last executing test programs: 8m2.069076342s ago: executing program 1 (id=318): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000280), 0x106, 0x2}}, 0xfe5e) unshare(0xf0020000) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x800}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @log={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LOG_LEVEL={0x8, 0x5, 0x1, 0x0, 0x8}]}}}, {0x10, 0x1, 0x0, 0x1, @counter={{0xc}, @void}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x20}}, 0x80}, 0x1, 0x0, 0x0, 0x40010}, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_group_source_req(r2, 0x0, 0x2e, &(0x7f0000000340)={0x5, {{0x2, 0x400, @multicast2}}, {{0x2, 0x4e22, @loopback}}}, 0x108) r3 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x27, &(0x7f0000000180)={@multicast1, @local}, 0xc) r4 = syz_open_procfs(0x0, &(0x7f0000002180)='net/mcfilter\x00') preadv(r4, &(0x7f00000000c0)=[{&(0x7f0000000f00)=""/46, 0x2e}], 0x1, 0x5e, 0x10003ff) 8m1.387629229s ago: executing program 1 (id=321): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000900)=@newsa={0x138, 0x10, 0x1, 0xbffffffe, 0x100, {{@in6=@mcast2, @in=@local, 0x1, 0x794, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x9, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0x1ff}, {0x4, 0xfffffffc, 0x2259}, 0x70bd2a, 0x3504, 0xa, 0x1, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x10) 7m59.984988403s ago: executing program 1 (id=325): r0 = socket$kcm(0x29, 0x2, 0x0) write$binfmt_script(r0, &(0x7f0000000100), 0xfecc) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000080)=@gcm_128={{0x303}, "b7a41f2300", "d21b0e8a0e000000000000000600", "1d1cbe23", "ecba06893bcdc493"}, 0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) recvfrom(r1, 0x0, 0x0, 0x17, 0x0, 0x0) writev(r1, &(0x7f0000001540)=[{&(0x7f0000000140)="58ddb007a47a8b1f458ab677d557ca50def8e5bc61dbc50bca64f7e76268cd64007095adfef77465b69ec03139854d6f03d5f9bd019fe046035ef7049f48fcc7321c34faca94ff08f59edaf2ab55eedcc278df823564618627217a527b971bdfa0afd948a6cdb9e05ccaef35c22047246a7b97a8e1b645e51c47b296c759c8dfd56beb8fa15c800ad060ab378a269557bc053d9be903", 0x96}, {&(0x7f0000000300)="2ea63d218bc1023b2e6eceeb92d548803a43d4dddc2433c76650030c188f490311ff86da69fab1539139f6dda31739c2bb4412dd471137e2a53496c5f7707e01ccfb826f2eb96895230862e11d56c19af139de912ac5e68a99080e428443fcfba8b0460290c6275affe9953a97260b0304fd7ef159c9cd30cae1bcc75d568d353575", 0x82}], 0x2) 7m55.404857854s ago: executing program 1 (id=342): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f0000000f00)=ANY=[@ANYBLOB="b702000002000000bfa30000000000000703000000feffff7a0af0fff8bffffd79a4f0ff00000000b7060000ffffffff2d640500000000006504040001001f000404000081007d60b7030000000000006a0a00fefdff0000850000000d000000b7000000000000009500000000000000c74396c8e3ebbadc20e5a7ef8c9ac1465c3a1f59916ffc9bf0bd09279c362f80e5cf8df265e1b40e4c8ae7a89cf8bd819b5c0c000000008da68076774bb4db2c769937000090af27db5b56024dcbbbd2cb2000ce94284673b4e8d5467e357754508535766c801100000000b290a248a120c9c6e39f3052aae80677eeba68562eaeaea5fecf298ca20f274233106e2baf69b1c60f0ce4099f366b89ab63ecf772de7b265040b6b1acbef92b2704550a4d1dd5c50b7420b58a93fe94c756008afcd0b2eb785632e0a85f02a5a6474ae549070000000000001