ T4506] loop0: detected capacity change from 0 to 256 [ 78.753840][ T4523] FAULT_INJECTION: forcing a failure. [ 78.753840][ T4523] name failslab, interval 1, probability 0, space 0, times 1 [ 78.771334][ T4523] CPU: 0 PID: 4523 Comm: syz.3.74 Not tainted syzkaller #0 [ 78.778574][ T4523] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 78.788649][ T4523] Call Trace: [ 78.791933][ T4523] [ 78.794851][ T4523] dump_stack_lvl+0x188/0x250 [ 78.799528][ T4523] ? show_regs_print_info+0x20/0x20 [ 78.804712][ T4523] ? load_image+0x410/0x410 [ 78.809207][ T4523] ? __lock_acquire+0x7b50/0x7b50 [ 78.814223][ T4523] should_fail+0x383/0x4b0 [ 78.818630][ T4523] should_failslab+0x5/0x20 [ 78.823117][ T4523] slab_pre_alloc_hook+0x51/0xc0 [ 78.828043][ T4523] __kmalloc+0x6b/0x340 [ 78.832182][ T4523] ? apply_wqattrs_prepare+0xb3/0xad0 [ 78.837546][ T4523] apply_wqattrs_prepare+0xb3/0xad0 [ 78.842823][ T4523] ? mutex_lock_io_nested+0x60/0x60 [ 78.848135][ T4523] apply_workqueue_attrs+0xd0/0x170 [ 78.853342][ T4523] alloc_workqueue+0xf1e/0x1450 [ 78.858194][ T4523] ? vsnprintf+0x1b22/0x1c20 [ 78.862790][ T4523] ? snprintf+0xe5/0x140 [ 78.867026][ T4523] ? lockdep_init_map_type+0x98/0x900 [ 78.872393][ T4523] ? apply_workqueue_attrs+0x170/0x170 [ 78.877844][ T4523] ? memset+0x1e/0x40 [ 78.881817][ T4523] ? lockdep_init_map_type+0x98/0x900 [ 78.887190][ T4523] nci_register_device+0x3fc/0x9f0 [ 78.892297][ T4523] ? nci_free_device+0x90/0x90 [ 78.897051][ T4523] ? nci_hci_allocate+0x1dd/0x2a0 [ 78.902062][ T4523] ? nci_allocate_device+0x241/0x350 [ 78.907336][ T4523] virtual_ncidev_open+0x55/0xc0 [ 78.912260][ T4523] ? virtual_ncidev_ioctl+0x90/0x90 [ 78.917447][ T4523] misc_open+0x31f/0x390 [ 78.921680][ T4523] chrdev_open+0x585/0x5f0 [ 78.926085][ T4523] ? cd_forget+0x160/0x160 [ 78.930489][ T4523] ? fsnotify_perm+0x3a7/0x560 [ 78.935239][ T4523] ? cd_forget+0x160/0x160 [ 78.939642][ T4523] do_dentry_open+0x7f7/0xf90 [ 78.944306][ T4523] ? vfs_open+0x2b/0x80 [ 78.948450][ T4523] path_openat+0x2718/0x2fb0 [ 78.953043][ T4523] ? __kasan_slab_alloc+0xa9/0xc0 [ 78.958059][ T4523] ? do_filp_open+0x400/0x400 [ 78.962737][ T4523] do_filp_open+0x1df/0x400 [ 78.967236][ T4523] ? vfs_tmpfile+0x300/0x300 [ 78.971827][ T4523] ? _raw_spin_unlock+0x24/0x40 [ 78.976670][ T4523] ? alloc_fd+0x59e/0x650 [ 78.981010][ T4523] do_sys_openat2+0x14b/0x500 [ 78.985671][ T4523] ? __lock_acquire+0x7b50/0x7b50 [ 78.990687][ T4523] ? do_sys_open+0xe0/0xe0 [ 78.995089][ T4523] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 79.001057][ T4523] ? lock_chain_count+0x20/0x20 [ 79.005905][ T4523] __x64_sys_openat+0x135/0x160 [ 79.010746][ T4523] do_syscall_64+0x4c/0xa0 [ 79.015149][ T4523] ? clear_bhb_loop+0x30/0x80 [ 79.019813][ T4523] ? clear_bhb_loop+0x30/0x80 [ 79.024479][ T4523] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 79.030366][ T4523] RIP: 0033:0x7f948b056159 [ 79.034766][ T4523] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 79.054358][ T4523] RSP: 002b:00007f94892ae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 79.062785][ T4523] RAX: ffffffffffffffda RBX: 00007f948b2ddfa0 RCX: 00007f948b056159 [ 79.070743][ T4523] RDX: 0000000000000002 RSI: 0000200000000080 RDI: ffffffffffffff9c [ 79.078725][ T4523] RBP: 00007f948b0ed06b R08: 0000000000000000 R09: 0000000000000000 [ 79.086680][ T4523] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 79.094633][ T4523] R13: 00007f948b2de038 R14: 00007f948b2ddfa0 R15: 00007ffe9b3a1518 [ 79.102603][ T4523] [ 79.123271][ T4527] loop2: detected capacity change from 0 to 512 [ 79.130124][ T4530] loop1: detected capacity change from 0 to 512 [ 79.159194][ T4524] ieee802154 phy0 wpan0: encryption failed: -22 [ 79.189673][ T4530] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 79.241191][ T4530] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 79.285083][ T4539] loop3: detected capacity change from 0 to 2048 [ 79.301863][ T4527] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 79.564028][ T4530] EXT4-fs (loop1): 1 truncate cleaned up [ 79.569705][ T4530] EXT4-fs (loop1): mounted filesystem without journal. Opts: bsddf,errors=remount-ro,data=journal,usrjquota=,init_itable=0x0000000000000022,. Quota mode: none. [ 79.627182][ T4530] EXT4-fs error (device loop1): ext4_append:79: inode #2: comm syz.1.76: Logical block already allocated [ 79.739361][ T4530] EXT4-fs (loop1): Remounting filesystem read-only [ 79.834784][ T4545] fuse: root generation should be zero [ 79.836348][ T4551] loop4: detected capacity change from 0 to 512 [ 79.850451][ T4556] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 80.336879][ T4551] EXT4-fs (loop4): Quota format mount options ignored when QUOTA feature is enabled [ 80.590512][ T4551] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpid,jqfmt=vfsv0,,errors=continue. Quota mode: writeback. [ 80.647479][ T4551] ext4 filesystem being mounted at /7/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 80.779066][ T4571] loop0: detected capacity change from 0 to 256 [ 81.655329][ T26] cfg80211: failed to load regulatory.db [ 81.776278][ T4579] netlink: 'syz.3.92': attribute type 1 has an invalid length. [ 81.883380][ T4579] Zero length message leads to an empty skb [ 81.900201][ T4585] loop2: detected capacity change from 0 to 1024 [ 81.903273][ T4586] loop0: detected capacity change from 0 to 256 [ 81.961336][ T4585] EXT4-fs (loop2): Ignoring removed bh option [ 82.025845][ T4585] EXT4-fs (loop2): mounted filesystem without journal. Opts: nobarrier,dioread_lock,barrier=0x0000000000000000,nolazytime,dax=inode,lazytime,errors=remount-ro,stripe=0x0000000000000004,bh,mb_optimize_scan=0x0000000000000001,. Quota mode: none. [ 82.257850][ T4585] EXT4-fs error (device loop2): ext4_read_inline_dir:1635: inode #12: block 7: comm syz.2.95: path /: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=60 fake=0 [ 82.356338][ T4585] EXT4-fs (loop2): Remounting filesystem read-only [ 82.387834][ T4585] EXT4-fs error (device loop2): ext4_read_inline_dir:1635: inode #12: block 7: comm syz.2.95: path /: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=60 fake=0 [ 82.404542][ T4597] loop3: detected capacity change from 0 to 512 [ 82.416487][ T4598] ip_tables: iptables: counters copy to user failed while replacing table [ 82.416950][ T4585] EXT4-fs (loop2): Remounting filesystem read-only [ 82.491478][ T4597] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 82.500816][ T4192] EXT4-fs error (device loop2): ext4_read_inline_dir:1635: inode #12: block 7: comm syz-executor: path /18/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=60 fake=0 [ 82.528117][ T4599] binder: 4587:4599 ioctl 4018620d 0 returned -22 [ 82.538327][ T4597] System zones: 1-12 [ 82.548886][ T4192] EXT4-fs (loop2): Remounting filesystem read-only [ 82.576768][ T4597] EXT4-fs error (device loop3): ext4_xattr_inode_iget:401: inode #12: comm syz.3.98: missing EA_INODE flag [ 82.608332][ T4192] EXT4-fs error (device loop2): ext4_read_inline_dir:1635: inode #12: block 7: comm syz-executor: path /18/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=60 fake=0 [ 82.673583][ T4597] EXT4-fs error (device loop3): ext4_xattr_inode_iget:406: comm syz.3.98: error while reading EA inode 12 err=-117 [ 82.673913][ T4597] EXT4-fs (loop3): 1 orphan inode deleted [ 82.673945][ T4597] EXT4-fs (loop3): mounted filesystem without journal. Opts: debug,resuid=0x000000000000ee01,,errors=continue. Quota mode: writeback. [ 82.676799][ T4192] EXT4-fs (loop2): Remounting filesystem read-only [ 82.677006][ T4192] EXT4-fs error (device loop2): empty_inline_dir:1890: inode #12: block 7: comm syz-executor: bad entry in directory: rec_len is too small for name_len - offset=20, inode=14, rec_len=40, size=60 fake=0 [ 82.678526][ T4192] EXT4-fs (loop2): Remounting filesystem read-only [ 82.678543][ T4192] EXT4-fs warning (device loop2): empty_inline_dir:1897: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 82.678846][ T4192] EXT4-fs error (device loop2): ext4_read_inline_dir:1635: inode #12: block 7: comm syz-executor: path /18/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=60 fake=0 [ 82.679043][ T4192] EXT4-fs (loop2): Remounting filesystem read-only [ 82.679091][ T4192] EXT4-fs error (device loop2): ext4_read_inline_dir:1635: inode #12: block 7: comm syz-executor: path /18/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=60 fake=0 [ 82.679264][ T4192] EXT4-fs (loop2): Remounting filesystem read-only [ 82.679481][ T4192] EXT4-fs error (device loop2): empty_inline_dir:1890: inode #12: block 7: comm syz-executor: bad entry in directory: rec_len is too small for name_len - offset=20, inode=14, rec_len=40, size=60 fake=0 [ 82.679670][ T4192] EXT4-fs (loop2): Remounting filesystem read-only [ 82.679684][ T4192] EXT4-fs warning (device loop2): empty_inline_dir:1897: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 82.679977][ T4192] EXT4-fs error (device loop2): ext4_read_inline_dir:1635: inode #12: block 7: comm syz-executor: path /18/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=60 fake=0 [ 82.680586][ T4192] EXT4-fs (loop2): Remounting filesystem read-only [ 82.680638][ T4192] EXT4-fs error (device loop2): ext4_read_inline_dir:1635: inode #12: block 7: comm syz-executor: path /18/file1/file0: bad entry in directory: rec_len is too small for name_len - offset=40, inode=14, rec_len=40, size=60 fake=0 [ 82.680809][ T4192] EXT4-fs (loop2): Remounting filesystem read-only [ 82.681294][ T4192] EXT4-fs warning (device loop2): empty_inline_dir:1897: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 82.687364][ T4192] EXT4-fs warning (device loop2): empty_inline_dir:1897: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 82.688221][ T4192] EXT4-fs warning (device loop2): empty_inline_dir:1897: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 82.689031][ T4192] EXT4-fs warning (device loop2): empty_inline_dir:1897: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 82.689778][ T4192] EXT4-fs warning (device loop2): empty_inline_dir:1897: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 82.690707][ T4192] EXT4-fs warning (device loop2): empty_inline_dir:1897: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 82.691681][ T4192] EXT4-fs warning (device loop2): empty_inline_dir:1897: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 82.692568][ T4192] EXT4-fs warning (device loop2): empty_inline_dir:1897: bad inline directory (dir #12) - inode 14, rec_len 40, name_len 255inline size 60 [ 82.936953][ T4608] loop1: detected capacity change from 0 to 512 [ 83.199575][ T4608] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 83.323748][ T4609] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 83.378881][ T4608] EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:3894: comm syz.1.103: Allocating blocks 41-42 which overlap fs metadata [ 83.379289][ T4608] EXT4-fs (loop1): Remounting filesystem read-only [ 83.379363][ T4608] Quota error (device loop1): write_blk: dquota write failed [ 83.379404][ T4608] Quota error (device loop1): find_free_dqentry: Can't write quota data block 5 [ 83.379506][ T4608] EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:3894: comm syz.1.103: Allocating blocks 41-42 which overlap fs metadata [ 83.379936][ T4608] EXT4-fs (loop1): Remounting filesystem read-only [ 83.379998][ T4608] Quota error (device