last executing test programs: 16m48.824209764s ago: executing program 32 (id=1379): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x3) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0x12) 15m32.095148292s ago: executing program 33 (id=1536): openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0xa0602, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x154}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4, 0xa22, 0x0, 0x0, 0x1000, 0x2, 0x0, 0x0, 0xe0}}}, &(0x7f0000000480)=0x0) r6 = dup(r0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/diskstats\x00', 0x0, 0x0) r7 = openat$comedi(0xffffff9c, &(0x7f0000000100)='/dev/comedi0\x00', 0x101401, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r8 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r8, &(0x7f0000019680)=""/102392, 0x18ff8) r9 = socket$inet6(0xa, 0x80001, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0xffffffffffffffff, 0x0, &(0x7f0000000680)={&(0x7f0000000000)=ANY=[@ANYBLOB="200000006800010000002000000000000a000000000000000800060000000000"], 0x20}}, 0x0) setsockopt$inet6_MCAST_MSFILTER(r9, 0x29, 0x30, 0x0, 0x310) setsockopt$inet6_group_source_req(r9, 0x29, 0x2b, 0x0, 0x0) r10 = openat(0xffffffffffffff9c, 0x0, 0x50440, 0x29) getpid() setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r10, 0x6, 0x1d, &(0x7f0000000080)={0x2, 0x5, 0x300e, 0x8}, 0x14) rename(0x0, &(0x7f00000000c0)='./file1/file0\x00') sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r7, 0x40946400, &(0x7f0000000140)={'dt2801\x00', [0x294, 0x7, 0x7fffffff, 0x8, 0x4, 0x9, 0xf5, 0x4, 0x8080ffa, 0x5, 0x0, 0x9, 0x0, 0x1000004, 0x1, 0x4, 0xfff7ffa8, 0x7ffffffd, 0x1ef, 0x9, 0x2000000f, 0x55, 0x8, 0x9, 0x4, 0x100008, 0x6, 0x10, 0xee, 0x4, 0x7ffd]}) r11 = syz_open_procfs(0xffffffffffffffff, 0x0) setuid(0xee01) fchown(r11, 0x0, 0xee00) syz_ublk_setup_queues(r6, r5, &(0x7f0000000180)={0x0, 0x3e80, 0x800, 0x1, 0x32c, 0x0, r1}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x200, 0x1006, 0x200015a, 0x0, r1}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7a, 0x40, 0x10001, 0x2a5}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x10000, 0x7, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x2000, 0x2, 0xbe, 0x0, r1}}], 0x1, &(0x7f0000000400)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0x4, 0x5c0, 0x0, 0x0}}, 0x0) 12m43.438747896s ago: executing program 34 (id=1985): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x549}) move_pages(0x0, 0x20000000000000fe, &(0x7f0000000080)=[&(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil], 0x0, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000000)={&(0x7f000011c000/0x2000)=nil, 0x2000}) 10m4.402988354s ago: executing program 8 (id=2374): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x1, 0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000740)={0x2c, &(0x7f0000000340)=ANY=[], 0x0, 0x0, 0x0, 0x0}) 9m58.942120914s ago: executing program 8 (id=2386): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, 0x0, 0x0) close(r0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./sys/block/md0/md/metadata_version\x00', 0x1, 0x0) write(r1, &(0x7f0000000700)='none\n', 0x5) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000800)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r2, &(0x7f0000000900)='raid1\n', 0x6) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r3, &(0x7f0000000b00)='2\n', 0x2) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000c00)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r4, &(0x7f0000000d00)='1:0\n', 0x4) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000e00)='./sys/block/md0/md/dev-ram0/slot\x00', 0x1, 0x0) write(r5, &(0x7f0000000f00)='0\n', 0x2) close(r5) r6 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r6, &(0x7f0000001100)='active\n', 0x7) close(r6) r7 = openat(0xffffffffffffff9c, &(0x7f0000001200)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r7, &(0x7f0000001300)='1:1', 0x3) close(r7) nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./sys/block/md0/md/dev-ram1/slot\x00', 0x1, 0x0) write(r8, 0x0, 0x0) close(r8) 9m56.824020651s ago: executing program 8 (id=2394): r0 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r0, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, 0x0, 0xa4242, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x6) r1 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x0, 0x10, 0x1, 0x80000ff}, &(0x7f0000000140)=0x0, &(0x7f0000000300)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r2, r3, r4, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x54}}) io_uring_enter(r1, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0) 9m56.005246122s ago: executing program 8 (id=2396): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f00000012c0)={0x5, 0xb4a}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x50) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080), 0xc) ptrace$poke(0x4, 0x0, &(0x7f00000010c0), 0x0) connect$inet(r1, &(0x7f0000000280)={0x2, 0x4e20, @local}, 0x10) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000001140), 0x2, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(r2, 0x7a0, &(0x7f0000000140)={@host}) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r2, 0x7a8, &(0x7f0000000340)={{@host}, @host, 0x0, 0x6, 0x244c, 0xffffffffffffffff, 0x101, 0x0, 0xfffffffc}) 9m53.886131412s ago: executing program 8 (id=2399): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x20, 0x0, 0x4, {0x1, 0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000980)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000740)={0x2c, &(0x7f0000000340)=ANY=[], 0x0, 0x0, 0x0, 0x0}) 9m48.267332889s ago: executing program 8 (id=2415): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, 0x0, 0x80) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r1 = syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x109301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) r2 = socket$inet(0xa, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x44, 0x6, 0x410, 0x138, 0x98, 0x138, 0x0, 0x0, 0x378, 0x378, 0x378, 0x378, 0x378, 0x6, 0x0, {[{{@ip={@loopback, @multicast1=0xe0007600, 0x0, 0x0, 'gre0\x00', 'ip6gre0\x00', {}, {}, 0x0, 0x0, 0x11}, 0x7a00, 0x70, 0x98}, @inet=@DSCP={0x28, 'DSCP\x00', 0x0, {0x3}}}, {{@ip={@multicast1, @local, 0x0, 0x0, 'wg1\x00', 'nicvf0\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb8, 0x100, 0x0, {}, [@common=@unspec=@limit={{0x48}, {0x0, 0x28, 0x9, 0x0, 0x0, 0x1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private2, 'veth0_virt_wifi\x00', {0x7}}}}, {{@ip={@rand_addr, @private, 0xffffffff, 0xff, 'syzkaller0\x00', 'veth1_to_team\x00', {}, {0xff}}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@ip={@empty, @empty, 0xff000000, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x1fb, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x470) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 9m32.460940667s ago: executing program 35 (id=2415): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, 0x0, 0x80) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r1 = syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x109301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r1, 0x8108551b, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000, 0x2, 0x2172, 0xffffffffffffffff, 0x0) r2 = socket$inet(0xa, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f00000002c0)=@mangle={'mangle\x00', 0x44, 0x6, 0x410, 0x138, 0x98, 0x138, 0x0, 0x0, 0x378, 0x378, 0x378, 0x378, 0x378, 0x6, 0x0, {[{{@ip={@loopback, @multicast1=0xe0007600, 0x0, 0x0, 'gre0\x00', 'ip6gre0\x00', {}, {}, 0x0, 0x0, 0x11}, 0x7a00, 0x70, 0x98}, @inet=@DSCP={0x28, 'DSCP\x00', 0x0, {0x3}}}, {{@ip={@multicast1, @local, 0x0, 0x0, 'wg1\x00', 'nicvf0\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb8, 0x100, 0x0, {}, [@common=@unspec=@limit={{0x48}, {0x0, 0x28, 0x9, 0x0, 0x0, 0x1}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@private2, 'veth0_virt_wifi\x00', {0x7}}}}, {{@ip={@rand_addr, @private, 0xffffffff, 0xff, 'syzkaller0\x00', 'veth1_to_team\x00', {}, {0xff}}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@ip={@empty, @empty, 0xff000000, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x1fb, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x470) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 4m37.146030154s ago: executing program 9 (id=3142): mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f0000000100)='ext4\x00', 0x80c010, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x18d042, 0x15) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$FUSE_INIT(r1, 0x0, 0x0) fallocate(r0, 0x0, 0x3, 0x8) 4m32.356438401s ago: executing program 9 (id=3152): syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000040)='./file1\x00', 0x815, &(0x7f0000000180)={[{@data_err_ignore}, {@resgid}, {@abort}, {@barrier_val={'barrier', 0x3d, 0x1}}, {@nobarrier}]}, 0x9, 0x624, &(0x7f0000001340)="$eJzs3ctvVNUfAPDvvZ0+aH8/W4hB2UgTYyBRWlrAEGMixC0h+Ni5qrQQpFBCa7RIQklwozFuXJi4ciH+F0ri1oVbF25cGEPSGMNCDMqYO71TZjqddvqYmT4+n+S299G553vbfHvOnDnn3gB2rcHsSxpxICKuJRH9FccKkR8cXPi5B3/ePJ8tSRSLb/2RxM1byVzluZL8e1/+4n/7I/kpjdjXUVvu9OyNy2OTkxPX8+3hmSvXhqdnbxy5dGXs4sTFiaujL4+ePHH8xMmRoxu6vkLF+pk7733Q/8nZd7756lEy8u0vZ5M4FY/z2LLrWvra7g2VnP3OBqO44OGTvWnp68kNnnur+Ku/+necSZbuYMu6EBH7I6IzIp6J/uio+Gv2x8dvtDU4oKmKSZTrKGDXSVbP/87aXT3NCQZooXI7oPzefrn3wbXSJrdKgFaYP73QSbaQ+50RUc7/wkLfYPSU+gZ6HyRV/TxJRGysZ25BVsaPP5y9ky1Rpx8OaI652+Ve7qX1f1LKzYHoKW31Pkir8j+tWLL9b66z/MEl2/IfWmfudkQ8m9f/XbHu/H93neXLfwAAAAAAANg8905HxEvLjf9LF8f/dC0z/qcvIk5tQvmrf/6X3s9Xkk0oDqgwfzri1Zrxv/9Ujg4e6Mg/5/9/aTxAZ3rh0uTE0Yh4KiIOR2d3tj1SfdqqAcJHPtv3Zb3yK8f/ZUtWfnksYH6q+4UlE3HHx2bGNufqYXebvx3xsDT+92C+p3r8T1b/JzX1/6evZwl+rcEy9r1w91zVjt+e/HtYPf+BZil+HXFo2fk/T5rbycr35xgutQeGy62CWs999Pl39cqX/9A+Wf3fu3L+dyeV9+uZXtv5uyLi2GyhWO/4etv/XcnbHeXzZz4cm5m5PhLRlZyp3T+6tphhpyrnQzlfsvw//PzK/X+L7f+KPNwTEXMNlrn/cd+v9Y6p/6F9svwfX7n+H6iu/9e60hOjdwe+z28xVuNcQ/X/8VKdfjjfo/8PKtXej6PRBG1LuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwzaUR8b9I0qHF9TQdGoroi4inozednJqeefHC1PtXx7Nj1c//71/YTsrP/x+o2B5dsn0sIvZGxBcde0rbQ+enJsfbffEAAAAAAAAAAAAAAAAAAACwRfSV5vwXu5fO/8/83tHu6ICmK+Tf5TvsPoV1v7LYvamBAC23/vwHtrvG87+zqXEArVc//x8+Kpa0NByghbT/YfdaZ/77uAB2APU/7FYN9un1NDsOoB0arv/nmxsHAAAAAACwKfYevPdzEhFzr+wpLZmu/JjB/rCzpe0OAGgbY3hh9ypMtTsCoF28xweSxbW/l53sX3/0f9KcgAAAAAAAAAAAAACAGocOrH3+/5xJg7AjpBErPMLb2H7YyVaoypdLfjU/7CD1H/3RSN2faCHANmb+P7BaPb7x+f/FW2sKCAAAAAAAAAAAAACo1XPj8tjk5MT16dntt/La1ghjbStzY1sijE1debzaz5QfM7+2M3dGxNa4wFavlG/B0cYw2vg/CQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqPJfAAAA//8MwS/R") sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x44}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) recvfrom$inet(0xffffffffffffffff, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b7000000df000000bfa300000000000007030000f0ffffff720af0fff8ffffff79a4f0ff000000005d040200000000001d400500000000004704000001ed0000620300ff000000003e440000000000007a0a00fe00ffffffc30300fff1000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a1074649c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c0dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6acdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fed000000007baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca485683252b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a0032f37ff559be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e"], &(0x7f00000001c0)='GPL\x00', 0xf, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) 4m25.700667549s ago: executing program 9 (id=3160): syz_usb_connect(0x6, 0x371, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) mkdir(&(0x7f0000000540)='./sys\x00', 0x0) mkdirat(0xffffffffffffffff, 0x0, 0x1f7) read$usbfs(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000000), 0x0) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:01.0/remove\x00', 0x1, 0x0) write(r1, &(0x7f00000000c0)='1', 0x1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/pci/rescan\x00', 0x1, 0x0) write(r2, &(0x7f0000000700)="3100d90daaa91f198d99db922334963f621e49a6ca0b870113948d1bd6e243e5da22cf2ba7bca0e3865eaa6666cca12e329a784c6e63a08e7d57f2e2a6fa1f85d8a30f16645140e37208d917f43c0e86486bb3e9fd67f758c7f029fcbacd68c67fd996ba", 0x64) 4m21.35076092s ago: executing program 9 (id=3166): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) connect(0xffffffffffffffff, &(0x7f0000000100)=@in6={0xa, 0x4e22, 0x8001, @dev={0xfe, 0x80, '\x00', 0x2c}, 0xa007}, 0x80) r1 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) pwritev(r1, &(0x7f0000000200)=[{&(0x7f0000000000)='0', 0x1}], 0x1, 0x8000, 0x1) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) clock_adjtime(0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[], 0x58}}, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) write(r2, &(0x7f0000001f00)="ef97646110265cf65eda0c997a00976ca6b72e643a4d71f06f4e112955fa9b595e718de352b21791dd333109ee5f4b0fb02caaf507c2e7aaf9adb3662a145451969da96427a09e58c069ef95473af4dfefeed6e3ecc1e724936fecd6c2d606b30eeb8c15e39738cf1338fc4643c5a3f0b5775b1834a7dd01e491668a1139efd38a9f014a061561e5bbde8983024934a373050000000000000011c31f288d48baed9dfb44bd33dba6bd292aad455d53d0c6f09126b38f54e663", 0xb9) syz_open_dev$vcsn(&(0x7f0000000040), 0x5, 0x800440) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f00000000c0)={0x2, {0x2, 0x3bf, 0xf88, 0x14a}}) 4m18.422002983s ago: executing program 9 (id=3174): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000002c0)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r1, 0x0, 0x20040084) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000640)=@newtfilter={0x3c, 0x2c, 0xe3f, 0x30bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xb, 0x3}, {}, {0x8, 0x9}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x0, 0xfff1}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x0) 4m13.532282585s ago: executing program 9 (id=3180): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r3 = io_uring_setup(0xa0, &(0x7f0000000080)={0x0, 0xb9d8, 0x2}) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) 3m57.496927345s ago: executing program 36 (id=3180): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r3 = io_uring_setup(0xa0, &(0x7f0000000080)={0x0, 0xb9d8, 0x2}) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) 1m47.346669067s ago: executing program 6 (id=3529): openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x2008800, &(0x7f0000000440)={{}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(0xffffffffffffffff, &(0x7f0000004140)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_DIRENTPLUS(0xffffffffffffffff, &(0x7f00000004c0)={0x10, 0x0, r0}, 0x10) statfs(&(0x7f0000000000)='./file0\x00', 0x0) 1m46.789425838s ago: executing program 6 (id=3532): syz_open_dev$usbmon(&(0x7f0000000900), 0x7, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev\x00', 0x1ff) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount(&(0x7f0000000300)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f00000001c0)='ext4\x00', 0x2008c00, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') write$binfmt_register(0xffffffffffffffff, &(0x7f0000000180)={0x3a, 'syz2', 0x3a, 'M', 0x3a, 0xfffffffffffffffb, 0x3a, '\xa2%:', 0x3a, '', 0x3a, './dev/sda1', 0x3a, [0x43]}, 0x2e) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101842, 0x1) r0 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) ftruncate(r0, 0x2007ffb) 1m45.14486097s ago: executing program 6 (id=3536): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) connect(0xffffffffffffffff, &(0x7f0000000100)=@in6={0xa, 0x4e22, 0x8001, @dev={0xfe, 0x80, '\x00', 0x2c}, 0xa007}, 0x80) r1 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) pwritev(r1, &(0x7f0000000200)=[{&(0x7f0000000000)='0', 0x1}], 0x1, 0x8000, 0x1) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) clock_adjtime(0x0, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) bind$inet6(0xffffffffffffffff, 0x0, 0x0) write(r2, &(0x7f0000001f00)="ef97646110265cf65eda0c997a00976ca6b72e643a4d71f06f4e112955fa9b595e718de352b21791dd333109ee5f4b0fb02caaf507c2e7aaf9adb3662a145451969da96427a09e58c069ef95473af4dfefeed6e3ecc1e724936fecd6c2d606b30eeb8c15e39738cf1338fc4643c5a3f0b5775b1834a7dd01e491668a1139efd38a9f014a061561e5bbde8983024934a373050000000000000011c31f288d48baed9dfb44bd33dba6bd292aad455d53d0c6f09126b38f54e663", 0xb9) syz_open_dev$vcsn(&(0x7f0000000040), 0x5, 0x800440) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f00000000c0)={0x2, {0x2, 0x3bf, 0xf88, 0x14a}}) 1m43.326683359s ago: executing program 4 (id=3542): syz_usb_connect$cdc_ncm(0x4, 0x6e, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000020000002505a1a440000102030109025c0002010000000904000001a3f45747d649f9a30105240000000d240f81000000"], 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010c001ddf8208c007121522300000000109021b0001000000010904010001faf48d00090582"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000002, 0x10012, r1, 0x0) write$char_usb(r0, &(0x7f0000001300)="92", 0x2) 1m40.888959607s ago: executing program 4 (id=3547): syz_open_dev$usbmon(&(0x7f0000000900), 0x7, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev\x00', 0x1ff) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount(&(0x7f0000000300)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f00000001c0)='ext4\x00', 0x2008c00, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') write$binfmt_register(0xffffffffffffffff, &(0x7f0000000180)={0x3a, 'syz2', 0x3a, 'M', 0x3a, 0xfffffffffffffffb, 0x3a, '\xa2%:', 0x3a, '', 0x3a, './dev/sda1', 0x3a, [0x43]}, 0x2e) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101842, 0x1) r0 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) ftruncate(r0, 0x2007ffb) 1m38.595762282s ago: executing program 6 (id=3557): syz_mount_image$vfat(&(0x7f0000000380), &(0x7f0000000e80)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x4000, &(0x7f00000000c0)=ANY=[@ANYBLOB='uni_xlate=0,iocharset=ep866,errors=continue,utf8=0,shortname=mixed,shortname=win95,nonumtail=0,uni_xlate=1,iocharset=cp857,shortname=mixed,utf8=1,uni_xlate=0,shortname=win95,codepage=936,utf8=1,utf8=0,\x00'], 0xfd, 0x2a8, &(0x7f0000000580)="$eJzs3c9qK1UcB/DfpGkSdZEsXInigC5cXW7vE6RIL1zMSslCXah4b0GaILRQ8A/GrgRXblz6BILQnS/hxjfwAQR3dlE4MslMk9Q07UDT+ufz2fT0nPOd8zuTaUsXOfnw5fHB0zz2T778LTqdLBr96MdZFr1oROXrWNL/LgCAf7OzlOKPNFMnl0VEZ3NlAQAbVPvv/+nGSwIANuydd997a3cw2Hs7zzvxePzN8bD4z774Ohvf3Y9PYhTP4mF04zwiXZi1H6eUJs280IvXx5PjYZEcf/BLef3d3yOm+Z3oRm/atZx/MtjbyWcW8pOijufL9ftF/lF048UV6z8Z7D1akY9hK954baH+B9GNXz+OT2MUT6dFzPNf7eT5m+n7P794vyivyGeT42F7Om8ubd3xSwMAAAAAAAAAAAAAAAAAAAAAwH/Yg/LsnHZMz+8pusrzd7bOi2+2I6/0ls/nmeWz6kKXzgeapPihOl/nYZ7nqZw4zzfjpWY072fXAAAAAAAAAAAAAAAAAAAA8M9y9NnnBx+NRs8Ob6VRnQZQva2//nVOp6n+Qs+rsT7Vnq/VKJtrloitak4WsbaeYhO3dFuuazx3Vc0//lT3gp3r52wXa3VucRfVy73QE1VPtvoeti8md6qH5OeqJ6WUWnHD1VtXDaVaj19r5VC39t1ovTBtTNbMieyqwr59Zf5zWQ5ll3fRWrrPS43tsrEQv/Rs1Hqe//67InNaBwAAAAAAAAAAAAAAAAAAbNT8Tb8rBk/WRhupvbGyAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBOzT//v0ZjUoZvMLkVh0f3vEUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD+B/4KAAD//+KpXP8=") seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x6, 0x3, 0x7ffcfffc}]}) syz_clone3(&(0x7f0000000080)={0x180801400, &(0x7f0000000000)=0xffffffffffffffff, 0x0, 0x0, {0x3d}, 0x0, 0x0, 0x0, 0x0}, 0x58) pidfd_send_signal(r0, 0x21, 0x0, 0x0) process_mrelease(r0, 0x0) 1m36.232831945s ago: executing program 6 (id=3560): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(0x0, 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x14, r1, 0x1, 0xffffffff, 0x400000}, 0x14}, 0x1, 0x620b}, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x3, 0x3, &(0x7f0000000140)=@framed={{0x18, 0x6, 0x0, 0x0, 0x7056}}, &(0x7f00000000c0)='GPL\x00', 0x6}, 0x94) r6 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r6, &(0x7f0000000240)={0xa, 0x0, 0x0, @dev, 0x2}, 0x1c) sendmmsg$inet6(r6, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x0) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f00000005c0)={@mcast1, @private2={0xfc, 0x2, '\x00', 0x1}, @remote, 0x1, 0x2, 0x5, 0x400, 0xb8, 0xd30048}) 1m35.313992517s ago: executing program 6 (id=3562): r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0x30bd, 0xc000, 0x8, 0x40000183}) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 1m33.960070195s ago: executing program 37 (id=3562): r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0x30bd, 0xc000, 0x8, 0x40000183}) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 59.919374206s ago: executing program 2 (id=3622): r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) syz_emit_ethernet(0x36, &(0x7f0000000200)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x0, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x2, 0x0, 0x7}}}}}, 0x0) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, 0x0, 0x1c) syz_emit_ethernet(0x2a, &(0x7f0000001800)={@link_local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x64, 0x0, 0x4, 0x2, 0x0, @empty, @multicast2}, @address_reply={0x12, 0x0, 0x0, 0xe0000002}}}}}, 0x0) 59.363006401s ago: executing program 2 (id=3626): syz_open_dev$usbmon(&(0x7f0000000900), 0x7, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./dev\x00', 0x1ff) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x0) mount(&(0x7f0000000300)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', &(0x7f00000001c0)='ext4\x00', 0x2008c00, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(0x0) write$binfmt_register(0xffffffffffffffff, &(0x7f0000000180)={0x3a, 'syz2', 0x3a, 'M', 0x3a, 0xfffffffffffffffb, 0x3a, '\xa2%:', 0x3a, '', 0x3a, './dev/sda1', 0x3a, [0x43]}, 0x2e) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101842, 0x1) r0 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) ftruncate(r0, 0x2007ffb) 58.844182387s ago: executing program 2 (id=3628): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './proc'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) 58.703449316s ago: executing program 2 (id=3629): bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x81899, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000180)='./file0/../file0\x00', &(0x7f0000000300)='./file0/file0\x00', 0x0, 0x18d883, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000340)='./file0/../file0\x00', 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r1, &(0x7f0000002380)={0x2020}, 0x2020) 57.21748463s ago: executing program 2 (id=3634): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='ramfs\x00', 0x1000010, 0x0) syz_mount_image$fuse(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x400a8, &(0x7f0000000380)=ANY=[], 0x5, 0x0, 0x0) symlinkat(&(0x7f0000000080)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100), 0x800000, 0x0) mount$bind(&(0x7f0000000480)='./file0/file0\x00', &(0x7f0000000340)='./file0\x00', 0x0, 0xa1c08, 0x0) 55.836890633s ago: executing program 2 (id=3639): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './proc'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f00000002c0)={r0, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) 54.811233504s ago: executing program 38 (id=3639): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x180) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000200)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './proc'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f00000002c0)={r0, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) 18.489757202s ago: executing program 1 (id=3773): r0 = userfaultfd(0x0) ioctl$BTRFS_IOC_TREE_SEARCH(0xffffffffffffffff, 0xd0009411, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP(r0, 0xd0009412, &(0x7f0000001540)={0x0, 0x81}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[], 0x1d) bpf$MAP_CREATE(0x0, 0x0, 0x48) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)={0x14, 0x0, 0x1, 0x70bd28}, 0x14}, 0x1, 0x0, 0x0, 0x40048d0}, 