294fba0ed5020e6477cc921fee1f6d8ad6a80d0947cd6d4a561ced23b0b4a902be6af7ec2d1ba000057f301000000000000000000000000100000aaf253886c0b9f6d4731d714ad72e5ad8530a6380ed2d29f47f96a576cd20cef7ed95157ab050000f0077e9d13d8b93eb0f2c6f8941e35e1577c10e509c9b133c849eb709df5c6ba73cccdfa3c58bc5204339b0b487f0eeed581cb202900000d322717c338033213c18a34ee0ca2cf61efb4b3797a642735d6d482ba98d252f36c54333aab1aa736369392239820f5f1557b0bf7ccb0a5a13c714e0b1a5bc3f9caff3283076cda3d0b1a2905cf7bd04f2db530abcbe44bc40528ad807970727fb819afa14aad99f93093ced7dd51995edcf53b907228fa9e83433eedb4ac88d0285594ffb0d14e71d5c57f33702f22b22417bfb38d04c8441ceec8bcaffbe800aa41307bd8325a76f395bc9a8b0c9d905979f34adddb521914f92eed3d3e9de82942a952e86bd67aff5bc2e3c1fcc00f61124dd06df4b8fd356cb365adc037e443820c05c5db160087a9cf471e0eff227f25b2c5cacebfcd55f8c81f5eb1f8d615ca27efb2193bb61665b8ce37f30c2efc9c3b5a4a5d95479fac471ba60fbd0e50223517a07a3484124c5563cd3700000000001825b05a580ea8cb7f85b77b35a06a895b287b47efbe220bc215aca4a65d7018a7f91c4228b35f71a7c183360ab7a7b6b7870086d851ff861ee07bbec801b79afa477ebab255c7265820456fdc3f34f9d729315d856be7ec564613d5e28cf7c405d6e2b6aeb20000b8505a36a8067cb459fab87c8de118117733d30f4fe049658a2c3edd43546ead9c7882858868cff89a49a693731140db1b7b7116060c30690a39de8b3e0eb4f5401e8354870848c546f9defe1a9c534c9030830fec3eeb5faf1d64bb8e80000000f6ff0000000000000055d843352632b829ceb5200a2cdeb63c0bc7e835e061f9ac3c052b5b6f689bf203aeb8858be07691bc83e178181fab55e6ed9e8a17819de49564d0f0c00dd507441b80cd499c39c5d03d6c00cf5be5215bae09a4f52abf8f1c1add498470a0bb9d7ab757a8b28e4accc939b3621e4c2c9e02741c51eeeaad40cf2e1c3659d83ed71fc628807739d70edda93542445e3204828c49bef648efdc2208341357dd158f411d379df9b1feffbe7c7ee80558a040fa3d5a303f36d5c1a66d9644fc0559aa0e291355ee3de6c7a705b8f7b45bb825044b9a82a6fd2f6eeb14eee0c3f71eeea9984e14c57022ef72850b6dc5fda167d6f98f6c1c73feb424b7937e3c7ca0d2525efbdac50eb94797cf3747b83b56cfea8c74dd3f957dc462e715b789934b422b7ddf3e11a6ad6ad9afd5389c728d14"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x3f, 0x10, &(0x7f0000000000), 0x2ca}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r3, 0x18000000000002a0, 0xf, 0x0, &(0x7f0000000040)="b90703600000f007529e0ff065581f", 0x0, 0x104, 0xa000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 7m54.221897622s ago: executing program 1 (id=348): setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x68, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000140)='./file1\x00') mkdir(&(0x7f00000020c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) mount$9p_fd(0x0, 0x0, 0x0, 0x800, &(0x7f0000000140)={'trans=fd,', {}, 0x2c, {}, 0x2c, {[{@access_uid}]}}) r1 = open(&(0x7f00000002c0)='.\x00', 0x101800, 0x1d2) sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r1, 0x40049366, &(0x7f0000000180)) 7m53.313056765s ago: executing program 1 (id=353): bind$inet6(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0xe0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = mq_open(&(0x7f0000000040)='!