loop1): write_blk: dquota write failed [ 83.380072][ T4608] Quota error (device loop1): qtree_write_dquot: Error -117 occurred while creating quota [ 83.380106][ T4608] EXT4-fs error (device loop1): ext4_acquire_dquot:6236: comm syz.1.103: Failed to acquire dquot type 1 [ 83.380463][ T4608] EXT4-fs (loop1): Remounting filesystem read-only [ 83.380548][ T4608] EXT4-fs error (device loop1): mb_free_blocks:1889: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 83.380923][ T4608] EXT4-fs (loop1): Remounting filesystem read-only [ 83.380978][ T4608] EXT4-fs error (device loop1): ext4_do_update_inode:5229: inode #12: comm syz.1.103: corrupted inode contents [ 83.382366][ T4608] EXT4-fs (loop1): Remounting filesystem read-only [ 83.382384][ T4608] EXT4-fs error (device loop1): ext4_dirty_inode:6087: inode #12: comm syz.1.103: mark_inode_dirty error [ 83.382686][ T4608] EXT4-fs (loop1): Remounting filesystem read-only [ 83.382779][ T4608] EXT4-fs error (device loop1): ext4_do_update_inode:5229: inode #12: comm syz.1.103: corrupted inode contents [ 83.383075][ T4608] EXT4-fs (loop1): Remounting filesystem read-only [ 83.383089][ T4608] EXT4-fs error (device loop1): __ext4_ext_dirty:183: inode #12: comm syz.1.103: mark_inode_dirty error [ 83.383363][ T4608] EXT4-fs (loop1): Remounting filesystem read-only [ 83.383403][ T4608] EXT4-fs error (device loop1): ext4_do_update_inode:5229: inode #12: comm syz.1.103: corrupted inode contents [ 83.383678][ T4608] EXT4-fs (loop1): Remounting filesystem read-only [ 83.383692][ T4608] EXT4-fs error (device loop1) in ext4_orphan_del:303: Corrupt filesystem [ 83.383964][ T4608] EXT4-fs (loop1): Remounting filesystem read-only [ 83.383985][ T4608] EXT4-fs error (device loop1): ext4_do_update_inode:5229: inode #12: comm syz.1.103: corrupted inode contents [ 83.384255][ T4608] EXT4-fs (loop1): Remounting filesystem read-only [ 83.384269][ T4608] EXT4-fs error (device loop1): ext4_truncate:4286: inode #12: comm syz.1.103: mark_inode_dirty error [ 83.384535][ T4608] EXT4-fs (loop1): Remounting filesystem read-only [ 83.384548][ T4608] EXT4-fs error (device loop1) in ext4_process_orphan:345: Corrupt filesystem [ 83.384807][ T4608] EXT4-fs (loop1): Remounting filesystem read-only [ 83.385016][ T4608] EXT4-fs (loop1): 1 truncate cleaned up [ 83.385036][ T4608] EXT4-fs (loop1): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000000800000,noblock_validity,inode_readahead_blks=0x0000000000200000,errors=remount-ro,noinit_itable,abort,noauto_da_alloc,init_itable,resgid=0x00000000000000002. Quota mode: writeback. [ 83.568181][ T4609] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 83.853143][ T4614] loop4: detected capacity change from 0 to 256 [ 84.260095][ T4609] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.678468][ T4622] loop1: detected capacity change from 0 to 512 [ 84.823111][ T4622] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 84.980183][ T4622] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpid,jqfmt=vfsv0,,errors=continue. Quota mode: writeback. [ 84.999557][ T4609] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.024090][ T4622] ext4 filesystem being mounted at /25/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 85.096272][ T4609] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.113191][ T4609] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.126914][ T4609] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.195343][ T4609] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.335470][ T4577] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.460190][ T4639] loop4: detected capacity change from 0 to 512 [ 85.641382][ T4639] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 85.657765][ T4577] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.263357][ T4639] EXT4-fs error (device loop4): ext4_mb_mark_diskspace_used:3894: comm syz.4.115: Allocating blocks 41-42 which overlap fs metadata [ 86.310372][ T4639] EXT4-fs (loop4): Remounting filesystem read-only [ 86.340546][ T4639] Quota error (device loop4): write_blk: dquota write failed [ 86.387780][ T4577] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 86.404013][ T4639] Quota error (device loop4): find_free_dqentry: Can't write quota data block 5 [ 86.413957][ T4639] EXT4-fs error (device loop4): ext4_mb_mark_diskspace_used:3894: comm syz.4.115: Allocating blocks 41-42 which overlap fs metadata [ 86.446124][ T4639] EXT4-fs (loop4): Remounting filesystem read-only [ 86.497822][ T4654] loop7: detected capacity change from 0 to 7 [ 86.524572][ T4654] Dev loop7: unable to read RDB block 7 [ 86.530338][ T4654] loop7: unable to read partition table [ 86.546161][ T4639] Quota error (device loop4): write_blk: dquota write failed [ 86.571262][ T4654] loop7: partition table beyond EOD, truncated [ 86.577476][ T4654] loop_reread_partitions: partition scan of loop7 (úùƒå¡™‰ü¾CêjÌ–ã¢P=ý?ã}X‹ºÐ œëÜ%õ«`ÉæÖ€ù…ˆ{í©Ö˜Èµ4FLQkÝŠ) failed (rc=-5) [ 86.605317][ T4660] netlink: zone id is out of range [ 86.641323][ T4639] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 86.912875][ T4639] EXT4-fs error (device loop4): ext4_acquire_dquot:6236: comm syz.4.115: Failed to acquire dquot type 1 [ 87.106357][ T4639] EXT4-fs (loop4): Remounting filesystem read-only [ 87.177516][ T4577] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 87.190659][ T4639] EXT4-fs error (device loop4): mb_free_blocks:1889: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 87.229829][ T4639] EXT4-fs (loop4): Remounting filesystem read-only [ 87.247742][ T4654] Dev loop7: unable to read RDB block 7 [ 87.411258][ T4639] EXT4-fs error (device loop4): ext4_do_update_inode:5229: inode #12: comm syz.4.115: corrupted inode contents [ 87.422174][ T4654] loop7: unable to read partition table [ 87.447961][ T4639] EXT4-fs (loop4): Remounting filesystem read-only [ 87.467072][ T4673] nftables ruleset with unbound chain [ 87.564169][ T4654] loop7: partition table beyond EOD, truncated [ 87.731861][ T4639] EXT4-fs error (device loop4): ext4_dirty_inode:6087: inode #12: comm syz.4.115: mark_inode_dirty error [ 88.027080][ T4639] EXT4-fs (loop4): Remounting filesystem read-only [ 88.039864][ T4639] EXT4-fs error (device loop4): ext4_do_update_inode:5229: inode #12: comm syz.4.115: corrupted inode contents [ 88.059870][ T2236] Bluetooth: hci3: command 0x0409 tx timeout [ 88.111886][ T4639] EXT4-fs (loop4): Remounting filesystem read-only [ 88.118435][ T4639] EXT4-fs error (device loop4): __ext4_ext_dirty:183: inode #12: comm syz.4.115: mark_inode_dirty error [ 88.206915][ T4639] EXT4-fs (loop4): Remounting filesystem read-only [ 88.223895][ T4639] EXT4-fs error (device loop4): ext4_do_update_inode:5229: inode #12: comm syz.4.115: corrupted inode contents [ 88.266613][ T4639] EXT4-fs (loop4): Remounting filesystem read-only [ 88.282906][ T4647] chnl_net:caif_netlink_parms(): no params data found [ 88.291231][ T4639] EXT4-fs error (device loop4) in ext4_orphan_del:303: Corrupt filesystem [ 88.330404][ T4639] EXT4-fs (loop4): Remounting filesystem read-only [ 88.360823][ T4639] EXT4-fs error (device loop4): ext4_do_update_inode:5229: inode #12: comm syz.4.115: corrupted inode contents [ 88.377646][ T4577] tipc: Left network mode [ 88.431791][ T4639] EXT4-fs (loop4): Remounting filesystem read-only [ 88.443708][ T4639] EXT4-fs error (device loop4): ext4_truncate:4286: inode #12: comm syz.4.115: mark_inode_dirty error [ 88.531365][ T4639] EXT4-fs (loop4): Remounting filesystem read-only [ 88.561581][ T4639] EXT4-fs error (device loop4) in ext4_process_orphan:345: Corrupt filesystem [ 88.591645][ T4639] EXT4-fs (loop4): Remounting filesystem read-only [ 89.071730][ T4639] EXT4-fs (loop4): 1 truncate cleaned up [ 89.077586][ T4639] EXT4-fs (loop4): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000000800000,noblock_validity,inode_readahead_blks=0x0000000000200000,errors=remount-ro,noinit_itable,abort,noauto_da_alloc,init_itable,resgid=0x00000000000000002. Quota mode: writeback. [ 89.317745][ T4647] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.325066][ T4647] bridge0: port 1(bridge_slave_0) entered disabled state [ 89.333985][ T4647] device bridge_slave_0 entered promiscuous mode [ 89.352446][ T4647] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.359678][ T4647] bridge0: port 2(bridge_slave_1) entered disabled state [ 89.372159][ T4647] device bridge_slave_1 entered promiscuous mode [ 89.493799][ T4720] ip_tables: iptables: counters copy to user failed while replacing table [ 89.586271][ T4718] loop0: detected capacity change from 0 to 128 [ 89.597582][ T4647] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 89.656004][ T4718] EXT4-fs (loop0): mounted filesystem without journal. Opts: nodiscard,,errors=continue. Quota mode: none. [ 89.723474][ T4724] ieee802154 phy0 wpan0: encryption failed: -22 [ 90.055320][ T4647] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 90.269391][ T4230] Bluetooth: hci3: command 0x041b tx timeout [ 90.276442][ T4718] ext4 filesystem being mounted at /41/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 90.453906][ T4647] team0: Port device team_slave_0 added [ 90.463038][ T4647] team0: Port device team_slave_1 added [ 90.579014][ T4647] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 90.638397][ T4734] ip_tables: iptables: counters copy to user failed while replacing table [ 90.657767][ T4647] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.782538][ T4647] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 90.827867][ T4647] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 90.868931][ T4647] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 90.932262][ T4647] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 91.837850][ T4753] loop3: detected capacity change from 0 to 128 [ 91.877248][ T4753] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 91.896058][ T4647] device hsr_slave_0 entered promiscuous mode [ 91.909616][ T4647] device hsr_slave_1 entered promiscuous mode [ 91.916440][ T4647] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 91.930069][ T4647] Cannot create hsr debugfs directory [ 91.952501][ T4753] FAT-fs (loop3): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 92.627780][ T4196] Bluetooth: hci3: command 0x040f tx timeout [ 92.923573][ T4782] loop0: detected capacity change from 0 to 256 [ 92.970231][ T4783] loop1: detected capacity change from 0 to 256 [ 92.993502][ T4577] device hsr_slave_0 left promiscuous mode [ 93.007047][ T4577] device hsr_slave_1 left promiscuous mode [ 93.047966][ T4577] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 93.075863][ T4577] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 93.127393][ T828] FAT-fs (loop3): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 93.150558][ T4577] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 93.180060][ T4577] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 93.188332][ T4577] device bridge_slave_1 left promiscuous mode [ 93.203621][ T4577] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.283530][ T4577] device bridge_slave_0 left promiscuous mode [ 93.290299][ T4577] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.317798][ T4577] device veth1_macvtap left promiscuous mode [ 93.329936][ T4577] device veth0_macvtap left promiscuous mode [ 93.336547][ T4577] device veth1_vlan left