0x40000) setsockopt$MRT_DEL_MFC_PROXY(0xffffffffffffffff, 0x0, 0xd3, &(0x7f00000000c0)={@empty, @local, 0xffffffffffffffff, "cae5c66b00e4bfdb8ea8fbabf2121dc8b1f8567a2939f7e3b4927f49a62f1a25", 0xfffffff5, 0x4, 0x8e, 0x9}, 0x3c) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r5, 0x29, 0xb, &(0x7f0000000040)=0x9, 0x4) bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r5, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) setsockopt$inet6_int(r5, 0x29, 0x42, &(0x7f0000000100)=0x5, 0x4) sendto$inet6(r5, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000000c0)={r1, 0x0, 0x0}, 0x20) prctl$PR_SCHED_CORE(0x3e, 0x0, r2, 0x3, 0x0) 14.753886643s ago: executing program 3 (id=3787): openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x1c3, 0x2f) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0/file1\x00', 0x40, 0x83) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000480)=ANY=[@ANYBLOB="03570000000000000100000001000000060000000000000003000000000000000180000000000000090000000000000006000000000000000000000000000000000000000000000080000000000000000000000000000000070000000000000057e68c4400000000010001000000000000000000"]) 14.380838419s ago: executing program 3 (id=3789): mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x298}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) 13.918120501s ago: executing program 3 (id=3791): mkdirat(0xffffffffffffff9c, 0x0, 0xe) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) chdir(&(0x7f0000000040)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000002280)=ANY=[], 0x0, 0x0, 0x0) setresuid(0x0, 0xee00, 0x0) listxattr(&(0x7f00000004c0)='./bus\x00', 0x0, 0x0) 13.518531016s ago: executing program 3 (id=3793): syz_mount_image$fuse(0x0, &(0x7f00000002c0)='./file0\x00', 0x11000a0, 0x0, 0xfe, 0x0, 0x0) r0 = openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000002c0)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000080)={0x50, 0x0, r1, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9}}, 0x50) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x18) syz_fuse_handle_req(r0, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x4}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r0, &(0x7f00000063c0)="99529ca7d265e2dba44891e35e7d5dab7921b730436ecd4e999a25bcf86a25f8f029c0dd50373e90b7cf7779b12ecd4423c5b13cfac186975cd723976f3c747612913029d42517c189364bc59d8ebad53ed1b86f8f66c99b1f9b5b40d78cef1f14f81815d53bdca7fef40607358db69eb8c0b1f6b0942ab4b1ee7ca8deb4eddef06381a3d1c52d6147fc5109c7c607591497a6b2477f60cc881d3219c96bffb34aadec3fa97250713cce17cd536721bf9c40a019531ed0bbad139e26a3d4d39b68ab1bf37cb1a4bd197a8789cb1940cd86d9e56713bc36c7cffd07a311f5bc2e91f16d152eb480645e85ec9b3bf09c7fa140dced0afd55d7b99e90a96e7748e2d0dc09631efe1783769819c182ca106f6184bcbb387ed246c43562d74c36ac3a7ec2f0e11f70bad0007c03bb9c0d2dacc2148cce4a4aea327c7319016ad146b52bfae0357f9e892e9bec61a13c93551cfa3d4f4bfa7585c93bb0bef01a9114f3dc54179cf9a57fe88f5cff3403e33c9d09e3e9c2e10f1f16894e1b59e3cad47c1f202cf7b756f2851fc96d09459c9a8d34c19e6a3525cd5001aac5181f57286d0e1e88ce5092c7c76b6abdaebf2c499aa47587b48eb12a2b72548c190b0324ebedb81a63333b6edb25550f859c5ccc404a944ff7f61af8800888192fbd4c8e0e417d1d181b4b335a6f52e0a7dae18397e81e3f747cab7be902ed903bdd6a622f178f9b4244718ee1206237257374d2fd1466ab6135ef7ef4a114ae170eafe9cd78cf9ffc36974cbc4b8003072bed78765a0b9f1240f24dec6a9e46db9bb498d40f727c0cbf8f4a6a49539bd0805caf65d80130d7fb60a69dc7ed890874a17530c042cf33a977d331435d68ef33885f638c777ad49564ca77d8b81ddd853a21cd55d95b627310dd633a4f005853a5506cd8f744c367f3cb6998b0fa97de6bb35b166b0c6408c4e0a38ed26235a88520c38ca97ac8a6dc81e6dc6483d383fa09f198997b8eea1c68c9e3320683c9a02dd89ddc34c241e7294ccc88d6b35762892e8746e558bfbc2251949f2ecb763dad5b975eaf36e2864be6a41d3e20514d32f5d4b6350dc7e3cc3a85428ea98efb3b1edc2a2ec1e618452949cc7e2ba1251990168fee342d4f304b7a7af9162bcbe6b09c75d7420d2c547b4e3cee1836df6eddd5dff73a4e308fcd8eaa7a33e6980a6f8ead03257a37d72d3b265d02fa42f57db877654ed513e31c35e1af0bd28511d6b57cfe07b27cbe9767a534b426dfc3dd257d5899444f34cbf4dc74b9eab2e7e3e1e1a8a6ac5e4359d653506b299a5b7c67b92dc462f1216655f952362a3387ad9966b606d98e8d1b544dc27dc6bc78fd18a446736e25c51143db9886b6c09812d5825b5d9e0932f218ff8bea4d9e1c4df9c9d4eb19336d48163a921c4ff1f0beef26b01b7e8c0d23fb59b84e229eaabb791f2cffc9aa4db75162cbfe4c9ae8d76a5b6bc4bff20e3f8f125b9aadb3e728d7f78d61fd55f46b7f59511b876e6563256686e44f25cf38d393a9b762bada272eba8df28e4086c4cd2fe3c9fab97756fb145373e6ca1991bb1ee6589e49c821ff29f047970819f88f724bd077cd3f0ae463d99b3e53078431e3f9bebabc5289a65479359efe3909186aac60a29f561de8c590988c913c9e693ab8106e8287f6565eee6735f7c88cad7124d1c8d9ff347e97912824088ee954de01c6d8a06447f06899607eadbfd078bc3df506252005749378dbd7399c9eca60b81dc0d88dedec31e5cf6e7b6d6d411958df8f9e0bf4443e8d3bdfe49d05f811d17088024d0629fc8ab8e05e309bf55e8e60d342623765f4e8d2dc4a90291cd4354ff9568c8170e6ea56e028bcf2719595253adb8c84050bb9ce4927a1c1f4560da87d109ceda90bbe45a1717763d8025f1ff40f157185ddf17079da272ae10c4f34162caf4b0d31221a57b3059fd449c87554d968a54b2eebd760dc3263c40d9eedf5905d5699d29706ea6e9e81ff2bf92489a06deffe7e978661f37a88450783e23f107c2bfce000dfc91c5fca49e46d9ea978f215a45984699f0d2503b30a741e13be56b7abe3e5663c0825c3cb04ead44ce97719c4ee6f4cdd3c452775ad7163d5c9034583cc2dbc2b0c04917a3e1aa3d0a8bb6fcf94d7922eb1d543c09185827aeb1b72ae7103ef2c014af2ff4b47fca40fb0e66ddf0264476d7a84e9b8dc551d4c407bdbac6757f7a25bd404b45bec1091696203cc438860131ad5f2fd80e3c45629864dd9f7d302b66fb8fb86735c9a6dcf8b135a273dd2ae9473bc905081be9fcb8f91b1ddba1ac692798dac0b9ccffe0319a779f5e10c65f294b22fe475283b023f9cd890e92c5447b1bc1528255c5af383bc1fb6e72cb9a67215a9e25cde63c89baa8c7125c7e8b748b728d07d9cb66778404f54e6a9e3ae1ae82f3d0ce77199f23f94a01b71b805b476fedbebeb52c83a1b857f23ba438c56a6c4c2a5909f721e6e3d240e4a16455e92220d13022ce7ec0b1365ba4e67aa6ecb324f8826579e12cebdfc0d8af63e83b5e5624d5b791f99093f9a27f7baea9fd10111209c0857a04f07408111063ef34026aee27a3d51b40e53883f9094402534bdd21cc49d7f5593e99cb204cd805bee4add0f82cf4b6dc5da14d6b79fbc68c9ccf7fb5fe774f8879e13079b024a8ad24bf123c420d630837a84ba05abf0ae4dc3fc04f25c7f74ff91d0d609c958642a48551e51b5c0074a56a7da10ce153b08cabea636f8489d8e7b655758a41d7f7474c9d76bf4d54d789bfceaffef139854065de6a94b0275a9626aab99ae838364b1a491e55017e4212b6b01f7a41bc9c215ecd17c49a8610db28c699259c58b81a0e84c45fd8e719c05c48501c49e8a6515044d247f5849190bf22fd6ae31f45339d1f801196d426c52269b1aaffaf18e2a03760bb231cb7cefa6d72f1d7eb6a3bbd65d0914221b8fbf531dbd562eb4a1b28983ac7d83d4813b10b34c9525ba644f61a2c4800d4fe96a7bca63da1041ed73cc57fb9d42f9dfc8ca41d80292bbb311c89b0a0fcee1d88a025a7416863342aea00e6f049cb2ddebd17c5c617ff562a8af0c965cbe8341431a30ea239e4a62aa2b19757a3b0de04229a9907f8610c27b26591405845bf8b5b83706ed18d910c4f68777378366ff565617b19168a04560a32ce5ad64aaef9f4377118c4335b24826cdf8ff8fb4bdb11498553f56d8dfeb3a482c70cc6580c399b92339cbdb3464fcc7b00e9839fd0d2b8b6db90c56b33593a0048bf7983421f29b1285c81a239045b96a9b0cacd70d6d9853206471f06915efc8d3ec4c50fb13601abc73247a656066fd7b329159b3ce9e3302b4c0d6aec58cb0946a8ee8e7f55f1af604f1edb4d887fa6292dc0ce57705c1a25dc62650c127d11a364b397aefc2fcc3a164bdc53165a461b01de9180c1461b309c75af0911b4cc1b8aa05652b62119c87b4b235c573aa15b1516cddf61efd6a7f8c953fbaaee9c0e800e8f519e1494de850ddb976864088fe0cf90bbc54395078ea2501e8baa84d6807e184105bc2a140b663416496886422643bbf764d406af06e7d086678828defda0b648b25666b7b5ea29e927141740d5be0e61bf25d40b8404ffd3c67bb855b11d4faf82b7b8051615c101c3deb0601a0fa9ecd8b4a95082ccbc8222b0982802dd8430e653d6eea2786dc3a91397135faffdc65a5bae048f5c463b1a6648becce961d39d063d28d1ad6dafcea0b0878379adb16cc0d4cea572abeacd9a168a4fe2e338092b5bc93ecf02ac6ccda03e5b23adf511fdf7a79442093233b79c67d3fdd3c36c96a8f67aa79e4743d99cf963ae6161877f73656eb0314d889f4b8649bbce8a759f90eac6c006197b54b2bbac7c9b237f1e3dc099c62a65481960e6ad697fc66316ac084ba99c60f58bf44ff45f3b2006cbc4196a25f124dfaf247e863a855ef6070deb45219a922dcf2be9bd01c340e1ca5ed7c3ddac9f7a677c5d00610991d21e0751ac8044585b39f3fec5b672a11a9bce32196c2003d01ea50b0f0403e16df188ecbbb74f295f01398363ddfecdb63a49347c912c125670205d7b6be999688df85bb7d5ac12b62b4fdc4eadcc2a9a7897028404f697b007603a0ad588c772952d6670ee870771774ad157c0b9cccd4b2192d835606198ea0c65036ae4e406cdc539ff3aa81fa20b7ab58d6f3abdb69cc1f503d593f7025d2035e7f21db76336efc2843a0dc9bd2eb8794718134ee68fc57d4d2bcc18969d08177f442b87433b48540c661940cf9e2462c53efa310c7e47487deab2ae15b1978ef05aa1e14110943f649d82486f710a39854409e74edcaf06b4a92d3580b9cdabf83c6351657698d3d5af7514f382e75d1c912cded577258603fc9ed002e010747cddf7885d34afc9a84d82696c6660cb5ecafb68b564908fc49c4db6a187d037241a26b1141cf20f2e968a53366db0f60b79cd98cf3c897c50b7b9728e6e7100f99e4d5ed2428dbd285516ca6660777a39b4b2617c1be5b0232d60b9c8099f5daedbf190109439c40b46090985200d6c0501313f3fa4d244864575c275faca47aeff32c7b3e3c59392618562a7c2d4b3af85a37a8847f595352024cb63d3a9085c2a502c6a3248f43c5fc828e636cb634b2d393d853ae2dc9605985cf85c060860a90256c7b574c1e01c320687a2bb0b2d51cc2950c485f2ffa5db0ad7aaf753f543de7f86efb775c6bac2989a33757a28836fd27f9347229a0004bd2e546994c69c678fe5717f613f905d945c072004c3a80e0e54215e19ff9972521890d4e705e429f16fc35fe5a15f2e6b75cd719d38f76b087b62e4b5dcdb35f4baa2bab167150bafb6c69e260ca51004bc826d46b77c3f67eaa08497294868e6d91b7b867e4da62052f4f891677256cfbaf19cf32bad99a7da69d8a66537686f89a58d78c7eeaa99cd38009a1a32582bedc5c718e57b19cd405ae659a89909356a07fcef89384d160fa5ae6683cc379642aea4f0c915f72d679bd521399cb16112f2abdede3001400b4a64d2173e153a68631183679b56b8f389ba889784133453a7e892fd3b092f5040870a3cfd6f982990143e7c0882b4ff4c5d049192d36925a25ae4be441aa30dc7e74398b340c45b52c73ed3b0cd640e3cc9fd4be24e7355f386106f65895f1ee850b2a781d1d1d322ca5a3b0fdb78ce1eda048ece94af25437969c99c58c08f1446ca5541e03987a20fd75283e3e116dc4c9222ab7522e4ccf6da14aef49cac9a6a2cd4aba1c54d49e6da4179a66b84e384cd3da53908579b28c11d525ebdc4dc69074cef8a9ecd3aab98f2858769d656b46141c3a4e69a5ed6c0a732c9ec1fce080ea5dcc1dcb9d623c3c44ba9c931f555d193e475ffafd20c53ccbab607c1a15fd06742a64691205eb0d00f7f40e4dd8efb279cf09b2522aac0729a631aacb92d5cfa2ce6bb07385b981890b5916755d5cc3a51c8c36bd2987068cc24fcf73840895469bbb9aff1059601f771afedf0a48d5921103920515b27d7e607951982feba197df8c61600feb3622b9eea13a4db4068728cb98cca76cfae197f6258758490bf41673ee29acd91fd296ec863c646e0ca6a0f0e9de146c663ba13d962964d7c32804fd12a14c1ca7212ad48bdfab469c6570dca562220ecbe7b6b163ed4c9361c5c10bed5c92861b8786ada20a99245d282e4454187ec02adfe354e30647cb10661c85168f7958e3ce69ab48c9455214707a63c9b1167f0845a6bfcce2a96cd53eab430f13cd527f1666290719a47c517cfa22fec2e9916af8aa93c78e567993d7fb8ee60fc4b903b8c67a3658302c5e5f35250c30427e4c055b6c54705bc599861f80b7200d361965ff98c88cc698a2615cadeac4bdfd3d613377cea52d2bbcb7e6b78ac31d4b2c33eaf0b2ed40b963e3cb25c7dfea3ebfe7b4aff2aaaaf184dc80ab649a108e2c830ce7eaea58a263392aa9cd13d7f7bd607dc7c8045201a87311e22062c93896e70f3a5c4b03521300b61cc311ebd5beb9838d0ed207c6bfc99e95804b10b36024f32e1fe1138e9ee7773f797b2bc6be7416f4e9691ef4c2a8d06af6c8b84bd1e6fd1ba3d3183475ef6c139ccf8dcf37671fbb96a2ab5e0e042f7c4728cf30bcc1a0de28a5024276ceaa194b4926e7f6a97b78bac36e47f832d56a96cd266434d37bcf2c2f57877717d91b1854972f832354acc207a2ee8caace7504e0e6197dd7e64a01c4c67bb2de8acc0cccc6c6bff0b0cbfe345542c5a795dfa48cc0990ab5702574d36494bc44c20f5b324f7c984d986cc8cb40cb2550076d96a069b6688d22171beed2dc5b6ff3ede8fff4c4a9de6d3817357a7ca7d24d87300b4545ebbac8cf7f09ec637a4f4d6bd07673709b6c363a75ccef585610c5f15de7851b5ab53e02a757bfc3caeb9a9a8996beffdc0cfd1201b6cd99cb035584e51a6c15a5d2e17d2f8aa6b41e26809392fac6caed1e02a53dcea8a413203608780dab33315a76eba24d540e4c5b9790420834bc8d4e47bc65ae52a54c0ff308427a8d7aff746aa6589d17514e40fee5d0b3533cf4ad2c5f9d96db9f50bd69ed8c92b860e199a35cf268c66ed13516a3b4b024f62d4b2a656067eece95575bdb4907efc488a9821bc3a9c81dd11b2128b7a01aa7a9ce6e73de3b4e9beced70206f91575baddbcbe5722337953c8016a0f4b62120d776c43b7d1a879b692107954f45acdf8967dcaa994aad4922d4fe093e16c2d0090906f5036af99e50bb09b04e9c9b3b5085abf621297ce203010249cede92e9b66b446b86b43eaaae228dfdd3b4408c12b404bb727f7e969e7da04fc59900112bf8d38af0416dc616e75f167aa1352215f07115a6f4eb6bb5fff6f5c2fc9ab906392036b44090e65fdaf017dc53bc94e0807d679d793df18cc44e6c846d414cef1569530f7692daf91eaaf4ae89fe2522f2c9cf33b6ca508ebcd006bc1a61f0c800553aff9dc7d57200b25ecb83e1e0b8cd29520b63aa649d3f71a62570eee56e03223ddf31f0c04fa686b7f6dd054e7a259d9ba335c2c5b2c508897506c0db7f01878dec1411c33f0af61b81dbcf9ff8bdc0c50044963a79f3ee1462150c6bd03a32dbdfef8d72f0b8b3a395ffb0cc85792e7bc867feb5e312cb64e29e193388e9f173c162f4a1320a6f99ea3795fb77d982605959909a1aa11076fcc779ea6b80ec1bf0edfc2569ec04d15a0bdeebccf3c75393dca5e81663532f8ced12d08e4c2ae6e2954d427c7bf053dc4718f56f453bc88d74045bd2f9747aae9b5298a0de927f1d6b1308f4e1483487f083e71ed09298deb52bb10079b13def7453eb432498069edb5ade70c5c54913684d934a3febf78753ac13300a91f467ff3f6e2f00898f015d08f7739047b321b3eaee5ad8aa7adbf7833f014d8c576a491af9fca6843b327ed513821cb3951b2e67a275225d7af6b382e2f955adaacba5d1fdea2223202dee132b91d5cf381b51da94145255f584a70c5e8d11e06a44afa6599bf3ed0cb61703eba254333af53afac60e54cf6397f9f7302249ab644f0b576c713b15007be1f4f9bb213660bca8a70251472b86669d361ef968f542e81ddbe8f4d2e9cabe8d7bf6a31f14a2cc272963553a424c105e7750437ec5bf316e30ce60b4b0c27ccc1eb27e60f6472fef27654da49905ff9c01b28695310ecd8701aedff25a83da4b7c41995f902bdf070069dcb5060000004710dd66ba8745ae2253cc6b75a038183a0bee21226d48239320efad6727093e4f94bbc2fdcc216200d903c32bb9f16dd17d5dac423ae0696f3decc576b8f1fdce63d0532370af7d1e2fa2ca5c5d17bd88f5e3abb4792dac8689ca13752f83d753b06b037bf5a80a3748983790352775685b0414c9d74849fd217e388f904278ddb6b0abdda941b61579c796e2bb77a9bc363b18642c401faa502a31011544111b6eedaa369976c814773d83220a75f31026d6ad0b8b4298ea6062234db232bc435e096e84f740e55bb14d46ae04af0500aa5bb218aff6c76aa8a8e3140a1b0d6638538fd7f30fa8d992e53abf8af2fbc16b9e8a668c1aac72cea1a746ee5f7f3392a4ec8f1d19f2f426b6069b1cd347cbc38bceba96ce5da49198083403143c740c04639cd1089abb34fe812d85921c47437604f684bca44a1eaa965c0a6e1c1fd1f70ee932af3455b36184cc15934cdb3f28959d37d8fc10696f8ec1e4b0c3d1b9ff74a01b796d1bb68954a3768c8bcec741b3b69da892f8922142b16b2cabb469a9906b34216243fac80374c10e178c5fd36440f8d7a8588a9c2510d86ffa8cb68ce8c330d2111c94724e522f04573dad43bce252eb505d29ca9379a6b281519d38b7174f3ae8f185544f3003c936a7e6b23ca97a313aac6a061caa45fda73522f3061767bb4e33dbe4bde390eb0f07225a8aef939cb6ab2ada10c02527281abad394cd4ea9f59467a08b72047cdb75d7b2b98e5b4542554a60f953ac7a4b980f42518eec05ff2c044549cab0cf33eef36dfbabcbc0300009d898862d2194cfcdd9a713c30bbe52291105193656ea5eb830873ac956469d31689cc3c69edb5cb9a6e31ce3e6fb50ddd4e52ef9fdeacfc0db21e1e83e0d8d0a64f17cacb4dc208a893e7fd8ffa86cfc554dfba3d9fd281115eccb4b9d909f2fbf3fbb66bedd7b5db3f6d4f076f5d8fb54f8832896f8ef6f624162f1dd589be7a8e87dd5065708a8b0bfb18a5c2299f5605ac8a11c1add55b2018e6099380a70bee3e0727ca6ec58928fe6eb3147b47401e8d822eebade713b58335787669e5e0de5d328a1067df4cd9124665bb02ee8adfd1b3618374ef167df1f0fe79456f78aee3da4c1bf397e4637b0cf41a0f4a2910efd02b17bf5f3c15b0084b36fa7d4e85a53e5be366b428244eeba7499c3e54397227928e2ff6e583f332d6f7e8cf4d058f379b58a7d03a4bfa454bb4b6d543804b8970e6a9fe8886179eb418a8ce9e509e8433571f7d32378f2e983fa418c8c91760ec9fb20968e7fc23b7c4ac71693b2576ac0f8ce2020ff1e7a7ff24301b48b544fb29a1ca4f2502daded865e488a16dd33ec67b2eee3025cdc5ef90f253c4b5e0a61d51e495b675c5a1d55b4ba3812c5f44cd08487e61d36b0c2dc32d27333a5ee8a0906bfbcd388bd9389d1509912c0471c7b706a5aff880569a3fb11ac5f14d780deb4c1b1afe30fb6b8daf87b27a4ceb869d587a97f2f5af8d819aa47bbf207db68a6ecbbefb1e109ed0bfbbf3b54fba9e79de8fad9c3bcd3e74b8b92ccea3ff5c558c6cd72d78a711fc39df603bd4aa1439dd302258edd2204e52d7f435c6f552b612fbc321bea971195cd4d8bb033e2a779e239164d7eea6d8fd233b0b9b776246564cfcf44b31a83031a2413bf98a398c9f93da243cef9ce73d81bade8ad551fb0ffa75bc874c11d23ac9d7752f22a0f54c3870f3314a83e64332db810da1ebb288e10c4eb9be9ec037317b8f813e68160a887da3f5c0389510a0734b69ef275e19973b169d340610cf2112e9964cc0566b9b690c3feb36c8526491d3a563f0bead2abbcf0665e048aa3f929351b2f89876580633a403250ae3b5244c8c0e996bf888938dfc8920348d88e272e6eadc7c0387ca1dae228bd620ce3975d43b58758d9412d3065f58c4573ba2557f1d8333ba007709b1239d682f03405b22135757178fb701bbde81d2f8faaa7666c025d8a8bb426dc4b8e61aed79b3b3d3a9b01ee9142772d869677ede166e7a8be8ab84cdd6946b1478ce77ba307a13971cfb24c86c344310f279e38d22254bf4caf83c02e715cb0550e615dc9f8dd2400fa749e3527493c15fb454c158e4c0603ae6e962b7890058ec7c10f0618ee274a15bca6ca9fe5bc5f9e7797c0950299912be9c58463c07d667d4bffe8aa590ae43db08512b40f3d265026bef2facdd508984e5f6d2ac7ef573397f14ed2e2ccdcbe5796e60ae64d173814906d1da5a5bfe8a2a4c5d6bb0b3315b878b4877d0c045f6e6cfa0dfc1ea4de7abe26f2b2d8c93299ed1d83f1b7853c756bfa346cd53b008fec169883983fe0f2405777dd85e17b2e4e8b23432c0dc4c386d67b6597184d0b4b95877362304638484cc0951400f66ee8391dd44417c58b3d46a8345a8049fcd70f7b5f4a6f912e2b18760947c74ef2b732b342878d7e7cc99902de87db36469555fbbfe76189f108d6ab31f4727fe4e22d075afaf6cc726ab17a5e1b4ab6c8f29a459da3c4266b5ad8ff55906a190f8b19a3bb92a50df49647c03d5d6106ec07e9300038d059a75b54ac31683ef8e5eee946e1c84d016ee1e7800a92c0a3823b62e0417fe86b191951f65abc0c38c1e0e8f1121a04b62a8a720790560f922804b1b7e7eaa497e1bede6e3d0dcf0312dbf221561958fa1e85a8f99e6fc82f919e78c17d1beda16cfef25fb5d00f7c32df9a51eac76000c988ffdf011564aa0e319764b16a5a7c728a470ff70772fb76c9ada26a0ac073fcbfa12501c2454b19e02d928e3939a40bfff76c002533b3849cdf8016728445131e5f1e292b7d3dc06bb3a3cfff6fabae0b7341694a8938c1d2497cd70b76c337c9a312e96c8f736d7625a535e1906eba53d199221ca60202a65be0f7e530aca10e61fa39c7601d65954e5ed4cab94345c6b89c7f8a0de5c61a7945e1564731b6715331d13263b2961a163382f7c4934d847033860e402f3aadb4f3e6cf47a97a2031401da4d2c8de8c80cdadb97b4deb2075a02282f958ac6772354e67f097ca693778224b80892490015e7d697fb9107f75cea708178ffec93fb1d44e8493bad1d42c918e661219ea819e0200759037a5a585c0fe074fd407536fe58013f42612c41bfc66e16870d7a9c00ee93a3122b253fecbf5de3837641f4a1376af0f053463413c26c29f9a346318565276856b963da30ba6ab8c4c8ef6cfddc432328586d9d9829895835759bcde0851ae0c838a3927ea63fe5ba793fae94da61cab00fc05f3a265a2da1221bb2b66775ed7ba856b41011652d4984991e56249360ddfc997245ac1547a1c16382d42df383a8d1c852643b24895c422712e79c436fdfffece4ed1c50922d4f25296aaf6b204522086d188bee254f8303b60537ead1195ac5dd301286f0042dd68aa05a70e4beb779aa0b61a316f736b72c9ab7ed860a0908a078f4b8a53f2df0abf993f689de4b02b9138ca5047fb0bfc9ba3b92bff033e36fc9553260b008cef3d147c62d1d3944fd1eaff79bc5a922ec2190907bfda1b51c2c7fb867db1f8e13a37b5e3ae0165e93350b958a239ec1f2b78561cff854b975307b5b5dd23b040602a5a36bd79947ee04c7d0e5e30f9c4c79f7b4e6eada98bfc6c357cdf8939213423f1b21ba26cfc2b2756ea3eb992372db0ab8a7c37d8ae96bf3ed6be873c1891550ef741812032e1ae938326c399ee43a3061602dda006f1b6b620bebb6a5752bee77e8acf9921ebf4d4c8af7eb5e937c65697c0664c594e31a62377a25605051996c474ca322ce8e0e6ef8a7988be00", 0x2000, &(0x7f0000001240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x10, 0x0, 0xfffffffffffffffb}, 0x0, 0x0, 0x0}) getdents64(r2, 0x0, 0x0) 13.334772606s ago: executing program 5 (id=3795): syz_usb_connect$cdc_ncm(0x4, 0x6e, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000020000002505a1a440000102030109025c0002010000000904000001a3f45747d649f9a30105240000000d240f8100000000000000000006241a0000000905810300000000000904010000020d00000904010102020d000009058202000000000009050302"], 0x0) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2000002, 0x10012, r1, 0x0) write$char_usb(r0, &(0x7f0000001300)="92", 0x2) 13.282763285s ago: executing program 1 (id=3796): openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001180), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x2008800, &(0x7f0000000440)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r0, &(0x7f0000004140)={0x2020}, 0x2020) write$FUSE_DIRENTPLUS(r0, 0x0, 0x0) statfs(&(0x7f0000000000)='./file0\x00', 0x0) 13.033240956s ago: executing program 3 (id=3798): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r2, 0x8, &(0x7f00000002c0)=0x80000000000003) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x1c, 0x7, 0x8, 0x8, 0x45}, 0x50) r4 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IP_VS_SO_SET_ADD(r4, 0x0, 0x482, &(0x7f0000000000)={0x11, @broadcast, 0x800, 0x3, 'lc\x00', 0x2, 0x7ff, 0x3e}, 0x2c) getsockopt$IP_VS_SO_GET_SERVICE(r4, 0x0, 0x483, &(0x7f0000000000), &(0x7f0000000180)=0x68) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=@base={0xe, 0x4, 0x8, 0x2}, 0x50) r5 = socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000001200)={0x0}}, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000700)={'batadv_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000440)=@newtfilter={0x24, 0x11, 0x1, 0x70bd28, 0x2000, {0x0, 0x0, 0x74, r6, {0xfffd, 0x10}, {0x1, 0xfff1}, {0xfff2, 0x3}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x14004804}, 0x840) 10.745136373s ago: executing program 1 (id=3800): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) capset(0x0, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r3, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000100)='bbr', 0x3) sendmmsg$inet(r3, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000c80)="91f8a984851bdef38491bbc4173c3c6f357d028feff84ab17c417789f9fc9b8572c98172b7319130feaab952ac4703cad04be6890ee50e997fc26e0000ea4feb931647fc5393de25000000000000000000f4922da20bf1f802970c30f03cc271337e892c99bda9475d51361f8b78938a6a68ba85987219000000eb52c9ff439180b413ec4d4fe130b41d113ce7efb5e9838379c5a554eb896f7808d5904cd8da06fd5159085c9275f49e775e92fb106c2f10442d508891e58a3f117fc203f787901de99a6a1b851ff5c85244beacba25d854577d68ca555e88fc249340ab9bdd8680abbbde02b0307ef45cb7ffffffff984c7bbb7bb3c689ef8daa63ca62e496be091cc1c7d4f371acaaec43337aee38542c35292cf3fdbfc45af8630174371535dbab0b2ec6403658ab3b48a93093de50c743a4f987cc433b546f194f00ba2d1cb675b44bdec6b6", 0x148}], 0x1}}], 0x1, 0x2090) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000600)=0xdf8, 0x4) sendmmsg(r3, &(0x7f0000008d80)=[{{0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f00000007c0)="c8b7df938dc9c0fcc8a7e84a57fa9059b9cfa4132462f9c45b583e8ce1f19a82364b01b4bc3436dcea3f3380b3269f2c986b7f8205fa231eac99a9de63cd1a85c820fc43c24662a22f18183bb042a742ac921efe546daedbd31cd4b5cda70186dd7ec449169ea58ebc3f3456774ea76202bc9969ea7026a8d7090c085a769e47294e4ea5b8ce3f6187e5ca87549e75b0b2980a21dc7b809da3f544d061ad96d06e0864906297353deefe8b52d519dd67f3f41dd7dd1cda0601b77e8415521d7dbb9893aeefbf94850960c84825a918b0", 0xd0}], 0x1}}, {{0x0, 0x0, &(0x7f0000003300)=[{&(0x7f0000000f00)="88a69f5139292fe55d24310330d349370620dd2737877e864a0d6d86ec395b0c41689f2e0742c4d3282f151e6faf27deab0464cdf91d6a7b73cbec929aa85b3d4f5114785c23d6c325efab561ca5f90113281359edb7ccdea124d6ea38a34d046ed5a7fdfc137e465ae8b692cb06ce3d14da5dc3ba35cac41c2fb97fe2618ebdd40e", 