last executing test programs: 4.704434299s ago: executing program 1 (id=2): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f00000001c0)='./bus\x00', 0x21) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r0 = open(&(0x7f0000000040)='./file0\x00', 0x400, 0x43) mknodat$loop(r0, &(0x7f00000002c0)='./file1\x00', 0xc000, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') linkat(r0, &(0x7f0000000100)='./file1\x00', r0, &(0x7f0000000240)='./file0\x00', 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000a00)='./file0\x00', 0xffffffffffffff9c, 0x0, 0x2) 4.572171314s ago: executing program 1 (id=5): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f000000010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) 3.772960746s ago: executing program 2 (id=3): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @sack_perm, @window={0x3, 0x3, 0x401}, @window], 0x63) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x12, 0x0, 0x12) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 3.465700129s ago: executing program 2 (id=8): r0 = socket(0x10, 0x3, 0x0) recvmsg(r0, &(0x7f0000001140)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001e00050300e1ff00fedb"], 0x24}, 0x1, 0x8000000, 0x0, 0xc880}, 0x0) 3.253576839s ago: executing program 2 (id=10): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @sack_perm, @window={0x3, 0x3, 0x401}, @window], 0x63) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x12, 0x0, 0x12) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 3.084677061s ago: executing program 2 (id=13): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000600)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000440)={0x44, &(0x7f0000000180)={0x20, 0xd}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000580)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) 1.909506687s ago: executing program 0 (id=19): ioctl$INCFS_IOC_FILL_BLOCKS(0xffffffffffffffff, 0x80106720, &(0x7f00000018c0)={0x1, &(0x7f0000001800)=[{0x92, 0x44, &(0x7f0000000800)="37a6c0f9362b72a96c0bff206a0a3f95050a0d79ee95f59e117f71c07800f43d61abf0332d96036921cecddcee20309509636bc3e5fdbb7eee4fb141f19350c0da1a0d52"}]}) r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x482, 0x0) write$binfmt_aout(r0, &(0x7f0000000400)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x83, "00000000000000000000ffff00"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) read$FUSE(r2, &(0x7f0000003f80)={0x2020}, 0x2020) 1.753486908s ago: executing program 0 (id=20): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x240, 0x9b99}, 0x9, [0x7, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x6, 0x5, 0x25cd, 0x1, 0xa4, 0x6, 0xa2b9, 0x6, 0x7, 0xe4, 0x9, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x8, 0x9, 0xd, 0x2, 0x12a3, 0x6, 0x1, 0x2, 0x4, 0x7, 0x81, 0x8a, 0x79, 0x558e0d31, 0x4, 0x0, 0x91, 0x4, 0x4, 0x7, 0x2, 0x5, 0x400, 0x7fff, 0x5, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x40, 0x2, 0x2, 0x3, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x6], [0x9, 0x3, 0x2, 0x5f, 0x4, 0xc66, 0xa8a9, 0x73, 0x8e, 0x10001, 0x8000, 0x5, 0x2, 0x9, 0x80000c1, 0x5, 0x1000, 0x0, 0x200b398, 0x400000, 0x0, 0x2, 0x1c, 0x7, 0x1, 0x2, 0x54f5bad8, 0x8, 0xfffffffd, 0x400, 0xffff58b9, 0x4c2336d3, 0x4, 0x1, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00000, 0x4, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fbf, 0x35db, 0x1cb, 0x1, 0x4, 0x6, 0x438, 0x2, 0x9, 0x95, 0x8000, 0x5, 0xfffffff9, 0x200004, 0x1000, 0xfffff801, 0x5], [0x2, 0x1, 0xffff, 0x3, 0x5, 0x2e6bf783, 0x80000001, 0xb, 0x5, 0x491, 0x8d3, 0x6, 0x8, 0x3ff, 0x2, 0x400, 0x40, 0x6, 0x7, 0x7, 0x5, 0x4, 0x5, 0x9, 0x0, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x100006, 0x8000, 0x400, 0x3e55, 0xff, 0xd3, 0x7, 0x3435, 0x3, 0x9, 0xfd, 0x401, 0x101, 0xdd83, 0x60a2, 0x17fc, 0x9d26, 0x5, 0x8, 0x2, 0x2, 0x6, 0x8000, 0xf45, 0x3, 0xd500, 0x8, 0x77, 0x9, 0xfffffffc, 0x10000, 0x1, 0x8, 0x1], [0xa772, 0x1, 0x5, 0x1afa, 0x20bfc, 0x8, 0x7c81, 0x7f, 0xfffffff8, 0x40, 0xff, 0x5, 0x7fffffff, 0x7, 0x4, 0x9, 0x81, 0x3, 0x9, 0x9, 0xfffffff7, 0x8, 0x40f1, 0x2, 0x3, 0x101, 0x80000001, 0x7777, 0xfff, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x624dfaee, 0xc, 0x7f, 0x1000, 0x1ff, 0x2000005, 0xffffffff, 0x10000, 0x0, 0x8001, 0x7fff, 0x1000, 0x6, 0xf, 0xe, 0x5337, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x1, 0x8, 0x5393, 0x1, 0x1b18]}, 0x45c) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x14, 0x0, 0x400, 0x70bd2d, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x2010}, 0x4001) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)="5c00000012", 0x5}], 0x1, 0x0, 0x1f, 0x1f00c00e}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000880)={0x0, 0x0, @pic={0x2a, 0xc0, 0x7, 0x6, 0xfb, 0x2, 0xf, 0x4, 0x3, 0x0, 0x3, 0x58, 0x9e, 0x6, 0x6, 0x7f}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x180, 0x4, 0x14, 0xf1, 0x0, 0x7fffffffffffe, 0x5, 0x4005, 0x6, 0x0, 0x45, 0x1, 0xbdb], 0x1, 0x1c4213}) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000bc0)=[{{&(0x7f0000000180)={0x2, 0x4e27, @empty}, 0x10, 0x0}}], 0x1, 0x20004840) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 1.729851305s ago: executing program 3 (id=21): write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x14, 0x0, 0x400, 0x70bd2d, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x2010}, 0x4001) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)="5c00000012", 0x5}], 0x1, 0x0, 0x1f, 0x1f00c00e}, 0x0) writev(0xffffffffffffffff, &(0x7f00000005c0)=[{&(0x7f00000001c0)}], 0x1) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000880)={0x0, 0x0, @pic={0x2a, 0xc0, 0x7, 0x6, 0xfb, 0x2, 0xf, 0x4, 0x3, 0x0, 0x3, 0x58, 0x9e, 0x6, 0x6, 0x7f}}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x180, 0x4, 0x14, 0xf1, 0x0, 0x7fffffffffffe, 0x5, 0x4005, 0x6, 0x0, 0x45, 0x1, 0xbdb], 0x1, 0x1c4213}) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000bc0)=[{{&(0x7f0000000180)={0x2, 0x4e27, @empty}, 0x10, 0x0}}], 0x1, 0x20004840) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 1.596878636s ago: executing program 0 (id=22): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @sack_perm, @window={0x3, 0x3, 0x401}, @window], 0x63) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x12, 0x0, 0x12) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 1.461780397s ago: executing program 0 (id=23): sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x14, 0x0, 0x400, 0x70bd2d, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x2010}, 0x4001) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) writev(0xffffffffffffffff, &(0x7f00000005c0)=[{&(0x7f00000001c0)}], 0x1) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000880)={0x0, 0x0, @pic={0x2a, 0xc0, 0x7, 0x6, 0xfb, 0x2, 0xf, 0x4, 0x3, 0x0, 0x3, 0x58, 0x9e, 0x6, 0x6, 0x7f}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x180, 0x4, 0x14, 0xf1, 0x0, 0x7fffffffffffe, 0x5, 0x4005, 0x6, 0x0, 0x45, 0x1, 0xbdb], 0x1, 0x1c4213}) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000bc0)=[{{&(0x7f0000000180)={0x2, 0x4e27, @empty}, 0x10, 0x0}}], 0x1, 0x20004840) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.407803413s ago: executing program 1 (id=24): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000240)="ed"}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)={0x30, 0x30, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 1.311629834s ago: executing program 3 (id=25): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f00000002c0)=[@acquire], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) 1.243352754s ago: executing program 0 (id=26): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @sack_perm, @window={0x3, 0x3, 0x401}, @window], 0x63) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, 0x0, 0x0, 0x12, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 