promiscuous mode [ 94.008381][ T4577] device veth0_vlan left promiscuous mode [ 94.806004][ T4577] team0 (unregistering): Port device team_slave_1 removed [ 94.835924][ T4230] Bluetooth: hci3: command 0x0419 tx timeout [ 94.853459][ T4577] team0 (unregistering): Port device team_slave_0 removed [ 94.871743][ T4577] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 94.887529][ T4577] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 94.967318][ T4577] bond0 (unregistering): Released all slaves [ 95.645821][ T4761] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 95.791725][ T4647] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 95.928102][ T4647] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 96.096657][ T4647] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 96.162200][ T4647] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 96.214898][ T4826] FAULT_INJECTION: forcing a failure. [ 96.214898][ T4826] name failslab, interval 1, probability 0, space 0, times 0 [ 96.278391][ T4826] CPU: 1 PID: 4826 Comm: syz.3.162 Not tainted syzkaller #0 [ 96.285721][ T4826] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 96.295784][ T4826] Call Trace: [ 96.299071][ T4826] [ 96.302010][ T4826] dump_stack_lvl+0x188/0x250 [ 96.306699][ T4826] ? entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 96.312791][ T4826] ? show_regs_print_info+0x20/0x20 [ 96.318017][ T4826] ? load_image+0x410/0x410 [ 96.322547][ T4826] should_fail+0x383/0x4b0 [ 96.326975][ T4826] ? netlink_trim+0x180/0x220 [ 96.331666][ T4826] should_failslab+0x5/0x20 [ 96.336179][ T4826] slab_pre_alloc_hook+0x51/0xc0 [ 96.341122][ T4826] ? netlink_trim+0x180/0x220 [ 96.345811][ T4826] __kmalloc_node_track_caller+0x68/0x3a0 [ 96.351543][ T4826] ? netlink_trim+0x180/0x220 [ 96.356236][ T4826] ? netlink_trim+0x180/0x220 [ 96.360931][ T4826] pskb_expand_head+0x128/0x1100 [ 96.365904][ T4826] ? refcount_dec_and_test+0x4f/0x70 [ 96.371211][ T4826] netlink_trim+0x180/0x220 [ 96.375726][ T4826] netlink_broadcast_filtered+0x69/0x1170 [ 96.381478][ T4826] nlmsg_notify+0xdf/0x190 [ 96.385909][ T4826] tc_ctl_action+0x83a/0xba0 [ 96.390528][ T4826] ? tcf_free_cookie_rcu+0x40/0x40 [ 96.395663][ T4826] ? mutex_optimistic_spin+0x5b/0x300 [ 96.401084][ T4826] ? tcf_free_cookie_rcu+0x40/0x40 [ 96.406205][ T4826] rtnetlink_rcv_msg+0x7f1/0xf10 [ 96.411155][ T4826] ? lock_chain_count+0x20/0x20 [ 96.416017][ T4826] ? rtnetlink_bind+0x80/0x80 [ 96.420754][ T4826] ? __local_bh_enable_ip+0x136/0x1c0 [ 96.426138][ T4826] ? lockdep_hardirqs_on+0x94/0x140 [ 96.431351][ T4826] ? __local_bh_enable_ip+0x136/0x1c0 [ 96.436732][ T4826] ? _local_bh_enable+0xa0/0xa0 [ 96.441606][ T4826] ? __dev_queue_xmit+0x1b64/0x2e50 [ 96.446833][ T4826] ? dev_queue_xmit+0x20/0x20 [ 96.451519][ T4826] ? memcpy+0x3c/0x60 [ 96.455516][ T4826] ? __copy_skb_header+0x3ba/0x4f0 [ 96.460643][ T4826] netlink_rcv_skb+0x1e9/0x430 [ 96.465423][ T4826] ? rtnetlink_bind+0x80/0x80 [ 96.470117][ T4826] ? netlink_ack+0xb10/0xb10 [ 96.474735][ T4826] netlink_unicast+0x78f/0x940 [ 96.479526][ T4826] netlink_sendmsg+0x8ba/0xbe0 [ 96.484309][ T4826] ? netlink_getsockopt+0x570/0x570 [ 96.489519][ T4826] ? aa_sock_msg_perm+0x94/0x150 [ 96.494568][ T4826] ? apparmor_socket_sendmsg+0x88/0x230 [ 96.500126][ T4826] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 96.505426][ T4826] ? security_socket_sendmsg+0x7c/0xa0 [ 96.510901][ T4826] ? netlink_getsockopt+0x570/0x570 [ 96.516112][ T4826] ____sys_sendmsg+0x5be/0x8f0 [ 96.520898][ T4826] ? __sys_sendmsg_sock+0x30/0x30 [ 96.525979][ T4826] ? import_iovec+0x6f/0xa0 [ 96.530497][ T4826] ___sys_sendmsg+0x236/0x2e0 [ 96.535196][ T4826] ? __sys_sendmsg+0x290/0x290 [ 96.540009][ T4826] __se_sys_sendmsg+0x1b7/0x2a0 [ 96.544875][ T4826] ? __x64_sys_sendmsg+0x80/0x80 [ 96.549821][ T4826] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 96.555825][ T4826] ? lockdep_hardirqs_on+0x94/0x140 [ 96.561038][ T4826] do_syscall_64+0x4c/0xa0 [ 96.565462][ T4826] ? clear_bhb_loop+0x30/0x80 [ 96.570149][ T4826] ? clear_bhb_loop+0x30/0x80 [ 96.574838][ T4826] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 96.580741][ T4826] RIP: 0033:0x7f948b056159 [ 96.585165][ T4826] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 96.604775][ T4826] RSP: 002b:00007f94892ae028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 96.613203][ T4826] RAX: ffffffffffffffda RBX: 00007f948b2ddfa0 RCX: 00007f948b056159 [ 96.621185][ T4826] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000004 [ 96.629169][ T4826] RBP: 00007f948b0ed06b R08: 0000000000000000 R09: 0000000000000000 [ 96.637158][ T4826] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 96.645400][ T4826] R13: 00007f948b2de038 R14: 00007f948b2ddfa0 R15: 00007ffe9b3a1518 [ 96.653398][ T4826] [ 97.721565][ T4647] 8021q: adding VLAN 0 to HW filter on device bond0 [ 97.762254][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 97.777260][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 97.992902][ T4647] 8021q: adding VLAN 0 to HW filter on device team0 [ 98.120483][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 98.160707][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 98.239012][ T4309] bridge0: port 1(bridge_slave_0) entered blocking state [ 98.246160][ T4309] bridge0: port 1(bridge_slave_0) entered forwarding state [ 98.311035][ T4894] netlink: 44 bytes leftover after parsing attributes in process `syz.1.181'. [ 98.375174][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 99.193875][ T4647] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 99.270926][ T4647] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 99.966806][ T4916] ieee802154 phy0 wpan0: encryption failed: -22 [ 100.144060][ T4914] sched: RT throttling activated [ 100.169023][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 100.178253][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 100.187323][ T4309] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.194440][ T4309] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.204437][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 100.213330][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 100.225418][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 100.235194][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 100.244133][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 100.253238][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 100.264780][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 100.304777][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 100.385429][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 100.420578][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 100.439673][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 100.494185][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 100.523014][ T4925] loop0: detected capacity change from 0 to 512 [ 100.552138][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 100.559631][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 100.592529][ T25] audit: type=1326 audit(1790357352.128:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4928 comm="syz.4.190" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6f195f6159 code=0x7ffc0000 [ 100.637192][ T4925] EXT4-fs (loop0): 1 truncate cleaned up [ 100.650035][ T4647] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 100.659308][ T4925] EXT4-fs (loop0): mounted filesystem without journal. Opts: quota,data_err=ignore,nouid32,errors=remount-ro,jqfmt=vfsv1,noauto_da_alloc,stripe=0x0000000000000005,. Quota mode: writeback. [ 100.685361][ T25] audit: type=1326 audit(1790357352.158:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4928 comm="syz.4.190" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6f195f6159 code=0x7ffc0000 [ 100.741370][ T25] audit: type=1326 audit(1790357352.158:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4928 comm="syz.4.190" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6f195f6159 code=0x7ffc0000 [ 100.950733][ T25] audit: type=1326 audit(1790357352.158:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4928 comm="syz.4.190" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=250 compat=0 ip=0x7f6f195f6159 code=0x7ffc0000 [ 100.977591][ T4943] loop1: detected capacity change from 0 to 256 [ 101.072084][ T4948] FAULT_INJECTION: forcing a failure. [ 101.072084][ T4948] name failslab, interval 1, probability 0, space 0, times 0 [ 101.083799][ T25] audit: type=1326 audit(1790357352.158:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4928 comm="syz.4.190" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6f195f6159 code=0x7ffc0000 [ 101.123475][ T4948] CPU: 1 PID: 4948 Comm: syz.0.195 Not tainted syzkaller #0 [ 101.130801][ T4948] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 101.140861][ T4948] Call Trace: [ 101.144141][ T4948] [ 101.147073][ T4948] dump_stack_lvl+0x188/0x250 [ 101.151762][ T4948] ? show_regs_print_info+0x20/0x20 [ 101.156967][ T4948] ? load_image+0x410/0x410 [ 101.161558][ T4948] ? __might_sleep+0xf0/0xf0 [ 101.166154][ T4948] ? __lock_acquire+0x7b50/0x7b50 [ 101.171194][ T4948] should_fail+0x383/0x4b0 [ 101.175621][ T4948] should_failslab+0x5/0x20 [ 101.180130][ T4948] slab_pre_alloc_hook+0x51/0xc0 [ 101.185073][ T4948] ? vm_area_alloc+0x20/0xe0 [ 101.189669][ T4948] kmem_cache_alloc+0x3d/0x280 [ 101.194443][ T4948] vm_area_alloc+0x20/0xe0 [ 101.198871][ T4948] alloc_bprm+0x2a8/0x690 [ 101.203216][ T4948] do_execveat_common+0x18d/0x6b0 [ 101.208255][ T4948] __x64_sys_execveat+0xc0/0xe0 [ 101.213116][ T4948] do_syscall_64+0x4c/0xa0 [ 101.217541][ T4948] ? clear_bhb_loop+0x30/0x80 [ 101.222223][ T4948] ? clear_bhb_loop+0x30/0x80 [ 101.226909][ T4948] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 101.232812][ T4948] RIP: 0033:0x7f38ea52d159 [ 101.237229][ T4948] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 101.256838][ T4948] RSP: 002b:00007f38e8785028 EFLAGS: 00000246 ORIG_RAX: 0000000000000142 [ 101.265263][ T4948] RAX: ffffffffffffffda RBX: 00007f38ea7b4fa0 RCX: 00007f38ea52d159 [ 101.273241][ T4948] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000005 [ 101.281219][ T4948] RBP: 00007f38ea5c406b R08: 0000000000001000 R09: 0000000000000000 [ 101.289199][ T4948] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 101.297176][ T4948] R13: 00007f38ea7b5038 R14: 00007f38ea7b4fa0 R15: 00007ffcd0dc76a8 [ 101.305164][ T4948] [ 101.368462][ T25] audit: type=1326 audit(1790357352.158:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4928 comm="syz.4.190" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f6f195f6159 code=0x7ffc0000 [ 101.537187][ T25] audit: type=1326 audit(1790357352.158:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4928 comm="syz.4.190" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f6f195f6159 code=0x7ffc0000 [ 101.835219][ T828] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 101.851804][ T828] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 101.962375][ T828] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 102.011611][ T828] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 102.051654][ T4647] device veth0_vlan entered promiscuous mode [ 102.067961][ T828] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 102.101954][ T828] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 102.145892][ T4647] device veth1_vlan