0x82}, {&(0x7f0000002240)="321f349be984b668f593bf16c2f60e4b01783ed59dcd6a4105711458d2cf86696caad21a4387232f7ae8dbda478307058ab2ffec546f49907b7d4c54fe1fa76d99f5c80956c6769c810b895a00ab69f114794c1e3ee671204a47d3153305395d1e523e504927505590c078bc1a7d6e82b332bf141f662f26ad9ba4c11b87d5abbc3340ef989b3a8e666f8f82ca82aab6d33c953938b30b61c91cbc926b2a58d67d8198e458ed8f10ad8975356af9dab25f718147ae2a3e81187adaa46d247e3a8c437053bb01b855c6fb0ee0e7024fa61bd2af5aa1d918fcc93b3ffadf3a982efefa3b47727caafee6246ee147d676a5e2879e351f5ac51e6b62aaedb5cd03d16cb4f8bfaac498397b3dc22c063fbd87b2912647948430488fb45ca42096e08a6760c831b06d4582b7440f9123f3711a87b71a4a3a4614b2bf8dcdb84d985777893889120fb820ffe525acbf530869895f2caf84922e5a8aee6a0f887145b0d961bfa9c8f71788ccb8d2ee73676c2f68427b776f537afb9a8c97e055e35204ec09fd3f2c9a0b9f8b33ef0343ef22c99a7fe463550d074b626c1173f34fc49f1431460881ccd35b679f186dd10ac84e2f9aa370443a75938812c1b1888e57b0a79001965832e7cd8c85865081a16938fc81e72c26e686078692dad56ca4a2371a6b370268da843aa7ba9e498a7ae8a6317907b2d5114acf3d35522e4c8cb4e014c7d3f5f60c57b1293ec9956bed6abb25b5e2f90cf3eba7adc060b00dcb50480282b649e9c601bf0a400290a337e46af9be19d489e8693750a0be63313307b51db7726d4c6643f6f8ab22ce41310043728ffd414567f6e514c5e88b5614195b9ba893c8980949974f1eae80d27f7f90b251a094469561598e3dcd2bc143edd69b131595bbf776aa7583687228d8ea578f9f08ea949be49c1b087f430262968f639047eeb91c84a4cc6df66c749fb9b5b38e7e6546683df3a6ae722ea0d644256d82d8f3ba6b8bca23498a7dcc06fcda64d94f15b6bf620e7b272a476b097715f430c1d7c4c221156df5225c9fee4e580a5600713a1ce6e503c37730b5b4d3be23b212eb0ac2a05a7dc6aa88984566664086491ba3214bd9c9a4196d028f6ba448682536b40eab416ea8cf4098101af663d53110ebc2dffd88457ffd70decf1269f3fa61460593671d750ea0ab08aaac98a555a78da62b62625b550f840f34d1b02788bceb09002f615187159295d1a10e2dcfda5c1d399226047a53a1695f0af8121ad144b4dbe411d34d5e4eb4b4075e522d60d0020b2969025021bfc03062e0c8281bfa4cbce38241b53e970acc20ee903fcc81e8770f93367d7eddb95093177337475d5ef009ab799de6950d06ad68e8f9474634672657ba29df601e0be9e362197bafc25fee416a2b6d378dd31294d99317e5cc0d83827f6916ac648d638a515f823d0d784d841c31483b7d030258c62256268055286d3e773316f0f50df6411da24d8aeed75f50f49b0f6cc8672630954c1c3a1632d3497e3be53a4734619bd79aea6ffd87b8278f09775884018c70a6cf7290d5d09c6fa35a2c5fe9be746c9a4cb3e45855a12bf0c0fdeecb5a86922094b0d7b1adf0c10295e0e2ded424c476b8a15ddc44d229951e8a86d359c911e6a4baaeeb2c84cf367e92566ad2bed0c079c614f903d48cd19252c004a2f1de096d83f032d1a86bcd0b53b16668c88258d7d5ca7fc72d41b74ffe5c4a02e5b7077eddbeb77e4678a45e2983e4a1c07e7eb53ebddedca9bf2c52b84b759a88ec4cad17935e7af6c1ae2dd0ce1d37a2dcc74c336a71daf179ebddb5651a41f209b6a5ea7a001efbf74bd21f7fa3708430baddc2b24a7871f7bb443913ca59e64556d361af986aff89975fa48682bd97e707590f3d508427f6a61e293393518b620c12b6d055014a2f5744be4a16a8b39e5cb19112eb529646f83ca092c52945bd873e6dffbd22f9ba99f350689313c2acc9d4a35c182056bf029aa5fbd942a955d5627b815b658a522605fc5a993c4cc3722da94d1509a1926fe2873c02027714784d20f2765c5f299c56a18791b4ca799bf477832093222f805fa125527495975cb5f50f5ca6cba89459b85d674214ff894c33b8a2c85193d7f312de8a42f4eede4fb84ae648dffae1ec13e8ad5663b10847f9d476e1bcacff45389dee0cc7e1a84834ab7904116ef8c89705f931b42a501303da83ac9799dde0df252d0b597e78001229d9a2339bd71c6244fdaebcffc10595c09ddad42bf7cfed789817962bffec261cc1d203910c5282b7971da3eae449202e1eda1d7c7793c2c24d6e6fd6f58331e63a59900e7a0e2c959fbc6b625fd4c95cd61d72ed56a96018d0b94358f9e50fb98eec69d4fae7d5ec303bde80f0bfd17908138c1a5c9e5d805c25adf392e5be7e1eb17945ed9b4171fb776e11602c32784718884fea99446ce11847ea0e4bcb2931105425c5614280f977380c50fe12d1542fcf61c61f", 0x6eb}], 0x2}}], 0x2, 0x0) 10.709022551s ago: executing program 5 (id=3801): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r0, 0x10e, 0xb, &(0x7f0000000000)=0x40b, 0x4) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYRES64=r0, @ANYRES16=r1, @ANYRES16=r1], 0x14}, 0x1, 0x0, 0x0, 0x4014}, 0x4010850) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() r4 = syz_open_procfs(0x0, &(0x7f0000000080)='smaps\x00') pread64(r4, &(0x7f0000001240)=""/102400, 0x19000, 0xffffffff8) sched_setscheduler(r3, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xd6d1c000) r5 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x1, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r5, 0x47, &(0x7f0000000200)=0x7) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./proc\x00', &(0x7f0000000010)='proc\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, &(0x7f0000000020)='./proc/net/afs/cells\x00', 0x2, 0x0) write(r7, &(0x7f0000000040)='add syz0 ::,', 0xc) futex(&(0x7f000000cffc)=0x1, 0xd, 0x2, 0x0, 0x0, 0x400000) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x3c, 0x3000001, 0x50, r7, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) 7.811535584s ago: executing program 5 (id=3803): setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8000000, 0x3, 0x2f8, 0x110, 0xffffffff, 0xffffffff, 0x110, 0xffffffff, 0x228, 0xffffffff, 0xffffffff, 0x228, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private1, [0xff000000, 0xffffff00, 0x6dc8f3d6512d1aed, 0xffffffff], [0xff, 0xff000000, 0xff000000], 'bond_slave_0\x00', 'batadv0\x00', {}, {}, 0x2f, 0x2, 0x3, 0xe}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, '\x00', 'syz1\x00'}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x17}, @mcast1, [], [], 'veth1\x00', 'wlan1\x00'}, 0x0, 0xa8, 0x118}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x7fffffff, 0x9, 0xb3, 0x1, 0x0, "86d6b549c4bf723e1f33da7c11e5cee0b1adedc05fbfc6af15c3f8b75adf8819ec9d8cd0614114f5f1d3b7ba1d33f3750c2e3b8acf37107767e107dac4688212"}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x358) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) setitimer(0x2, &(0x7f0000000040)={{0x0, 0x2710}, {0x0, 0x2710}}, 0x0) 7.795630996s ago: executing program 1 (id=3804): mkdirat(0xffffffffffffff9c, 0x0, 0xe) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) write$P9_RVERSION(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="1500000065ffff097b000008003950323030302e4c"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f00000000c0)={0x14c}, 0x137) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r2]) chdir(&(0x7f0000000040)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000002280)=ANY=[], 0x0, 0x0, 0x0) setresuid(0x0, 0xee00, 0x0) listxattr(&(0x7f00000004c0)='./bus\x00', 0x0, 0x0) 7.439094095s ago: executing program 3 (id=3805): memfd_secret(0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/mtrr\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$RDMA_NLDEV_CMD_RES_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x9f9ec54af98ce9ae}, 0x40800) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f0000000100)={0xf, 0x1f, 0x2, 0x2}, 0x51) prlimit64(0x0, 0x6, &(0x7f0000000140)={0x7, 0x4}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xea03, 0xc000, 0x3, 0xc1}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1608000004"], 0x50) io_uring_enter(r0, 0x4095, 0x7721, 0x16, 0x0, 0x0) 6.014555861s ago: executing program 1 (id=3807): r0 = userfaultfd(0x0) ioctl$BTRFS_IOC_TREE_SEARCH(0xffffffffffffffff, 0xd0009411, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP(r0, 0xd0009412, &(0x7f0000001540)={0x0, 0x81}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[], 0x1d) bpf$MAP_CREATE(0x0, 0x0, 0x48) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)={0x14, 0x0, 0x1, 0x70bd28}, 0x14}, 0x1, 0x0, 0x0, 0x40048d0}, 0x40000) setsockopt$MRT_DEL_MFC_PROXY(0xffffffffffffffff, 0x0, 0xd3, &(0x7f00000000c0)={@empty, @local, 0xffffffffffffffff, "cae5c66b00e4bfdb8ea8fbabf2121dc8b1f8567a2939f7e3b4927f49a62f1a25", 0xfffffff5, 0x4, 0x8e, 0x9}, 0x3c) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r5, 0x29, 0xb, &(0x7f0000000040)=0x9, 0x4) bind$inet6(r5, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r5, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) setsockopt$inet6_int(r5, 0x29, 0x42, &(0x7f0000000100)=0x5, 0x4) sendto$inet6(r5, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000000c0)={r1, 0x0, 0x0}, 0x20) prctl$PR_SCHED_CORE(0x3e, 0x0, r2, 0x3, 0x0) 5.396673143s ago: executing program 7 (id=3810): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) 5.394636319s ago: executing program 0 (id=3811): openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001180), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x2008800, &(0x7f0000000440)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r0, &(0x7f0000004140)={0x2020}, 0x2020) write$FUSE_DIRENTPLUS(r0, 0x0, 0x0) statfs(&(0x7f0000000000)='./file0\x00', 0x0) 4.811282843s ago: executing program 7 (id=3812): openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x1c3, 0x2f) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r0 = openat$dir(0xffffffffffffff9c, 0x0, 0x40, 0x83) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000480)=ANY=[@ANYBLOB="03570000000000000100000001000000060000000000000003000000000000000180000000000000090000000000000006000000000000000000000000000000000000000000000080000000000000000000000000000000070000000000000057e68c4400000000010001000000000000000000"]) 4.296695538s ago: executing program 7 (id=3813): pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000000)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) write$tun(r0, &(0x7f0000000380)=ANY=[], 0xfdef) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x2) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r3, r3) setpgid(0x0, r3) fchdir(r2) mount(0x0, &(0x7f00000000c0)='./tracefs_dir\x00', 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs_dir/buffer_size_kb\x00', 0x1, 0x0) 4.179122798s ago: executing program 4 (id=3552): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x44, 0x10, 0x1, 0x470bd27, 0x25dfd402, {0x0, 0x0, 0x0, r1, 0x640a4, 0x57ee1}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0xc, 0x5, 0x0, 0x1, [@IFLA_BRPORT_NEIGH_SUPPRESS={0x5, 0x20, 0x1}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x404c080}, 0x200088c2) 4.120512082s ago: executing program 0 (id=3814): setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x8, 0x3, 0x380, 0x0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x460, 0xffffffff, 0xffffffff, 0x460, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'bridge0\x00'}, 0x0, 0x1b0, 0x1d8, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@private1, [0xff000000, 0xffffffff, 0xff, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xffffffff, 0xffffffff], @ipv6=@empty, [0xff000000, 0xff, 0xff, 0xff], @ipv6=@local, [0xffffffff, 0xff000000, 0xff000000, 0xffffff00], 0x80, 0x54, 0x3b, 0x4e20, 0x4e23, 0x4e21, 0x4e23, 0x446, 0x39a}, 0x100, 0x20}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @local}, [], [], 'erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x0, 0x0, 0x4b}, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x3e0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000600)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000940)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000002000000e00000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000064010102000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x310) setsockopt$inet_group_source_req(r0, 0x0, 0x2b, &(0x7f00000004c0)={0x2, {{0x2, 0x203, @multicast2}}, {{0x2, 0xfffe, @local}}}, 0x108) 3.738681837s ago: executing program 0 (id=3815): ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x7f}) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/220, &(0x7f00000000c0)=""/80, &(0x7f0000000780)=""/82}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000b40)={0x2, 0x0, [{0x7000, 0xb3, &(0x7f0000000800)=""/179}, {0x0, 0xc2, &(0x7f0000000940)=""/194}]}) 3.615563368s ago: executing program 4 (id=3816): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = openat$binfmt_format(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz0\x00', 0x2, 0x0) pwritev(r1, &(0x7f0000000200)=[{&(0x7f0000000000)='0', 0x1}], 0x1, 0x8000, 0x1) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) clock_adjtime(0x0, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) bind$inet6(0xffffffffffffffff, 0x0, 0x0) write(r2, &(0x7f0000001f00)="ef97646110265cf65eda0c997a00976ca6b72e643a4d71f06f4e112955fa9b595e718de352b21791dd333109ee5f4b0fb02caaf507c2e7aaf9adb3662a145451969da96427a09e58c069ef95473af4dfefeed6e3ecc1e724936fecd6c2d606b30eeb8c15e39738cf1338fc4643c5a3f0b5775b1834a7dd01e491668a1139efd38a9f014a061561e5bbde8983024934a373050000000000000011c31f288d48baed9dfb44bd33dba6bd292aad455d53d0c6f09126b38f54e663", 0xb9) syz_open_dev$vcsn(&(0x7f0000000040), 0x5, 0x800440) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f00000000c0)={0x2, {0x2, 0x3bf, 0xf88, 0x14a}}) 3.530032292s ago: executing program 7 (id=3817): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$pppoe(0x18, 0x1, 0x0) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) syz_io_uring_setup(0x57da, &(0x7f0000000300)={0x0, 0xf20f, 0x40, 0x2, 0x17}, &(0x7f0000000100), &(0x7f00000000c0), &(0x7f00000001c0)) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_GET(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0) r2 = creat(&(0x7f0000000080)='./bus\x00', 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x4000011) r3 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a320000000008004100"], 0x38}, 0x1, 0x0, 0x0, 0x8040044}, 0x40050) sendmsg$RDMA_NLDEV_CMD_DELLINK(r3, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000015c0)=ANY=[@ANYRESHEX, @ANYRESOCT], 0x18}, 0x1, 0x0, 0x0, 0x671ec167a4b72164}, 0x0) r4 = socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r2, 0xc008551a, &(0x7f00000003c0)={0x6, 0x10, [0xa1, 0xa4f2, 0x6, 0x4]}) sendmsg$SOCK_DIAG_BY_FAMILY(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000040)=ANY=[@ANYBLOB="240000001400050126bc70006bdbdf2511000d000100c80e4501a254722eaea6d93916f8d66cffe8ef8d00000000"], 0x24}, 0x1, 0x0, 0x0, 0x2}, 0x54840) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="30000000100001006c4789ec390bca4900000000", @ANYRES32=0x0, @ANYBLOB="211000000300000008001b"], 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) 3.408311785s ago: executing program 5 (id=3818): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10) gettid() sendmsg$inet6(0xffffffffffffffff, &(0x7f0000001840)={&(0x7f0000000080)={0xa, 0x2, 0x9, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x6}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=ANY=[], 0x30}, 0x24000804) socket$nl_route(0x10, 0x3, 0x0) r1 = fsopen(&(0x7f00000001c0)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x1, 0xe) fchdir(r2) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r3 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) chdir(&(0x7f0000000140)='./file0\x00') unlinkat(r3, &(0x7f0000000780)='./file0\x00', 0x200) r4 = openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0) getdents64(r4, 0x0, 0x0) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e20, @empty}, 0x10) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000000)={0x6, 0x10, &(0x7f00000001c0)=ANY=[], &(0x7f0000000640)='syzkaller\x00', 0x8, 0x94, &(0x7f0000000100)=""/148, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2000000}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r5, 0x84, 0x70, &(0x7f0000000000)={0x0, @in6={{0xa, 0x4e21, 0x10001, @empty, 0xce}}, [0x3, 0x5, 0x4, 0x7, 0x7, 0x3, 0x8001, 0xc2, 0x3, 0x81, 0x0, 0x2, 0x3ff, 0x10001, 0x6]}, &(0x7f0000000100)=0x100) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x88840, 0x0) io_setup(0x1ff, &(0x7f00000001c0)) 2.309518568s ago: executing program 4 (id=3819): ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', 0x0}) mmap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x4000000) r0 = syz_clone(0x0, 0x0, 0x43, 0x0, 0x0, 0x0) process_vm_writev(r0, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x1, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x20001c34}], 0x1, 0x0) 2.207196244s ago: executing program 0 (id=3820): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/target/core/rd_mcp_0\x00', 0x1ff) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/target/core/rd_mcp_0/ramdisk0/control\x00', 0x1, 0x0) write(r0, &(0x7f0000000240)='rd_pag', 0x6) close(r0) write(0xffffffffffffffff, &(0x7f00000002c0)='1\n', 0x2) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/target/usb_gadget/naa.6001405c935d7912\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r1, &(0x7f0000000400)='naa.6001405c935d791', 0x13) close(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.6001405c935d7912/tpgt_1/enable\x00', 0x1, 0x0) write(r2, &(0x7f0000000540)='1\n', 0x2) 1.693410265s ago: executing program 7 (id=3821): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x942) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NLBL_MGMT_C_ADD(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000696000/0x1000)=nil, &(0x7f0000695000/0x1000)=nil, &(0x7f000068d000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r2 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0x2bb}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) write$evdev(r1, 0x0, 0x0) bpf$MAP_CREATE(0x600000000000000, &(0x7f00000000c0)=@base={0xf, 0x4, 0x4, 0x20002, 0x0, 0x1, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4}, 0x50) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000007940)={0x0, 0x0, &(0x7f0000007900)={&(0x7f0000000680)=@newtaction={0xc0, 0x30, 0x216822a75a8bdd29, 0xffe4, 0x0, {}, [{0xac, 0x1, [@m_connmark={0x34, 0x2, 0x0, 0x0, {{0xd}, {0x4}, {0x4}, {0xc}, {0xc}}}, @m_ct={0x44, 0x1, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}, @m_gact={0x30, 0x3, 0x0, 0x0, {{0x9}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}]}]}, 0xc0}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_MEDIA_SET(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x24000881}, 0x24004084) 1.619116605s ago: executing program 5 (id=3822): socket$nl_route(0x10, 0x3, 0x0) memfd_secret(0x80000) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x1, 0x4, 0x8, 0x80}, 0x0, &(0x7f00000002c0)={0x3ff, 0x30e3, 0x0, 0x3, 0x8, 0x8000000000, 0x80000001, 0xfffffffffffffffc}, 0x0, 0x0) 1.302381883s ago: executing program 0 (id=3823): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000240)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) 860.50776ms ago: executing program 7 (id=3824): openat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x1c3, 0x2f) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) r0 = openat$dir(0xffffffffffffff9c, 0x0, 0x40, 0x83) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000480)=ANY=[@ANYBLOB="03570000000000000100000001000000060000000000000003000000000000000180000000000000090000000000000006000000000000000000000000000000000000000000000080000000000000000000000000000000070000000000000057e68c4400000000010001000000000000000000"]) 259.850531ms ago: executing program 4 (id=3825): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000140)='/dev/comedi4\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x800000, 0x13, r0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x39, 0x200000f, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x21}, 0x0, 0x0, 0x0, 0x0}, 0x58) 182.238812ms ago: executing program 5 (id=3826): openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x183341, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001180), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x2008800, &(0x7f0000000440)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x8000}}) read$FUSE(r0, &(0x7f0000004140)={0x2020}, 0x2020) write$FUSE_DIRENTPLUS(r0, 0x0, 0x0) statfs(&(0x7f0000000000)='./file0\x00', 0x0) 48.285803ms ago: executing program 1 (id=3827): r0 = memfd_create(&(0x7f0000000040)='dummy\x00', 0x0) ftruncate(r0, 0x6400000) r1 = syz_open_dev$loop(&(0x7f0000000080), 0x0, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$LOOP_CTL_ADD(r2, 0x4c80, 0x1) r3 = memfd_create(&(0x7f0000000100)='dummy2\x00', 0x0) ftruncate(r3, 0x6400000) syz_open_dev$loop(&(0x7f0000000140), 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./sys\x00', 0x1ff) mount(0x0, &(0x7f00000001c0)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r4, 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r5, &(0x7f0000000300)='7:0', 0x3) r6 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./sys/block/md0/md/new_dev\x00', 0x1, 0x0) write(r6, &(0x7f0000000380)='7:', 0x2) r7 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./sys/block/md0/md/level\x00', 0x1, 0x0) write(r7, &(0x7f0000000400)='rai', 0x3) r8 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./sys/block/md0/md/raid_disks\x00', 0x1, 0x0) write(r8, &(0x7f0000000480)='2\x00', 0x2) r9 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./sys/block/md0/md/dev-loop0/slot\x00', 0x101081, 0x0) write(r9, &(0x7f0000000500)="3002", 0x2) r10 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./sys/block/md0/md/dev-loop1/slot\x00', 0x1, 0x0) write(r10, &(0x7f0000000580)='1\x00', 0x2) r11 = openat(r7, &(0x7f00000005c0)='./sys/block/md0/md/dev-loop0/slot\x00', 0x1, 0x40) write(r11, &(0x7f0000000600)='external\x00', 0x9) openat(0xffffffffffffff9c, &(0x7f0000000640)='./sys/block/md0/md/bitmap/chunksize\x00', 0x1, 0x0) r12 = openat(0xffffffffffffff9c, &(0x7f00000007c0)='./sys/block/md0/md/array_state\x00', 0x1, 0x0) write(r12, &(0x7f0000000800)='readonly\x00', 0x9) 0s ago: executing program 0 (id=3828): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000380)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x44, 0x10, 0x1, 0x470bd27, 0x25dfd402, {0x0, 0x0, 0x0, r1, 0x640a4, 0x57ee1}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0xc, 0x5, 0x0, 0x1, [@IFLA_BRPORT_NEIGH_SUPPRESS={0x5, 0x20, 0x1}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x404c080}, 0x200088c2) kernel console output (not intermixed with test programs): ping remainder of the config [ 1076.796852][ T5746] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1076.796892][ T5746] usb 5-1: Product: syz [ 1076.796919][ T5746] usb 5-1: Manufacturer: syz [ 1076.796946][ T5746] usb 5-1: SerialNumber: syz [ 1076.832376][ T5746] keyspan 5-1:1.0: Keyspan 2 port adapter converter detected [ 1076.832635][ T5746] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 87 [ 1076.832720][ T5746] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 7 [ 1076.864349][ T5746] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 81 [ 1076.864448][ T5746] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 82 [ 1076.864542][ T5746] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 1 [ 1076.864637][ T5746] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 2 [ 1076.864730][ T5746] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 85 [ 1076.879363][ T5746] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 5 [ 1076.929258][ T5746] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 1076.951303][ T5746] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 83 [ 1076.951379][ T5746] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 84 [ 1076.951449][ T5746] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 3 [ 1076.951518][ T5746] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 4 [ 1076.951588][ T5746] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 86 [ 1076.951657][ T5746] keyspan 5-1:1.0: found no endpoint descriptor for endpoint 6 [ 1076.962238][ T5746] usb 5-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 1077.155681][ T5760] usb 5-1: USB disconnect, device number 54 [ 1077.226899][ T5760] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 1077.548829][ T5760] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 1077.644785][ T5760] keyspan 5-1:1.0: device disconnected [ 1079.494791][T15402] veth0_vlan: entered promiscuous mode [ 1079.533617][T15402] veth1_vlan: entered promiscuous mode [ 1079.735986][T15402] veth0_macvtap: entered promiscuous mode [ 1079.957041][T15402] veth1_macvtap: entered promiscuous mode [ 1080.769731][T15402] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1080.841820][T15402] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1080.983536][T13251] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1081.990062][ T37] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1081.990136][ T37] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1082.073455][ T6297] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1082.583535][T15954] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1082.584159][T15954] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1083.189030][ T6297] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1083.189063][ T6297] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1083.348800][T15963] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2823'. [ 1083.443944][ T1298] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1083.443977][ T1298] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1083.489589][T15964] siw: device registration error -23 [ 1083.491625][T15964] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2807'. [ 1085.059167][ T5834] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 1085.225769][ T5834] usb 7-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1085.230766][ T5834] usb 7-1: config 