\x7f\x00\xca\x00\x00\x00\f\x00\x00\x01E!Tnux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000000)={0x3c, 0x9, 0xa, 0x3}) mq_timedreceive(r0, 0x0, 0xfffffffffffffee3, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = getpid() landlock_create_ruleset(0xfffffffffffffffe, 0x8, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mq_timedreceive(r0, &(0x7f0000000280)=""/196, 0xc4, 0x27, 0x0) mq_timedreceive(r0, &(0x7f0000000640)=""/155, 0x9b, 0x1000, 0x0) 7m37.120120478s ago: executing program 32 (id=353): bind$inet6(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0xe0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = mq_open(&(0x7f0000000040)='!\x7f\x00\xca\x00\x00\x00\f\x00\x00\x01E!Tnux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000000)={0x3c, 0x9, 0xa, 0x3}) mq_timedreceive(r0, 0x0, 0xfffffffffffffee3, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = getpid() landlock_create_ruleset(0xfffffffffffffffe, 0x8, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mq_timedreceive(r0, &(0x7f0000000280)=""/196, 0xc4, 0x27, 0x0) mq_timedreceive(r0, &(0x7f0000000640)=""/155, 0x9b, 0x1000, 0x0) 5m43.641034071s ago: executing program 5 (id=837): bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, 0x0, 0x0}, 0x94) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000fc0)={&(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10, 0x0}, 0x20000811) r0 = socket$kcm(0x29, 0x2, 0x0) socket$kcm(0x2, 0x1, 0x0) sendmsg$NL80211_CMD_SET_WDS_PEER(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000640)={&(0x7f00000005c0)={0x20, 0x0, 0x20, 0x70bd2c, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa}]}, 0x20}, 0x1, 0x0, 0x0, 0x20060004}, 0x40080b4) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a09000000000000000000020000000900020073794f310000000008000440080000000900010073797a3000000000080003400000000114000000110001"], 0x64}, 0x1, 0x0, 0x0, 0x814}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, 0x0, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000180a0500000000000000000002000000300003802c00038004000100776732000000000000000000000000001400010076657468315f746f5f627269646765000900020073797a30000000000900010073797a30"], 0x84}, 0x1, 0x0, 0x0, 0x40000}, 0x20008000) sendmsg$NFT_MSG_GETOBJ(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=ANY=[@ANYBLOB="34000000150a03f50000000000000000020000000900020073797a31000000000800034000000001"], 0x34}, 0x1, 0x0, 0x0, 0x66df5cfbe53006f1}, 0x0) 5m42.511505379s ago: executing program 5 (id=844): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c) sendto$inet6(r3, &(0x7f0000000a40)='\x00', 0x1, 0x0, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c) recvmmsg(r3, &(0x7f0000000200)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=""/36, 0x18}, 0x6}], 0x400000000000084, 0x40000100, 0x0) 5m41.301586818s ago: executing program 5 (id=847): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{}, {0x10000002, 0x2, 0xb}]}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) r2 = socket$kcm(0x2, 0x5, 0x84) recvmsg$unix(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) r4 = socket$kcm(0x2, 0x5, 0x84) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000010080)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000003c0)=[{0xfffffffc, 0x0, 0x1, 0x7}, {0x10000002}], 0x10, 0x316bb6af}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) close(r6) recvmsg$unix(r5, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(r4, 