entered promiscuous mode [ 102.278690][ T828] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 102.306960][ T828] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 102.324774][ T828] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 102.368372][ T828] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 102.395206][ T4647] device veth0_macvtap entered promiscuous mode [ 102.441397][ T4647] device veth1_macvtap entered promiscuous mode [ 102.519083][ T4647] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 102.550203][ T4647] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 102.580536][ T4647] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 102.598059][ T4647] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 102.629643][ T4647] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 102.655921][ T4647] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 102.666665][ T4647] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 102.677458][ T4647] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 102.688693][ T4647] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 102.699160][ T4647] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 102.709749][ T4647] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 102.824541][ T4647] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 103.030591][ T4647] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 103.243194][ T4647] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 103.343934][ T4647] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 103.384966][ T4989] loop0: detected capacity change from 0 to 128 [ 103.438204][ T4647] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 103.473419][ T4647] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 103.503777][ T4647] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 103.523771][ T4989] FAT-fs (loop0): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 103.535814][ T828] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 103.579795][ T828] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 103.594013][ T4989] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 103.618874][ T828] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 103.652269][ T828] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 103.661507][ T828] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 103.674543][ T828] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 103.699890][ T4647] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.737028][ T4647] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.760288][ T4647] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.776240][ T4647] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 103.951599][ T5002] loop4: detected capacity change from 0 to 256 [ 103.972087][ T4352] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 103.980908][ T4352] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.025305][ T828] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 104.170510][ T828] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 104.204570][ T828] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 104.315015][ T1235] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 104.626690][ T828] FAT-fs (loop0): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 106.020174][ T5047] netlink: 'syz.5.217': attribute type 1 has an invalid length. [ 106.149560][ T5055] loop4: detected capacity change from 0 to 512 [ 106.667866][ T5055] EXT4-fs (loop4): mounting ext3 file system using the ext4 subsystem [ 106.800909][ T5053] loop1: detected capacity change from 0 to 2048 [ 106.802267][ T5061] netlink: 8 bytes leftover after parsing attributes in process `syz.5.222'. [ 106.923149][ T5055] EXT4-fs (loop4): 1 truncate cleaned up [ 106.928834][ T5055] EXT4-fs (loop4): mounted filesystem without journal. Opts: noload,stripe=0x00000000000000dc,data_err=abort,noload,data_err=ignore,noblock_validity,,errors=continue. Quota mode: none. [ 107.039178][ T5053] EXT4-fs (loop1): mounted filesystem without journal. Opts: nobarrier,noinit_itable,i_version,init_itable,,errors=continue. Quota mode: none. [ 107.063521][ T5053] ext4 filesystem being mounted at /48/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 107.080230][ T5053] fs-verity: sha512 using implementation "sha512-avx2" [ 108.019730][ T5079] loop3: detected capacity change from 0 to 512 [ 108.184635][ T5079] ======================================================= [ 108.184635][ T5079] WARNING: The mand mount option has been deprecated and [ 108.184635][ T5079] and is ignored by this kernel. Remove the mand [ 108.184635][ T5079] option from the mount to silence this warning. [ 108.184635][ T5079] ======================================================= [ 108.988804][ T5079] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 109.031482][ T5079] ext4 filesystem being mounted at /49/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 109.435632][ T5118] loop5: detected capacity change from 0 to 256 [ 109.545462][ T5120] netlink: 8 bytes leftover after parsing attributes in process `syz.1.235'. [ 109.554528][ T5120] netlink: 8 bytes leftover after parsing attributes in process `syz.1.235'. [ 111.886232][ T5133] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.071244][ T5133] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.087821][ T5151] loop4: detected capacity change from 0 to 2048 [ 112.148518][ T5151] EXT4-fs (loop4): mounted filesystem without journal. Opts: auto_da_alloc=0x0000000000000006,user_xattr,,errors=continue. Quota mode: none. [ 112.183548][ T5151] ext4 filesystem being mounted at /34/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 112.185603][ T5133] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.294274][ T5133] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 112.469699][ T5133] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.470030][ T25] audit: type=1807 audit(1790357363.998:9): action=measure uid>1 res=1 [ 112.492314][ T5162] ima: policy update completed [ 112.516285][ T25] audit: type=1802 audit(1790357364.028:10): pid=5162 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=policy_update cause=completed comm="syz.3.247" res=1 errno=0 [ 112.518253][ T5133] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.613401][ T5133] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.646311][ T5133] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 112.898351][ T5172] netlink: 'syz.0.249': attribute type 4 has an invalid length. [ 113.133057][ T4252] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm kworker/u4:6: bg 0: block 345: padding at end of block bitmap is not set [ 113.154515][ T4252] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 0 with max blocks 128 with error 117 [ 113.523374][ T4252] EXT4-fs (loop4): This should not happen!! Data will be lost [ 113.523374][ T4252] [ 113.631542][ T4252] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 144 with max blocks 2048 with error 28 [ 113.655909][ T4252] EXT4-fs (loop4): This should not happen!! Data will be lost [ 113.655909][ T4252] [ 113.677729][ T4252] EXT4-fs (loop4): Total free blocks count 0 [ 113.690374][ T4252] EXT4-fs (loop4): Free/Dirty block details [ 113.708987][ T4252] EXT4-fs (loop4): free_blocks=0 [ 113.720649][ T4252] EXT4-fs (loop4): dirty_blocks=3232 [ 113.743156][ T4252] EXT4-fs (loop4): Block reservation details [ 114.045498][ T4252] EXT4-fs (loop4): i_reserved_data_blocks=202 [ 114.532534][ T5197] loop1: detected capacity change from 0 to 512 [ 114.631149][ T5201] capability: warning: `syz.3.258' uses 32-bit capabilities (legacy support in use) [ 114.678641][ T5197] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 114.814570][ T5197] EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:3894: comm syz.1.256: Allocating blocks 41-42 which overlap fs metadata [ 115.098078][ T5211] syz.5.259 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 115.467678][ T5207] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.561123][ T5197] EXT4-fs (loop1): Remounting filesystem read-only [ 115.721271][ T5197] Quota error (device loop1): write_blk: dquota write failed [ 115.802249][ T5197] Quota error (device loop1): find_free_dqentry: Can't write quota data block 5 [ 115.803099][ T5216] loop5: detected capacity change from 0 to 128 [ 115.841382][ T5197] Quota error (device loop1): qtree_write_dquot: Error -117 occurred while creating quota [ 115.881218][ T5197] EXT4-fs error (device loop1): ext4_acquire_dquot:6236: comm syz.1.256: Failed to acquire dquot type 1 [ 115.911451][ T5207] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 115.935684][ T5197] EXT4-fs (loop1): Remounting filesystem read-only [ 115.972894][ T5216] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 115.996249][ T5216] ext4 filesystem being mounted at /12/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 116.025395][ T5197] EXT4-fs error (device loop1): mb_free_blocks:1889: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 116.116575][ T5197] EXT4-fs (loop1): Remounting filesystem read-only [ 116.139482][ T5197] EXT4-fs error (device loop1): ext4_do_update_inode:5229: inode #12: comm syz.1.256: corrupted inode contents [ 116.216911][ T5197] EXT4-fs (loop1): Remounting filesystem read-only [ 116.232655][ T5197] EXT4-fs error (device loop1): ext4_dirty_inode:6087: inode #12: comm syz.1.256: mark_inode_dirty error [ 117.719590][ T5207] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 117.770847][ T5197] EXT4-fs (loop1): Remounting filesystem read-only [ 117.952715][ T5197] EXT4-fs error (device loop1): ext4_do_update_inode:5229: inode #12: comm syz.1.256: corrupted inode contents [ 118.126505][ T5197] EXT4-fs (loop1): Remounting filesystem read-only [ 118.136753][ T5197] EXT4-fs error (device loop1): __ext4_ext_dirty:183: inode #12: comm syz.1.256: mark_inode_dirty error [ 118.321903][ T5197] EXT4-fs (loop1): Remounting filesystem read-only [ 118.329002][ T5197] EXT4-fs error (device loop1): ext4_do_update_inode:5229: inode #12: comm syz.1.256: corrupted inode contents [ 118.416281][ T5197] EXT4-fs (loop1): Remounting filesystem read-only [ 118.424074][ T5197] EXT4-fs error (device loop1) in ext4_orphan_del:303: Corrupt filesystem [ 118.434022][ T5197] EXT4-fs (loop1): Remounting filesystem read-only [ 118.440638][ T5197] EXT4-fs error (device loop1): ext4_do_update_inode:5229: inode #12: comm syz.1.256: corrupted inode contents [ 118.468534][ T5232] loop5: detected capacity change from 0 to 512 [ 118.525275][ T5197] EXT4-fs (loop1): Remounting filesystem read-only [ 118.542258][ T5197] EXT4-fs error (device loop1): ext4_truncate:4286: inode #12: comm syz.1.256: mark_inode_dirty error [ 118.560228][ T5197] EXT4-fs (loop1): Remounting filesystem read-only [ 118.567094][ T5197] EXT4-fs error (device loop1) in ext4_process_orphan:345: Corrupt filesystem [ 118.569237][ T5207] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 118.581683][ T5197] EXT4-fs (loop1): Remounting filesystem read-only [ 118.599061][ T5234] netlink: 'syz.3.265': attribute type 4 has an invalid length. [ 118.606185][ T5232] EXT4-fs (loop5): mounting ext2 file system using the ext4 subsystem [ 118.708944][ T5197] EXT4-fs (loop1): 1 truncate cleaned up [ 118.723337][ T5197] EXT4-fs (loop1): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000000800000,noblock_validity,inode_readahead_blks=0x0000000000200000,errors=remount-ro,noinit_itable,abort,noauto_da_alloc,init_itable,resgid=0x00000000000000002. Quota mode: writeback. [ 118.778769][ T5232] EXT4-fs error (device loop5): ext4_orphan_get:1410: inode #15: comm syz.5.263: casefold flag without casefold feature [ 118.803429][ T5232] EXT4-fs error (device loop5): ext4_orphan_get:1415: comm syz.5.263: couldn't read orphan inode 15 (err -117) [ 119.461936][ T5232] EXT4-fs (loop5): mounted filesystem without journal. Opts: block_validity,,errors=continue. Quota mode: none. [ 119.490862][ T5243] loop3: detected capacity change from 0 to 256 [ 119.533241][ T5245] loop4: detected capacity change from 0 to 512 [ 119.541818][ T5155] EXT4-fs error (device loop5): ext4_validate_block_bitmap:429: comm ext4lazyinit: bg 0: block 5: invalid block bitmap [ 119.664083][ T5245] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 120.487271][ T5257] device-mapper: ioctl: only supply one of name or uuid, cmd(15) [ 121.235097][ T5267] loop4: detected capacity change from 0 to 512 [ 121.457861][ T5267] EXT4-fs (loop4): mounted filesystem without journal. Opts: noauto_da_alloc,min_batch_time=0x0000000000000004,,errors=continue. Quota mode: writeback. [ 121.741326][ T5267] ext4 filesystem being mounted at /38/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 122.089511][ T1235] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 96 vs 65376 free clusters [ 122.126679][ T1235] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 18 with max blocks 2048 with error 28 [ 122.149640][ T1235] EXT4-fs (loop4): This should not happen!! Data will be lost [ 122.149640][ T1235] [ 122.169999][ T1235] EXT4-fs (loop4): Total free blocks count 0 [ 122.180098][ T1235] EXT4-fs (loop4): Free/Dirty block details [ 122.200315][ T1235] EXT4-fs (loop4): free_blocks=65280 [ 122.207563][ T1235] EXT4-fs (loop4): dirty_blocks=2912 [ 122.221183][ T1235] EXT4-fs (loop4): Block reservation details [ 122.231163][ T1235] EXT4-fs (loop4): i_reserved_data_blocks=2912 [ 122.317374][ T4311] EXT4-fs (loop4): Delayed block allocation failed for inode 15 at logical offset 2068 with max blocks 862 with error 28 [ 122.340325][ T4311] EXT4-fs (loop4): This should not happen!! Data will be lost [ 122.340325][ T4311] [ 122.502872][ T5280] netlink: 'syz.4.278': attribute type 4 has an invalid length. [ 123.343630][ T5207] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.369361][ T5207] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.393282][ T5207] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.486043][ T5207] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 123.616651][ T5290] loop3: detected capacity change from 0 to 512 [ 124.134708][ T5290] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 124.326249][ T5298] loop0: detected capacity change from 0 to 2048 [ 124.638834][ T5298] EXT4-fs (loop0): mounted filesystem without journal. Opts: auto_da_alloc=0x0000000000000006,user_xattr,,errors=continue. Quota mode: none. [ 124.729588][ T5298] ext4 filesystem being mounted at /78/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 125.388047][ T5327] netlink: 'syz.4.290': attribute type 4 has an invalid length. [ 125.485344][ T5329] loop3: detected capacity change from 0 to 128 [ 125.747009][ T5329] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 125.868891][ T5329] ext4 filesystem being mounted at /67/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 125.964979][ T5343] input: syz0 as /devices/virtual/input/input11 [ 127.233310][ T5356] loop5: detected capacity change from 0 to 164 [ 127.279184][ T5362] loop3: detected capacity change from 0 to 512 [ 127.430666][ T5356] iso9660: Corrupted directory entry in block 2 of inode 1792 [ 127.459160][ T5364] FAULT_INJECTION: forcing a failure. [ 127.459160][ T5364] name failslab, interval 1, probability 0, space 0, times 0 [ 127.781368][ T5364] CPU: 1 PID: 5364 Comm: syz.1.302 Not tainted syzkaller #0 [ 127.788693][ T5364] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 127.798745][ T5364] Call Trace: [ 127.802019][ T5364] [ 127.804944][ T5364] dump_stack_lvl+0x188/0x250 [ 127.809627][ T5364] ? show_regs_print_info+0x20/0x20 [ 127.814820][ T5364] ? load_image+0x410/0x410 [ 127.819321][ T5364] ? __lock_acquire+0x7b50/0x7b50 [ 127.824348][ T5364] should_fail+0x383/0x4b0 [ 127.828878][ T5364] should_failslab+0x5/0x20 [ 127.833415][ T5364] slab_pre_alloc_hook+0x51/0xc0 [ 127.838366][ T5364] __kmalloc+0x6b/0x340 [ 127.842550][ T5364] ? __se_sys_memfd_create+0x142/0x450 [ 127.848024][ T5364] ? strnlen_user+0x19b/0x250 [ 127.852706][ T5364] __se_sys_memfd_create+0x142/0x450 [ 127.858012][ T5364] ? lock_chain_count+0x20/0x20 [ 127.862880][ T5364] ? __x64_sys_memfd_create+0x60/0x60 [ 127.868261][ T5364] ? lockdep_hardirqs_on+0x94/0x140 [ 127.873553][ T5364] do_syscall_64+0x4c/0xa0 [ 127.877968][ T5364] ? clear_bhb_loop+0x30/0x80 [ 127.882645][ T5364] ? clear_bhb_loop+0x30/0x80 [ 127.887326][ T5364] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 127.893220][ T5364] RIP: 0033:0x7f392bdf2159 [ 127.897636][ T5364] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 127.917239][ T5364] RSP: 002b:00007f392a049e08 EFLAGS: 00000202 ORIG_RAX: 000000000000013f [ 127.925659][ T5364] RAX: ffffffffffffffda RBX: 00000000000002cd RCX: 00007f392bdf2159 [ 127.933625][ T5364] RDX: 00007f392a049ee0 RSI: 0000000000000000 RDI: 00007f392be8924b [ 127.941594][ T5364] RBP: 0000200000000b80 R08: 00000000ffffffff R09: 0000000000000000 [ 127.949560][ T5364] R10: 0000000000000001 R11: 0000000000000202 R12: 0000200000000200 [ 127.957526][ T5364] R13: 00007f392a049ee0 R14: 00007f392a049ea0 R15: 0000200000000340 [ 127.965508][ T5364] [ 128.083443][ T5362] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 129.540530][ T5394] loop5: detected capacity change from 0 to 512 [ 129.603689][ T5394] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 129.629127][ T5394] System zones: 1-12 [ 129.659696][ T5394] EXT4-fs error (device loop5): ext4_xattr_inode_iget:401: inode #12: comm syz.5.309: missing EA_INODE flag [ 129.667672][ T5401] input: syz0 as /devices/virtual/input/input12 [ 129.685029][ T5394] EXT4-fs error (device loop5): ext4_xattr_inode_iget:406: comm syz.5.309: error while reading EA inode 12 err=-117 [ 129.793169][ T5394] EXT4-fs (loop5): 1 orphan inode deleted [ 129.799004][ T5394] EXT4-fs (loop5): mounted filesystem without journal. Opts: debug,resuid=0x000000000000ee01,,errors=continue. Quota mode: writeback. [ 132.806163][ T1420] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.815356][ T1420] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.936989][ T5434] netlink: 'syz.0.321': attribute type 4 has an invalid length. [ 133.296411][ T5443] FAULT_INJECTION: forcing a failure. [ 133.296411][ T5443] name failslab, interval 1, probability 0, space 0, times 0 [ 133.639603][ T5443] CPU: 0 PID: 5443 Comm: syz.1.324 Not tainted syzkaller #0 [ 133.646945][ T5443] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 133.656995][ T5443] Call Trace: [ 133.660271][ T5443] [ 133.663199][ T5443] dump_stack_lvl+0x188/0x250 [ 133.667879][ T5443] ? show_regs_print_info+0x20/0x20 [ 133.673080][ T5443] ? load_image+0x410/0x410 [ 133.677590][ T5443] ? __lock_acquire+0x7b50/0x7b50 [ 133.682621][ T5443] should_fail+0x383/0x4b0 [ 133.687043][ T5443] should_failslab+0x5/0x20 [ 133.691544][ T5443] slab_pre_alloc_hook+0x51/0xc0 [ 133.696479][ T5443] kmem_cache_alloc_trace+0x47/0x290 [ 133.701757][ T5443] ? alloc_fdtable+0xca/0x2c0 [ 133.706428][ T5443] ? __rwlock_init+0x140/0x140 [ 133.711191][ T5443] alloc_fdtable+0xca/0x2c0 [ 133.715696][ T5443] dup_fd+0x982/0xc70 [ 133.719691][ T5443] ksys_unshare+0x458/0x8e0 [ 133.724190][ T5443] ? __lock_acquire+0x7b50/0x7b50 [ 133.729216][ T5443] ? sighand_ctor+0x40/0x40 [ 133.733715][ T5443] ? lock_chain_count+0x20/0x20 [ 133.738572][ T5443] ? syscall_enter_from_user_mode+0x21/0x70 [ 133.744470][ T5443] __x64_sys_unshare+0x34/0x40 [ 133.749232][ T5443] do_syscall_64+0x4c/0xa0 [ 133.753732][ T5443] ? clear_bhb_loop+0x30/0x80 [ 133.758404][ T5443] ? clear_bhb_loop+0x30/0x80 [ 133.763080][ T5443] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 133.768974][ T5443] RIP: 0033:0x7f392bdf2159 [ 133.773423][ T5443] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 133.793031][ T5443] RSP: 002b:00007f392a04a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 133.801455][ T5443] RAX: ffffffffffffffda RBX: 00007f392c079fa0 RCX: 00007f392bdf2159 [ 133.809432][ T5443] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000002c040480 [ 133.817496][ T5443] RBP: 00007f392be8906b R08: 0000000000000000 R09: 0000000000000000 [ 133.825477][ T5443] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 133.833456][ T5443] R13: 00007f392c07a038 R14: 00007f392c079fa0 R15: 00007ffdead2ec08 [ 133.841451][ T5443] [ 134.093961][ T5463] loop3: detected capacity change from 0 to 256 [ 134.108621][ T5465] loop0: detected capacity change from 0 to 512 [ 134.123146][ T5462] autofs4:pid:5462:autofs_fill_super: called with bogus options [ 134.175769][ T5468] input: syz0 as /devices/virtual/input/input13 [ 134.238394][ T5465] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 134.285483][ T5465] System zones: 1-12 [ 134.350356][ T5465] EXT4-fs error (device loop0): ext4_xattr_inode_iget:401: inode #12: comm syz.0.330: missing EA_INODE flag [ 134.407420][ T5465] EXT4-fs error (device loop0): ext4_xattr_inode_iget:406: comm syz.0.330: error while reading EA inode 12 err=-117 [ 134.430605][ T5465] EXT4-fs (loop0): 1 orphan inode deleted [ 134.748064][ T5465] EXT4-fs (loop0): mounted filesystem without journal. Opts: debug,resuid=0x000000000000ee01,,errors=continue. Quota mode: writeback. [ 136.954838][ T5506] netlink: 'syz.1.339': attribute type 4 has an invalid length. [ 137.710564][ T5516] loop5: detected capacity change from 0 to 256 [ 137.967377][ T5527] loop3: detected capacity change from 0 to 164 [ 138.570617][ T5527] iso9660: Corrupted directory entry in block 2 of inode 1792 [ 138.750924][ T5540] input: syz0 as /devices/virtual/input/input14 [ 138.956927][ T5549] loop5: detected capacity change from 0 to 128 [ 139.214346][ T5549] EXT4-fs (loop5): mounted filesystem without journal. Opts: data_err=ignore,,errors=continue. Quota mode: none. [ 139.227226][ T5554] autofs4:pid:5554:autofs_fill_super: called with bogus options [ 139.286378][ T5549] ext4 filesystem being mounted at /29/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 141.886385][ T5579] netlink: 'syz.1.356': attribute type 4 has an invalid length. [ 141.894979][ T5580] loop3: detected capacity change from 0 to 512 [ 142.019110][ T5585] loop4: detected capacity change from 0 to 256 [ 142.146211][ T5580] EXT4-fs (loop3): Ignoring removed nobh option [ 142.182959][ T5580] fscrypt (loop3, inode 2): Error -61 getting encryption context [ 142.204796][ T5580] EXT4-fs (loop3): Cannot turn on journaled quota: type 1: error -61 [ 142.229087][ T5580] EXT4-fs error (device loop3): ext4_orphan_get:1410: inode #13: comm syz.3.357: inode has both inline data and extents flags [ 142.249443][ T5580] EXT4-fs error (device loop3): ext4_orphan_get:1415: comm syz.3.357: couldn't read orphan inode 13 (err -117) [ 142.269572][ T5580] EXT4-fs (loop3): mounted filesystem without journal. Opts: jqfmt=vfsold,nouid32,nobh,stripe=0x000000000000ffff,block_validity,grpjquota=",errors=continue. Quota mode: writeback. [ 142.641756][ T5580] fscrypt (loop3, inode 2): Error -61 getting encryption context [ 143.043241][ T5596] netlink: 4 bytes leftover after parsing attributes in process `syz.0.361'. [ 143.772274][ T5601] FAULT_INJECTION: forcing a failure. [ 143.772274][ T5601] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 143.804884][ T5603] input: syz0 as /devices/virtual/input/input15 [ 143.837292][ T5601] CPU: 0 PID: 5601 Comm: syz.1.362 Not tainted syzkaller #0 [ 143.844613][ T5601] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 143.854682][ T5601] Call Trace: [ 143.857956][ T5601] [ 143.860882][ T5601] dump_stack_lvl+0x188/0x250 [ 143.865576][ T5601] ? show_regs_print_info+0x20/0x20 [ 143.870783][ T5601] ? load_image+0x410/0x410 [ 143.875290][ T5601] ? __lock_acquire+0x7b50/0x7b50 [ 143.880329][ T5601] should_fail+0x383/0x4b0 [ 143.884759][ T5601] _copy_from_user+0x2e/0x170 [ 143.889528][ T5601] __copy_msghdr_from_user+0x48a/0x630 [ 143.894990][ T5601] ? verify_lock_unused+0x140/0x140 [ 143.900196][ T5601] ? __ia32_sys_shutdown+0x1d0/0x1d0 [ 143.905479][ T5601] ? __lock_acquire+0x13dc/0x7b50 [ 143.910529][ T5601] ___sys_sendmsg+0x19a/0x2e0 [ 143.915224][ T5601] ? __sys_sendmsg+0x290/0x290 [ 143.920025][ T5601] __se_sys_sendmsg+0x1b7/0x2a0 [ 143.924883][ T5601] ? __x64_sys_sendmsg+0x80/0x80 [ 143.929836][ T5601] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 143.935840][ T5601] ? lockdep_hardirqs_on+0x94/0x140 [ 143.941056][ T5601] do_syscall_64+0x4c/0xa0 [ 143.945484][ T5601] ? clear_bhb_loop+0x30/0x80 [ 143.950170][ T5601] ? clear_bhb_loop+0x30/0x80 [ 143.954859][ T5601] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 143.960764][ T5601] RIP: 0033:0x7f392bdf2159 [ 143.965185][ T5601] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 143.984795][ T5601] RSP: 002b:00007f392a04a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 143.993211][ T5601] RAX: ffffffffffffffda RBX: 00007f392c079fa0 RCX: 00007f392bdf2159 [ 144.001189][ T5601] RDX: 9cdc2384056f4939 RSI: 0000200000000100 RDI: 0000000000000005 [ 144.009199][ T5601] RBP: 00007f392be8906b R08: 0000000000000000 R09: 0000000000000000 [ 144.017180][ T5601] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 144.025160][ T5601] R13: 00007f392c07a038 R14: 00007f392c079fa0 R15: 00007ffdead2ec08 [ 144.033154][ T5601] [ 145.313731][ T5627] loop1: detected capacity change from 0 to 164 [ 145.491175][ T5627] iso9660: Corrupted directory entry in block 2 of inode 1792 [ 145.667617][ T5635] netlink: 16 bytes leftover after parsing attributes in process `syz.3.373'. [ 145.700425][ T5635] netlink: 4 bytes leftover after parsing attributes in process `syz.3.373'. [ 145.711606][ T5638] netlink: 'syz.0.372': attribute type 4 has an invalid length. [ 147.677096][ T5665] loop3: detected capacity change from 0 to 512 [ 147.887530][ T5661] input: syz0 as /devices/virtual/input/input16 [ 147.918334][ T5665] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 147.951573][ T5665] System zones: 1-12 [ 148.026721][ T5665] EXT4-fs error (device loop3): ext4_xattr_inode_iget:401: inode #12: comm syz.3.382: missing EA_INODE flag [ 148.151785][ T5665] EXT4-fs error (device loop3): ext4_xattr_inode_iget:406: comm syz.3.382: error while reading EA inode 12 err=-117 [ 148.167938][ T5665] EXT4-fs (loop3): 1 orphan inode deleted [ 148.174190][ T5665] EXT4-fs (loop3): mounted filesystem without journal. Opts: debug,resuid=0x000000000000ee01,,errors=continue. Quota mode: writeback. [ 148.819023][ T5688] netlink: 'syz.1.386': attribute type 4 has an invalid length. [ 149.097886][ T5695] loop3: detected capacity change from 0 to 512 [ 149.323005][ T5695] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 149.350405][ T5695] System zones: 1-12 [ 149.788522][ T5695] EXT4-fs error (device loop3): ext4_xattr_inode_iget:401: inode #12: comm syz.3.398: missing EA_INODE flag [ 149.922351][ T5695] EXT4-fs error (device loop3): ext4_xattr_inode_iget:406: comm syz.3.398: error while reading EA inode 12 err=-117 [ 149.976317][ T5695] EXT4-fs (loop3): 1 orphan inode deleted [ 150.071138][ T5695] EXT4-fs (loop3): mounted filesystem without journal. Opts: debug,resuid=0x000000000000ee01,,errors=continue. Quota mode: writeback. [ 152.601164][ T5724] input: syz0 as /devices/virtual/input/input17 [ 154.706246][ T5754] netlink: 'syz.4.401': attribute type 4 has an invalid length. [ 159.196840][ T5812] netlink: 4 bytes leftover after parsing attributes in process `syz.1.413'. [ 159.279004][ T5812] netlink: 28 bytes leftover after parsing attributes in process `syz.1.413'. [ 159.820968][ T5817] loop1: detected capacity change from 0 to 256 [ 159.829398][ T5819] loop3: detected capacity change from 0 to 256 [ 160.988312][ T5828] tmpfs: Bad value for 'mpol' [ 163.471249][ T4231] Bluetooth: hci5: command 0x0409 tx timeout [ 163.585100][ T5838] chnl_net:caif_netlink_parms(): no params data found [ 163.870792][ T5885] FAULT_INJECTION: forcing a failure. [ 163.870792][ T5885] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 163.897475][ T5885] CPU: 1 PID: 5885 Comm: syz.1.430 Not tainted syzkaller #0 [ 163.904806][ T5885] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 163.914093][ T5838] bridge0: port 1(bridge_slave_0) entered blocking state [ 163.915039][ T5885] Call Trace: [ 163.915048][ T5885] [ 163.928263][ T5885] dump_stack_lvl+0x188/0x250 [ 163.932954][ T5885] ? show_regs_print_info+0x20/0x20 [ 163.933331][ T5838] bridge0: port 1(bridge_slave_0) entered disabled state [ 163.938157][ T5885] ? load_image+0x410/0x410 [ 163.938183][ T5885] ? __lock_acquire+0x7b50/0x7b50 [ 163.954703][ T5885] should_fail+0x383/0x4b0 [ 163.959129][ T5885] _copy_from_iter+0x234/0x1160 [ 163.963995][ T5885] ? __lock_acquire+0x7b50/0x7b50 [ 163.968834][ T5889] FAULT_INJECTION: forcing a failure. [ 163.968834][ T5889] name failslab, interval 1, probability 0, space 0, times 0 [ 163.969066][ T5885] ? copy_mc_pipe_to_iter+0x7d0/0x7d0 [ 163.987190][ T5885] ? __virt_addr_valid+0x3c6/0x470 [ 163.992316][ T5885] ? __phys_addr_symbol+0x2b/0x70 [ 163.997351][ T5885] ? __check_object_size+0x30c/0x410 [ 164.002651][ T5885] netlink_sendmsg+0x758/0xbe0 [ 164.007433][ T5885] ? netlink_getsockopt+0x570/0x570 [ 164.012632][ T5885] ? aa_sock_msg_perm+0x94/0x150 [ 164.017577][ T5885] ? apparmor_socket_sendmsg+0x88/0x230 [ 164.017976][ T5838] device bridge_slave_0 entered promiscuous mode [ 164.023129][ T5885] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 164.023152][ T5885] ? security_socket_sendmsg+0x7c/0xa0 [ 164.023169][ T5885] ? netlink_getsockopt+0x570/0x570 [ 164.023186][ T5885] ____sys_sendmsg+0x5be/0x8f0 [ 164.023211][ T5885] ? __sys_sendmsg_sock+0x30/0x30 [ 164.023233][ T5885] ? import_iovec+0x6f/0xa0 [ 164.023254][ T5885] ___sys_sendmsg+0x236/0x2e0 [ 164.023278][ T5885] ? __sys_sendmsg+0x290/0x290 [ 164.023326][ T5885] __se_sys_sendmsg+0x1b7/0x2a0 [ 164.057494][ T5838] bridge0: port 2(bridge_slave_1) entered blocking state [ 164.059758][ T5885] ? __x64_sys_sendmsg+0x80/0x80 [ 164.086004][ T5885] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 164.092050][ T5885] ? lockdep_hardirqs_on+0x94/0x140 [ 164.094461][ T5838] bridge0: port 2(bridge_slave_1) entered disabled state [ 164.097338][ T5885] do_syscall_64+0x4c/0xa0 [ 164.097362][ T5885] ? clear_bhb_loop+0x30/0x80 [ 164.113452][ T5885] ? clear_bhb_loop+0x30/0x80 [ 164.118160][ T5885] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 164.124419][ T5885] RIP: 0033:0x7f392bdf2159 [ 164.128872][ T5885] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 164.143691][ T5838] device bridge_slave_1 entered promiscuous mode [ 164.148484][ T5885] RSP: 002b:00007f392a04a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 164.148513][ T5885] RAX: ffffffffffffffda RBX: 00007f392c079fa0 RCX: 00007f392bdf2159 [ 164.148525][ T5885] RDX: 0000000000000000 RSI: 00002000000007c0 RDI: 0000000000000004 [ 164.148537][ T5885] RBP: 00007f392be8906b R08: 0000000000000000 R09: 0000000000000000 [ 164.148547][ T5885] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 164.195200][ T5885] R13: 00007f392c07a038 R14: 00007f392c079fa0 R15: 00007ffdead2ec08 [ 164.203224][ T5885] [ 164.206242][ T5889] CPU: 0 PID: 5889 Comm: syz.3.432 Not tainted syzkaller #0 [ 164.213535][ T5889] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 164.223600][ T5889] Call Trace: [ 164.226884][ T5889] [ 164.229810][ T5889] dump_stack_lvl+0x188/0x250 [ 164.234499][ T5889] ? show_regs_print_info+0x20/0x20 [ 164.239719][ T5889] ? load_image+0x410/0x410 [ 164.244237][ T5889] ? __might_sleep+0xf0/0xf0 [ 164.248922][ T5889] ? __lock_acquire+0x7b50/0x7b50 [ 164.253959][ T5889] should_fail+0x383/0x4b0 [ 164.258395][ T5889] should_failslab+0x5/0x20 [ 164.263383][ T5889] slab_pre_alloc_hook+0x51/0xc0 [ 164.268326][ T5889] kmem_cache_alloc_trace+0x47/0x290 [ 164.273610][ T5889] ? sctp_association_new+0x86/0x2400 [ 164.278999][ T5889] sctp_association_new+0x86/0x2400 [ 164.284223][ T5889] sctp_connect_new_asoc+0x2da/0x6a0 [ 164.289622][ T5889] ? __sctp_connect+0xd80/0xd80 [ 164.294487][ T5889] ? __local_bh_enable_ip+0x136/0x1c0 [ 164.299874][ T5889] ? bpf_lsm_sctp_bind_connect+0x5/0x10 [ 164.305440][ T5889] ? security_sctp_bind_connect+0x85/0xb0 [ 164.311178][ T5889] sctp_sendmsg+0x15e1/0x2940 [ 164.315975][ T5889] ? sctp_getsockopt+0x8a0/0x8a0 [ 164.320925][ T5889] ? aa_af_perm+0x340/0x340 [ 164.325693][ T5889] ? tomoyo_socket_sendmsg_permission+0x1dd/0x2f0 [ 164.332108][ T5889] ? aa_sock_msg_perm+0x94/0x150 [ 164.337050][ T5889] ? sock_rps_record_flow+0x17/0x3b0 [ 164.342344][ T5889] ? inet_sendmsg+0xca/0x2a0 [ 164.346937][ T5889] ? inet_send_prepare+0x250/0x250 [ 164.352053][ T5889] ____sys_sendmsg+0x5be/0x8f0 [ 164.356828][ T5889] ? __sys_sendmsg_sock+0x30/0x30 [ 164.361863][ T5889] ? import_iovec+0x6f/0xa0 [ 164.366376][ T5889] ___sys_sendmsg+0x236/0x2e0 [ 164.371154][ T5889] ? __sys_sendmsg+0x290/0x290 [ 164.375955][ T5889] __sys_sendmmsg+0x2ba/0x500 [ 164.380651][ T5889] ? __ia32_sys_sendmsg+0x80/0x80 [ 164.385703][ T5889] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 164.391780][ T5889] ? lock_chain_count+0x20/0x20 [ 164.396650][ T5889] __x64_sys_sendmmsg+0x9c/0xb0 [ 164.401504][ T5889] do_syscall_64+0x4c/0xa0 [ 164.405925][ T5889] ? clear_bhb_loop+0x30/0x80 [ 164.410601][ T5889] ? clear_bhb_loop+0x30/0x80 [ 164.415281][ T5889] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 164.421177][ T5889] RIP: 0033:0x7f948b056159 [ 164.425593][ T5889] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 164.446423][ T5889] RSP: 002b:00007f94892ae028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 164.454856][ T5889] RAX: ffffffffffffffda RBX: 00007f948b2ddfa0 RCX: 00007f948b056159 [ 164.462933][ T5889] RDX: 0000000000000001 RSI: 0000200000000480 RDI: 0000000000000006 [ 164.470927][ T5889] RBP: 00007f948b0ed06b R08: 0000000000000000 R09: 0000000000000000 [ 164.478899][ T5889] R10: 0000000004000000 R11: 0000000000000246 R12: 0000000000000000 [ 164.486871][ T5889] R13: 00007f948b2de038 R14: 00007f948b2ddfa0 R15: 00007ffe9b3a1518 [ 164.494860][ T5889] [ 164.544468][ T5838] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 164.753621][ T5838] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 164.866284][ T5838] team0: Port device team_slave_0 added [ 