0 has no interfaces? [ 1085.239708][ T5834] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1085.239747][ T5834] usb 7-1: Product: syz [ 1085.239774][ T5834] usb 7-1: Manufacturer: syz [ 1085.239801][ T5834] usb 7-1: SerialNumber: syz [ 1085.263916][ T5834] usb 7-1: config 0 descriptor?? [ 1085.496738][T11056] usb 7-1: USB disconnect, device number 28 [ 1092.365679][ T31] audit: type=1326 audit(1789804989.936:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16057 comm="syz.9.2845" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fe67a79e159 code=0x0 [ 1096.216157][T16083] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2851'. [ 1096.825931][T16095] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 1096.825931][T16095] The task syz.0.2855 (16095) triggered the difference, watch for misbehavior. [ 1098.782594][T16113] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1098.787885][T16113] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1098.907367][ T31] audit: type=1326 audit(1789804996.476:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16117 comm="syz.4.2865" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f7c11b9e159 code=0x0 [ 1106.994874][T16177] can0: slcan on ttyS3. [ 1107.899139][T16172] can0 (unregistered): slcan off ttyS3. [ 1108.127723][T16181] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2884'. [ 1113.347426][ T10] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 1113.376295][ T31] audit: type=1800 audit(1789805010.946:60): pid=16235 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.2900" name="bus" dev="tmpfs" ino=1333 res=0 errno=0 [ 1113.493276][T16226] mmap: syz.0.2896 (16226) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 1113.511759][ T10] usb 7-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 1113.523300][ T10] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1113.539949][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1113.539991][ T10] usb 7-1: Product: syz [ 1113.540020][ T10] usb 7-1: Manufacturer: syz [ 1113.540048][ T10] usb 7-1: SerialNumber: syz [ 1113.590011][ T10] keyspan 7-1:1.0: Keyspan 2 port adapter converter detected [ 1113.590289][ T10] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 87 [ 1113.590375][ T10] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 7 [ 1113.591943][ T10] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 81 [ 1113.592041][ T10] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 82 [ 1113.592136][ T10] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 1 [ 1113.592234][ T10] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 2 [ 1113.592331][ T10] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 85 [ 1113.595362][ T10] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 5 [ 1113.605319][ T10] usb 7-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 1113.678013][ T10] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 83 [ 1113.678114][ T10] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 84 [ 1113.678235][ T10] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 3 [ 1113.678329][ T10] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 4 [ 1113.678421][ T10] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 86 [ 1113.678515][ T10] keyspan 7-1:1.0: found no endpoint descriptor for endpoint 6 [ 1113.682941][ T10] usb 7-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 1113.774062][ T10] usb 7-1: USB disconnect, device number 29 [ 1113.806042][ T10] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 1113.828177][ T10] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 1113.829172][ T10] keyspan 7-1:1.0: device disconnected [ 1115.211519][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 1115.211608][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 1118.941255][T16281] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2914'. [ 1118.943477][T16281] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2914'. [ 1119.358082][ T10] usb 8-1: new high-speed USB device number 22 using dummy_hcd [ 1119.518493][ T10] usb 8-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 1119.519991][ T10] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1119.548404][ T10] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1119.548445][ T10] usb 8-1: Product: syz [ 1119.548472][ T10] usb 8-1: Manufacturer: syz [ 1119.548500][ T10] usb 8-1: SerialNumber: syz [ 1119.609467][ T10] keyspan 8-1:1.0: Keyspan 2 port adapter converter detected [ 1119.609735][ T10] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 87 [ 1119.609822][ T10] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 7 [ 1119.653387][ T10] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 81 [ 1119.653491][ T10] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 82 [ 1119.653594][ T10] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 1 [ 1119.653691][ T10] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 2 [ 1119.653786][ T10] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 85 [ 1119.653881][ T10] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 5 [ 1119.710411][ T10] usb 8-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 1119.712346][ T10] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 83 [ 1119.712445][ T10] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 84 [ 1119.712545][ T10] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 3 [ 1119.712648][ T10] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 4 [ 1119.712748][ T10] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 86 [ 1119.712846][ T10] keyspan 8-1:1.0: found no endpoint descriptor for endpoint 6 [ 1119.714685][ T10] usb 8-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 1119.883394][ T5760] usb 8-1: USB disconnect, device number 22 [ 1119.902303][ T5760] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 1119.967626][ T5760] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 1119.979119][ T5760] keyspan 8-1:1.0: device disconnected [ 1120.237497][ T10] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 1120.391095][ T10] usb 7-1: New USB device found, idVendor=0644, idProduct=8047, bcdDevice= 1.00 [ 1120.392541][ T10] usb 7-1: config 1 has an invalid interface number: 3 but max is 0 [ 1120.392586][ T10] usb 7-1: config 1 has no interface number 0 [ 1120.425203][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1120.425243][ T10] usb 7-1: Product: syz [ 1120.425271][ T10] usb 7-1: Manufacturer: syz [ 1120.425316][ T10] usb 7-1: SerialNumber: syz [ 1120.469791][ T10] usb 7-1: 3:1 : does not exist [ 1120.469826][ T10] usb 7-1: 3:2 : does not exist [ 1121.492786][T16308] loop4: detected capacity change from 0 to 1024 [ 1121.504269][T16308] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 1121.514653][T16308] JBD2: no valid journal superblock found [ 1121.527069][T16308] EXT4-fs (loop4): Could not load journal inode [ 1122.682064][T16320] overlayfs: failed to resolve './file1': -2 [ 1124.677432][ T5760] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 1124.840205][ T5760] usb 6-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 1124.845034][ T5760] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1124.881879][ T5760] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1124.881922][ T5760] usb 6-1: Product: syz [ 1124.881950][ T5760] usb 6-1: Manufacturer: syz [ 1124.881979][ T5760] usb 6-1: SerialNumber: syz [ 1124.959388][ T5760] keyspan 6-1:1.0: Keyspan 2 port adapter converter detected [ 1124.959650][ T5760] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 87 [ 1124.959736][ T5760] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 7 [ 1125.039835][ T5760] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 81 [ 1125.039936][ T5760] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 82 [ 1125.040032][ T5760] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 1 [ 1125.040136][ T5760] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 2 [ 1125.040239][ T5760] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 85 [ 1125.040334][ T5760] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 5 [ 1125.074218][ T5760] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 1125.140278][ T5760] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 83 [ 1125.140379][ T5760] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 84 [ 1125.140475][ T5760] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 3 [ 1125.140571][ T5760] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 4 [ 1125.140667][ T5760] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 86 [ 1125.140778][ T5760] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 6 [ 1125.211687][ T5760] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 1125.301332][ T5760] usb 6-1: USB disconnect, device number 50 [ 1125.381876][ T5760] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 1125.476910][ T5760] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 1125.535572][ T5760] keyspan 6-1:1.0: device disconnected [ 1126.156773][ T10] usb 7-1: USB disconnect, device number 30 [ 1127.503927][T16362] loop4: detected capacity change from 0 to 1024 [ 1127.539695][T16362] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 1127.545912][T16362] JBD2: no valid journal superblock found [ 1127.573107][T16362] EXT4-fs (loop4): Could not load journal inode [ 1128.696130][T16369] overlayfs: failed to resolve './file1': -2 [ 1131.157623][ T31] audit: type=1800 audit(1789805028.676:61): pid=16372 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2948" name="syzkaller0" dev="sda1" ino=2058 res=0 errno=0 [ 1132.664881][T16397] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1132.678197][T16397] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1132.778409][T16403] loop9: detected capacity change from 0 to 1024 [ 1132.798423][T16403] EXT4-fs (loop9): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 1132.806057][T16403] JBD2: no valid journal superblock found [ 1135.621087][T16403] EXT4-fs (loop9): Could not load journal inode [ 1136.137393][T16417] overlayfs: failed to resolve './file1': -2 [ 1138.128894][ T31] audit: type=1800 audit(1789805035.706:62): pid=16423 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.2967" name="syzkaller0" dev="sda1" ino=2058 res=0 errno=0 [ 1139.043775][T16433] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 1140.320458][T16449] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1140.321014][T16449] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1140.430744][T16451] loop6: detected capacity change from 0 to 1024 [ 1140.438802][T16451] EXT4-fs (loop6): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 1140.445249][T16451] JBD2: no valid journal superblock found [ 1140.472095][T16451] EXT4-fs (loop6): Could not load journal inode [ 1149.924131][T16498] loop5: detected capacity change from 0 to 1024 [ 1149.939668][T16498] EXT4-fs (loop5): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 1149.946617][T16498] JBD2: no valid journal superblock found [ 1150.907723][T16498] EXT4-fs (loop5): Could not load journal inode [ 1150.979848][T16511] loop9: detected capacity change from 0 to 256 [ 1155.008999][T16544] xt_hashlimit: size too large, truncated to 1048576 [ 1157.208796][T16561] syzkaller0: left promiscuous mode [ 1157.208830][T16561] syzkaller0: left allmulticast mode [ 1157.554705][T16566] loop9: detected capacity change from 0 to 1024 [ 1157.564210][T16566] EXT4-fs (loop9): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 1157.593514][T16566] JBD2: no valid journal superblock found [ 1157.639757][T16566] EXT4-fs (loop9): Could not load journal inode [ 1157.917405][T10455] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 1158.067479][T10455] usb 5-1: Using ep0 maxpacket: 8 [ 1158.068346][T10455] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1158.265679][T10455] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 1158.265777][T10455] usb 5-1: config 0 has no interface number 0 [ 1158.311506][T10455] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1158.311707][T10455] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1158.524568][T10455] usb 5-1: config 0 descriptor?? [ 1158.942641][T10455] iowarrior 5-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1159.009754][ T5623] usb 5-1: USB disconnect, device number 55 [ 1159.628788][T10455] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 1159.779914][T10455] usb 10-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1159.786349][T10455] usb 10-1: config 0 has no interfaces? [ 1160.035713][T10455] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1160.035839][T10455] usb 10-1: Product: syz [ 1160.035887][T10455] usb 10-1: Manufacturer: syz [ 1160.035979][T10455] usb 10-1: SerialNumber: syz [ 1160.422760][T10455] usb 10-1: config 0 descriptor?? [ 1160.473634][T16590] FAULT_INJECTION: forcing a failure. [ 1160.473634][T16590] name fail_futex, interval 1, probability 0, space 0, times 0 [ 1160.473697][T16590] CPU: 1 UID: 0 PID: 16590 Comm: syz.6.3021 Not tainted syzkaller #0 PREEMPT(full) [ 1160.473745][T16590] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 1160.473771][T16590] Call Trace: [ 1160.473786][T16590] [ 1160.473802][T16590] dump_stack_lvl+0x100/0x190 [ 1160.473866][T16590] should_fail_ex.cold+0x5/0xa [ 1160.473921][T16590] get_futex_key+0x1d0/0x14f0 [ 1160.473977][T16590] ? __pfx_get_futex_key+0x10/0x10 [ 1160.474028][T16590] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1160.474082][T16590] ? __rb_reserve_next.constprop.0+0x6f7/0x1640 [ 1160.474164][T16590] futex_wait_setup+0x91/0x540 [ 1160.474242][T16590] __futex_wait+0x19f/0x300 [ 1160.474311][T16590] ? __pfx___futex_wait+0x10/0x10 [ 1160.474384][T16590] ? __pfx_futex_wake_mark+0x10/0x10 [ 1160.474455][T16590] ? finish_task_switch.isra.0+0x2bd/0x10d0 [ 1160.474503][T16590] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1160.474555][T16590] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1160.474611][T16590] ? rcu_is_watching+0x13/0xc0 [ 1160.474664][T16590] ? finish_task_switch.isra.0+0x2c2/0x10d0 [ 1160.474710][T16590] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1160.474769][T16590] futex_wait+0xe6/0x370 [ 1160.474834][T16590] ? __pfx_futex_wait+0x10/0x10 [ 1160.474924][T16590] do_futex+0x265/0x440 [ 1160.474981][T16590] ? __pfx_do_futex+0x10/0x10 [ 1160.475034][T16590] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1160.475085][T16590] ? event_triggers_call+0x337/0x4d0 [ 1160.475138][T16590] ? preempt_schedule_notrace_thunk+0x16/0x30 [ 1160.475195][T16590] __x64_sys_futex+0x34f/0x4d0 [ 1160.475257][T16590] ? __pfx___x64_sys_futex+0x10/0x10 [ 1160.475311][T16590] ? find_held_lock+0x2b/0x80 [ 1160.475366][T16590] ? trace_syscall_enter+0xcc/0x120 [ 1160.475415][T16590] ? trace_syscall_enter+0xcc/0x120 [ 1160.475469][T16590] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1160.475527][T16590] do_syscall_64+0x123/0x790 [ 1160.475575][T16590] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1160.475625][T16590] RIP: 0033:0x7efcf019e159 [ 1160.475657][T16590] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1160.475698][T16590] RSP: 002b:00007efcee3f60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1160.475738][T16590] RAX: ffffffffffffffda RBX: 00007efcf0425fa8 RCX: 00007efcf019e159 [ 1160.475767][T16590] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007efcf0425fa8 [ 1160.475794][T16590] RBP: 00007efcf0425fa0 R08: 0000000000000000 R09: 0000000000000000 [ 1160.475821][T16590] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1160.475848][T16590] R13: 00007efcf0426038 R14: 00007ffc426bb260 R15: 00007ffc426bb348 [ 1160.475903][T16590] [ 1160.998029][ T5623] usb 10-1: USB disconnect, device number 2 [ 1163.059713][T16617] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 1163.059745][T16617] overlayfs: failed to set xattr on upper [ 1163.059759][T16617] overlayfs: ...falling back to redirect_dir=nofollow. [ 1163.059774][T16617] overlayfs: ...falling back to index=off. [ 1163.059788][T16617] overlayfs: ...falling back to uuid=null. [ 1163.282582][T16625] loop7: detected capacity change from 0 to 1024 [ 1163.301046][T16625] EXT4-fs (loop7): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 1163.329386][T16625] JBD2: no valid journal superblock found [ 1163.332019][T16625] EXT4-fs (loop7): Could not load journal inode [ 1163.375050][T14268] Bluetooth: hci3: command 0x0406 tx timeout [ 1164.100595][T16630] lo speed is unknown, defaulting to 1000 [ 1164.598514][ T10] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 1165.387352][ T10] usb 6-1: Using ep0 maxpacket: 8 [ 1165.389441][ T10] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1165.390928][ T10] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 1165.390967][ T10] usb 6-1: config 0 has no interface number 0 [ 1165.391021][ T10] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1165.391084][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1165.457112][ T10] usb 6-1: config 0 descriptor?? [ 1165.479612][ T10] iowarrior 6-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1166.180750][ T5623] usb 6-1: USB disconnect, device number 51 [ 1167.179969][T16661] loop7: detected capacity change from 0 to 512 [ 1169.225895][T16672] loop5: detected capacity change from 0 to 512 [ 1171.747372][ T5623] usb 8-1: new high-speed USB device number 23 using dummy_hcd [ 1171.897761][ T5623] usb 8-1: Using ep0 maxpacket: 8 [ 1171.900873][ T5623] usb 8-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1171.909454][ T5623] usb 8-1: config 0 has an invalid interface number: 1 but max is 0 [ 1171.909494][ T5623] usb 8-1: config 0 has no interface number 0 [ 1171.909550][ T5623] usb 8-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1171.909614][ T5623] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1171.950760][ T5623] usb 8-1: config 0 descriptor?? [ 1171.996891][ T5623] iowarrior 8-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1172.930478][ T5834] usb 8-1: USB disconnect, device number 23 [ 1176.652008][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 1176.652421][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 1179.625735][ T31] audit: type=1800 audit(1789805077.196:63): pid=16750 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.3075" name="syzkaller0" dev="sda1" ino=2058 res=0 errno=0 [ 1181.432360][T16784] FAULT_INJECTION: forcing a failure. [ 1181.432360][T16784] name failslab, interval 1, probability 0, space 0, times 0 [ 1181.432415][T16784] CPU: 1 UID: 0 PID: 16784 Comm: syz.4.3085 Not tainted syzkaller #0 PREEMPT(full) [ 1181.432461][T16784] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 1181.432486][T16784] Call Trace: [ 1181.432500][T16784] [ 1181.432516][T16784] dump_stack_lvl+0x100/0x190 [ 1181.432576][T16784] should_fail_ex.cold+0x5/0xa [ 1181.432627][T16784] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1181.432682][T16784] should_failslab+0xc2/0x120 [ 1181.432724][T16784] __kmalloc_node_track_caller_noprof+0xfa/0x870 [ 1181.432787][T16784] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1181.432835][T16784] ? lockdep_hardirqs_on+0x7d/0x110 [ 1181.432876][T16784] ? vfs_parse_fs_qstr+0x112/0x1c0 [ 1181.432936][T16784] kmemdup_nul+0x49/0xd0 [ 1181.432990][T16784] vfs_parse_fs_qstr+0x112/0x1c0 [ 1181.433042][T16784] ? __pfx_vfs_parse_fs_qstr+0x10/0x10 [ 1181.433092][T16784] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1181.433147][T16784] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1181.433195][T16784] ? lockdep_init_map_type+0x5c/0x250 [ 1181.433238][T16784] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1181.433287][T16784] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1181.433335][T16784] ? ovl_next_opt+0x143/0x1c0 [ 1181.433394][T16784] ? __pfx_ovl_next_opt+0x10/0x10 [ 1181.433449][T16784] vfs_parse_monolithic_sep+0x195/0x210 [ 1181.433507][T16784] ? __pfx_vfs_parse_monolithic_sep+0x10/0x10 [ 1181.433563][T16784] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1181.433617][T16784] ? alloc_fs_context+0x65a/0xf40 [ 1181.433677][T16784] path_mount+0x77f/0x24c0 [ 1181.433734][T16784] ? __pfx_path_mount+0x10/0x10 [ 1181.433781][T16784] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1181.433829][T16784] ? lockdep_hardirqs_on+0x7d/0x110 [ 1181.433868][T16784] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1181.433921][T16784] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1181.433973][T16784] ? kmem_cache_free+0x127/0x6c0 [ 1181.434040][T16784] ? __x64_sys_mount+0x293/0x310 [ 1181.434088][T16784] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1181.434135][T16784] __x64_sys_mount+0x293/0x310 [ 1181.434187][T16784] ? __pfx___x64_sys_mount+0x10/0x10 [ 1181.434236][T16784] ? trace_syscall_enter+0xcc/0x120 [ 1181.434290][T16784] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1181.434346][T16784] do_syscall_64+0x123/0x790 [ 1181.434392][T16784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1181.434433][T16784] RIP: 0033:0x7f7c11b9e159 [ 1181.434466][T16784] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1181.434505][T16784] RSP: 002b:00007f7c12a11028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 1181.434544][T16784] RAX: ffffffffffffffda RBX: 00007f7c11e25fa0 RCX: 00007f7c11b9e159 [ 1181.434572][T16784] RDX: 0000200000000440 RSI: 0000200000000100 RDI: 0000000000000000 [ 1181.434606][T16784] RBP: 00007f7c11c3506b R08: 0000200000000140 R09: 0000000000000000 [ 1181.434633][T16784] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000000 [ 1181.434658][T16784] R13: 00007f7c11e26038 R14: 00007f7c11e25fa0 R15: 00007ffe7f249a28 [ 1181.434711][T16784] [ 1186.157593][ T31] audit: type=1800 audit(1789805083.726:64): pid=16810 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.9.3095" name="syzkaller0" dev="sda1" ino=2058 res=0 errno=0 [ 1190.890401][T16852] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1190.893832][T16852] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1195.021650][ T31] audit: type=1800 audit(1789805092.596:65): pid=16866 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.3112" name="syzkaller0" dev="sda1" ino=2058 res=0 errno=0 [ 1201.815131][T10455] usb 10-1: new full-speed USB device number 3 using dummy_hcd [ 1203.072194][T10455] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1203.088089][T10455] usb 10-1: config 1 has an invalid descriptor of length 48, skipping remainder of the config [ 1203.088284][T10455] usb 10-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 23 [ 1203.137909][T10455] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1203.137962][T10455] usb 10-1: SerialNumber: syz [ 1203.813020][ T31] audit: type=1800 audit(1789805101.386:66): pid=16919 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.3126" name="syzkaller0" dev="sda1" ino=2058 res=0 errno=0 [ 1207.753540][T10455] usb 10-1: can't set config #1, error -71 [ 1207.755293][T10455] usb 10-1: USB disconnect, device number 3 [ 1208.365756][T16963] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 conventional PCI endpoint [ 1210.160477][ T31] audit: type=1800 audit(1789805107.736:67): pid=16968 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.9.3142" name="syzkaller0" dev="sda1" ino=2058 res=0 errno=0 [ 1212.872346][T16991] event trace: Could not enable event p [ 1213.214634][T16995] overlayfs: missing 'lowerdir' [ 1213.835980][T16996] loop9: detected capacity change from 0 to 1024 [ 1213.984908][T16996] EXT4-fs (loop9): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 1213.991659][T16996] JBD2: no valid journal superblock found [ 1214.030818][T16996] EXT4-fs (loop9): Could not load journal inode [ 1214.607921][ T10] usb 6-1: new full-speed USB device number 52 using