0x84, 0x6e, &(0x7f0000000000)=r7, 0x10) setsockopt$sock_attach_bpf(r2, 0x84, 0x7d, &(0x7f0000000000)=r3, 0x8) 5m40.210250114s ago: executing program 5 (id=855): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r0, 0xa02000000000000, 0x60, 0x0, 0x0) add_key$fscrypt_provisioning(&(0x7f0000000000), 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="01"], 0x48, 0xfffffffffffffffd) mknod$loop(&(0x7f00000190c0)='./file0\x00', 0xfff, 0x0) execve(&(0x7f0000019100)='./file0\x00', 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) r3 = socket$igmp6(0xa, 0x3, 0x2) connect$inet6(r3, &(0x7f0000000040)={0xa, 0x4e21, 0x8, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x37}}, 0xe}, 0x1c) connect$inet6(r3, &(0x7f0000000100)={0xa, 0x4e21, 0xfffbfff6, @mcast2, 0xfffff000}, 0x1c) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e20, 0xffffffff, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10001}, 0x1c) 5m40.080283667s ago: executing program 5 (id=856): syz_clone(0x100111, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000002c0)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0xfffffffc, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x3}, 0x50) io_setup(0x4, &(0x7f0000000000)=0x0) r1 = socket$inet6(0xa, 0x80002, 0x0) socket$netlink(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x10) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) accept4$bt_l2cap(r2, 0x0, 0x0, 0x0) recvmmsg(r1, 0x0, 0x0, 0x40002003, 0x0) r3 = eventfd(0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) io_submit(r0, 0x2, &(0x7f0000001300)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0xc2, r3, &(0x7f0000000280)="0100fd6400000000", 0x8, 0x36, 0x0, 0x0, r3}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7, 0x0, r3, 0x0, 0x0, 0x0, 0x0, 0x3, r3}]) syz_clone(0xc30e3400, 0x0, 0x0, 0x0, 0x0, 0x0) 5m37.943746819s ago: executing program 5 (id=863): r0 = socket$netlink(0x10, 0x3, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000500)="480000001400257f09004b01fcfc8c860a881300f217e0060000e3323909b8f8896e33719fe3bb036e0bc90900000000000000000000ffff5bf1090000d0bd5e000000006203005b", 0x48}], 0x1) 5m23.08127278s ago: executing program 33 (id=863): r0 = socket$netlink(0x10, 0x3, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) writev(r0, &(0x7f0000000080)=[{&(0x7f0000000500)="480000001400257f09004b01fcfc8c860a881300f217e0060000e3323909b8f8896e33719fe3bb036e0bc90900000000000000000000ffff5bf1090000d0bd5e000000006203005b", 0x48}], 0x1) 14.072689278s ago: executing program 2 (id=1945): r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeeb, 0x8031, r0, 0xc36e5000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f00008c7000/0x2000)=nil, 0x2000, 0x2000007, 0x10, r2, 0x5ee36000) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f0000000800)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000380)=ANY=[@ANYBLOB="020101090800000000170006ffffff00030006001000000002000000e0000009f9ff0f0005000000030005007217440502000000e0000001"], 0x40}}, 0x0) sendmsg$key(r4, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0xe, @in={0x2, 0x0, @multicast1=0xe0000009}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x50}}, 0x0) 13.121153531s ago: executing program 