164.921127][ T5838] team0: Port device team_slave_1 added [ 165.194365][ T5838] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 165.651492][ T4231] Bluetooth: hci5: command 0x041b tx timeout [ 165.681163][ T5838] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 165.889244][ T5838] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 166.211413][ T5838] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 166.379590][ T5838] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 166.791173][ T5838] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 167.711433][ T2236] Bluetooth: hci5: command 0x040f tx timeout [ 167.916716][ T5838] device hsr_slave_0 entered promiscuous mode [ 167.991660][ T5838] device hsr_slave_1 entered promiscuous mode [ 168.008400][ T5838] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 168.030547][ T5838] Cannot create hsr debugfs directory [ 168.150013][ T4311] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 168.298163][ T4311] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 168.362754][ T5950] netlink: 4 bytes leftover after parsing attributes in process `syz.3.444'. [ 168.451212][ T5950] netlink: 28 bytes leftover after parsing attributes in process `syz.3.444'. [ 168.538661][ T4311] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 169.668434][ T4311] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 169.778237][ T5965] loop3: detected capacity change from 0 to 512 [ 169.784751][ T21] Bluetooth: hci5: command 0x0419 tx timeout [ 169.869677][ T5972] loop4: detected capacity change from 0 to 512 [ 169.933180][ T5972] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 169.961723][ T5965] EXT4-fs (loop3): DAX enabled. Warning: EXPERIMENTAL, use at your own risk [ 170.024409][ T5965] EXT4-fs (loop3): DAX unsupported by block device. [ 170.053953][ T5972] EXT4-fs error (device loop4): ext4_mb_mark_diskspace_used:3894: comm syz.4.454: Allocating blocks 41-42 which overlap fs metadata [ 170.079276][ T5972] EXT4-fs (loop4): Remounting filesystem read-only [ 170.088210][ T5972] Quota error (device loop4): write_blk: dquota write failed [ 170.096841][ T5972] Quota error (device loop4): find_free_dqentry: Can't write quota data block 5 [ 170.107199][ T5972] EXT4-fs error (device loop4): ext4_mb_mark_diskspace_used:3894: comm syz.4.454: Allocating blocks 41-42 which overlap fs metadata [ 170.123397][ T5972] EXT4-fs (loop4): Remounting filesystem read-only [ 170.133936][ T5972] Quota error (device loop4): write_blk: dquota write failed [ 170.147111][ T5972] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 170.162890][ T5972] EXT4-fs error (device loop4): ext4_acquire_dquot:6236: comm syz.4.454: Failed to acquire dquot type 1 [ 170.177865][ T5838] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 170.185995][ T5972] EXT4-fs (loop4): Remounting filesystem read-only [ 170.209161][ T5972] EXT4-fs error (device loop4): mb_free_blocks:1889: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 170.245040][ T5838] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 170.271398][ T5972] EXT4-fs (loop4): Remounting filesystem read-only [ 170.278119][ T5972] EXT4-fs error (device loop4): ext4_do_update_inode:5229: inode #12: comm syz.4.454: corrupted inode contents [ 170.305429][ T5838] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 170.334737][ T5972] EXT4-fs (loop4): Remounting filesystem read-only [ 170.374771][ T5838] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 170.413772][ T5972] EXT4-fs error (device loop4): ext4_dirty_inode:6087: inode #12: comm syz.4.454: mark_inode_dirty error [ 170.451564][ T5972] EXT4-fs (loop4): Remounting filesystem read-only [ 170.458160][ T5972] EXT4-fs error (device loop4): ext4_do_update_inode:5229: inode #12: comm syz.4.454: corrupted inode contents [ 170.499998][ T5972] EXT4-fs (loop4): Remounting filesystem read-only [ 170.577097][ T5972] EXT4-fs error (device loop4): __ext4_ext_dirty:183: inode #12: comm syz.4.454: mark_inode_dirty error [ 170.691991][ T5972] EXT4-fs (loop4): Remounting filesystem read-only [ 170.882299][ T5972] EXT4-fs error (device loop4): ext4_do_update_inode:5229: inode #12: comm syz.4.454: corrupted inode contents [ 170.906326][ T5972] EXT4-fs (loop4): Remounting filesystem read-only [ 171.311207][ T5972] EXT4-fs error (device loop4) in ext4_orphan_del:303: Corrupt filesystem [ 171.333949][ T5972] EXT4-fs (loop4): Remounting filesystem read-only [ 171.369150][ T5972] EXT4-fs error (device loop4): ext4_do_update_inode:5229: inode #12: comm syz.4.454: corrupted inode contents [ 171.402035][ T5972] EXT4-fs (loop4): Remounting filesystem read-only [ 171.427216][ T5972] EXT4-fs error (device loop4): ext4_truncate:4286: inode #12: comm syz.4.454: mark_inode_dirty error [ 171.468321][ T5838] 8021q: adding VLAN 0 to HW filter on device bond0 [ 171.847282][ T5972] EXT4-fs (loop4): Remounting filesystem read-only [ 171.920463][ T5972] EXT4-fs error (device loop4) in ext4_process_orphan:345: Corrupt filesystem [ 172.015307][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 172.195686][ T5972] EXT4-fs (loop4): Remounting filesystem read-only [ 172.221485][ T5972] EXT4-fs (loop4): 1 truncate cleaned up [ 172.236424][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 172.300900][ T5972] EXT4-fs (loop4): mounted filesystem without journal. Opts: inode_readahead_blks=0x0000000000800000,noblock_validity,inode_readahead_blks=0x0000000000200000,errors=remount-ro,noinit_itable,abort,noauto_da_alloc,max_dir_size_kb=0x0000000000000006,resgid=0x00000000000000002. Quota mode: writeback. [ 172.361566][ T5838] 8021q: adding VLAN 0 to HW filter on device team0 [ 172.405113][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 172.407604][ T6023] loop1: detected capacity change from 0 to 512 [ 172.430678][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 172.457387][ T4307] bridge0: port 1(bridge_slave_0) entered blocking state [ 172.465035][ T4307] bridge0: port 1(bridge_slave_0) entered forwarding state [ 172.540444][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 172.559367][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 172.574286][ T6023] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 172.621237][ T6023] EXT4-fs (loop1): 1 truncate cleaned up [ 172.627888][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 172.685349][ T6023] EXT4-fs (loop1): mounted filesystem without journal. Opts: noload,stripe=0x00000000000000dc,data_err=abort,noload,data_err=ignore,noblock_validity,,errors=continue. Quota mode: none. [ 172.742605][ T4307] bridge0: port 2(bridge_slave_1) entered blocking state [ 172.749730][ T4307] bridge0: port 2(bridge_slave_1) entered forwarding state [ 172.781458][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 172.790786][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 172.822590][ T6034] loop3: detected capacity change from 0 to 512 [ 172.830284][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 172.852697][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 172.861881][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 172.870616][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 172.986752][ T5838] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 173.042966][ T5838] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 173.078436][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 173.095296][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 173.140725][ T6034] EXT4-fs (loop3): mounted filesystem without journal. Opts: i_version,,errors=continue. Quota mode: writeback. [ 173.192287][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 173.227877][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 173.272943][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 173.331415][ T6034] ext4 filesystem being mounted at /111/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 173.356168][ T4307] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 175.444891][ T4311] device hsr_slave_0 left promiscuous mode [ 175.493809][ T4311] device hsr_slave_1 left promiscuous mode [ 175.605305][ T4311] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 175.621357][ T4311] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 175.696183][ T4311] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 175.749063][ T4311] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 175.818728][ T4311] device bridge_slave_1 left promiscuous mode [ 175.856739][ T4311] bridge0: port 2(bridge_slave_1) entered disabled state [ 176.036898][ T4311] device bridge_slave_0 left promiscuous mode [ 176.071685][ T4311] bridge0: port 1(bridge_slave_0) entered disabled state [ 176.149789][ T4311] device veth1_macvtap left promiscuous mode [ 176.171385][ T4311] device veth0_macvtap left promiscuous mode [ 176.179462][ T4311] device veth1_vlan left promiscuous mode [ 176.212549][ T4311] device veth0_vlan left promiscuous mode [ 176.500123][ T6089] loop3: detected capacity change from 0 to 512 [ 176.555090][ T6089] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 176.599713][ T6089] EXT4-fs (loop3): 1 truncate cleaned up [ 176.609945][ T6089] EXT4-fs (loop3): mounted filesystem without journal. Opts: noload,stripe=0x00000000000000dc,data_err=abort,noload,data_err=ignore,noblock_validity,,errors=continue. Quota mode: none. [ 177.110860][ T4311] team0 (unregistering): Port device team_slave_1 removed [ 177.144021][ T4311] team0 (unregistering): Port device team_slave_0 removed [ 177.174603][ T4311] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 177.210883][ T4311] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 177.418838][ T4311] bond0 (unregistering): Released all slaves [ 177.520926][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 177.521290][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 177.526455][ T5838] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 177.617525][ T6100] loop4: detected capacity change from 0 to 256 [ 177.763531][ T6100] FAT-fs (loop4): Directory bread(block 64) failed [ 177.786015][ T6099] device syzkaller0 entered promiscuous mode [ 177.813897][ T6100] FAT-fs (loop4): Directory bread(block 65) failed [ 177.823862][ T6100] FAT-fs (loop4): Directory bread(block 66) failed [ 177.830441][ T6100] FAT-fs (loop4): Directory bread(block 67) failed [ 177.857556][ T6100] FAT-fs (loop4): Directory bread(block 68) failed [ 177.915884][ T6100] FAT-fs (loop4): Directory bread(block 69) failed [ 177.951254][ T6100] FAT-fs (loop4): Directory bread(block 70) failed [ 177.981103][ T6100] FAT-fs (loop4): Directory bread(block 71) failed [ 177.987736][ T6100] FAT-fs (loop4): Directory bread(block 72) failed [ 178.053773][ T6100] FAT-fs (loop4): Directory bread(block 73) failed [ 179.467531][ T4353] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 179.509651][ T4353] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 179.585572][ T4353] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 179.620984][ T4353] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 179.650678][ T5838] device veth0_vlan entered promiscuous mode [ 179.691592][ T4353] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 179.735588][ T4353] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 179.800952][ T5838] device veth1_vlan entered promiscuous mode [ 179.980410][ T5838] device veth0_macvtap entered promiscuous