dummy_hcd [ 1214.821324][ T10] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1214.867657][ T10] usb 6-1: config 1 has an invalid descriptor of length 48, skipping remainder of the config [ 1214.868792][ T10] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 23 [ 1215.130718][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1215.130752][ T10] usb 6-1: SerialNumber: syz [ 1215.164149][ T10] hub 6-1:1.0: bad descriptor, ignoring hub [ 1215.164177][ T10] hub 6-1:1.0: probe with driver hub failed with error -5 [ 1215.164788][ T10] cdc_acm 6-1:1.0: Control and data interfaces are not separated! [ 1215.164810][ T10] cdc_acm 6-1:1.0: This needs exactly 3 endpoints [ 1215.164837][ T10] cdc_acm 6-1:1.0: probe with driver cdc_acm failed with error -22 [ 1217.650377][T11056] usb 6-1: USB disconnect, device number 52 [ 1220.756261][T17027] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 conventional PCI endpoint [ 1222.995879][ T31] audit: type=1800 audit(1789805120.566:68): pid=17036 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.3164" name="syzkaller0" dev="sda1" ino=2058 res=0 errno=0 [ 1224.042437][T17042] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3165'. [ 1224.143802][T17042] erspan0: entered promiscuous mode [ 1224.156201][T17042] macvtap3: entered promiscuous mode [ 1224.156431][T17042] macvtap3: entered allmulticast mode [ 1224.156457][T17042] erspan0: entered allmulticast mode [ 1224.225175][T17044] erspan0: left allmulticast mode [ 1224.225363][T17044] erspan0: left promiscuous mode [ 1224.305300][T17049] overlayfs: missing 'lowerdir' [ 1224.405495][T17044] macvtap3: left promiscuous mode [ 1224.405546][T17044] macvtap3: left allmulticast mode [ 1226.099893][T17063] loop7: detected capacity change from 0 to 1024 [ 1226.202891][T17063] EXT4-fs (loop7): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 1226.205679][T17063] JBD2: no valid journal superblock found [ 1226.205928][T17063] EXT4-fs (loop7): Could not load journal inode [ 1229.634530][T17084] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1229.637890][T17084] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1232.660618][T17098] netlink: 52 bytes leftover after parsing attributes in process `syz.6.3178'. [ 1233.157396][ T31] audit: type=1800 audit(1789805130.726:69): pid=17099 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.3181" name="syzkaller0" dev="sda1" ino=2058 res=0 errno=0 [ 1236.130793][ T31] audit: type=1800 audit(1789805133.696:70): pid=17104 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.3181" name="syzkaller0" dev="sda1" ino=2058 res=0 errno=0 [ 1236.674117][T17122] overlayfs: missing 'lowerdir' [ 1238.107907][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 1238.107992][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 1239.074869][T17133] loop7: detected capacity change from 0 to 1024 [ 1239.085740][T17133] EXT4-fs (loop7): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 1239.092342][T17133] JBD2: no valid journal superblock found [ 1239.104199][T17135] loop5: detected capacity change from 0 to 512 [ 1239.235166][T17120] lo speed is unknown, defaulting to 1000 [ 1239.285405][T17133] EXT4-fs (loop7): Could not load journal inode [ 1242.132028][T11056] usb 7-1: new full-speed USB device number 31 using dummy_hcd [ 1242.321989][T11056] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1242.330395][T11056] usb 7-1: config 1 has an invalid descriptor of length 48, skipping remainder of the config [ 1242.330501][T11056] usb 7-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 23 [ 1242.359535][T11056] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1242.359588][T11056] usb 7-1: SerialNumber: syz [ 1242.981524][T11056] hub 7-1:1.0: bad descriptor, ignoring hub [ 1242.981633][T11056] hub 7-1:1.0: probe with driver hub failed with error -5 [ 1243.095898][T11056] cdc_acm 7-1:1.0: Control and data interfaces are not separated! [ 1243.095952][T11056] cdc_acm 7-1:1.0: This needs exactly 3 endpoints [ 1243.096006][T11056] cdc_acm 7-1:1.0: probe with driver cdc_acm failed with error -22 [ 1244.937687][ T30] usb 7-1: USB disconnect, device number 31 [ 1248.370440][T17187] overlayfs: missing 'lowerdir' [ 1250.576333][T17199] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1250.587686][T17199] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1250.590165][T17199] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1250.602042][T17199] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1250.604236][T17199] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1251.187382][T17208] loop6: detected capacity change from 0 to 512 [ 1252.661678][T10764] Bluetooth: hci5: command tx timeout [ 1254.787816][T10764] Bluetooth: hci5: command tx timeout [ 1255.659059][T17226] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1255.663457][T17226] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1256.798925][T10455] usb 8-1: new high-speed USB device number 24 using dummy_hcd [ 1256.817347][T10764] Bluetooth: hci5: command tx timeout [ 1256.989215][T10455] usb 8-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 1257.080014][T10455] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1257.080605][T10455] usb 8-1: config 0 has no interfaces? [ 1257.140241][ T1166] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1257.143894][T10455] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1257.143934][T10455] usb 8-1: Product: syz [ 1257.143962][T10455] usb 8-1: Manufacturer: syz [ 1257.143989][T10455] usb 8-1: SerialNumber: syz [ 1257.201245][T10455] usb 8-1: config 0 descriptor?? [ 1258.164697][T10455] usb 8-1: USB disconnect, device number 24 [ 1258.897295][T10764] Bluetooth: hci5: command tx timeout [ 1260.063479][ T1166] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1260.331208][ T1166] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1260.420343][T17246] loop7: detected capacity change from 0 to 1024 [ 1260.440932][T17246] EXT4-fs (loop7): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 1260.470453][T17246] JBD2: no valid journal superblock found [ 1260.482274][T17246] EXT4-fs (loop7): Could not load journal inode [ 1262.159672][T17262] loop4: detected capacity change from 0 to 512 [ 1262.519200][ T1166] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1262.819549][T17197] lo speed is unknown, defaulting to 1000 [ 1267.141290][ T1166] bridge_slave_1: left allmulticast mode [ 1267.141327][ T1166] bridge_slave_1: left promiscuous mode [ 1267.141556][ T1166] bridge0: port 2(bridge_slave_1) entered disabled state [ 1267.181558][ T1166] bridge_slave_0: left allmulticast mode [ 1267.181592][ T1166] bridge_slave_0: left promiscuous mode [ 1267.181841][ T1166] bridge0: port 1(bridge_slave_0) entered disabled state [ 1269.876832][ T5834] usb 6-1: new full-speed USB device number 53 using dummy_hcd [ 1269.877102][ C1] raw-gadget.0 gadget.5: ignoring, device is not running [ 1270.111347][ T5834] usb 6-1: device descriptor read/64, error -32 [ 1270.892438][ T5834] usb 6-1: new full-speed USB device number 54 using dummy_hcd [ 1270.892691][ C1] raw-gadget.0 gadget.5: ignoring, device is not running [ 1271.017626][ T5834] usb 6-1: device descriptor read/64, error -32 [ 1271.127711][ T5834] usb usb6-port1: attempt power cycle [ 1271.246453][ T1166] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1271.302713][ T1166] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1271.330339][ T1166] bond0 (unregistering): Released all slaves [ 1271.474074][ T5834] usb 6-1: new full-speed USB device number 55 using dummy_hcd [ 1271.498029][ C1] raw-gadget.0 gadget.5: failed to queue control event [ 1271.498305][ T5834] usb 6-1: device descriptor read/8, error -32 [ 1271.608051][ T5834] raw-gadget.0 gadget.5: failed to queue suspend event [ 1271.610989][ T5834] raw-gadget.0 gadget.5: failed to queue reset event [ 1271.691938][ T5834] raw-gadget.0 gadget.5: failed to queue resume event [ 1271.748160][ T5834] usb 6-1: new full-speed USB device number 56 using dummy_hcd [ 1271.769918][ C1] raw-gadget.0 gadget.5: ignoring, device is not running [ 1271.771747][ T5834] usb 6-1: device descriptor read/8, error -32 [ 1271.878521][ T5834] raw-gadget.0 gadget.5: failed to queue suspend event [ 1271.880165][ T5834] usb usb6-port1: unable to enumerate USB device [ 1273.856371][T17290] raw-gadget.0 gadget.5: failed to queue disconnect event [ 1277.425011][ T31] audit: type=1326 audit(1789805174.996:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17336 comm="syz.4.3241" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7c11b9e159 code=0x7ffc0000 [ 1277.425236][ T31] audit: type=1326 audit(1789805174.996:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17336 comm="syz.4.3241" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7c11b9e159 code=0x7ffc0000 [ 1277.479930][ T31] audit: type=1326 audit(1789805175.006:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17336 comm="syz.4.3241" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7c11b9e159 code=0x7ffc0000 [ 1277.480011][ T31] audit: type=1326 audit(1789805175.036:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17336 comm="syz.4.3241" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7c11b9e159 code=0x7ffc0000 [ 1277.480085][ T31] audit: type=1326 audit(1789805175.036:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17336 comm="syz.4.3241" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f7c11b9e159 code=0x7ffc0000 [ 1277.480160][ T31] audit: type=1326 audit(1789805175.036:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17336 comm="syz.4.3241" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7c11b9e159 code=0x7ffc0000 [ 1277.480234][ T31] audit: type=1326 audit(1789805175.036:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17336 comm="syz.4.3241" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7c11b9e159 code=0x7ffc0000 [ 1277.480307][ T31] audit: type=1326 audit(1789805175.036:78): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17336 comm="syz.4.3241" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7c11b9e159 code=0x7ffc0000 [ 1277.480380][ T31] audit: type=1326 audit(1789805175.036:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17336 comm="syz.4.3241" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7f7c11b9e159 code=0x7ffc0000 [ 1277.480454][ T31] audit: type=1326 audit(1789805175.036:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17336 comm="syz.4.3241" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7c11b9e159 code=0x7ffc0000 [ 1277.821225][ T1166] hsr_slave_0: left promiscuous mode [ 1277.837373][ T1166] hsr_slave_1: left promiscuous mode [ 1277.838334][ T1166] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1277.838362][ T1166] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1277.845673][ T1166] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1277.845701][ T1166] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1277.935033][ T1166] veth1_macvtap: left promiscuous mode [ 1277.935084][ T1166] veth0_macvtap: left promiscuous mode [ 1277.935217][ T1166] veth1_vlan: left promiscuous mode [ 1277.935326][ T1166] veth0_vlan: left promiscuous mode [ 1278.361764][T17347] loop4: detected capacity change from 0 to 1024 [ 1278.391333][T17347] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 1278.421367][T17347] JBD2: no valid journal superblock found [ 1278.435927][T17347] EXT4-fs (loop4): Could not load journal inode [ 1281.020871][T17364] loop5: detected capacity change from 0 to 512 [ 1284.569981][ T1166] team0 (unregistering): Port device team_slave_1 removed [ 1284.630871][ T1166] team0 (unregistering): Port device team_slave_0 removed [ 1286.149544][T17411] loop6: detected capacity change from 0 to 1024 [ 1286.215781][T17411] EXT4-fs (loop6): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 1286.254360][T17411] JBD2: no valid journal superblock found [ 1286.532221][T17413] loop5: detected capacity change from 0 to 512 [ 1286.939869][T17411] EXT4-fs (loop6): Could not load journal inode [ 1286.945561][ T5274] 8021q: adding VLAN 0 to HW filter on device eth9 [ 1287.018512][T17400] syzkaller0: left promiscuous mode [ 1287.018543][T17400] syzkaller0: left allmulticast mode [ 1287.262108][T17197] bridge0: port 1(bridge_slave_0) entered blocking state [ 1287.262235][T17197] bridge0: port 1(bridge_slave_0) entered disabled state [ 1287.262397][T17197] bridge_slave_0: entered allmulticast mode [ 1287.269185][T17197] bridge_slave_0: entered promiscuous mode [ 1287.329435][T17197] bridge0: port 2(bridge_slave_1) entered blocking state [ 1287.332966][T17197] bridge0: port 2(bridge_slave_1) entered disabled state [ 1287.333128][T17197] bridge_slave_1: entered allmulticast mode [ 1287.366216][T17197] bridge_slave_1: entered promiscuous mode [ 1287.914914][T17197] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1287.954219][T17197] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1288.116296][T17197] team0: Port device team_slave_0 added [ 1288.158294][T17197] team0: Port device team_slave_1 added [ 1288.424867][T17197] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1288.424895][T17197] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1288.424943][T17197] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1288.478018][T17197] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1288.478042][T17197] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1288.478089][T17197] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1288.547074][ T31] kauditd_printk_skb: 48 callbacks suppressed [ 1288.547101][ T31] audit: type=1326 audit(1789805186.116:127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17431 comm="syz.5.3270" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe5a2b9e159 code=0x7ffc0000 [ 1288.594118][ T31] audit: type=1326 audit(1789805186.176:128): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17431 comm="syz.5.3270" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe5a2b9e159 code=0x7ffc0000 [ 1288.985703][ T31] audit: type=1326 audit(1789805186.556:129): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17431 comm="syz.5.3270" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe5a2b9e159 code=0x7ffc0000 [ 1288.985789][ T31] audit: type=1326 audit(1789805186.556:130): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17431 comm="syz.5.3270" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe5a2b9e159 code=0x7ffc0000 [ 1289.073461][ T31] audit: type=1326 audit(1789805186.646:131): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17431 comm="syz.5.3270" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=442 compat=0 ip=0x7fe5a2b9e159 code=0x7ffc0000 [ 1289.118049][ T31] audit: type=1326 audit(1789805186.646:132): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17431 comm="syz.5.3270" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe5a2b9e159 code=0x7ffc0000 [ 1289.177652][ T31] audit: type=1326 audit(1789805186.686:133): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17431 comm="syz.5.3270" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe5a2b9e159 code=0x7ffc0000 [ 1289.177881][ T31] audit: type=1326 audit(1789805186.736:135): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17431 comm="syz.5.3270" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe5a2b9e159 code=0x7ffc0000 [ 1289.178143][ T31] audit: type=1326 audit(1789805186.686:134): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17431 comm="syz.5.3270" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe5a2b9e159 code=0x7ffc0000 [ 1289.295053][ T31] audit: type=1326 audit(1789805186.736:136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17431 comm="syz.5.3270" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fe5a2b9e159 code=0x7ffc0000 [ 1291.401125][T17440] loop7: detected capacity change from 0 to 512 [ 1291.602478][T17197] hsr_slave_0: entered promiscuous mode [ 1291.620791][T17197] hsr_slave_1: entered promiscuous mode [ 1291.637663][T17197] debugfs: 'hsr0' already exists in 'hsr' [ 1291.637693][T17197] Cannot create hsr debugfs directory [ 1291.712600][T17440] FAT-fs (loop7): error, fat_free_clusters: deleting FAT entry beyond EOF [ 1291.712638][T17440] FAT-fs (loop7): Filesystem has been set read-only [ 1294.349098][ T5739] usb 5-1: new full-speed USB device number 56 using dummy_hcd [ 1294.514690][ T5739] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1294.536305][ T5739] usb 5-1: config 1 has an invalid descriptor of length 48, skipping remainder of the config [ 1294.536477][ T5739] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 23 [ 1294.552709][ T5739] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1294.552811][ T5739] usb 5-1: SerialNumber: syz [ 1294.687057][T17459] loop5: detected capacity change from 0 to 512 [ 1294.838771][ T5739] hub 5-1:1.0: bad descriptor, ignoring hub [ 1294.838901][ T5739] hub 5-1:1.0: probe with driver hub failed with error -5 [ 1294.889602][ T5739] cdc_acm 5-1:1.0: Control and data interfaces are not separated! [ 1294.889660][ T5739] cdc_acm 5-1:1.0: This needs exactly 3 endpoints [ 1294.889780][ T5739] cdc_acm 5-1:1.0: probe with driver cdc_acm failed with error -22 [ 1296.589393][ T5834] usb 5-1: USB disconnect, device number 56 [ 1297.151639][T17197] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1297.443561][ T5274] 8021q: adding VLAN 0 to HW filter on device eth10 [ 1297.636559][T17197] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1297.936726][T17197] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1298.246566][T17197] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1299.539978][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 1299.540057][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 1300.184175][T17197] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1300.216273][T17197] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1300.236126][T17197] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1300.302146][T17197] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1300.324278][T17197] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1300.365622][T17197] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1300.380733][T17197] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1300.426911][T17197] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1300.872089][T17542] loop5: detected capacity change from 0 to 512 [ 1301.025665][T17197] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1301.141597][T17197] 8021q: adding VLAN 0 to HW filter on device team0 [ 1301.199650][T13251] bridge0: port 1(bridge_slave_0) entered blocking state [ 1301.199778][T13251] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1301.276214][ T5973] bridge0: port 2(bridge_slave_1) entered blocking state [ 1301.276350][ T5973] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1301.727554][T17546] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1301.727790][T17546] block device autoloading is deprecated and will be removed. [ 1301.803418][ T5274] 8021q: adding VLAN 0 to HW filter on device eth11 [ 1304.625824][T17197] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1304.914023][T17197] veth0_vlan: entered promiscuous mode [ 1304.958821][T17197] veth1_vlan: entered promiscuous mode [ 1305.095491][ T5274] 8021q: adding VLAN 0 to HW filter on device eth12 [ 1305.445732][T17197] veth0_macvtap: entered promiscuous mode [ 1305.465077][T17197] veth1_macvtap: entered promiscuous mode [ 1305.555682][T17197] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1305.623267][T17197] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1305.669848][ T5966] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1305.670398][ T5966] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1305.670605][ T59] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1305.670667][ T59] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1306.469100][T17634] netlink: 'syz.4.3319': attribute type 6 has an invalid length. [ 1306.812151][ T6297] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1306.812194][ T6297] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1307.029670][T13251] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1307.029732][T13251] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1308.697761][T17199] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1308.705443][T17199] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1308.717960][T17199] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1308.735959][T17199] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1308.744310][T17199] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1310.781139][T17682] loop5: detected capacity change from 0 to 512 [ 1310.807504][T17199] Bluetooth: hci3: command tx timeout [ 1311.741844][T17695] loop2: detected capacity change from 0 to 128 [ 1312.363201][T17668] lo speed is unknown, defaulting to 1000 [ 1312.887897][T17199] Bluetooth: hci3: command tx timeout [ 1314.617307][ T30] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 1314.786252][ T30] usb 5-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 1314.805338][ T30] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1314.805404][ T30] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 1314.805454][ T30] usb 5-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 1314.805519][ T30] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1314.968232][T17199] Bluetooth: hci3: command tx timeout [ 1315.198857][ T30] cxacru_cm: 14 callbacks suppressed [ 1315.198891][ T30] cxacru 5-1:1.0: invalid response length to cm 0x90: 63 [ 1315.206004][T17740] cxacru 5-1:1.0: Direct firmware load for cxacru-fw.bin failed with error -2 [ 1315.206043][T17740] cxacru 5-1:1.0: Falling back to sysfs fallback for: cxacru-fw.bin [ 1315.487134][ T5623] usb 5-1: USB disconnect, device number 57 [ 1315.937784][T17749] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1315.937810][T17749] IPv6: NLM_F_CREATE should be set when creating new route [ 1316.460279][T17749] bridge0: port 2(bridge_slave_1) entered disabled state [ 1316.460925][T17749] bridge0: port 1(bridge_slave_0) entered disabled state [ 1317.048800][T17199] Bluetooth: hci3: command tx timeout [ 1317.433412][T17749] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1317.459272][T17749] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1320.847984][ T5969] netdevsim netdevsim7 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1320.852713][ T5968] netdevsim netdevsim7 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1320.852784][ T5968] netdevsim netdevsim7 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1320.865530][ T5966] netdevsim netdevsim7 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1320.871027][T17668] bridge0: port 1(bridge_slave_0) entered blocking state [ 1320.871145][T17668] bridge0: port 1(bridge_slave_0) entered disabled state [ 1320.871302][T17668] bridge_slave_0: entered allmulticast mode [ 1320.892410][T17668] bridge_slave_0: entered promiscuous mode [ 1320.922984][T17668] bridge0: port 2(bridge_slave_1) entered blocking state [ 1320.923109][T17668] bridge0: port 2(bridge_slave_1) entered disabled state [ 1320.936793][T17668] bridge_slave_1: entered allmulticast mode [ 1320.962685][T17668] bridge_slave_1: entered promiscuous mode [ 1321.324137][T17668] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1321.336722][T17668] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1321.417284][ T5753] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 1321.573740][ T5753] usb 6-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 1321.576718][ T5753] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1321.576782][ T5753] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 1321.576831][ T5753] usb 6-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 1321.576896][ T5753] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1321.711640][T17668] team0: Port device team_slave_0 added [ 1321.743703][T17668] team0: Port device team_slave_1 added [ 1322.121852][ T5753] cxacru 6-1:1.0: invalid response length to cm 0x90: 63 [ 1322.282253][ T5753] usb 6-1: USB disconnect, device number 57 [ 1323.151472][T17668] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1323.151499][T17668] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1323.151548][T17668] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1323.176877][T17668] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1323.179207][T17668] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1323.179256][T17668] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1323.656715][T17668] hsr_slave_0: entered promiscuous mode [ 1323.662396][T17823] loop2: detected capacity change from 0 to 164 [ 1323.676860][T17668] hsr_slave_1: entered promiscuous mode [ 1323.690912][T17668] debugfs: 'hsr0' already exists in 'hsr' [ 1323.690941][T17668] Cannot create hsr debugfs directory [ 1324.422474][T17823] isofs_fill_super: root inode is not a directory. Corrupted media? [ 1327.426499][T17668] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1328.421600][T17879] tun0: tun_chr_ioctl cmd 1074025680 [ 1328.425386][T17879] tun0: tun_chr_ioctl cmd 1074812117 [ 1330.360062][T17668] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1330.387879][ T10] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 1330.558775][ T10] usb 3-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 1330.560411][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1330.560479][ T10] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 1330.560529][ T10] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 1330.560595][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1330.778212][T17668] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1331.118825][ T10] cxacru 3-1:1.0: send of cm 0x91 failed (-71) [ 1331.118866][ T10] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 1331.118890][ T10] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 1331.152120][ T10] cxacru 3-1:1.0: probe with driver cxacru failed with error -71 [ 1331.184893][ T10] usb 3-1: USB disconnect, device number 23 [ 1331.238581][T17668] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1332.494386][T17668] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1332.558602][T17668] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1332.574118][T17668] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1332.628992][T17668] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1332.636439][T17668] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1332.710751][T17668] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1332.721003][T17668] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1333.693069][T17668] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1334.501898][T17942] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 conventional PCI endpoint [ 1336.175654][T17668] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1336.264467][T17668] 8021q: adding VLAN 0 to HW filter on device team0 [ 1336.285439][ T5973] bridge0: port 1(bridge_slave_0) entered blocking state [ 1336.285564][ T5973] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1336.324353][ T5973] bridge0: port 2(bridge_slave_1) entered blocking state [ 1336.324476][ T5973] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1336.774631][T17955] bridge0: port 1(bridge_slave_0) entered disabled state [ 1338.157333][ T10] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 1338.308520][ T10] usb 3-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 1338.310237][ T10] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1338.310317][ T10] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 1338.310367][ T10] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 1338.310432][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1339.537327][ T10] cxacru 3-1:1.0: send of cm 0x91 failed (-71) [ 1339.537369][ T10] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 1339.537393][ T10] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 1339.545911][ T10] cxacru 3-1:1.0: probe with driver cxacru failed with error -71 [ 1340.569806][ T10] usb 3-1: USB disconnect, device number 24 [ 1342.139510][T18011] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 conventional PCI endpoint [ 1344.174863][T17668] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1344.982732][T17668] veth0_vlan: entered promiscuous mode [ 1345.078259][T17668] veth1_vlan: entered promiscuous mode [ 1345.393885][T17668] veth0_macvtap: entered promiscuous mode [ 1345.454544][T17668] veth1_macvtap: entered promiscuous mode [ 1345.621502][T17668] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1345.709751][T17668] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1345.785494][ T5973] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1345.793607][ T59] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1345.794087][ T59] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1345.794573][ T59] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1345.840680][ T30] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 1346.021015][ T30] usb 3-1: New USB device found, idVendor=0572, idProduct=cafe, bcdDevice= 1.00 [ 1346.049978][ T30] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1346.050856][ T30] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 229, setting to 64 [ 1346.051074][ T30] usb 3-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 4 [ 1346.052701][ T30] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1346.549514][T18067] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3427'. [ 1346.770991][ T30] cxacru 3-1:1.0: send of cm 0x91 failed (-71) [ 1346.771082][ T30] ATM dev 0: cxacru_atm_start: CARD_GET_MAC_ADDRESS returned -71 [ 1346.771132][ T30] ATM dev 0: usbatm_atm_init: atm_start failed: -71! [ 1347.551901][ T30] cxacru 3-1:1.0: probe with driver cxacru failed with error -71 [ 1347.604091][T18067] vlan2: entered promiscuous mode [ 1347.604120][T18067] syz_tun: entered promiscuous mode [ 1347.619409][ T30] usb 3-1: USB disconnect, device number 25 [ 1347.951897][ T5973] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1347.951929][ T5973] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1348.199518][T13251] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1348.199552][T13251] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1350.024415][T10764] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1350.035472][T10764] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1350.036365][T10764] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1350.052023][T10764] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1350.054819][T10764] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1351.126131][T18119] netlink: 52 bytes leftover after parsing attributes in process `syz.4.3429'. [ 1351.831087][ T5973] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1352.167647][T17199] Bluetooth: hci0: command tx timeout [ 1352.968972][ T5973] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1353.337449][ T5973] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1353.463436][T18112] lo speed is unknown, defaulting to 1000 [ 1354.581228][T17199] Bluetooth: hci0: command tx timeout [ 1354.743749][ T5973] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1354.998811][T18171] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3455'. [ 1355.085819][T18175] loop4: detected capacity change from 0 to 128 [ 1355.102606][T18175] FAT-fs (loop4): Invalid FSINFO signature: 0x00000000, 0x61417272 (sector = 1) [ 1355.102664][T18175] FAT-fs (loop4): data area starts beyond volume (36 > 6) [ 1355.102701][T18175] FAT-fs (loop4): Can't find a valid FAT filesystem [ 1355.713119][ T5973] bridge_slave_1: left allmulticast mode [ 1355.713155][ T5973] bridge_slave_1: left promiscuous mode [ 1355.713391][ T5973] bridge0: port 2(bridge_slave_1) entered disabled state [ 1355.781902][ T5973] bridge_slave_0: left allmulticast mode [ 1355.781938][ T5973] bridge_slave_0: left promiscuous mode [ 1355.782158][ T5973] bridge0: port 1(bridge_slave_0) entered disabled state [ 1356.647352][T17199] Bluetooth: hci0: command tx timeout [ 1357.783128][ T5973] bond0 (unregistering): (slave 30): Releasing backup interface [ 1357.979379][T18206] loop4: detected capacity change from 0 to 512 [ 1358.061501][ T5973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1358.099001][ T5973] bond0 (unregistering): Released all slaves [ 1358.796819][T17199] Bluetooth: hci0: command tx timeout [ 1358.977232][T18210] loop6: detected capacity change from 0 to 164 [ 1359.333467][T18218] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1359.333507][T18218] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 1359.333527][T18218] overlayfs: missing 'lowerdir' [ 1359.626921][T18224] netlink: 24 bytes leftover after parsing attributes in process `syz.7.3466'. [ 1360.454477][T18112] bridge0: port 1(bridge_slave_0) entered blocking state [ 1360.454602][T18112] bridge0: port 1(bridge_slave_0) entered disabled state [ 1360.454778][T18112] bridge_slave_0: entered allmulticast mode [ 1360.490325][T18112] bridge_slave_0: entered promiscuous mode [ 1360.531714][T18112] bridge0: port 2(bridge_slave_1) entered blocking state [ 1360.531857][T18112] bridge0: port 2(bridge_slave_1) entered disabled state [ 1360.532017][T18112] bridge_slave_1: entered allmulticast mode [ 1360.536972][T18112] bridge_slave_1: entered promiscuous mode [ 1360.799225][T18112] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1360.877563][T18112] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1360.970574][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 1360.970650][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 1361.093410][ T5973] hsr_slave_0: left promiscuous mode [ 1361.096460][ T5973] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1361.096490][ T5973] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1361.101481][ T5973] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1361.101511][ T5973] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1361.264593][ T5973] veth1_macvtap: left promiscuous mode [ 1361.264688][ T5973] veth0_macvtap: left promiscuous mode [ 1361.283592][ T5973] veth1_vlan: left promiscuous mode [ 1361.283693][ T5973] veth0_vlan: left promiscuous mode [ 1362.532697][ T5973] team0 (unregistering): Port device team_slave_1 removed [ 1362.865272][ T5973] team0 (unregistering): Port device team_slave_0 removed [ 1364.308213][T18274] loop2: detected capacity change from 0 to 512 [ 1364.778699][T18281] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3485'. [ 1365.165704][ T5274] 8021q: adding VLAN 0 to HW filter on device eth13 [ 1365.175607][T18112] team0: Port device team_slave_0 added [ 1365.193532][T18112] team0: Port device team_slave_1 added [ 1365.629429][T18112] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1365.629456][T18112] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1365.629505][T18112] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1365.642570][T18112] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1365.642593][T18112] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1365.642640][T18112] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1368.077160][T18112] hsr_slave_0: entered promiscuous mode [ 1368.094709][T18112] hsr_slave_1: entered promiscuous mode [ 1368.726817][T18320] netlink: 52 bytes leftover after parsing attributes in process `syz.7.3498'. [ 1369.564175][ T5973] IPVS: stop unused estimator thread 0... [ 1372.146083][T18112] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1372.376929][T18112] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1373.094836][T18112] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1373.280961][T18112] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1373.282521][T18112] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1373.287267][T10764] Bluetooth: hci5: command 0x0406 tx timeout [ 1373.334510][T18112] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1373.350546][T18379] 9p: Bad value for 'wfdno' [ 1373.364749][T18112] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1373.389368][T18112] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1374.022085][T18112] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1374.102049][T18112] 8021q: adding VLAN 0 to HW filter on device team0 [ 1374.132681][ T6297] bridge0: port 1(bridge_slave_0) entered blocking state [ 1374.132808][ T6297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1374.200490][ T73] bridge0: port 2(bridge_slave_1) entered blocking state [ 1374.200615][ T73] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1374.389153][ T31] audit: type=1800 audit(1789805271.956:151): pid=18405 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.3517" name=08 dev="sda1" ino=2061 res=0 errno=0 [ 1375.926647][T18431] 9p: Bad value for 'wfdno' [ 1376.540410][T17810] cxacru 6-1:1.0: firmware (cxacru-fw.bin) unavailable (system misconfigured?) [ 1376.880168][T17740] cxacru 5-1:1.0: firmware (cxacru-fw.bin) unavailable (system misconfigured?) [ 1378.312342][T18465] fuse: Bad value for 'fd' [ 1378.333659][T18463] bond1: entered allmulticast mode [ 1378.334171][T18463] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1378.778827][T18112] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1379.934745][T18485] loop2: detected capacity change from 0 to 512 [ 1381.845814][T18516] loop2: detected capacity change from 0 to 512 [ 1381.868540][T18516] FAT-fs (loop2): error, fat_get_cluster: invalid cluster chain (i_pos 1) [ 1381.868596][T18516] FAT-fs (loop2): Filesystem has been set read-only [ 1382.114769][T18112] veth0_vlan: entered promiscuous mode [ 1382.174711][T18112] veth1_vlan: entered promiscuous mode [ 1382.395563][T18112] veth0_macvtap: entered promiscuous mode [ 1382.434403][T18112] veth1_macvtap: entered promiscuous mode [ 1382.572238][T18112] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1382.622829][T18112] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1382.647688][ T30] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 1382.697912][T11483] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1382.698100][T11483] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1382.698162][T11483] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1382.698223][T11483] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1382.741863][T18532] loop7: detected capacity change from 0 to 128 [ 1382.764254][T18531] fuse: Bad value for 'fd' [ 1382.827289][ T30] usb 5-1: Using ep0 maxpacket: 8 [ 1382.829340][ T30] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1382.834499][ T30] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 1382.834539][ T30] usb 5-1: config 0 has no interface number 0 [ 1382.834593][ T30] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1382.834651][ T30] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1382.920785][ T30] usb 5-1: config 0 descriptor?? [ 1382.936844][ T30] iowarrior 5-1:0.1: no interrupt-in endpoint found [ 1383.170637][T18532] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 1383.170667][T18532] overlayfs: failed to set xattr on upper [ 1383.170681][T18532] overlayfs: ...falling back to redirect_dir=nofollow. [ 1383.170696][T18532] overlayfs: ...falling back to index=off. [ 1383.170711][T18532] overlayfs: ...falling back to uuid=null. [ 1383.224364][ T5623] usb 5-1: USB disconnect, device number 58 [ 1383.248871][T13251] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1383.248901][T13251] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1383.506853][T13251] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1383.506887][T13251] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1385.420820][T18565] netlink: 'syz.5.3550': attribute type 9 has an invalid length. [ 1386.761783][T10764] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1386.766663][T10764] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1386.786966][T10764] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1386.801719][T10764] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1386.803963][T10764] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1388.267990][T18587] loop6: detected capacity change from 0 to 256 [ 1388.373997][ T31] audit: type=1326 audit(1789805285.946:152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18586 comm="syz.6.3557" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efcf019e159 code=0x7ffc0000 [ 1388.406248][ T31] audit: type=1326 audit(1789805285.966:153): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18586 comm="syz.6.3557" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efcf019e159 code=0x7ffc0000 [ 1388.406327][ T31] audit: type=1326 audit(1789805285.966:154): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18586 comm="syz.6.3557" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=435 compat=0 ip=0x7efcf019e159 code=0x7ffc0000 [ 1388.654671][ T31] audit: type=1326 audit(1789805286.226:155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18586 comm="syz.6.3557" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efcf019e159 code=0x7ffc0000 [ 1388.655500][ T31] audit: type=1326 audit(1789805286.226:157): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18594 comm="syz.6.3557" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7efcf015e98e code=0x7ffc0000 [ 1388.686172][ T31] audit: type=1326 audit(1789805286.226:156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18586 comm="syz.6.3557" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efcf019e159 code=0x7ffc0000 [ 1388.886488][ T31] audit: type=1326 audit(1789805286.456:158): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18586 comm="syz.6.3557" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=424 compat=0 ip=0x7efcf019e159 code=0x7ffc0000 [ 1388.915176][T17199] Bluetooth: hci2: command tx timeout [ 1388.916760][ T31] audit: type=1326 audit(1789805286.486:159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18586 comm="syz.6.3557" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efcf019e159 code=0x7ffc0000 [ 1388.923626][ T31] audit: type=1326 audit(1789805286.496:160): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18586 comm="syz.6.3557" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7efcf019e159 code=0x7ffc0000 [ 1388.937300][ T31] audit: type=1326 audit(1789805286.496:161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18586 comm="syz.6.3557" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=448 compat=0 ip=0x7efcf019e159 code=0x7ffc0000 [ 1389.047492][T11056] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 1389.120752][T10107] FAT-fs (loop6): error, corrupted directory (invalid entries) [ 1389.121507][T10107] FAT-fs (loop6): error, corrupted directory (invalid entries) [ 1389.198590][T11056] usb 6-1: Using ep0 maxpacket: 8 [ 1389.204209][T11056] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1389.210425][T11056] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 1389.210464][T11056] usb 6-1: config 0 has no interface number 0 [ 1389.210519][T11056] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1389.210576][T11056] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1389.232479][T11056] usb 6-1: config 0 descriptor?? [ 1389.256243][T11056] iowarrior 6-1:0.1: no interrupt-in endpoint found [ 1389.509863][ T30] usb 6-1: USB disconnect, device number 58 [ 1389.530801][T13251] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1389.977824][T13251] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1390.992210][T17199] Bluetooth: hci2: command tx timeout [ 1391.293508][T13251] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1391.412817][T13251] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1391.479427][T18577] lo speed is unknown, defaulting to 1000 [ 1391.757465][T18626] netlink: 'syz.2.3566': attribute type 9 has an invalid length. [ 1392.269569][T18628] pci 0000:00:01.0: [8086:7110] type 00 class 0x060100 conventional PCI endpoint [ 1393.057273][T17199] Bluetooth: hci2: command tx timeout [ 1394.792991][T10764] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1394.806802][T10764] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1394.820644][T10764] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1394.823696][T10764] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1394.825347][T10764] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1395.127293][T17199] Bluetooth: hci2: command tx timeout [ 1395.556759][T13251] bridge_slave_1: left allmulticast mode [ 1395.556797][T13251] bridge_slave_1: left promiscuous mode [ 1395.557477][T13251] bridge0: port 2(bridge_slave_1) entered disabled state [ 1395.572793][T13251] bridge_slave_0: left allmulticast mode [ 1395.572824][T13251] bridge_slave_0: left promiscuous mode [ 1395.574407][T13251] bridge0: port 1(bridge_slave_0) entered disabled state [ 1396.177121][T18650] loop5: detected capacity change from 0 to 256 [ 1396.306142][T18650] overlayfs: missing 'lowerdir' [ 1396.887455][T17199] Bluetooth: hci1: command tx timeout [ 1398.090383][T13251] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1398.109078][T13251] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1398.116161][T13251] bond0 (unregistering): Released all slaves [ 1398.294623][T18684] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1398.300544][T18684] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1398.337900][T17950] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 1398.824716][T17950] usb 3-1: Using ep0 maxpacket: 8 [ 1398.944333][T17950] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1398.973808][T17950] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1398.973850][T17950] usb 3-1: config 0 has no interface number 0 [ 1398.973905][T17950] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1398.973963][T17950] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1398.996269][T17199] Bluetooth: hci1: command tx timeout [ 1399.107778][T13251] tipc: Disabling bearer [ 1399.293511][T13251] tipc: Left network mode [ 1399.546846][T17950] usb 3-1: config 0 descriptor?? [ 1400.207588][T17950] iowarrior 3-1:0.1: no interrupt-in endpoint found [ 1401.047582][T17199] Bluetooth: hci1: command tx timeout [ 1401.107937][T17950] usb 3-1: USB disconnect, device number 26 [ 1401.426262][T13251] batman_adv: batadv0: Interface deactivated: macvtap1 [ 1401.513619][T13251] batman_adv: batadv0: Removing interface: macvtap1 [ 1401.703629][T18695] netlink: 'syz.2.3581': attribute type 9 has an invalid length. [ 1402.214589][ T5274] 8021q: adding VLAN 0 to HW filter on device eth13 [ 1402.891998][T18708] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3583'. [ 1402.897713][T18708] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3583'. [ 1403.147426][T17199] Bluetooth: hci1: command tx timeout [ 1403.916393][T13251] hsr_slave_0: left promiscuous mode [ 1403.921594][T13251] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1403.921624][T13251] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1403.939978][T13251] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1403.940001][T13251] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1404.002999][T13251] veth1_macvtap: left promiscuous mode [ 1404.003036][T13251] veth0_macvtap: left promiscuous mode [ 1404.003148][T13251] veth1_vlan: left promiscuous mode [ 