1.185685444s ago: executing program 3 (id=27): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) mkdir(&(0x7f0000000040)='./file0\x00', 0x80) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x80, &(0x7f0000000380)) chdir(&(0x7f0000000440)='./bus\x00') r0 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) sendfile(r0, r0, 0x0, 0x7f03) 1.14083245s ago: executing program 3 (id=28): ioctl$INCFS_IOC_FILL_BLOCKS(0xffffffffffffffff, 0x80106720, &(0x7f00000018c0)={0x1, &(0x7f0000001800)=[{0x92, 0x44, &(0x7f0000000800)="37a6c0f9362b72a96c0bff206a0a3f95050a0d79ee95f59e117f71c07800f43d61abf0332d96036921cecddcee20309509636bc3e5fdbb7eee4fb141f19350c0da1a0d52"}]}) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x482, 0x0) write$binfmt_aout(r0, 0x0, 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x83, "00000000000000000000ffff00"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) read$FUSE(r2, &(0x7f0000003f80)={0x2020}, 0x2020) 1.072244849s ago: executing program 3 (id=29): mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',grou', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000041c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000380)={0x50, 0x0, r1, {0x7, 0x27, 0x4, 0xc01001a, 0x66d, 0x0, 0x0, 0x400, 0x0, 0x0, 0x80, 0x9}}, 0x50) openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./file0/../file0/file0/file0\x00', 0xc0301, 0x10) setxattr(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000300)=@known='user.incfs.id\x00', 0x0, 0x0, 0x2) syz_fuse_handle_req(r0, &(0x7f000000a280)="1695367704d10dd832678e4e2d01860484a69eaac410e2d6cf3b3d3925f9a3cb602592377170dffdc4de86f163e390e21d07459b0f058cfc248c4bcbe896f3c68006f3c2cbe07c55b87170871c1d364d740faeb750c8c8acb76aca18bc0c018ed341b55b0ef80cefe95b85756aac978a0e0b5ce59cae6657643e7ada0c1336bab310888351664553c2faa6dd39054e19e23cc7c4b4d33546407f880194aa0761f2a9360c4ba26de342328b92db81ae84fc9c1e9eefb4b7ec3f58a6d5d23b907327b14480a37f3c84305729a91c28807f8809b997235bfa2d4b6f45ee9568bb4a416df34f4140c5e272bfc068ea61a48b365490ccb02772a906dad457f5d2dd1a57cc1209e8897c8115049d7e4e3c756a7f5ad0c004ef66c8bf91f600910e73b4aa5f516bab5cd62ad93642960ab32b7fdaeacb1a9587a389a529c231f8a47a65fb6d27ba6a0eeb46660cd75dbf47df89e9f578eafa6992a12d9d7de56d69fd0e30b15caabd13c28d63921597466292f8c4e87f23d53d52e6e8f1c9295af0743c8c671a49273074ba44dbce9e9b1136a93dbc19d2b8e60cda5f50eba2d814822a68a0fd4ff5e6a25dd5346f96b26b5e1563ebb97829a76fd8c2aa467499fdced91b05b193b68316494f11f5ce97ed8e13d474b03c6f6eda4eff54b0ec362fda53003e6e2a3868a5d57e2426aed5adccdac8e162c6cc20361dd4709889b79b2810ba42f531fdd3746562a00da65b4211fb7d8f482a3610748d3b80d2942d8432471f98c6e9036cb57f3913b31dd8baddd6d85b44e8463b838fcfb6979628c5fa3dbd30688e10b9ede257ebc7b96d4092f38d11b9e6a4d10490a9df1387b3743cf51e206c7dbc0741c408bbebaae7f36d81b5ce5b21bb9fe992c8a0cb3a91ea2df21e571ff094b53b17c46fe22c0cead29144d203294eb42c984790a6b6348ed8b7b0317ee5b2353cc54bcfd808bf0f61f73917584e17bd9259c8a04d2ba3b4f931571947c77035975933471fb1203088dce478eb4e411ddb7b88caeb02e1cda741245df701a2b5c29c48a631eaf18549bd90c70222fd6dafe5550726bb58dd0fbf84ffeeae683a0379505f03740a652025add8e0e4e6b5bfb4bd0876dfe1ecb639acc110eba97294a4e4642aefbcad04ba50d830e945fd9900ee7e02488694041f43cbaa86280c1df64e8f1f81f7cd5130914efd19b58262f3bd2c43bd8b4a5beac09f1ba27020521994465e62c329debb50efe0716d22cf0056febc7cb95aa818e10639077e91cac3c80b37d6eebc6907dde971b578383ee04086a0dad18750ceff6b8d6d373afa93a51fee65fe1318c1ac291b784e45d66962c8b54571bc1e92a996c11561d94af6ecdd37948d35adbd1ad63c1c05c31c7f4afd707aa1956d1444fec1137fb6d81f56566887131777e5fe3e2fafe8af8f21ed34480afe74afb25d8d16f8089fcb851ac49dd826b7f273aa3d771856d712c62397d49c72d93e3c2a5e6b9767fcff0fc5b3d70dcd70ff8bad5dfd7f5a84c194f99450601f970104f9be026852ead21824152dd8f6536fcd01a69177a65f2af266e619d61d20de0c738680fbec29e7c594cad29f009d46d87908c951b2e4ad8d9a67db8be6f570fe5416d9e4dd22a108140a1c95369731807325ee7f4201209a795fa1609ce8fa27384677816f651a96cc08400e1b647bdddfb851313e3ccaa472b9a6a1da3a0936e119a6d7808f09de244d739c39df3ed36004b77cb54b6b1396b718c87fba28cb1439c7d1d140dae1ee2c2a7d647427b1e7472710c7ac4f1fb0fc0c9d15ecce28167d23e2e42474dbf1c63c0819606be9c9b6dc2eb59bf9932568ef408c20e9498cf105e84eee30460d4348f4cdfab623b416adadb4427887d9b1b6b8db75b224e8a55fa0351d21093b2b7e42e6685491cbfce100d602d0281f4bd086b50612f3ccf055fab1aad97a52695a233c3d458be4536b66b0acdda5ce0aaab48bb7d7f39a8af473c4478991f1c4569839eab0c1d684001ee1772290871653a2293bb7754c1eac178c60f86e2a98e1992dee198c76365f2d04d159d7c210c6cc58764e3b7dfb5bc15190555febd01c69cab8f55926c28a13fa4f9060dde1ca2df7e1f71fd99a0c350d7f0e341ece8e0685e9c205b486ef400910211b688f07fb05b542261c74b45f4ac23ff53e9e620ab12dad7b5131f67128bb8ed6a4a70caec437f2157f8bcb3d080091e5715dfc7d7539dd0320c90d0aab6a6d7a447ebeea893a0efa2176292c648c62cedd4138c9d0535ab0621855484fc43e0e3e84357db6951bb21fe2f4e99fa188ebecbc23f73ea879bd304408acd1c470fd112606ccfd7b7970e950ebd363afbba359a51877248a42845097094ff785dc82264225752f3aefa980d9ed5309b48f47a5b5ef49f69808b91bde955277b6525f55436ffeba0bfa8c13f6314c57ec97eea295afc66a9f4ec844474c0da6ff1ef0c6c65c035f3bb74a70ffa668359b58a46af97600c428626b45c81a4e372e198894c02e2bee8010fb4c2c075ea623a6ee24a99e225f809322df6ea6f39b1566b1aee5403d45ba648f94f70976013199b3241744458d030a5319360780897413289d89267c389e04f23de79adf4b864c5ca76efc225eb1ecf6424887f0d8b3ac13cbe9df4eb69f7b702e85fb396dc4a030d57a8c4edd227ee568fb11a9859935ad53dcfdb01727f106af352c569a020b7e405a1ad4c6b39e2e8796fe9f16db3794550f5ef3ecd6af2b2ab0383e6c198f17ada5840bde84ccbaa661d9c456d9ddaf92763ba450098cd5a971d847fd5030a4c9b066ab3b0096dfdf7e5ce2f8349165f94c493b7e4192e85239bb11552f910fb41c5e96ee10fc8dce711e88e0572ce0bbbd9c9f3b7c9dae89f1dfa6af309c4321755a5b19070c8731ac590c30fffb69feeb75f699aebb101d3a30f784f1745182cb4f0bf63a148b521f0a03c691927694ee453b278523e3ed256c150098a932f62c90ac65faa4b9782c27a3ef6ca2b5ecae6a01d8a1d7096bf6a7d1b317a9eab22ef4907c631bcca224f723f5fb9a44d7e1295186cf37fd71343919aa167fa70a505a73e9f52a11cfbd40d8c1087d4ffdfe45a40ed5aebfa4b0c3622c78a914d68dd92f46478711437ff88803ab28cd9ce2223aa0fa37eb9d9a4a7866dec4ca6bb66e794ccac6bd19b11daa0b6d4d42cbcf7d6426b5718030ca51bf92b3d8ea0b11c46ec5c0c6e3805c88b39731b2b751d9928ed1ddba7c66bcc5273d709fd295aa0792384435b98c1f44575c028ff2869074156713931f7e62f8b0f8c7ee9dfeaeb2e096e77600586a47d6f6a2e13a17dfceae46ad84858bf8873f9f1e35fc700aef0a648af168ab0774a3441a203ef325577f2c76f5f0e5808acdc7965bc65e8ad1ca816bc3b67711ea42e619c957d0f26b394be1f3b0c4ac9af8558eaebf5c1c27b6549022513479b4c28dbe3f1c3131cc9211eee768f96a9c8b5e0e6425bef921a355faccf0072ba19b16d88b75feb5dc8fcfc1b7b5973eb9654ca3dcfd482831ff5d1fe09fe7ae43cf129c8c17a6686685a13ed076f34608b7ac16eb8e9de6a44418c4e3f8162e6a679bc9482df96a04b14575ebf093b99bf5cc26495f5dd6e571129d9760de3f801b001a1f3248d14f579bc519de2b656641a88da758a2ed3baf15fdf2739ddb44f0e5892de7ea48e9302129d0c939137b9d0687b296577675bcbf433a53f6a9816797cbfef1ba0caa2b8602387b5a8bae24d3e15d42b34d81708738fd269c3e8cbacdc3ff5ab1d4816a783d7be0f0a8086e345a6b4c231ffd61745f6c45cfceaf6089e70542aea1574e3c78740f77a08eb55b37f03549c1dd318cb5a76094210e8cf800c350d328fbf9442d0437e7affd54b3bfc33da3f24558f3ea8e59da8e61ae60e7e7b4de7179b8cf941d51d420c8eee69143966800dc4f7bcb50a033331fcac02a65e88de28ab219c68388a9da9196e044dd1ebbd3994bf8cc862f6f8b419fa1f4f4e5427f10866b498935fa28b8e6f9c5e48be8b74b9c2262823390480f71aff6cf72281f526265877d223eef9ad7a4be7438f9afb6aff0e80c5125c2c612ceb83f0470ea04479979c0a10fbbd0bed7379e949cc19fe36fbcbcc59a9fe30a2662d3e4d22862e8841b587b8995ef8482bc60fe0863b41752ef3dd44a387eff101595822bf1ce440ff9e5f73e560e4f7fbfe4754d9dabbcd92de02017eb43d3cf7c75e45ba04009a782a68ce11eefd52253c721daa5f37c6408e37b48d1f2e36d7c1793300f2c9039e69a52057486b63c0fa644d00528ce48f2e551ca88e356ac25ae74c73492ed3e6233490acfbe7ed8244f23e2af86e0ade6b78bb34a75a86f6cbadbd39762680cb0821d6d28f18d427df13d0e747f6da54be970e43ef8ca8285dc8bf44e3