4 (id=1948): prlimit64(0x0, 0xe, &(0x7f0000000100)={0x7, 0x80000001}, 0x0) fcntl$setsig(0xffffffffffffffff, 0xa, 0x11) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000200)='./file1\x00', 0x408e, &(0x7f0000000240)={[{@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x2e}}, {@min_batch_time={'min_batch_time', 0x3d, 0xfff}}, {@jqfmt_vfsv0}, {@stripe={'stripe', 0x3d, 0x4000}}, {@errors_remount}, {@max_batch_time={'max_batch_time', 0x3d, 0x4}}]}, 0x3, 0x43a, &(0x7f0000000340)="$eJzs28tvG0UYAPBv13FKXySU8ugDCBRExCNp0gI9cAGBxAEkJDiUY0jSqtRtUBMkWlUQECpHVIk74ojEX8AJLgg4IXGFO6pUoVxaOBmtvZs4jp0mwY5L/ftJm8zsjjPzeXbs2Z1sAH1rJPuRROyJiN8jYqieXV1gpP7r5tLl6b+XLk8nUa2+9VdSK3dj6fJ0UbR43e48M5pGpJ8lcahFvfMXL52dqlRmL+T58YVz74/PX7z07JlzU6dnT8+enzxx4vixiReen3yuI3Fmbbpx8KO5wwdee+fqG9Mnr77787dJEX9THB0yst7BJ6rVDlfXW3sb0slADxvCppQiIuuucm38D0UpVjpvKF79tKeNA7qqWq1Wd7c/vFgF7mBJbLTk2fzzArgzFF/02fVvsW3T1OO2cP2l+gVQFvfNfKsfGYg0L1Nuur7tpJGIOLn4z1fZFt25DwEAsMr32fznmVbzvzTubyh3d742NBwR90TEvoi4NyL2R8R9EbWyD0TEg5usv3mRZO38J722pcA2KJv/vZivba2e/xWzvxgu5bm9tfjLyakzldmj+XsyGuUdWX5inTp+eOW3L9oda5z/ZVtWfzEXzNtxbWDH6tfMTC1M/ZeYG13/JOLgQKv4k+WVgCQiDkTEwS3Wceapbw63O9Yu/vJG/nAH1pmqX0c8We//xWiKv5Csvz45fldUZo+OF2fFWr/8euXNdvXfuv+7K+v/XS3P/+X4h5PG9dr5zddx5Y/P217TbPX8H0zerqUH830fTi0sXJiIGExerze6cf/kymuLfFE+i3/0SOvxvy9W3olDEZGdxA9FxMMR8Uje9kcj4rGIOLJO/D+9/Ph7W4+/u7L4ZzbV/yuJwWje0zpROvvjd6sqHd5M/Fn/H6+lRvM9G/n820i7tnY2AwAAwP9PGhF7IknHltNpOjZW/3/5/bErrczNLzx9au6D8zP1ZwSGo5wWd7qGGu6HTuSX9UV+sil/LL9v/GVpZy0/Nj1Xmel18NDndrcZ/5k/S71uHdB1nteC/mX8Q/8y/qF/Gf/Qv1qM/529aAew/Vp9/3/cg3YA269p/Fv2gz7i+h/6l/EP/cv4h740vzNu/ZC8hMSaRKS3RTMkupTo9ScTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAZ/wbAAD//9E940M=") r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) syz_mount_image$udf(&(0x7f0000000000), &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="00089aafc727346c3e0d8728525a2641b3b31621730c58dcf8e0ca2e6767a45a978776e9d2c689feab83a160d00a77ae5112cd4e7141cad333d7cbb69dc6b314609d3827059c11066ba0b4b95c12d2d9ff9c8896d9e247bd55f9ff578a14e0e9d0ca07693396b00d2ef44adb4858475a07d5e8fa3ef5b306fe8a5d1cd2d8e06e7f88226ece092c6aabf8870e140124d5a48670513e0c419c99b7c5105959e7a535f12694634cf272490e0000"], 0x81, 0x4ac, &(0x7f00000011c0)="$eJzs20tsG1UXwPFzPLbruPk+3Adpi6piCSRCS9skLmmrIKE8iEBqG0gaEBUPhdgJJk4cxSkkVUu7BHYsumTJlgUrxBZVYolYoCDUXemGjVeUHeiO52XXSewm8TT1/1e1dx7H7r33zMy914kFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACIDL022NOrYdcCAAC00qWJ8Z4M4z8AAG3lMut/AACAdqJiyR+icnKurBft/YrEhfzC1ZXJkdH6L+tQUYmIZcebv4nevsyZl/vPnnPLjV+/3Y7I2MTlwfRwcX5xKVcq5bLpyYX8dDGba/gdtvr6WsftDkjPz13NzsyU0n2nMlWnV1L39+ztSg30vz8cd2MnR0ZHJwIx0dgj/+8PWW+GHxdLXhSVT374Ti+JSES23hebXDs7rcNuxHG7EZMjo3ZDCvmphWVzUiNOVKS6T+JuH7UgF1sSETH10vj2rNliYsmPojJ0uqxjImK5/XDC/mC4ofqEIWqWriLSLbsgZ4+xPWLJh6Jy53RK3nT61c5/XOR62JXDjos6939Ry/qW/Tww95N5bF54O/3GwkwxEKsR545qZnyocw+GPj600mP+bEqIJWP2HV/W8bArg5brEEvmRSX+9af2vELseelTA2ePPXs+OMM4tMn7mNhTzs3VyJgcc6YOGjF/HqHa2BYJteRPUXnwe8Le73Zyw08E2oRaUhCVf26UVWvWpVZgfe/Z7WvDna1/R2K4uLi6lJ/9eLnu+WRi8KPS8tLUdP3TlbWrFTyy2Tq2VqS5JVlSKyu+Lz4re69z1gD/q+z5tfn2un8tdNeUruD108h2w8+ZJuZRpk6qltwTlZkPDlfGGUk23TftwOR/VFRK5V/UzbST/2hlL5D/V/z+S2h16bFz+//K51ruXOLIlYPrHd+J/Js6mfy/KypDfx92PtOo5N+qiTVxXaLy3u2jTlwkbuKibnMq7ziTL+R