mode [ 179.996209][ T6145] loop4: detected capacity change from 0 to 512 [ 180.074710][ T5838] device veth1_macvtap entered promiscuous mode [ 180.084430][ T6145] EXT4-fs (loop4): mounting ext3 file system using the ext4 subsystem [ 180.151828][ T4353] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 180.169535][ T4353] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 180.212017][ T6145] EXT4-fs (loop4): 1 truncate cleaned up [ 180.217959][ T6145] EXT4-fs (loop4): mounted filesystem without journal. Opts: noload,stripe=0x00000000000000dc,data_err=abort,noload,data_err=ignore,noblock_validity,,errors=continue. Quota mode: none. [ 180.239114][ T4353] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 180.417584][ T4353] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 180.517442][ T5838] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 180.540489][ T5838] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 180.550393][ T5838] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 180.560844][ T5838] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 180.591367][ T5838] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 180.636295][ T5838] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 180.661968][ T5838] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 180.714683][ T5838] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 180.746265][ T5838] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 180.802862][ T5838] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 180.861060][ T5838] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 180.924491][ T5838] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 180.951557][ T5838] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 180.981761][ T5838] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 181.016877][ T5838] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 181.049107][ T5838] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 181.090394][ T5838] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 181.134370][ T5838] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 181.192447][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 181.232738][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 181.259103][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 181.292006][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 181.314773][ T5838] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 181.354206][ T5838] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 181.401084][ T5838] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 181.441276][ T5838] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 181.597595][ T6166] netlink: 40 bytes leftover after parsing attributes in process `syz.3.490'. [ 183.255221][ T6178] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 [ 183.679881][ T6183] loop3: detected capacity change from 0 to 256 [ 185.014128][ T6193] autofs4:pid:6193:autofs_fill_super: called with bogus options [ 185.048787][ T6198] loop3: detected capacity change from 0 to 512 [ 185.061677][ T4236] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 185.081787][ T4236] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 185.117904][ T4309] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 185.149698][ T4236] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 185.187689][ T4236] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 185.295680][ T6198] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 185.362518][ T4236] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 185.417189][ T6206] loop1: detected capacity change from 0 to 512 [ 185.528529][ T6198] EXT4-fs (loop3): 1 truncate cleaned up [ 185.541761][ T6198] EXT4-fs (loop3): mounted filesystem without journal. Opts: noload,stripe=0x00000000000000dc,data_err=abort,noload,data_err=ignore,noblock_validity,,errors=continue. Quota mode: none. [ 185.593187][ T6206] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 185.942468][ T21] Bluetooth: hci0: command 0x0406 tx timeout [ 185.948774][ T21] Bluetooth: hci2: command 0x0406 tx timeout [ 185.976667][ T21] Bluetooth: hci1: command 0x0406 tx timeout [ 186.162895][ T21] Bluetooth: hci4: command 0x0406 tx timeout [ 187.406626][ T6229] ODEBUG: Out of memory. ODEBUG disabled [ 187.433190][ T6231] xt_bpf: check failed: parse error [ 189.641684][ T6249] loop1: detected capacity change from 0 to 256 [ 189.751493][ T6252] device syzkaller0 entered promiscuous mode [ 189.832061][ T6252] [ 189.834419][ T6252] ============================================ [ 189.840572][ T6252] WARNING: possible recursive locking detected [ 189.846728][ T6252] syzkaller #0 Not tainted [ 189.851161][ T6252] -------------------------------------------- [ 189.857740][ T6252] syz.0.510/6252 is trying to acquire lock: [ 189.863645][ T6252] ffff888076680108 (&sch->q.lock){+.-.}-{2:2}, at: __dev_queue_xmit+0xa2b/0x2e50 [ 189.872808][ T6252] [ 189.872808][ T6252] but task is already holding lock: [ 189.880205][ T6252] ffff888076680108 (&sch->q.lock){+.-.}-{2:2}, at: __dev_queue_xmit+0xa2b/0x2e50 [ 189.889535][ T6252] [ 189.889535][ T6252] other info that might help us debug this: [ 189.897690][ T6252] Possible unsafe locking scenario: [ 189.897690][ T6252] [ 189.905140][ T6252] CPU0 [ 189.908420][ T6252] ---- [ 189.911693][ T6252] lock(&sch->q.lock); [ 189.915843][ T6252] lock(&sch->q.lock); [ 189.919989][ T6252] [ 189.919989][ T6252] *** DEADLOCK *** [ 189.919989][ T6252] [ 189.928118][ T6252] May be due to missing lock nesting notation [ 189.928118][ T6252] [ 189.936427][ T6252] 3 locks held by syz.0.510/6252: [ 189.941444][ T6252] #0: ffffffff8c31efc0 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 [ 189.951125][ T6252] #1: ffff888076680108 (&sch->q.lock){+.-.}-{2:2}, at: __dev_queue_xmit+0xa2b/0x2e50 [ 189.960709][ T6252] #2: ffffffff8c31efc0 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire+0x9/0x30 [ 189.970292][ T6252] [ 189.970292][ T6252] stack backtrace: [ 189.976191][ T6252] CPU: 0 PID: 6252 Comm: syz.0.510 Not tainted syzkaller #0 [ 189.983472][ T6252] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 189.993628][ T6252] Call Trace: [ 189.996912][ T6252] [ 189.999847][ T6252] dump_stack_lvl+0x188/0x250 [ 190.004535][ T6252] ? show_regs_print_info+0x20/0x20 [ 190.009747][ T6252] ? load_image+0x410/0x410 [ 190.014266][ T6252] __lock_acquire+0x1247/0x7b50 [ 190.019132][ T6252] ? stack_trace_snprint+0xe0/0xe0 [ 190.024257][ T6252] ? lockdep_unlock+0x143/0x2e0 [ 190.029121][ T6252] ? verify_lock_unused+0x140/0x140 [ 190.034331][ T6252] ? add_lock_to_list+0x18d/0x280 [ 190.039357][ T6252] ? __lock_acquire+0x2844/0x7b50 [ 190.044392][ T6252] lock_acquire+0x19e/0x400 [ 190.048912][ T6252] ? __dev_queue_xmit+0xa2b/0x2e50 [ 190.054038][ T6252] ? read_lock_is_recursive+0x10/0x10 [ 190.059546][ T6252] ? rcu_read_lock_bh_held+0x76/0xf0 [ 190.064848][ T6252] ? rcu_read_lock_held+0x40/0x40 [ 190.069873][ T6252] _raw_spin_lock+0x2a/0x40 [ 190.074379][ T6252] ? __dev_queue_xmit+0xa2b/0x2e50 [ 190.079476][ T6252] __dev_queue_xmit+0xa2b/0x2e50 [ 190.084406][ T6252] ? dev_queue_xmit+0x20/0x20 [ 190.089074][ T6252] ? __kernel_text_address+0x9a/0x100 [ 190.094432][ T6252] ? _raw_spin_unlock_irqrestore+0x82/0x120 [ 190.100341][ T6252] ? lockdep_hardirqs_on+0x94/0x140 [ 190.105552][ T6252] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 190.111449][ T6252] ? _raw_spin_unlock+0x40/0x40 [ 190.116325][ T6252] ? stack_trace_save+0xa6/0xf0 [ 190.121197][ T6252] ? netdev_core_pick_tx+0x300/0x300 [ 190.126494][ T6252] sch_frag_xmit_hook+0x2d8/0x1be0 [ 190.131624][ T6252] ? __kasan_slab_alloc+0xa9/0xc0 [ 190.136654][ T6252] ? __kasan_slab_alloc+0x92/0xc0 [ 190.141693][ T6252] ? slab_post_alloc_hook+0x4c/0x380 [ 190.146979][ T6252] ? kmem_cache_alloc+0x15d/0x280 [ 190.152048][ T6252] ? skb_clone+0x1bd/0x350 [ 190.156477][ T6252] ? tcf_mirred_act+0x5b0/0x1640 [ 190.161419][ T6252] ? tcf_action_exec+0x177/0x570 [ 190.166352][ T6252] ? basic_classify+0x1ae/0x2c0 [ 190.171207][ T6252] ? tcf_classify+0x218/0xad0 [ 190.175887][ T6252] ? qfq_enqueue+0x31b/0x1310 [ 190.180567][ T6252] ? dev_qdisc_enqueue+0x48/0x210 [ 190.185596][ T6252] ? __dev_queue_xmit+0xbde/0x2e50 [ 190.190713][ T6252] ? packet_sendmsg+0x3b4f/0x4de0 [ 190.195746][ T6252] ? mq_dump_class_stats+0x430/0x430 [ 190.201034][ T6252] ? do_syscall_64+0x4c/0xa0 [ 190.205643][ T6252] ? entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 190.211731][ T6252] ? __copy_skb_header+0x3ba/0x4f0 [ 190.216851][ T6252] ? memcpy+0x3c/0x60 [ 190.220834][ T6252] ? __copy_skb_header+0x3ba/0x4f0 [ 190.225948][ T6252] ? __skb_clone+0x446/0x6c0 [ 190.230552][ T6252] ? skb_clone+0x1f1/0x350 [ 190.234972][ T6252] ? tcf_mirred_act+0x59a/0x1640 [ 190.239920][ T6252] tcf_mirred_act+0xc5a/0x1640 [ 190.244690][ T6252] tcf_action_exec+0x177/0x570 [ 190.249461][ T6252] basic_classify+0x1ae/0x2c0 [ 190.254144][ T6252] tcf_classify+0x218/0xad0 [ 190.258745][ T6252] qfq_enqueue+0x31b/0x1310 [ 190.263255][ T6252] ? sch_tree_lock+0x110/0x110 [ 190.268026][ T6252] ? do_raw_spin_lock+0x128/0x2f0 [ 190.273057][ T6252] ? __rwlock_init+0x140/0x140 [ 190.277817][ T6252] ? __alloc_skb+0x473/0x750 [ 190.282387][ T6252] dev_qdisc_enqueue+0x48/0x210 [ 190.287222][ T6252] __dev_queue_xmit+0xbde/0x2e50 [ 190.292167][ T6252] ? dev_queue_xmit+0x20/0x20 [ 190.296871][ T6252] ? virtio_net_hdr_to_skb+0xca1/0x1260 [ 190.302503][ T6252] ? packet_cached_dev_get+0x270/0x270 [ 190.307950][ T6252] ? skb_put+0x10e/0x200 [ 190.312252][ T6252] packet_sendmsg+0x3b4f/0x4de0 [ 190.317111][ T6252] ? sched_move_task+0x180/0x4f0 [ 190.322038][ T6252] ? aa_sk_perm+0x7dc/0x910 [ 190.326521][ T6252] ? packet_getsockopt+0x9a0/0x9a0 [ 190.331623][ T6252] ? apparmor_setprocattr+0x42e/0x6a0 [ 190.336996][ T6252] ? apparmor_socket_sendmsg+0x88/0x230 [ 190.342624][ T6252] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 190.347940][ T6252] ? security_socket_sendmsg+0x7c/0xa0 [ 190.353534][ T6252] ? packet_getsockopt+0x9a0/0x9a0 [ 190.358639][ T6252] ____sys_sendmsg+0x5be/0x8f0 [ 190.363393][ T6252] ? __sys_sendmsg_sock+0x30/0x30 [ 190.368407][ T6252] ? import_iovec+0x6f/0xa0 [ 190.373345][ T6252] ___sys_sendmsg+0x236/0x2e0 [ 190.378005][ T6252] ? __sys_sendmsg+0x290/0x290 [ 190.382760][ T6252] __se_sys_sendmsg+0x1b7/0x2a0 [ 190.387593][ T6252] ? __x64_sys_sendmsg+0x80/0x80 [ 190.392515][ T6252] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 190.398528][ T6252] ? lockdep_hardirqs_on+0x94/0x140 [ 190.403726][ T6252] do_syscall_64+0x4c/0xa0 [ 190.408126][ T6252] ? clear_bhb_loop+0x30/0x80 [ 190.412788][ T6252] ? clear_bhb_loop+0x30/0x80 [ 190.417459][ T6252] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 190.423344][ T6252] RIP: 0033:0x7f38ea52d159 [ 190.427740][ T6252] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 190.447331][ T6252] RSP: 002b:00007f38e8785028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 190.455857][ T6252] RAX: ffffffffffffffda RBX: 00007f38ea7b4fa0 RCX: 00007f38ea52d159 [ 190.463815][ T6252] RDX: 0000000000004005 RSI: 0000200000000280 RDI: 0000000000000006 [ 190.471776][ T6252] RBP: 00007f38ea5c406b R08: 0000000000000000 R09: 0000000000000000 [ 190.479743][ T6252] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 190.487693][ T6252] R13: 00007f38ea7b5038 R14: 00007f38ea7b4fa0 R15: 00007ffcd0dc76a8 [ 190.495738][ T6252]