cecdbf2d8757a9800bb889b846d58cc636a2648809451a95736a0ecec6ea3fe61fb24dcd8a00ac0b8933918189cda555b17e431d99ee190d6d0d9f769e665ec193ba8889ae72a01e18b98cebb75d20ed778e5778ef657ce85d40eafa44b46f293d64023b877e8c5d58587c3abecf9a1ad8d874a4cdba0bfbea61b7eb19e81f7c932be12a83bacc51017b42dbe2931dc11c742a5a942cb6ed9bd9922ad78f55b0f6cbae0e8d4235140263ed8c83ab22e71a0f0a62b6920b5d5109e415254e527546546bd025cf1583e3e8d9d5bf735a4651fa2e5c3c86a185bb77e9b75224cdda8cb0eb21d9e3bb19e286832aa5dce19f055539a0a5caccfd752742a31d0af882c4f02c29cbd90ac2cdf5cc61c448cd09eb7b82b930ca99962c0e5ed84124fe37f7d30aad0296ee340377a7e0aa7413c495ac8ab0b482c4c5f59872efd5a1ceadbc7606e67d3c79a77d095bd82519db0893b9d2bbc2b2f3a7391826840e49424703c006399cde5f2a52a9383e89dfbfca284be4d75dd3aafd8a43dc6c71bd7fde9460647eb5c97707e96ddb9124d6020da38ee7ad743db8fd0377a8711905194c496e39a2132d7bbf35b79f920b6dcaa73625bf8b5320da250513cd45bf42c8072809ad59d69c02f0554cf82b79ff291e42d9227de1948352b0dba0281b69876ae0ca24972a5e75aee7e0a46bd4fc83f5a0dd3f22d666f2d950ca580c6da6dfaaa293beded10d1328613611b6e01d5d8567541e81466467302d8050a3ae4791fbddc1aec749edb68173be5341166c1d5c42d63e7368473e48bafa43459de3fa3a5550a4ac979711dd9a2d6796b0bcf9b5881124ade4b12bf64fa55724976a0da9d642e76a036c430f5fb2c06d599b0f78e978580f8eb763d2846177ff18b9b5cf8c76197ed809ef24212bc5563a1713214ce78e0e6cced6e41578d46a07839795c83c189610244bc1b680535fce39f290da90d719078015d90020b1d4567a97081b48514709df8e327d814e8c15496d90efacae6b13e297ed520d280203896bbc3a23f3b638adf594de03a782bb292a93ef0b14b8b3e13c01787a0b7bfb3abd8ab15eebbc651b7b054d3e56ebb7808de9b9bd067560ec6a6432455b37054292a3d9d32434506bf84b2907560017089de3f60c2deb4dfb7371f96d65a575d446aa1d2df81867135120df4e24e9227f72ff9f8f015a7754948704ecd084a1a93fbeb5a44af086ef73e9fc1c072b7d5473e92558fc2824acf27f1dbe9b019247d3074bf4256a966ceb674a2c4222632c8e4b6c0736de019ccfe4cca40b9b07f8c4df9753cdfb4ad66643ed71510983e29c2b5f9ae7db4913cb74d9dd0461a900810650d0da73f766aa6882385f3bb40644bf43f01faf2aa4cd187659edb0498527f201442b64349afa814b3dae5ce815971f3b11d177e3e1aaf90c7674c097d475640218ad27e63f9071c9081c06d9b5d1f3a070da3eed4f4080190a74063e7f97b5f35706dd1173dcbfa13a70d5362e50d57d0c5105c8d3beb926d93f61699e737ebe1a935839c3aa5b629dc93aa209d9e7774c40de7f59fca1eb274a8280022a15934e5dd2579a8cf5cd16a3b0a1ff3ea712c4258164fe2fa17a4cbfa5630f4041bad4204605eb2e762d610fa17dafa415ed8a678da1d4b5a6618d71d0066d66e3ac10b3ce65137a5a02344abc57f1be4ce0cbf1a2ac66dcb5e94495e863819c627e4704fb479c232b27aa4a5dfca8896a7eb8e0592b6b392ec9fa2767f569d5c1356d7ef7a909d8ee344ba017c75ca664d98f5288230b7f1ffa2fa7a5d07fab5f4b53b7f19c3fb361795fd632fa8a654004d931b4b7fc0890927aec727160cded3c01b7e40e6b81ce015796895f9c007762a1c22acfb9513eccd93c845e91ea8b0960b299b3ce788cbcce5bea9a94325289d2c3573975c512d56e19c4655f849b3652f8b5f9fa6f49e03202f2031debe3c299c3ceceb1febf4b285da9033493088a36f885ed6d3958b8d05cc6be00f3465de8bf6e41796d17e393067585b459b143d592cea102f584e48676a45f896cf662bd6b3b2309aa7f46d2b8ec6597a063f12bcc88922050c8c1e070134ce77ab1cb7a7f29983a0b30d9b2abeca5cfbfc55e941376c616c2834b1c1c9a9473b531c86c3b708478ee95923fe6a8108c2c4dc8a78a9d5e995f6c815b292b986cab0afa233ef10567a49d4e8dc17f438b90b620df4d291b52549ac8e1b69078b62011ed4bb0e288db740817ff07d01e779e11cb8e0606b5ca3aac6c7b262499f5a115acdad8a67b6eb77503318ef3bf0008347b270aa986d9e79e2af174f38a4743250c1091e6053a7a785464483161aad3ef3ad976e5329b71afe9bbfd93d7541a1014db4cc159ac266021e841c665217fa150e130f921ebd4cfb5accdb87f5f9bc0fd94b402289db4d0ac3f0906a689aef044c09fc2c5a00f7795ea935aeb943eb32826bd2176c1d1cb058195e3229d293595ebc07514c6b038a1d964199c59e59d4fc621c54b7bbd3410ccec22f7fb6751527c2aa0940ed2f0c9dcfc4e99ced91d09ba4a37042b5f48b127439cad24df2951ff1e769d3892dc4788dbbe27cce60f7f0138789444712e84e059ac0a4e87557f6c3369fc61b9a843c816df3cb4ec77a11e16390234da24dc0420f6a44554fc7954cc74d63ec030d4d964898e14500d0dacdbb2959f7a8a191773f66448348f36c3f4904187088bcfeafda7dd721236810d04469e93ca4e7926305c25b1ef1380d775008fd238e33e8dd2dc5a9783f97414487a7ef70eba3dcf71331803fad223f65aadfc87d79512bf311c14926d619a089f5e84c46f4a9ff393969f8eacc8fa20acaa9eb01a8aab625853e415d3871e555a11ee71ee93cba85ee9cde60b3962e294c2c840f0a1ba87714bac54f1ca0ebda74daa3e8e19d382b951d64a22da48c632ec5754f42129214a807427e69a93c128b6b0a8697c9ee375818dd79244a38287fe8f66c7cc3aa18aee2fbf804fc1aadcc7d2daf75be82a60276b6902a51f2bbb64c261915b80053fb9635f405f1fa855d1ec8adc0ebe9648b8151eda70ec5ad5f704fa2a337bcfb7ecbc845a11cae7a68d6bc58f107ac7bb0c2f6b83edc48703ba00c94036b9af4ada51d6d78bfe697df06f47573c14cd7191ec52dc0f208ecdcf54669529bba2c2fb7a6b38f6f2b5ec5fe876f03c096ae092b6f881a84b00edd1e9f67449069d876afaa99eb1a446f20656b5104c72ed28bd8553c724785f4e8bfdc33194409960de4969b708ce26e4cd608d21ace0c38e27d54b55369a9e807cfda9a6240466dd94f6150d4b0105f7b9ae392009b2cf146d1dad5d7c8664463d7d60d11b45f30d01db7364e21ac557d37a4c9ad88926c472e98710d2cbfc4b70d6a5dbb128d46909e634761c6f6952bf9021aa5282c391dcee3278a25e3e2ee31a7f6713979a546084fb2e598214c36a3b7618bf23c57bb23b33e9c98dfe5192ef257dc2d891a6f7c11be334fbdab015eedafe1c4aea95ff1fa6d340d0cade542f3f782c1589470fa64c6fd9ac0c31536ecee0ae312f992733beea6fcaf7562dd6e0f2c016f712ce14d93f02a54f577c75b444fd7f46e9bd2cd9cd1f89195781d88f984eca45c97355095d3b48b0d9bd730c7d6f63b1dc78d2344bdb0f18c4e1554822345c11efa2ba32bcef4f29ed05315cf44617a80d7d1392de077bbda08669c8c3cb6c0b12f872f1247bc1d07634bf5bf4acc3a4ecdae7e6acd7c4af9820147afe55500a7270d7eb511f907339e5af54cfaf33e2364f54091ebee2a245ba048452d383cd441604c4dd1c6376e4df8b83ebf6070d2be248174fc1dc0a1352c103325360aeb3ab71cb73bb646ac6247dd68155fd48b90250c3b0f250a74f827780367e117a94094e5005e2f926accaef0b3e36c25e315c1e80cd4c3481f3465d99025c7de91c45bb8dd0a5577174c1f366017d87d2033239a8b6f399a9095845b5fafe9cca113b93f455bb790709b6c93fcbbd0c4bd7b5d621088dca06802e241836291226ad56d40b3b4e90eb68bd5845742baf4cb4a69b4bdb07f02d0bd6fbb5a5fad3af030816b254725e6db4073b7a0536b884c8985c3a159cdb105c73f7e0e03546248336449eff6afeb96cf8ad3617df18ee2247bc2d11ebbe10e0379f5578c41611872c5461541fb4da5be3f3348e0592982a61c352315370a9b452306c9f31f9040ef755ad096a8733dd9daf6bdbcb7a3521ad2282ae4fa7bfdb9cda5997ba3a6652af46c6d0205bb356dfb411e2b931b357723bb70254211819b74a461ed5c126cec6573cda4f6107fc3ebc76483621e9ab5789a5575ea3a91463f76138ea0f3ec9c44e1cddb2de59bef83333d235e922b920e267453676575b38e6415bd136534b8df2360ab489fb69eefd04b66758ab5dd105be7b0635f7194f9e4b158b22b21ac97fda4e804747a9718b40a32531cd5c3fd1d3c1dd8ba5ef9c86d3c8df8c71f81da1a9756e5db4dddf70755053f7129d656a8069fe83c39ab240cf7a73f0f880ec7a791c5115ab262184839b906c238eaabf2268dfcd6560c5bcb70fea00b580ad52e7de0333e6de63ae351952e6e5dee6edf284de0a2f53e2089db13bd5eca5f98883a24eb2e1a58ae199f8db9c60a5b6b85585b2d2a17d6b5406e5668685d95c4718c375db05f7953b363c25d2ed0906eda70eb659845acd31fec9b8e4d5951d12fd50bbb969dd824a78c72622c8311a980f0f2e6a1ddc368879a1f3a07d3c0780e85a4e5d13223a3424782e3f77bf6a1ebf823f468d41b777ff61345064f1096ed653c277bab90ca5afc8ad6d25f4447236cdd82950afff27763f3fef5308f034379f4ad4955cb8cc5280d51b5427de4eba374f64dde2f1e7a6ae628aa4696160a5cf0ae9fc70e307b4eb19c0a5af2c2855710c8e117211d73a7e7f3f7f2ba55d03a4b73d816c9c3fc1edb86ec95ddcd77884a913805ad6549e7a5f776a1c2385dd6d83877727f128207cda29f83462269a7f606fa31934d06a6e0efd238d0a180c754a9d2e85609fd20c880ea0e79cbe887c442f9f682801da783529e1e45eb3e70195fa2711fa291dca43ee0672b7afc14cf87b9506a7ebe223019c856777e1783f6ae1b0ed90486b32e3b6f7ff77be834c7b6676da6c8052fa49450e3e16a6f90ee33742bbfe3dc025832e0bbc7abeb625077b8c1ea07dee89c7dc26fa42514ff9ac21e848e32309bc2862a873fb57796e05923fce42fa2833c73866e22a04497ec13acebcdff6ae1df71dd8756f1febac04f2034c1f3e1d401ddbdb7f2ef676d5c85437830d527a5fb04c9bbf0d892ee1306d2d2df37008916a3a66e70f865cd6d25de16fdb4bb4f2616204cf86a3ffdbf147223968c092a46dc2aae4aedb32fb850b85d4adb87bfada328bce4c2c70ec42affde442179fcc1d3d9f5e4a848c8ba03b0df3065d1b2d5f1b08d8c25148c51bb54e191a87ea59903084000b4b520fffda111fe831d4bdcf62423c1fcd673