1404.003218][T13251] veth0_vlan: left promiscuous mode [ 1408.568578][ T5760] usb 8-1: new full-speed USB device number 25 using dummy_hcd [ 1408.741078][ T5760] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1408.748738][ T5760] usb 8-1: config 1 has an invalid descriptor of length 48, skipping remainder of the config [ 1408.748951][ T5760] usb 8-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 23 [ 1408.796984][ T5760] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1408.797038][ T5760] usb 8-1: SerialNumber: syz [ 1408.938998][ T5760] hub 8-1:1.0: bad descriptor, ignoring hub [ 1408.939136][ T5760] hub 8-1:1.0: probe with driver hub failed with error -5 [ 1409.016890][ T5760] cdc_acm 8-1:1.0: Control and data interfaces are not separated! [ 1409.016986][ T5760] cdc_acm 8-1:1.0: This needs exactly 3 endpoints [ 1409.017082][ T5760] cdc_acm 8-1:1.0: probe with driver cdc_acm failed with error -22 [ 1410.515113][T13251] team0 (unregistering): Port device team_slave_1 removed [ 1411.086977][T13251] team0 (unregistering): Port device team_slave_0 removed [ 1411.548298][ T5760] usb 8-1: USB disconnect, device number 25 [ 1412.009601][T18753] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3596'. [ 1412.016428][T18753] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3596'. [ 1412.865777][T18633] lo speed is unknown, defaulting to 1000 [ 1412.865987][T18577] bridge0: port 1(bridge_slave_0) entered blocking state [ 1412.866104][T18577] bridge0: port 1(bridge_slave_0) entered disabled state [ 1412.866250][T18577] bridge_slave_0: entered allmulticast mode [ 1412.875980][T18577] bridge_slave_0: entered promiscuous mode [ 1413.030802][T18577] bridge0: port 2(bridge_slave_1) entered blocking state [ 1413.030926][T18577] bridge0: port 2(bridge_slave_1) entered disabled state [ 1413.031083][T18577] bridge_slave_1: entered allmulticast mode [ 1413.033663][T18577] bridge_slave_1: entered promiscuous mode [ 1414.149583][T18577] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1414.172019][T18577] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1414.754627][T18577] team0: Port device team_slave_0 added [ 1414.759956][T18577] team0: Port device team_slave_1 added [ 1414.803434][T13251] IPVS: stop unused estimator thread 0... [ 1415.763706][T18577] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1415.763734][T18577] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1415.763783][T18577] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1415.830028][T18577] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1415.830052][T18577] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1415.830102][T18577] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1416.273136][T18577] hsr_slave_0: entered promiscuous mode [ 1416.285375][T18577] hsr_slave_1: entered promiscuous mode [ 1416.296462][T18577] debugfs: 'hsr0' already exists in 'hsr' [ 1416.296491][T18577] Cannot create hsr debugfs directory [ 1416.479174][T18799] FAULT_INJECTION: forcing a failure. [ 1416.479174][T18799] name failslab, interval 1, probability 0, space 0, times 0 [ 1416.479223][T18799] CPU: 1 UID: 0 PID: 18799 Comm: syz.5.3605 Not tainted syzkaller #0 PREEMPT(full) [ 1416.479271][T18799] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 1416.479296][T18799] Call Trace: [ 1416.479309][T18799] [ 1416.479325][T18799] dump_stack_lvl+0x100/0x190 [ 1416.479386][T18799] should_fail_ex.cold+0x5/0xa [ 1416.479430][T18799] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1416.479487][T18799] should_failslab+0xc2/0x120 [ 1416.479528][T18799] __kmalloc_cache_noprof+0x91/0x6d0 [ 1416.479583][T18799] ? fuse_dev_alloc_no_pq+0x3c/0x180 [ 1416.479642][T18799] fuse_dev_alloc_no_pq+0x3c/0x180 [ 1416.479733][T18799] fuse_dev_open+0x13/0x60 [ 1416.479781][T18799] ? __pfx_fuse_dev_open+0x10/0x10 [ 1416.479830][T18799] misc_open+0x26d/0x450 [ 1416.479881][T18799] ? __pfx_misc_open+0x10/0x10 [ 1416.479930][T18799] chrdev_open+0x234/0x6a0 [ 1416.479967][T18799] ? __pfx_apparmor_file_open+0x10/0x10 [ 1416.480010][T18799] ? __pfx_chrdev_open+0x10/0x10 [ 1416.480051][T18799] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1416.480100][T18799] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 1416.480164][T18799] do_dentry_open+0x6ab/0x14d0 [ 1416.480223][T18799] ? __pfx_chrdev_open+0x10/0x10 [ 1416.480266][T18799] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1416.480323][T18799] vfs_open+0x82/0x3f0 [ 1416.480365][T18799] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1416.480424][T18799] path_openat+0x19fa/0x2440 [ 1416.480473][T18799] ? __pfx_path_openat+0x10/0x10 [ 1416.480543][T18799] do_file_open+0x20e/0x430 [ 1416.480589][T18799] ? __pfx_do_file_open+0x10/0x10 [ 1416.480663][T18799] ? _raw_spin_unlock+0x28/0x50 [ 1416.480731][T18799] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1416.480781][T18799] ? alloc_fd+0x471/0x7a0 [ 1416.480837][T18799] do_sys_openat2+0x10f/0x1e0 [ 1416.480883][T18799] ? __pfx_do_sys_openat2+0x10/0x10 [ 1416.480947][T18799] __x64_sys_openat+0x12d/0x210 [ 1416.480995][T18799] ? __pfx___x64_sys_openat+0x10/0x10 [ 1416.481041][T18799] ? find_held_lock+0x2b/0x80 [ 1416.481098][T18799] ? trace_syscall_enter+0xcc/0x120 [ 1416.481145][T18799] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1416.481200][T18799] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1416.481257][T18799] do_syscall_64+0x123/0x790 [ 1416.481304][T18799] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1416.481346][T18799] RIP: 0033:0x7fa4e9f9e159 [ 1416.481379][T18799] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1416.481420][T18799] RSP: 002b:00007fa4ead83028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1416.481459][T18799] RAX: ffffffffffffffda RBX: 00007fa4ea225fa0 RCX: 00007fa4e9f9e159 [ 1416.481487][T18799] RDX: 0000000000000002 RSI: 0000200000002080 RDI: ffffffffffffff9c [ 1416.481514][T18799] RBP: 00007fa4ea03506b R08: 0000000000000000 R09: 0000000000000000 [ 1416.481540][T18799] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1416.481566][T18799] R13: 00007fa4ea226038 R14: 00007fa4ea225fa0 R15: 00007ffec63b0bc8 [ 1416.481619][T18799] [ 1417.224964][ T5274] 8021q: adding VLAN 0 to HW filter on device eth14 [ 1417.700070][T18816] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3607'. [ 1419.187917][T11056] usb 6-1: new full-speed USB device number 59 using dummy_hcd [ 1419.420194][T11056] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1419.425699][T11056] usb 6-1: config 1 has an invalid descriptor of length 48, skipping remainder of the config [ 1419.425879][T11056] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 23 [ 1419.470725][T11056] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1419.470825][T11056] usb 6-1: SerialNumber: syz [ 1419.643453][T11056] hub 6-1:1.0: bad descriptor, ignoring hub [ 1419.643576][T11056] hub 6-1:1.0: probe with driver hub failed with error -5 [ 1419.669745][T11056] cdc_acm 6-1:1.0: Control and data interfaces are not separated! [ 1419.669775][T11056] cdc_acm 6-1:1.0: This needs exactly 3 endpoints [ 1419.669810][T11056] cdc_acm 6-1:1.0: probe with driver cdc_acm failed with error -22 [ 1422.043708][T18633] bridge0: port 1(bridge_slave_0) entered blocking state [ 1422.043970][T18633] bridge0: port 1(bridge_slave_0) entered disabled state [ 1422.044162][T18633] bridge_slave_0: entered allmulticast mode [ 1422.061268][T18633] bridge_slave_0: entered promiscuous mode [ 1422.067698][T11056] usb 6-1: USB disconnect, device number 59 [ 1422.084157][T18633] bridge0: port 2(bridge_slave_1) entered blocking state [ 1422.085709][T18633] bridge0: port 2(bridge_slave_1) entered disabled state [ 1422.085878][T18633] bridge_slave_1: entered allmulticast mode [ 1422.119448][T18633] bridge_slave_1: entered promiscuous mode [ 1422.453289][T18633] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1422.482686][T18633] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1422.496079][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 1422.496154][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 1422.854887][T18633] team0: Port device team_slave_0 added [ 1422.995411][T18633] team0: Port device team_slave_1 added [ 1423.229876][T18633] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1423.229904][T18633] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1423.229985][T18633] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1423.286247][T18633] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1423.286272][T18633] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1423.286323][T18633] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1423.538188][T18868] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3619'. [ 1424.113486][T18633] hsr_slave_0: entered promiscuous mode [ 1424.131470][T18633] hsr_slave_1: entered promiscuous mode [ 1424.132310][T18633] debugfs: 'hsr0' already exists in 'hsr' [ 1424.132339][T18633] Cannot create hsr debugfs directory [ 1424.618488][T18577] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1424.641494][T18577] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1425.437111][T18577] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1425.462760][T18577] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1425.466934][T18577] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1425.499737][T18577] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1425.563458][T18577] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1425.580533][T18577] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1425.955019][T18891] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1426.422270][T18633] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1426.773307][T18633] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1427.195341][T18633] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1427.268412][T18920] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3631'. [ 1428.480886][T18633] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1428.480986][T18931] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1429.120074][T18577] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1429.478471][T18577] 8021q: adding VLAN 0 to HW filter on device team0 [ 1429.520238][ T5969] bridge0: port 1(bridge_slave_0) entered blocking state [ 1429.520361][ T5969] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1429.560981][ T5969] bridge0: port 2(bridge_slave_1) entered blocking state [ 1429.561105][ T5969] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1430.246591][T18633] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1430.267117][T18633] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1430.277680][T18633] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1430.295228][T18633] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1430.296850][T18633] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1430.320676][T18633] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1430.325084][T18633] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1430.346656][T18633] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1430.594354][T18633] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1430.673271][T18633] 8021q: adding VLAN 0 to HW filter on device team0 [ 1430.693145][ T6443] bridge0: port 1(bridge_slave_0) entered blocking state [ 1430.693275][ T6443] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1430.750716][ T6443] bridge0: port 2(bridge_slave_1) entered blocking state [ 1430.750841][ T6443] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1431.110943][T10764] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1431.114736][T10764] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1431.133581][T10764] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1431.145276][T10764] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1431.146137][T10764] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1433.220807][T10764] Bluetooth: hci5: command tx timeout [ 1434.412985][T19033] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1434.413449][T19033] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1434.887908][T10764] Bluetooth: hci3: command 0x0406 tx timeout [ 1435.580295][T17199] Bluetooth: hci5: command tx timeout [ 1437.499845][T18975] lo speed is unknown, defaulting to 1000 [ 1437.608103][T17199] Bluetooth: hci5: command tx timeout [ 1438.224669][T18577] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1439.717219][T10764] Bluetooth: hci5: command tx timeout [ 1439.727387][T18633] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1439.750894][T19112] netlink: 'syz.5.3670': attribute type 9 has an invalid length. [ 1439.897858][T19120] overlayfs: missing 'lowerdir' [ 1440.006768][T18975] bridge0: port 1(bridge_slave_0) entered blocking state [ 1440.006894][T18975] bridge0: port 1(bridge_slave_0) entered disabled state [ 1440.007035][T18975] bridge_slave_0: entered allmulticast mode [ 1440.009722][T18975] bridge_slave_0: entered promiscuous mode [ 1440.030069][T18975] bridge0: port 2(bridge_slave_1) entered blocking state [ 1440.033216][T18975] bridge0: port 2(bridge_slave_1) entered disabled state [ 1440.033381][T18975] bridge_slave_1: entered allmulticast mode [ 1440.038609][T18975] bridge_slave_1: entered promiscuous mode [ 1440.433732][T18975] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1440.496233][T18975] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1440.617579][T17950] usb 6-1: new full-speed USB device number 60 using dummy_hcd [ 1440.626439][T18975] team0: Port device team_slave_0 added [ 1440.663024][T18975] team0: Port device team_slave_1 added [ 1440.715930][T18633] veth0_vlan: entered promiscuous mode [ 1440.724266][T18975] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1440.724291][T18975] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1440.725540][T18975] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1440.740413][T18975] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1440.740435][T18975] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1440.740482][T18975] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1440.823997][T18633] veth1_vlan: entered promiscuous mode [ 1440.833763][T17950] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1440.844380][T17950] usb 6-1: config 1 has an invalid descriptor of length 48, skipping remainder of the config [ 1440.844443][T17950] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 23 [ 1440.846180][T17950] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1440.846220][T17950] usb 6-1: SerialNumber: syz [ 1440.900598][T17950] hub 6-1:1.0: bad descriptor, ignoring hub [ 1440.900636][T17950] hub 6-1:1.0: probe with driver hub failed with error -5 [ 1440.903049][T17950] cdc_acm 6-1:1.0: Control and data interfaces are not separated! [ 1440.903079][T17950] cdc_acm 6-1:1.0: This needs exactly 3 endpoints [ 1440.903114][T17950] cdc_acm 6-1:1.0: probe with driver cdc_acm failed with error -22 [ 1441.014728][T18975] hsr_slave_0: entered promiscuous mode [ 1441.015964][T18975] hsr_slave_1: entered promiscuous mode [ 1441.016869][T18975] debugfs: 'hsr0' already exists in 'hsr' [ 1441.016897][T18975] Cannot create hsr debugfs directory [ 1441.230081][T18577] veth0_vlan: entered promiscuous mode [ 1441.248280][ T31] kauditd_printk_skb: 2 callbacks suppressed [ 1441.248305][ T31] audit: type=1326 audit(1789805338.826:164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19137 comm="syz.7.3676" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a01d9e159 code=0x7ffc0000 [ 1441.248507][ T31] audit: type=1326 audit(1789805338.826:165): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19137 comm="syz.7.3676" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a01d9e159 code=0x7ffc0000 [ 1441.254910][ T31] audit: type=1326 audit(1789805338.826:166): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19137 comm="syz.7.3676" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a01d9e159 code=0x7ffc0000 [ 1441.256790][ T31] audit: type=1326 audit(1789805338.826:167): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19137 comm="syz.7.3676" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=437 compat=0 ip=0x7f2a01d9e159 code=0x7ffc0000 [ 1441.258768][ T5739] usb 6-1: USB disconnect, device number 60 [ 1441.301944][ T31] audit: type=1326 audit(1789805338.866:168): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19137 comm="syz.7.3676" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a01d9e159 code=0x7ffc0000 [ 1441.303265][ T31] audit: type=1326 audit(1789805338.866:169): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19137 comm="syz.7.3676" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a01d9e159 code=0x7ffc0000 [ 1441.313703][ T31] audit: type=1326 audit(1789805338.866:170): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19137 comm="syz.7.3676" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a01d9e159 code=0x7ffc0000 [ 1441.313787][ T31] audit: type=1326 audit(1789805338.866:171): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19137 comm="syz.7.3676" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a01d9e159 code=0x7ffc0000 [ 1441.313860][ T31] audit: type=1326 audit(1789805338.866:172): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19137 comm="syz.7.3676" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f2a01d9e159 code=0x7ffc0000 [ 1441.315122][ T31] audit: type=1326 audit(1789805338.866:173): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=19137 comm="syz.7.3676" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f2a01d9e159 code=0x7ffc0000 [ 1441.449931][T18577] veth1_vlan: entered promiscuous mode [ 1441.525353][T18633] veth0_macvtap: entered promiscuous mode [ 1441.783757][T18633] veth1_macvtap: entered promiscuous mode [ 1442.256857][T18633] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1442.646144][T18633] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1442.660980][T18577] veth0_macvtap: entered promiscuous mode [ 1442.745250][T19156] netlink: 'syz.7.3682': attribute type 9 has an invalid length. [ 1442.870310][T18577] veth1_macvtap: entered promiscuous mode [ 1443.208742][ T5973] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1444.279049][T19173] overlayfs: failed to clone upperpath [ 1444.317560][ T193] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1444.317911][ T193] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1444.339680][T18577] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1444.397619][ T73] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1444.454702][T18577] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1444.499810][T11483] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1444.499838][T11483] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1444.557647][ T193] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1444.557716][ T193] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1444.557779][ T193] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1444.557842][ T193] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1445.478763][T11483] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1445.478796][T11483] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1445.744610][T18975] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1445.793282][T18975] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1445.796538][T18975] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1445.826217][T18975] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1445.836033][T18975] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1445.853288][T18975] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1445.934621][T18975] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1445.967585][T18975] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1446.170276][T19200] netlink: 'syz.0.3693': attribute type 9 has an invalid length. [ 1446.565195][T10764] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1446.583411][T10764] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1446.596321][T10764] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1446.614049][T10764] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1446.614945][T10764] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1447.521542][T18975] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1448.238252][T18975] 8021q: adding VLAN 0 to HW filter on device team0 [ 1448.266638][ T5966] bridge0: port 1(bridge_slave_0) entered blocking state [ 1448.266774][ T5966] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1448.317053][ T5973] bridge0: port 2(bridge_slave_1) entered blocking state [ 1448.317268][ T5973] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1448.649104][T10764] Bluetooth: hci6: command tx timeout [ 1449.737594][ T30] usb 6-1: new full-speed USB device number 61 using dummy_hcd [ 1449.898543][ T30] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1449.966839][ T30] usb 6-1: config 1 has an invalid descriptor of length 48, skipping remainder of the config [ 1449.967089][ T30] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 23 [ 1450.034917][ T30] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1450.034975][ T30] usb 6-1: SerialNumber: syz [ 1450.464089][ T30] hub 6-1:1.0: bad descriptor, ignoring hub [ 1450.464656][ T30] hub 6-1:1.0: probe with driver hub failed with error -5 [ 1450.659044][ T30] cdc_acm 6-1:1.0: Control and data interfaces are not separated! [ 1450.659094][ T30] cdc_acm 6-1:1.0: This needs exactly 3 endpoints [ 1450.659196][ T30] cdc_acm 6-1:1.0: probe with driver cdc_acm failed with error -22 [ 1450.727462][T10764] Bluetooth: hci6: command tx timeout [ 1451.263474][T19258] netlink: 'syz.7.3706': attribute type 9 has an invalid length. [ 1452.299347][ T5973] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1452.808057][T10764] Bluetooth: hci6: command tx timeout [ 1452.968862][T19274] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 1452.978803][T19274] rtrs_client L2101: : Failed to resolve address, err: -ENODEV [ 1452.979476][T19274] rtrs_client L2644: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 1453.861143][T19278] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1453.930754][ T5973] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1453.938188][ T5739] usb 6-1: USB disconnect, device number 61 [ 1454.035684][T19280] loop3: detected capacity change from 0 to 512 [ 1454.050515][T19280] FAT-fs (loop3): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 1454.313093][ T5973] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1454.335641][T19288] FAULT_INJECTION: forcing a failure. [ 1454.335641][T19288] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1454.335690][T19288] CPU: 0 UID: 0 PID: 19288 Comm: syz.5.3712 Not tainted syzkaller #0 PREEMPT(full) [ 1454.335744][T19288] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 1454.335770][T19288] Call Trace: [ 1454.335784][T19288] [ 1454.335800][T19288] dump_stack_lvl+0x100/0x190 [ 1454.335861][T19288] should_fail_ex.cold+0x5/0xa [ 1454.335915][T19288] strncpy_from_user+0x3b/0x2d0 [ 1454.335979][T19288] __do_sys_memfd_create+0x1a7/0x3d0 [ 1454.336032][T19288] do_syscall_64+0x123/0x790 [ 1454.336079][T19288] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1454.336120][T19288] RIP: 0033:0x7fa4e9f9e159 [ 1454.336152][T19288] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1454.336191][T19288] RSP: 002b:00007fa4ead83028 EFLAGS: 00000246 ORIG_RAX: 000000000000013f [ 1454.336230][T19288] RAX: ffffffffffffffda RBX: 00007fa4ea225fa0 RCX: 00007fa4e9f9e159 [ 1454.336258][T19288] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000740 [ 1454.336285][T19288] RBP: 00007fa4ea03506b R08: 0000000000000000 R09: 0000000000000000 [ 