b020c5f2c41973dd1b9698054368081f917715e1c1592bc78dd265e051bcda5bf5877821fedfcf7790a58b328cf780f71ee71491e59194504bc800d319251607e53ba0e1ed15cd4fd5c959eaff4d3a1c7cb28c479f2776256633ef7c0f0e98688b54e8c8634cf57e27e5c1ee1e43573ae23bfbb1ff1bef6cabd33c02ff165c44f0f190426ba8391ba4f03458be3351869c5c5c9d5fa5600edbcce523525b9cd9c3bb040e34771ea277d05cb76302c72fac5edc815412dbbbc651371d70d044c4f89a68da7abd836fb3a495e212b5fd13819c41c9a240405582ae69b7c35b30935af3085d457a4d76a94c9272c5eafcecc4c92dd4f314b04b4739864e626a5bab27fa2f345f052afe3bae2ff4c442c42a1c83091bfcc23a3b5e06a511d02cefcd618a6d9761de00af192cf1aacc902cf3ba98f898c48fbc74b6710db7ac890b4f7ed7377e0fa3b4c46a131e775130a80db5014a79e674c8fc8b45495066e88201d2e320320fa4561abab617d0e67e9e879b0080a8ab404f4eb007a088990aa6a7b29afce5b8dd038ce96d43e1271315f6070e761e759c44fba1ce78730e35ca31e0bf5840cc01289c81613a07c497f288ed70a6d10d9f58fe135558b2a862bd877fcc939d7536e7dc988409290cd73da04a3b1399b0a2637f737d5f86bba4a31019546e2000a3ca57f8291cd9af28299eb93909061200c9738cca998add04e7bb0137ecc460fc3ef72872e7d13c159914fcdf577910e6c5d7a1636b13b78c5088551c614e3c75befb0f37fb89b918f4aad0126a9efd3390d6a0cab97ed0e01c7eae0e798a4142345578beb10d6b61a90b4d1fe836022def90bb8e37e07428a4592e7bf30e935951e492234a8db96f081379e7c4e18c3b6ce4ed1f97698dc1da940f14217e877bb8e0f33b392d801a01c48ec62ce2774d2e4e55e9415c063e1bfa31a8f0633443ec19c5fab977c1485147e46c06f86742278fd071de4a165dff7eddd5390a1e031d80e3d44477f6009c9fc27a7d92b865a292b0d586083f681c2d92da7e7f42eabd076fa7d61eba0c2b406c75f1cec561b1a523dd4c6f344b02ed59bd473d7d30a24144e981fc8da434931adeb841d63bb705485f8f58a180da91af64bad1379356787b37467dc9b4a0d12496e5048e7ccb40a978eebee5eaac4e9dd96faf194aa93a22333d7f68cccde147dce26c9ff18d7c8ffe0d1377c70dd1057d54473b2c2b2b3eea82fb223952c0dc3796efd0cd94afea38341ab9a83c6a9ee77f26bf8dea8510dfc964f9b9b4942c08ade50e43f06e5101f2e6b68b6a7f9cc5443c862b1198627461938daf4bd1fc7b21d6d7fd3f775f0e4a1f60434a242b049f159dbe5de145e741c5c9b4e59a7f5d7de54a6d51cd87845dde819ca74e3abf60356fbcf18bfff3b6ae1c545e243c08f9f41b86e55ed6e71be453843e0bffc5b6bdcfeefd33075ee5110627d4f05e008e54ddd62fb6979d9c2a5e4a2cb45fad7b2d77bd17508952889b30df2124cdc2fe6a749a12c9f6dbbd01226cc4ba2693b7e6a858d3c36ac6519ee70e896588a6df81b0e3be3604bbbe1a845088cf1834a04368dde8b6ee76d0492911dc09b05cf6642e0003cd8faafd398872c1a8dc3e85d3658ec8", 0x2000, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000008c0)={0x90, 0x0, 0x8, {0x3, 0x3, 0x100000003, 0x0, 0x0, 0x3881fffc, {0x5, 0x7, 0x1, 0x0, 0x3, 0x0, 0xa, 0x0, 0x0, 0x8000, 0x0, 0x0, r2, 0x5, 0x8009}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.001406798s ago: executing program 3 (id=30): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2}, 0x10) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c00038014"], 0xfc}}, 0x0) close(r1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local}) write$cgroup_devices(r0, 0x0, 0xffdd) 464.132146ms ago: executing program 1 (id=31): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x12, 0x0, 0x12) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 291.651153ms ago: executing program 0 (id=32): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f000000010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) 0s ago: executing program 2 (id=33): write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x240, 0x9b99}, 0x9, [0x7, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x6, 0x5, 0x25cd, 0x1, 0xa4, 0x6, 0xa2b9, 0x6, 0x7, 0xe4, 0x9, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x8, 0x9, 0xd, 0x2, 0x12a3, 0x6, 0x1, 0x2, 0x4, 0x7, 0x81, 0x8a, 0x79, 0x558e0d31, 0x4, 0x0, 0x91, 0x4, 0x4, 0x7, 0x2, 0x5, 0x400, 0x7fff, 0x5, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x40, 0x2, 0x2, 0x3, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x6], [0x9, 0x3, 0x2, 0x5f, 0x4, 0xc66, 0xa8a9, 0x73, 0x8e, 0x10001, 0x8000, 0x5, 0x2, 0x9, 0x80000c1, 0x5, 0x1000, 0x0, 0x200b398, 0x400000, 0x0, 0x2, 0x1c, 0x7, 0x1, 0x2, 0x54f5bad8, 0x8, 0xfffffffd, 0x400, 0xffff58b9, 0x4c2336d3, 0x4, 0x1, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00000, 0x4, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fbf, 0x35db, 0x1cb, 0x1, 0x4, 0x6, 0x438, 0x2, 0x9, 0x95, 0x8000, 0x5, 0xfffffff9, 0x200004, 0x1000, 0xfffff801, 0x5], [0x2, 0x1, 0xffff, 0x3, 0x5, 0x2e6bf783, 0x80000001, 0xb, 0x5, 0x491, 0x8d3, 0x6, 0x8, 0x3ff, 0x2, 0x400, 0x40, 0x6, 0x7, 0x7, 0x5, 0x4, 0x5, 0x9, 0x0, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x100006, 0x8000, 0x400, 0x3e55, 0xff, 0xd3, 0x7, 0x3435, 0x3, 0x9, 0xfd, 0x401, 0x101, 0xdd83, 0x60a2, 0x17fc, 0x9d26, 0x5, 0x8, 0x2, 0x2, 0x6, 0x8000, 0xf45, 0x3, 0xd500, 0x8, 0x77, 0x9, 0xfffffffc, 0x10000, 0x1, 0x8, 0x1], [0xa772, 0x1, 0x5, 0x1afa, 0x20bfc, 0x8, 0x7c81, 0x7f, 0xfffffff8, 0x40, 0xff, 0x5, 0x7fffffff, 0x7, 0x4, 0x9, 0x81, 0x3, 0x9, 0x9, 0xfffffff7, 0x8, 0x40f1, 0x2, 0x3, 0x101, 0x80000001, 0x7777, 0xfff, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x624dfaee, 0xc, 0x7f, 0x1000, 0x1ff, 0x2000005, 0xffffffff, 0x10000, 0x0, 0x8001, 0x7fff, 0x1000, 0x6, 0xf, 0xe, 0x5337, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x1, 0x8, 0x5393, 0x1, 0x1b18]}, 0x45c) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x14, 0x0, 0x400, 0x70bd2d, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x2010}, 0x4001) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)="5c00000012", 0x5}], 0x1, 0x0, 0x1f, 0x1f00c00e}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000880)={0x0, 0x0, @pic={0x2a, 0xc0, 0x7, 0x6, 0xfb, 0x2, 0xf, 0x4, 0x3, 0x0, 0x3, 0x58, 0x9e, 0x6, 0x6, 0x7f}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x180, 0x4, 0x14, 0xf1, 0x0, 0x7fffffffffffe, 0x5, 0x4005, 0x6, 0x0, 0x45, 0x1, 0xbdb], 0x1, 0x1c4213}) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000bc0)=[{{&(0x7f0000000180)={0x2, 0x4e27, @empty}, 0x10, 0x0}}], 0x1, 0x20004840) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r4 = dup(r3) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.10' (ED25519) to the list of known hosts. [ 84.210284][ T5849] cgroup: Unknown subsys name 'net' [ 84.327198][ T5849] cgroup: Unknown subsys name 'cpuset' [ 84.337504][ T5849] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 86.183163][ T5849] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 90.112131][ T5873] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 90.118206][ T5870] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 90.120806][ T5873] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 90.142509][ T5871] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 90.144788][ T5873] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 90.154276][ T5871] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 90.166148][ T5871] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 90.183393][ T5871] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 90.183702][ T5873] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 90.191306][ T5871] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 90.214161][ T5873] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 90.221565][ T5871] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 90.222100][ T5876] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 90.236513][ T5181] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 90.244135][ T5873] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 90.254237][ T5869] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 90.263596][ T5869] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 90.274164][ T5876] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 90.285279][ T5876] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 90.296190][ T5876] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 90.739751][ T5860] chnl_net:caif_netlink_parms(): no params data found [ 90.890484][ T5861] chnl_net:caif_netlink_parms(): no params data found [ 90.987152][ T5858] chnl_net:caif_netlink_parms(): no params data found [ 91.067705][ T5860] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.075835][ T5860] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.083495][ T5860] bridge_slave_0: entered allmulticast mode [ 91.091023][ T5860] bridge_slave_0: entered promiscuous mode [ 91.135849][ T5860] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.143129][ T5860] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.150311][ T5860] bridge_slave_1: entered allmulticast mode [ 91.158568][ T5860] bridge_slave_1: entered promiscuous mode [ 91.171816][ T5859] chnl_net:caif_netlink_parms(): no params data found [ 91.286603][ T5861] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.294346][ T5861] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.301535][ T5861] bridge_slave_0: entered allmulticast mode [ 91.309840][ T5861] bridge_slave_0: entered promiscuous mode [ 91.334707][ T5860] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.349610][ T5861] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.357171][ T5861] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.364454][ T5861] bridge_slave_1: entered allmulticast mode [ 91.371742][ T5861] bridge_slave_1: entered promiscuous mode [ 91.379463][ T5858] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.386870][ T5858] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.394250][ T5858] bridge_slave_0: entered allmulticast mode [ 91.401457][ T5858] bridge_slave_0: entered promiscuous mode [ 91.411882][ T5860] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.468466][ T5858] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.475945][ T5858] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.483400][ T5858] bridge_slave_1: entered allmulticast mode [ 91.490633][ T5858] bridge_slave_1: entered promiscuous mode [ 91.519257][ T5861] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.544861][ T5860] team0: Port device team_slave_0 added [ 91.564924][ T5861] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.605691][ T5860] team0: Port device team_slave_1 added [ 91.615442][ T5858] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 91.668089][ T5858] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 91.692394][ T5859] bridge0: port 1(bridge_slave_0) entered blocking state [ 91.700329][ T5859] bridge0: port 1(bridge_slave_0) entered disabled state [ 91.707755][ T5859] bridge_slave_0: entered allmulticast mode [ 91.715743][ T5859] bridge_slave_0: entered promiscuous mode [ 91.725499][ T5861] team0: Port device team_slave_0 added [ 91.764036][ T5859] bridge0: port 2(bridge_slave_1) entered blocking state [ 91.771248][ T5859] bridge0: port 2(bridge_slave_1) entered disabled state [ 91.778737][ T5859] bridge_slave_1: entered allmulticast mode [ 91.786522][ T5859] bridge_slave_1: entered promiscuous mode [ 91.796482][ T5861] team0: Port device team_slave_1 added [ 91.803435][ T5860] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 91.810399][ T5860] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.836841][ T5860] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 91.850357][ T5858] team0: Port device team_slave_0 added [ 91.860039][ T5858] team0: Port device team_slave_1 added [ 91.911092][ T5860] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 91.918231][ T5860] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 91.944487][ T5860] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.007668][ T5858] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.014706][ T5858] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.041099][ T5858] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.056675][ T5859] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 92.066704][ T5861] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.074181][ T5861] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.100644][ T5861] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.113999][ T5861] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.120989][ T5861] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.147906][ T5861] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.160807][ T5858] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.167952][ T5858] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.194510][ T5858] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.215988][ T5859] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 92.294214][ T5876] Bluetooth: hci2: command tx timeout [ 92.294219][ T5867] Bluetooth: hci3: command tx timeout [ 92.334735][ T5859] team0: Port device team_slave_0 added [ 92.348958][ T5860] hsr_slave_0: entered promiscuous mode [ 92.357567][ T5860] hsr_slave_1: entered promiscuous mode [ 92.373318][ T5867] Bluetooth: hci1: command tx timeout [ 92.375641][ T5876] Bluetooth: hci0: command tx timeout [ 92.413515][ T5859] team0: Port device team_slave_1 added [ 92.427859][ T5861] hsr_slave_0: entered promiscuous mode [ 92.435231][ T5861] hsr_slave_1: entered promiscuous mode [ 92.441748][ T5861] debugfs: 'hsr0' already exists in 'hsr' [ 92.448263][ T5861] Cannot create hsr debugfs directory [ 92.517783][ T5858] hsr_slave_0: entered promiscuous mode [ 92.525747][ T5858] hsr_slave_1: entered promiscuous mode [ 92.532054][ T5858] debugfs: 'hsr0' already exists in 'hsr' [ 92.538320][ T5858] Cannot create hsr debugfs directory [ 92.647552][ T5859] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 92.656825][ T5859] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.683393][ T5859] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 92.737727][ T5859] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 92.744967][ T5859] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 92.771729][ T5859] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 92.997451][ T5859] hsr_slave_0: entered promiscuous mode [ 93.004736][ T5859] hsr_slave_1: entered promiscuous mode [ 93.010974][ T5859] debugfs: 'hsr0' already exists in 'hsr' [ 93.017095][ T5859] Cannot create hsr debugfs directory [ 93.216822][ T5861] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 93.230436][ T5861] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 93.257658][ T5861] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 93.292363][ T5861] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 93.380209][ T5860] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 93.391411][ T5860] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 93.404562][ T5860] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 93.415895][ T5860] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 93.552736][ T5858] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 93.568878][ T5858] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 93.588470][ T5858] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 93.600010][ T5858] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 93.702548][ T5859] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 93.714674][ T5859] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 93.728129][ T5859] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 93.752142][ T5859] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 93.806414][ T5860] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.836073][ T5861] 8021q: adding VLAN 0 to HW filter on device bond0 [ 93.892711][ T5861] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.910757][ T5860] 8021q: adding VLAN 0 to HW filter on device team0 [ 93.926108][ T1007] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.933459][ T1007] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.968564][ T1007] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.975831][ T1007] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.007303][ T1007] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.014480][ T1007] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.048040][ T1338] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.055260][ T1338] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.070107][ T5858] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.140409][ T5861] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 94.170160][ T5858] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.232015][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.239253][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.292613][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.299865][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.377724][ T5876] Bluetooth: hci3: command tx timeout [ 94.385045][ T5867] Bluetooth: hci2: command tx timeout [ 94.396610][ T5859] 8021q: adding VLAN 0 to HW filter on device bond0 [ 94.451081][ T5859] 8021q: adding VLAN 0 to HW filter on device team0 [ 94.460400][ T5867] Bluetooth: hci1: command tx timeout [ 94.469218][ T5867] Bluetooth: hci0: command tx timeout [ 94.516344][ T1338] bridge0: port 1(bridge_slave_0) entered blocking state [ 94.523652][ T1338] bridge0: port 1(bridge_slave_0) entered forwarding state [ 94.566224][ T1338] bridge0: port 2(bridge_slave_1) entered blocking state [ 94.573481][ T1338] bridge0: port 2(bridge_slave_1) entered forwarding state [ 94.719129][ T5861] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.849193][ T5860] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.891229][ T5861] veth0_vlan: entered promiscuous mode [ 94.911006][ T5858] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 94.956535][ T5861] veth1_vlan: entered promiscuous mode [ 95.067707][ T5861] veth0_macvtap: entered promiscuous mode [ 95.101702][ T5860] veth0_vlan: entered promiscuous mode [ 95.118018][ T5861] veth1_macvtap: entered promiscuous mode [ 95.137999][ T5859] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 95.150647][ T5858] veth0_vlan: entered promiscuous mode [ 95.163793][ T5860] veth1_vlan: entered promiscuous mode [ 95.185101][ T5858] veth1_vlan: entered promiscuous mode [ 95.199631][ T5861] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.224482][ T5861] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.260366][ T3010] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.271115][ T3010] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.296734][ T1320] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.306843][ T1320] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.361870][ T5860] veth0_macvtap: entered promiscuous mode [ 95.386370][ T5859] veth0_vlan: entered promiscuous mode [ 95.405240][ T5858] veth0_macvtap: entered promiscuous mode [ 95.430650][ T5859] veth1_vlan: entered promiscuous mode [ 95.437885][ T5860] veth1_macvtap: entered promiscuous mode [ 95.468778][ T5858] veth1_macvtap: entered promiscuous mode [ 95.483783][ T3010] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.498949][ T3010] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.559382][ T5860] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.571598][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.578643][ T5858] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.587882][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.602472][ T5860] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.630309][ T5858] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 95.651359][ T5859] veth0_macvtap: entered promiscuous mode [ 95.669680][ T1338] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.691902][ T1338] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.704763][ T5859] veth1_macvtap: entered promiscuous mode [ 95.726145][ T1338] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.736624][ T1338] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.750046][ T5861] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 95.776626][ T1338] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.811168][ T1338] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.833689][ T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.842464][ T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 95.966661][ T5859] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 95.986583][ T5859] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 96.036873][ T1320] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.060329][ T1320] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.073387][ T1320] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.098233][ T1320] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 96.106313][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.117209][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.174302][ T3010] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.187148][ T3010] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.231398][ T1320] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.241009][ T1320] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.265356][ T10] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 96.332055][ T3010] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.361086][ T3010] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.386910][ T1320] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.415377][ T1320] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.443371][ T10] usb 2-1: Using ep0 maxpacket: 32 [ 96.450812][ T5960] overlayfs: missing 'lowerdir' [ 96.456398][ T5876] Bluetooth: hci2: command tx timeout [ 96.468857][ T5876] Bluetooth: hci3: command tx timeout [ 96.475827][ T10] usb 2-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 96.492996][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 96.529885][ T1007] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 96.538297][ T5876] Bluetooth: hci0: command tx timeout [ 96.538343][ T5876] Bluetooth: hci1: command tx timeout [ 96.560155][ T10] usb 2-1: config 0 descriptor?? [ 96.585030][ T1007] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.624457][ T10] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 96.764167][ T5964] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 96.791007][ T10] gspca_vc032x: reg_r err -32 [ 96.814202][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 96.836713][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 96.842073][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 96.881518][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 96.896687][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 96.902049][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 96.910579][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 96.918118][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 96.923935][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 96.943156][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 96.958708][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 96.961983][ T5969] netlink: 8 bytes leftover after parsing attributes in process `syz.3.7'. [ 96.974260][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 96.979601][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 97.003915][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 97.017695][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 97.040386][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 97.046619][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 97.052655][ T10] gspca_vc032x: I2c Bus Busy Wait 00 [ 97.061854][ T10] gspca_vc032x: Unknown sensor... [ 97.069154][ T10] vc032x 2-1:0.0: probe with driver vc032x failed with error -22 [ 97.168969][ T5975] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8'. [ 97.190614][ T5973] netlink: 8 bytes leftover after parsing attributes in process `syz.2.8'. [ 97.266702][ T24] cfg80211: failed to load regulatory.db [ 97.713026][ T5926] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 97.873590][ T5926] usb 3-1: Using ep0 maxpacket: 16 [ 97.881010][ T5926] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 97.892676][ T5926] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 97.908514][ T5926] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 97.917879][ T5926] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 97.926230][ T5926] usb 3-1: Product: syz [ 97.931826][ T5926] usb 3-1: Manufacturer: syz [ 97.936582][ T5926] usb 3-1: SerialNumber: syz [ 97.944938][ T5926] usb 3-1: config 0 descriptor?? [ 97.955017][ T5926] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 97.965006][ T5926] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 98.516735][ T5998] overlayfs: missing 'lowerdir' [ 98.533194][ T5867] Bluetooth: hci3: command tx timeout [ 98.533399][ T5876] Bluetooth: hci2: command tx timeout [ 98.559017][ T5926] em28xx 3-1:0.0: unknown em28xx chip ID (0) [ 98.562860][ T6000] netlink: 8 bytes leftover after parsing attributes in process `syz.3.18'. [ 98.575171][ T5926] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 98.583507][ T5926] em28xx 3-1:0.0: AC97 chip type couldn't be determined [ 98.590619][ T5926] em28xx 3-1:0.0: No AC97 audio processor [ 98.614793][ T5876] Bluetooth: hci1: command tx timeout [ 98.619661][ T5867] Bluetooth: hci0: command tx timeout [ 99.089288][ T5926] usb 2-1: USB disconnect, device number 2 [ 99.332568][ T6029] overlayfs: missing 'lowerdir' [ 99.471422][ T6033] fuse: Unknown parameter 'grou00000000000000000000' [ 99.542558][ T6035] netlink: 8 bytes leftover after parsing attributes in process `syz.3.30'. [ 100.483058][ T5926] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 100.516979][ T5952] usb 3-1: USB disconnect, device number 2 [ 100.547525][ T5952] em28xx 3-1:0.0: Disconnecting em28xx [ 100.607337][ T5952] ================================================================== [ 100.615461][ T5952] BUG: KASAN: slab-use-after-free in media_devnode_unregister+0xe2/0xf0 [ 100.623869][ T5952] Read of size 4 at addr ffff8880582404f0 by task kworker/1:6/5952 [ 100.631798][ T5952] [ 100.634157][ T5952] CPU: 1 UID: 0 PID: 5952 Comm: kworker/1:6 Not tainted syzkaller #0 PREEMPT(full) [ 100.634180][ T5952] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 100.634193][ T5952] Workqueue: usb_hub_wq hub_event [ 100.634223][ T5952] Call Trace: [ 100.634231][ T5952] [ 100.634238][ T5952] dump_stack_lvl+0x189/0x250 [ 100.634257][ T5952] ? rcu_is_watching+0x15/0xb0 [ 100.634279][ T5952] ? __kasan_check_byte+0x12/0x40 [ 100.634300][ T5952] ? __pfx_dump_stack_lvl+0x10/0x10 [ 100.634315][ T5952] ? rcu_is_watching+0x15/0xb0 [ 100.634336][ T5952] ? lock_release+0x4b/0x3e0 [ 100.634356][ T5952] ? __virt_addr_valid+0x1c8/0x5c0 [ 100.634384][ T5952] ? __virt_addr_valid+0x4a5/0x5c0 [ 100.634411][ T5952] print_report+0xca/0x240 [ 100.634428][ T5952] ? media_devnode_unregister+0xe2/0xf0 [ 100.634452][ T5952] kasan_report+0x118/0x150 [ 100.634473][ T5952] ? media_devnode_unregister+0xe2/0xf0 [ 100.634499][ T5952] media_devnode_unregister+0xe2/0xf0 [ 100.634524][ T5952] media_device_unregister+0x37c/0x400 [ 100.634547][ T5952] ? em28xx_audio_fini+0x59/0x1b0 [ 100.634569][ T5952] em28xx_release_resources+0xac/0x240 [ 100.634597][ T5952] em28xx_usb_disconnect+0x19f/0x2f0 [ 100.634623][ T5952] usb_unbind_interface+0x26e/0x910 [ 100.634647][ T5952] ? __pfx_usb_unbind_interface+0x10/0x10 [ 100.634667][ T5952] device_release_driver_internal+0x4d9/0x800 [ 100.634693][ T5952] bus_remove_device+0x34d/0x410 [ 100.634711][ T5952] device_del+0x511/0x8e0 [ 100.634734][ T5952] ? __pfx_device_del+0x10/0x10 [ 100.634760][ T5952] ? kobject_put+0x446/0x480 [ 100.634780][ T5952] usb_disable_device+0x3e9/0x8a0 [ 100.634801][ T5952] usb_disconnect+0x330/0x950 [ 100.634831][ T5952] hub_event+0x1cf5/0x4a20 [ 100.634848][ T5952] ? kasan_save_track+0x3e/0x80 [ 100.634865][ T5952] ? __kasan_save_free_info+0x46/0x50 [ 100.634890][ T5952] ? __kasan_slab_free+0x5b/0x80 [ 100.634918][ T5952] ? do_raw_spin_lock+0x121/0x290 [ 100.634944][ T5952] ? register_lock_class+0x51/0x320 [ 100.634969][ T5952] ? __pfx_hub_event+0x10/0x10 [ 100.634986][ T5952] ? process_scheduled_works+0x9ef/0x17b0 [ 100.635009][ T5952] ? _raw_spin_unlock_irq+0x23/0x50 [ 100.635033][ T5952] ? process_scheduled_works+0x9ef/0x17b0 [ 100.635052][ T5952] ? process_scheduled_works+0x9ef/0x17b0 [ 100.635073][ T5952] process_scheduled_works+0xae1/0x17b0 [ 100.635105][ T5952] ? __pfx_process_scheduled_works+0x10/0x10 [ 100.635133][ T5952] worker_thread+0x8a0/0xda0 [ 100.635155][ T5952] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 100.635184][ T5952] ? __kthread_parkme+0x7b/0x200 [ 100.635210][ T5952] kthread+0x711/0x8a0 [ 100.635237][ T5952] ? __pfx_worker_thread+0x10/0x10 [ 100.635257][ T5952] ? __pfx_kthread+0x10/0x10 [ 100.635283][ T5952] ? _raw_spin_unlock_irq+0x23/0x50 [ 100.635307][ T5952] ? lockdep_hardirqs_on+0x9c/0x150 [ 100.635332][ T5952] ? __pfx_kthread+0x10/0x10 [ 100.635357][ T5952] ret_from_fork+0x47c/0x820 [ 100.635378][ T5952] ? __pfx_ret_from_fork+0x10/0x10 [ 100.635401][ T5952] ? __switch_to_asm+0x39/0x70 [ 100.635419][ T5952] ? __switch_to_asm+0x33/0x70 [ 100.635436][ T5952] ? __pfx_kthread+0x10/0x10 [ 100.635461][ T5952] ret_from_fork_asm+0x1a/0x30 [ 100.635487][ T5952] [ 100.635493][ T5952] [ 100.945328][ T5952] Allocated by task 5926: [ 100.949689][ T5952] kasan_save_track+0x3e/0x80 [ 100.954397][ T5952] __kasan_kmalloc+0x93/0xb0 [ 100.958996][ T5952] __kmalloc_cache_noprof+0x3d5/0x6f0 [ 100.964547][ T5952] __media_device_register+0x58/0x280 [ 100.969933][ T5952] em28xx_usb_probe+0x1764/0x2a20 [ 100.974982][ T5952] usb_probe_interface+0x665/0xc30 [ 100.980122][ T5952] really_probe+0x26d/0x9e0 [ 100.984652][ T5952] __driver_probe_device+0x18c/0x2f0 [ 100.989961][ T5952] driver_probe_device+0x4f/0x430 [ 100.995001][ T5952] __device_attach_driver+0x2ce/0x530 [ 101.000386][ T5952] bus_for_each_drv+0x24e/0x2e0 [ 101.005289][ T5952] __device_attach+0x2b8/0x400 [ 101.010072][ T5952] bus_probe_device+0x185/0x260 [ 101.014932][ T5952] device_add+0x7b6/0xb50 [ 101.019276][ T5952] usb_set_configuration+0x1a87/0x20e0 [ 101.024748][ T5952] usb_generic_driver_probe+0x8d/0x150 [ 101.030216][ T5952] usb_probe_device+0x1c1/0x390 [ 101.035078][ T5952] really_probe+0x26d/0x9e0 [ 101.039600][ T5952] __driver_probe_device+0x18c/0x2f0 [ 101.044994][ T5952] driver_probe_device+0x4f/0x430 [ 101.050047][ T5952] __device_attach_driver+0x2ce/0x530 [ 101.055439][ T5952] bus_for_each_drv+0x24e/0x2e0 [ 101.060488][ T5952] __device_attach+0x2b8/0x400 [ 101.065329][ T5952] bus_probe_device+0x185/0x260 [ 101.070198][ T5952] device_add+0x7b6/0xb50 [ 101.074657][ T5952] usb_new_device+0xa39/0x16f0 [ 101.079445][ T5952] hub_event+0x2958/0x4a20 [ 101.083881][ T5952] process_scheduled_works+0xae1/0x17b0 [ 101.089482][ T5952] worker_thread+0x8a0/0xda0 [ 101.094093][ T5952] kthread+0x711/0x8a0 [ 101.098199][ T5952] ret_from_fork+0x47c/0x820 [ 101.102811][ T5952] ret_from_fork_asm+0x1a/0x30 [ 101.107616][ T5952] [ 101.109945][ T5952] Freed by task 5952: [ 101.113930][ T5952] kasan_save_track+0x3e/0x80 [ 101.118615][ T5952] __kasan_save_free_info+0x46/0x50 [ 101.123836][ T5952] __kasan_slab_free+0x5b/0x80 [ 101.128615][ T5952] kfree+0x199/0x6d0 [ 101.132518][ T5952] media_devnode_release+0x61/0xa0 [ 101.137660][ T5952] device_release+0x99/0x1c0 [ 101.142268][ T5952] kobject_put+0x228/0x480 [ 101.146691][ T5952] media_devnode_unregister+0x6d/0xf0 [ 101.152167][ T5952] media_device_unregister+0x37c/0x400 [ 101.157637][ T5952] em28xx_release_resources+0xac/0x240 [ 101.163115][ T5952] em28xx_usb_disconnect+0x19f/0x2f0 [ 101.168430][ T5952] usb_unbind_interface+0x26e/0x910 [ 101.173693][ T5952] device_release_driver_internal+0x4d9/0x800 [ 101.179788][ T5952] bus_remove_device+0x34d/0x410 [ 101.185007][ T5952] device_del+0x511/0x8e0 [ 101.189364][ T5952] usb_disable_device+0x3e9/0x8a0 [ 101.194435][ T5952] usb_disconnect+0x330/0x950 [ 101.199133][ T5952] hub_event+0x1cf5/0x4a20 [ 101.203597][ T5952] process_scheduled_works+0xae1/0x17b0 [ 101.209161][ T5952] worker_thread+0x8a0/0xda0 [ 101.213807][ T5952] kthread+0x711/0x8a0 [ 101.217897][ T5952] ret_from_fork+0x47c/0x820 [ 101.222516][ T5952] ret_from_fork_asm+0x1a/0x30 [ 101.227294][ T5952] [ 101.229625][ T5952] The buggy address belongs to the object at ffff888058240000 [ 101.229625][ T5952] which belongs to the cache kmalloc-2k of size 2048 [ 101.243685][ T5952] The buggy address is located 1264 bytes inside of [ 101.243685][ T5952] freed 2048-byte region [ffff888058240000, ffff888058240800) [ 101.257672][ T5952] [ 101.260003][ T5952] The buggy address belongs to the physical page: [ 101.266440][ T5952] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x58240 [ 101.275216][ T5952] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 101.283722][ T5952] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 101.291271][ T5952] page_type: f5(slab) [ 101.295298][ T5952] raw: 00fff00000000040 ffff88801a842000 dead000000000122 0000000000000000 [ 101.303891][ T5952] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 101.312533][ T5952] head: 00fff00000000040 ffff88801a842000 dead000000000122 0000000000000000 [ 101.321216][ T5952] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 101.329900][ T5952] head: 00fff00000000003 ffffea0001609001 00000000ffffffff 00000000ffffffff [ 101.338583][ T5952] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 101.347265][ T5952] page dumped because: kasan: bad access detected [ 101.354480][ T5952] page_owner tracks the page as allocated [ 101.360203][ T5952] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5926, tgid 5926 (kworker/1:5), ts 98597974582, free_ts 30832044128 [ 101.381784][ T5952] post_alloc_hook+0x240/0x2a0 [ 101.386568][ T5952] get_page_from_freelist+0x21e4/0x22c0 [ 101.392127][ T5952] __alloc_frozen_pages_noprof+0x181/0x370 [ 101.397942][ T5952] alloc_pages_mpol+0x232/0x4a0 [ 101.402801][ T5952] allocate_slab+0x8a/0x330 [ 101.407318][ T5952] ___slab_alloc+0xbd1/0x13f0 [ 101.412018][ T5952] __slab_alloc+0x55/0xa0 [ 101.416452][ T5952] __kmalloc_cache_noprof+0x411/0x6f0 [ 101.421838][ T5952] __media_device_register+0x58/0x280 [ 101.427223][ T5952] em28xx_usb_probe+0x1764/0x2a20 [ 101.432269][ T5952] usb_probe_interface+0x665/0xc30 [ 101.437392][ T5952] really_probe+0x26d/0x9e0 [ 101.441906][ T5952] __driver_probe_device+0x18c/0x2f0 [ 101.447203][ T5952] driver_probe_device+0x4f/0x430 [ 101.452244][ T5952] __device_attach_driver+0x2ce/0x530 [ 101.457626][ T5952] bus_for_each_drv+0x24e/0x2e0 [ 101.462495][ T5952] page last free pid 1 tgid 1 stack trace: [ 101.468302][ T5952] __free_frozen_pages+0xbc4/0xd30 [ 101.473425][ T5952] free_contig_range+0x1bd/0x4a0 [ 101.478382][ T5952] destroy_args+0x69/0x660 [ 101.482808][ T5952] debug_vm_pgtable+0x39f/0x3b0 [ 101.487670][ T5952] do_one_initcall+0x233/0x820 [ 101.492443][ T5952] do_initcall_level+0x104/0x190 [ 101.497402][ T5952] do_initcalls+0x59/0xa0 [ 101.501750][ T5952] kernel_init_freeable+0x334/0x4b0 [ 101.506961][ T5952] kernel_init+0x1d/0x1d0 [ 101.511313][ T5952] ret_from_fork+0x47c/0x820 [ 101.515924][ T5952] ret_from_fork_asm+0x1a/0x30 [ 101.520707][ T5952] [ 101.523039][ T5952] Memory state around the buggy address: [ 101.528678][ T5952] ffff888058240380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 101.536741][ T5952] ffff888058240400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 101.544809][ T5952] >ffff888058240480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 101.552872][ T5952] ^ [ 101.560593][ T5952] ffff888058240500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 101.568659][ T5952] ffff888058240580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 101.576820][ T5952] ================================================================== [ 101.638587][ T5926] usb 1-1: Using ep0 maxpacket: 32 [ 101.646819][ T5952] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 101.654086][ T5952] CPU: 1 UID: 0 PID: 5952 Comm: kworker/1:6 Not tainted syzkaller #0 PREEMPT(full) [ 101.663490][ T5952] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 101.673577][ T5952] Workqueue: usb_hub_wq hub_event [ 101.678644][ T5952] Call Trace: [ 101.681938][ T5952] [ 101.684883][ T5952] dump_stack_lvl+0x99/0x250 [ 101.689505][ T5952] ? __asan_memcpy+0x40/0x70 [ 101.694149][ T5952] ? __pfx_dump_stack_lvl+0x10/0x10 [ 101.699386][ T5952] ? __pfx__printk+0x10/0x10 [ 101.704100][ T5952] vpanic+0x237/0x6d0 [ 101.708106][ T5952] ? __pfx_vpanic+0x10/0x10 [ 101.712623][ T5952] ? preempt_schedule+0xae/0xc0 [ 101.717491][ T5952] ? __pfx_preempt_schedule+0x10/0x10 [ 101.722933][ T5952] panic+0xb9/0xc0 [ 101.726679][ T5952] ? __pfx_panic+0x10/0x10 [ 101.731118][ T5952] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 101.737052][ T5952] ? media_devnode_unregister+0xe2/0xf0 [ 101.742634][ T5952] check_panic_on_warn+0x89/0xb0 [ 101.747597][ T5952] ? media_devnode_unregister+0xe2/0xf0 [ 101.753171][ T5952] end_report+0x78/0x160 [ 101.757429][ T5952] kasan_report+0x129/0x150 [ 101.761951][ T5952] ? media_devnode_unregister+0xe2/0xf0 [ 101.767529][ T5952] media_devnode_unregister+0xe2/0xf0 [ 101.772948][ T5952] media_device_unregister+0x37c/0x400 [ 101.778429][ T5952] ? em28xx_audio_fini+0x59/0x1b0 [ 101.783471][ T5952] em28xx_release_resources+0xac/0x240 [ 101.788949][ T5952] em28xx_usb_disconnect+0x19f/0x2f0 [ 101.794256][ T5952] usb_unbind_interface+0x26e/0x910 [ 101.799473][ T5952] ? __pfx_usb_unbind_interface+0x10/0x10 [ 101.805205][ T5952] device_release_driver_internal+0x4d9/0x800 [ 101.811292][ T5952] bus_remove_device+0x34d/0x410 [ 101.816291][ T5952] device_del+0x511/0x8e0 [ 101.820654][ T5952] ? __pfx_device_del+0x10/0x10 [ 101.825531][ T5952] ? kobject_put+0x446/0x480 [ 101.830141][ T5952] usb_disable_device+0x3e9/0x8a0 [ 101.835178][ T5952] usb_disconnect+0x330/0x950 [ 101.839880][ T5952] hub_event+0x1cf5/0x4a20 [ 101.844565][ T5952] ? kasan_save_track+0x3e/0x80 [ 101.849436][ T5952] ? __kasan_save_free_info+0x46/0x50 [ 101.854911][ T5952] ? __kasan_slab_free+0x5b/0x80 [ 101.860052][ T5952] ? do_raw_spin_lock+0x121/0x290 [ 101.865097][ T5952] ? register_lock_class+0x51/0x320 [ 101.870337][ T5952] ? __pfx_hub_event+0x10/0x10 [ 101.875113][ T5952] ? process_scheduled_works+0x9ef/0x17b0 [ 101.880845][ T5952] ? _raw_spin_unlock_irq+0x23/0x50 [ 101.886060][ T5952] ? process_scheduled_works+0x9ef/0x17b0 [ 101.891789][ T5952] ? process_scheduled_works+0x9ef/0x17b0 [ 101.897538][ T5952] process_scheduled_works+0xae1/0x17b0 [ 101.903134][ T5952] ? __pfx_process_scheduled_works+0x10/0x10 [ 101.909155][ T5952] worker_thread+0x8a0/0xda0 [ 101.913765][ T5952] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 101.920115][ T5952] ? __kthread_parkme+0x7b/0x200 [ 101.925171][ T5952] kthread+0x711/0x8a0 [ 101.929274][ T5952] ? __pfx_worker_thread+0x10/0x10 [ 101.934441][ T5952] ? __pfx_kthread+0x10/0x10 [ 101.939070][ T5952] ? _raw_spin_unlock_irq+0x23/0x50 [ 101.944298][ T5952] ? lockdep_hardirqs_on+0x9c/0x150 [ 101.949526][ T5952] ? __pfx_kthread+0x10/0x10 [ 101.954167][ T5952] ret_from_fork+0x47c/0x820 [ 101.958776][ T5952] ? __pfx_ret_from_fork+0x10/0x10 [ 101.963913][ T5952] ? __switch_to_asm+0x39/0x70 [ 101.968686][ T5952] ? __switch_to_asm+0x33/0x70 [ 101.973455][ T5952] ? __pfx_kthread+0x10/0x10 [ 101.978065][ T5952] ret_from_fork_asm+0x1a/0x30 [ 101.982844][ T5952] [ 101.986209][ T5952] Kernel Offset: disabled [ 101.990539][ T5952] Rebooting in 86400 seconds..