1454.336314][T19288] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1454.336340][T19288] R13: 00007fa4ea226038 R14: 00007fa4ea225fa0 R15: 00007ffec63b0bc8 [ 1454.336387][T19288] [ 1454.575189][T19290] loop3: detected capacity change from 0 to 512 [ 1454.582318][T19211] lo speed is unknown, defaulting to 1000 [ 1454.887710][T10764] Bluetooth: hci6: command tx timeout [ 1455.006108][ T5973] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1455.713391][T18975] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1456.545410][T19326] rnbd_client L607: Mapping device /dev/ram0 on session s+, (access_mode: rw, nr_poll_queues: 0) [ 1456.557036][T19326] rtrs_client L2101: : Failed to resolve address, err: -ENODEV [ 1456.559034][T19326] rtrs_client L2644: : init_conns() failed: err=-ENODEV path=@ip:127.0.0.1 [:0] [ 1457.392511][T19324] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1457.393099][T19324] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1457.876357][ T5973] bridge_slave_1: left allmulticast mode [ 1457.876394][ T5973] bridge_slave_1: left promiscuous mode [ 1457.876629][ T5973] bridge0: port 2(bridge_slave_1) entered disabled state [ 1457.946791][ T5973] bridge_slave_0: left allmulticast mode [ 1457.946825][ T5973] bridge_slave_0: left promiscuous mode [ 1457.947229][ T5973] bridge0: port 1(bridge_slave_0) entered disabled state [ 1457.947420][ T30] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 1458.100216][ T30] usb 4-1: Using ep0 maxpacket: 8 [ 1458.103403][ T30] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1458.109695][ T30] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1458.109741][ T30] usb 4-1: config 0 has no interface number 0 [ 1458.109796][ T30] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1458.109854][ T30] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1458.144404][ T30] usb 4-1: config 0 descriptor?? [ 1458.197780][ T30] iowarrior 4-1:0.1: no interrupt-in endpoint found [ 1458.406740][T17950] usb 4-1: USB disconnect, device number 25 [ 1458.439301][T19346] 9p: Bad value for 'rfdno' [ 1458.873364][ T5973] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1458.902555][ T5973] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1458.918527][ T5973] bond0 (unregistering): Released all slaves [ 1459.076434][T18975] veth0_vlan: entered promiscuous mode [ 1459.114182][T18975] veth1_vlan: entered promiscuous mode [ 1459.155057][T19356] loop5: detected capacity change from 0 to 512 [ 1459.502483][ T5973] hsr_slave_0: left promiscuous mode [ 1459.503421][ T5973] hsr_slave_1: left promiscuous mode [ 1459.504351][ T5973] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1459.504380][ T5973] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1459.538009][ T5973] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1459.538039][ T5973] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1459.571659][ T5973] veth1_macvtap: left promiscuous mode [ 1459.571708][ T5973] veth0_macvtap: left promiscuous mode [ 1459.571830][ T5973] veth1_vlan: left promiscuous mode [ 1459.571977][ T5973] veth0_vlan: left promiscuous mode [ 1460.483663][ T5973] team0 (unregistering): Port device team_slave_1 removed [ 1460.523913][ T5973] team0 (unregistering): Port device team_slave_0 removed [ 1460.566377][T19374] loop3: detected capacity change from 0 to 164 [ 1460.620512][T19374] ISOFS: unable to read i-node block [ 1460.620582][T19374] ISOFS: root inode is unusable. Disabling Rock Ridge and switching to Joliet. [ 1461.307070][T19378] bond1: option xmit_hash_policy: invalid value (78) [ 1461.327648][T19378] bond1 (unregistering): Released all slaves [ 1461.502740][T19396] netlink: 'syz.7.3742': attribute type 9 has an invalid length. [ 1461.547013][T19384] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1461.563439][T19384] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1461.568942][T19384] bond0 (unregistering): Released all slaves [ 1461.914811][T19211] bridge0: port 1(bridge_slave_0) entered blocking state [ 1461.914948][T19211] bridge0: port 1(bridge_slave_0) entered disabled state [ 1461.915100][T19211] bridge_slave_0: entered allmulticast mode [ 1461.946114][T19211] bridge_slave_0: entered promiscuous mode [ 1461.976527][T19211] bridge0: port 2(bridge_slave_1) entered blocking state [ 1461.977881][T19211] bridge0: port 2(bridge_slave_1) entered disabled state [ 1461.978031][T19211] bridge_slave_1: entered allmulticast mode [ 1461.984378][T19211] bridge_slave_1: entered promiscuous mode [ 1462.145463][T18975] veth0_macvtap: entered promiscuous mode [ 1462.241944][T18975] veth1_macvtap: entered promiscuous mode [ 1462.262522][T19211] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1462.300349][T19211] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1462.441175][T19211] team0: Port device team_slave_0 added [ 1462.474564][T19211] team0: Port device team_slave_1 added [ 1462.764726][T19211] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1462.764760][T19211] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1462.764809][T19211] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1462.803125][T18975] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1462.816326][T19211] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1462.816350][T19211] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1462.816398][T19211] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1462.927425][T18975] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1462.981868][ T5973] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1462.983769][ T5969] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1462.984074][ T5969] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1463.290633][T19211] hsr_slave_0: entered promiscuous mode [ 1463.291799][T19211] hsr_slave_1: entered promiscuous mode [ 1463.297536][T19211] debugfs: 'hsr0' already exists in 'hsr' [ 1463.297564][T19211] Cannot create hsr debugfs directory [ 1463.303163][ T5969] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1463.480997][T19436] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3750'. [ 1463.506034][T19436] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3750'. [ 1464.181300][T19449] overlayfs: missing 'lowerdir' [ 1464.247509][T18076] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 1464.276070][ T5968] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1464.276100][ T5968] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1464.397602][T18076] usb 4-1: Using ep0 maxpacket: 8 [ 1464.399479][T18076] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1464.401748][T18076] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1464.401788][T18076] usb 4-1: config 0 has no interface number 0 [ 1464.401843][T18076] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1464.401891][T18076] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1464.401947][T18076] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1464.477961][T18076] usb 4-1: config 0 descriptor?? [ 1464.526617][T18076] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1464.690124][ T5969] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1464.706641][ T5969] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1464.789890][T17950] usb 4-1: USB disconnect, device number 26 [ 1465.566137][T19481] fuse: Bad value for 'fd' [ 1465.788735][T19488] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3765'. [ 1465.831716][T19488] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3765'. [ 1466.266032][T19494] overlayfs: missing 'lowerdir' [ 1466.474635][ T31] kauditd_printk_skb: 24 callbacks suppressed [ 1466.474664][ T31] audit: type=1800 audit(1789805364.046:198): pid=19484 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.3764" name="syzkaller0" dev="sda1" ino=2058 res=0 errno=0 [ 1466.597708][T19211] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1466.626846][T19211] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1466.638234][T19211] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1466.660858][T19211] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1466.663029][T19211] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1466.691088][T19211] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1466.692412][T19211] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1466.720868][T19211] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1468.051773][T19211] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1468.165731][T19211] 8021q: adding VLAN 0 to HW filter on device team0 [ 1468.214990][ T5969] bridge0: port 1(bridge_slave_0) entered blocking state [ 1468.215114][ T5969] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1468.313768][ T3383] bridge0: port 2(bridge_slave_1) entered blocking state [ 1468.313900][ T3383] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1468.490298][ T5739] usb 4-1: new high-speed USB device number 27 using dummy_hcd [ 1468.648935][ T5739] usb 4-1: Using ep0 maxpacket: 8 [ 1468.649688][ T5739] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1468.653739][ T5739] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 1468.653785][ T5739] usb 4-1: config 0 has no interface number 0 [ 1468.653841][ T5739] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1468.653890][ T5739] usb 4-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1468.653947][ T5739] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1468.725085][ T5739] usb 4-1: config 0 descriptor?? [ 1468.753829][ T5739] iowarrior 4-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1468.936351][T19526] iowarrior 4-1:0.1: Error -90 while submitting URB [ 1468.950553][ T5739] usb 4-1: USB disconnect, device number 27 [ 1469.223919][T19548] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3781'. [ 1469.235157][T19548] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3781'. [ 1470.062082][T19552] overlayfs: missing 'lowerdir' [ 1470.389932][T19559] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1470.749733][T19574] overlayfs: missing 'workdir' [ 1470.812359][T19575] raw_sendmsg: syz.7.3786 forgot to set AF_INET. Fix it! [ 1471.272703][T19578] Bluetooth: MGMT ver 1.23 [ 1472.075801][T19597] fuse: Bad value for 'fd' [ 1472.164364][T19211] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1472.282440][T19600] netlink: 20 bytes leftover after parsing attributes in process `syz.7.3794'. [ 1472.315520][T19600] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3794'. [ 1472.400452][T19610] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1472.400500][T19610] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1473.189548][T19613] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3798'. [ 1474.389454][ T6297] IPVS: starting estimator thread 0... [ 1474.405877][T19600] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1474.456254][T19600] 8021q: adding VLAN 0 to HW filter on device team0 [ 1474.477383][T19615] IPVS: using max 23 ests per chain, 55200 per kthread [ 1474.518028][T19600] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1474.723147][T19600] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1474.733898][T19600] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1474.773362][T19600] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1474.773392][T19600] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1474.824242][T19600] veth1_vlan: left promiscuous mode [ 1474.832849][T19600] veth0_vlan: left promiscuous mode [ 1474.846098][T19600] veth0_vlan: entered promiscuous mode [ 1474.871103][T19600] veth1_vlan: entered promiscuous mode [ 1474.925292][T19600] veth1_macvtap: left promiscuous mode [ 1474.926360][T19600] veth0_macvtap: left promiscuous mode [ 1474.936133][T19600] veth0_macvtap: entered promiscuous mode [ 1474.941835][T19600] veth1_macvtap: entered promiscuous mode [ 1474.966519][T19600] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1474.973468][T19600] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1475.208655][T19600] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1475.229340][T19600] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1477.520143][T17199] Bluetooth: hci0: command 0x0406 tx timeout [ 1477.617549][ T5968] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1477.617624][ T5968] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1477.617688][ T5968] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1477.617758][ T5968] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1477.636155][T19613] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1477.684161][T19613] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1477.746568][ T139] bridge0: port 1(bridge_slave_0) entered blocking state [ 1477.746699][ T139] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1477.899455][ T139] bridge0: port 2(bridge_slave_1) entered blocking state [ 1477.899579][ T139] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1479.685091][T19211] veth0_vlan: entered promiscuous mode [ 1479.711161][T19211] veth1_vlan: entered promiscuous mode [ 1479.730520][T19656] fuse: Bad value for 'fd' [ 1479.901583][T19211] veth0_macvtap: entered promiscuous mode [ 1479.935048][T19211] veth1_macvtap: entered promiscuous mode [ 1480.050359][T19211] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1480.113078][T19211] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1480.172915][ T5973] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1480.176083][ T5966] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1480.176589][ T5966] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1480.289275][T13251] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1480.324002][T19664] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1480.324064][T19664] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1480.651172][ T5966] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1480.651209][ T5966] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1480.828097][T19672] overlayfs: failed to clone upperpath [ 1480.895245][ T5965] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1480.895276][ T5965] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1483.116087][T19699] netlink: 20 bytes leftover after parsing attributes in process `syz.7.3817'. [ 1483.174338][T19699] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3817'. [ 1483.853861][ T1305] ieee802154 phy0 wpan0: encryption failed: -22 [ 1483.853938][ T1305] ieee802154 phy1 wpan1: encryption failed: -22 [ 1485.015988][T19728] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1485.016052][T19728] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1485.309059][T19733] overlayfs: failed to clone upperpath [ 1485.420044][T19737] [ 1485.422403][T19737] ====================================================== [ 1485.429418][T19737] WARNING: possible circular locking dependency detected [ 1485.436437][T19737] syzkaller #0 Not tainted [ 1485.440853][T19737] ------------------------------------------------------ [ 1485.447866][T19737] syz.1.3827/19737 is trying to acquire lock: [ 1485.453931][T19737] ffffffff8f9bd2e0 (major_names_lock){+.+.}-{4:4}, at: blk_probe_dev+0x28/0x1e0 [ 1485.463059][T19737] [ 1485.463059][T19737] but task is already holding lock: [ 1485.470419][T19737] ffff88805121e358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: new_dev_store+0x2c8/0x8d0 [ 1485.480136][T19737] [ 1485.480136][T19737] which lock already depends on the new lock. [ 1485.480136][T19737] [ 1485.490529][T19737] [ 1485.490529][T19737] the existing dependency chain (in reverse order) is: [ 1485.499531][T19737] [ 1485.499531][T19737] -> #3 (&mddev->reconfig_mutex){+.+.}-{4:4}: [ 1485.507806][T19737] lock_acquire+0x1d1/0x380 [ 1485.512835][T19737] __mutex_lock+0x1a4/0x1bd0 [ 1485.517953][T19737] md_start_sync+0x55f/0xea0 [ 1485.523075][T19737] process_one_work+0xac7/0x1b10 [ 1485.528556][T19737] worker_thread+0x5ef/0xe50 [ 1485.533696][T19737] kthread+0x373/0x450 [ 1485.538302][T19737] ret_from_fork+0x730/0xd60 [ 1485.543419][T19737] ret_from_fork_asm+0x1a/0x30 [ 1485.548708][T19737] [ 1485.548708][T19737] -> #2 ((work_completion)(&mddev->sync_work)){+.+.}-{0:0}: [ 1485.558201][T19737] lock_acquire+0x1d1/0x380 [ 1485.563236][T19737] process_one_work+0xa32/0x1b10 [ 1485.568722][T19737] worker_thread+0x5ef/0xe50 [ 1485.573855][T19737] kthread+0x373/0x450 [ 1485.578459][T19737] ret_from_fork+0x730/0xd60 [ 1485.583576][T19737] ret_from_fork_asm+0x1a/0x30 [ 1485.588861][T19737] [ 1485.588861][T19737] -> #1 ((wq_completion)md_misc){+.+.}-{0:0}: [ 1485.597136][T19737] lock_acquire+0x1d1/0x380 [ 1485.602166][T19737] touch_wq_lockdep_map+0xad/0x1c0 [ 1485.607809][T19737] __flush_workqueue+0x131/0x1200 [ 1485.613372][T19737] md_alloc+0x30/0x10a0 [ 1485.618054][T19737] md_probe+0x73/0xf0 [ 1485.622562][T19737] blk_probe_dev+0x149/0x1e0 [ 1485.627693][T19737] blk_request_module+0x16/0xc0 [ 1485.633069][T19737] blkdev_get_no_open+0x9b/0xf0 [ 1485.638454][T19737] blkdev_open+0x141/0x4f0 [ 1485.643405][T19737] do_dentry_open+0x6ab/0x14d0 [ 1485.648710][T19737] vfs_open+0x82/0x3f0 [ 1485.653305][T19737] path_openat+0x19fa/0x2440 [ 1485.658422][T19737] do_file_open+0x20e/0x430 [ 1485.663449][T19737] do_sys_openat2+0x10f/0x1e0 [ 1485.668653][T19737] __x64_sys_openat+0x12d/0x210 [ 1485.674034][T19737] do_syscall_64+0x123/0x790 [ 1485.679147][T19737] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1485.685571][T19737] [ 1485.685571][T19737] -> #0 (major_names_lock){+.+.}-{4:4}: [ 1485.693320][T19737] check_prev_add+0xeb/0xe60 [ 1485.698461][T19737] __lock_acquire+0x1528/0x1f40 [ 1485.703836][T19737] lock_acquire+0x1d1/0x380 [ 1485.708859][T19737] __mutex_lock+0x1a4/0x1bd0 [ 1485.713973][T19737] blk_probe_dev+0x28/0x1e0 [ 1485.719014][T19737] blk_request_module+0x16/0xc0 [ 1485.724387][T19737] blkdev_get_no_open+0x9b/0xf0 [ 1485.729771][T19737] bdev_file_open_by_dev+0x70/0x210 [ 1485.735507][T19737] md_import_device+0x120/0x360 [ 1485.740897][T19737] new_dev_store+0x423/0x8d0 [ 1485.746024][T19737] md_attr_store+0x1c5/0x330 [ 1485.751156][T19737] sysfs_kf_write+0xf2/0x150 [ 1485.756295][T19737] kernfs_fop_write_iter+0x3e0/0x5f0 [ 1485.762124][T19737] vfs_write+0x6af/0x1050 [ 1485.766992][T19737] ksys_write+0x12a/0x250 [ 1485.771860][T19737] do_syscall_64+0x123/0x790 [ 1485.776978][T19737] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1485.783397][T19737] [ 1485.783397][T19737] other info that might help us debug this: [ 1485.783397][T19737] [ 1485.793615][T19737] Chain exists of: [ 1485.793615][T19737] major_names_lock --> (work_completion)(&mddev->sync_work) --> &mddev->reconfig_mutex [ 1485.793615][T19737] [ 1485.809196][T19737] Possible unsafe locking scenario: [ 1485.809196][T19737] [ 1485.816635][T19737] CPU0 CPU1 [ 1485.821987][T19737] ---- ---- [ 1485.827344][T19737] lock(&mddev->reconfig_mutex); [ 1485.832372][T19737] lock((work_completion)(&mddev->sync_work)); [ 1485.841134][T19737] lock(&mddev->reconfig_mutex); [ 1485.848682][T19737] lock(major_names_lock); [ 1485.853188][T19737] [ 1485.853188][T19737] *** DEADLOCK *** [ 1485.853188][T19737] [ 1485.861319][T19737] locks held by syz.1.3827/19737: 5, last CPU#1: [ 1485.867650][T19737] #0: ffff88807f099270 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 1485.876746][T19737] #1: ffff888050fd2460 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 1485.885776][T19737] #2: ffff88805a078080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 [ 1485.895580][T19737] #3: ffff888075087968 (kn->active#71){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 [ 1485.905655][T19737] #4: ffff88805121e358 (&mddev->reconfig_mutex){+.+.}-{4:4}, at: new_dev_store+0x2c8/0x8d0 [ 1485.915799][T19737] [ 1485.915799][T19737] stack backtrace: [ 1485.921681][T19737] CPU: 1 UID: 0 PID: 19737 Comm: syz.1.3827 Not tainted syzkaller #0 PREEMPT(full) [ 1485.931057][T19737] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 1485.941111][T19737] Call Trace: [ 1485.944385][T19737] [ 1485.947309][T19737] dump_stack_lvl+0x100/0x190 [ 1485.952006][T19737] print_circular_bug.cold+0x178/0x1be [ 1485.957494][T19737] check_noncircular+0x146/0x160 [ 1485.962467][T19737] check_prev_add+0xeb/0xe60 [ 1485.967087][T19737] __lock_acquire+0x1528/0x1f40 [ 1485.971971][T19737] lock_acquire+0x1d1/0x380 [ 1485.976478][T19737] ? blk_probe_dev+0x28/0x1e0 [ 1485.981180][T19737] ? __pfx___might_resched+0x10/0x10 [ 1485.986497][T19737] ? ksys_write+0x12a/0x250 [ 1485.991022][T19737] __mutex_lock+0x1a4/0x1bd0 [ 1485.995622][T19737] ? blk_probe_dev+0x28/0x1e0 [ 1486.000320][T19737] ? blk_probe_dev+0x28/0x1e0 [ 1486.005018][T19737] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1486.010666][T19737] ? lock_acquire+0x1d1/0x380 [ 1486.015345][T19737] ? find_inode_fast+0xa5/0xa30 [ 1486.020214][T19737] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1486.025866][T19737] ? find_held_lock+0x2b/0x80 [ 1486.030559][T19737] ? __pfx___mutex_lock+0x10/0x10 [ 1486.035593][T19737] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1486.041249][T19737] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1486.046895][T19737] ? find_inode_fast+0x1fa/0xa30 [ 1486.051856][T19737] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1486.057504][T19737] ? blk_probe_dev+0x28/0x1e0 [ 1486.062199][T19737] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1486.067848][T19737] blk_probe_dev+0x28/0x1e0 [ 1486.072378][T19737] blk_request_module+0x16/0xc0 [ 1486.077238][T19737] blkdev_get_no_open+0x9b/0xf0 [ 1486.082113][T19737] bdev_file_open_by_dev+0x70/0x210 [ 1486.087330][T19737] md_import_device+0x120/0x360 [ 1486.092207][T19737] new_dev_store+0x423/0x8d0 [ 1486.096819][T19737] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1486.102463][T19737] ? do_raw_spin_lock+0x128/0x260 [ 1486.107500][T19737] ? __pfx_new_dev_store+0x10/0x10 [ 1486.112630][T19737] ? md_attr_store+0x195/0x330 [ 1486.117423][T19737] ? md_attr_store+0x195/0x330 [ 1486.122211][T19737] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1486.127868][T19737] md_attr_store+0x1c5/0x330 [ 1486.132484][T19737] ? __pfx_md_attr_store+0x10/0x10 [ 1486.137617][T19737] sysfs_kf_write+0xf2/0x150 [ 1486.142238][T19737] kernfs_fop_write_iter+0x3e0/0x5f0 [ 1486.147546][T19737] ? __pfx_sysfs_kf_write+0x10/0x10 [ 1486.152777][T19737] vfs_write+0x6af/0x1050 [ 1486.157131][T19737] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 1486.162963][T19737] ? __pfx_vfs_write+0x10/0x10 [ 1486.167746][T19737] ? find_held_lock+0x2b/0x80 [ 1486.172460][T19737] ksys_write+0x12a/0x250 [ 1486.176812][T19737] ? __pfx_ksys_write+0x10/0x10 [ 1486.181686][T19737] ? trace_syscall_enter+0xcc/0x120 [ 1486.186902][T19737] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1486.192553][T19737] do_syscall_64+0x123/0x790 [ 1486.197158][T19737] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1486.203060][T19737] RIP: 0033:0x7f0abfd9e159 [ 1486.207475][T19737] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1486.227091][T19737] RSP: 002b:00007f0ac0c2b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1486.235530][T19737] RAX: ffffffffffffffda RBX: 00007f0ac0025fa0 RCX: 00007f0abfd9e159 [ 1486.243503][T19737] RDX: 0000000000000003 RSI: 0000200000000300 RDI: 0000000000000008 [ 1486.251473][T19737] RBP: 00007f0abfe3506b R08: 0000000000000000 R09: 0000000000000000 [ 1486.259443][T19737] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1486.267412][T19737] R13: 00007f0ac0026038 R14: 00007f0ac0025fa0 R15: 00007ffccbe82b48 [ 1486.275395][T19737] [ 1486.352575][T19740] fuse: Bad value for 'fd' [ 1486.417786][T19737] block device autoloading is deprecated and will be removed. [ 1486.417849][T19737] md: loop0 has zero or unknown size, marking faulty! [ 1486.824375][T19737] md: personality for level rai is not loaded!