6TOy/orL/ZzdW7NikE3vAj+01sSVR+fJOdexeJ/agH9tnYtdE5e5v9WOf9mMzJnbV5Otu2o1NmthjTmyXH3tquljIbtatJv99ovLOzdfVbfO6+Q/c/7dqSs9DOd94e7vynwocu+Xk9YqT/+gm+f9KVFb/Ouq22+5797LaZ//r59/Mlb+/XR3rTkb3+7G9jTYrbCb/+0Tl/qtrXpudtjm7foaC+X8mWl16/RpS/vcFjqWcesWb7It2VFq9NjdVKOSW2GCDDTa8jbCfTGgFM/6Pm1G931J3HuOM/52VPX/G9OBzf/wfqCk9IY3/+wPHBpxZSywqklieX4wdEkmUVq+dzM9PzeZmcwuZM/09fefP9GTOxeLu5M7farjvngQm/ydE5cZPv3rrmOr5X/35f7Km9ISU/wPBNlXNaxruirZk8t8pKv331rz15kbzf3f93/1cdendfyHl/2DgWMqpV2eTfQEAAAAAAAAAAAAAAAAAu0lSLXleVFbGX1L3O0SN/P5ftqb0hPT7X12BY9nt/16D+9WoqlONVh0AAAAAAAAAAKCVImLJN6LygpT1pjnQKXIxWOKJ9l8AAAD//16uQhc=") pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x8080c61) 13.120615341s ago: executing program 2 (id=1949): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), r1) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}, 0x1, 0x0, 0x0, 0x24008810}, 0x8010) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x4) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x66) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001440)=@newlink={0x50, 0x10, 0xffffff1f, 0x4, 0x80, {0x0, 0x0, 0x0, 0x0, 0x300, 0x17e05}, [@IFLA_MASTER={0x8, 0xa, r5}, @IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @veth={{0x9}, {0x18, 0x2, 0x0, 0x1, @val=@VETH_INFO_PEER={0x14, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x4000, 0x400}}}}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x488c5}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8000) sendmsg$nl_route(r0, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000c40)={&(0x7f00000000c0)=@setlink={0x2c, 0x13, 0x5, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, r2, 0x312}, [@IFLA_ADDRESS={0xa, 0x1, @remote}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x42) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x1, 0x803, 0x0) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="4c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00030000000000001c0012800c0001006d6163766c616e000c000280080001000800000008000500", @ANYRES32=r8, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r8], 0x4c}}, 0x884) 11.448899662s ago: executing program 4 (id=1952): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) getsockopt$netlink(0xffffffffffffffff, 0x10e, 0xa, 0x0, 0x0) ioctl$BTRFS_IOC_QGROUP_CREATE(r2, 0xc400941b, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r3 = syz_io_uring_setup(0x31c5, &(0x7f0000000340)={0x0, 0xd73c, 0x2}, &(0x7f00000001c0), &(0x7f00000003c0), &(0x7f0000000000)) syz_io_uring_setup(0x3c5f, &(0x7f00000004c0)={0x0, 0x0, 0x27, 0xff, 0x0, 0x0, r3}, &(0x7f0000000080), &(0x7f0000000480), &(0x7f0000000000)) 10.597625432s ago: executing program 2 (id=1954): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x6, 0x1f, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f00000000c0)={0xdb, 0x1ff, 0xb}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000000)={0x7fff, 0x8, 0x100}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000240)={0x2, 0x5, 0x40003}) r3 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000080)={0x8, 0xe3, 0x8000}) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000280)={0x40, 0x403, 0xc, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000140)={0x2, 0xffff, 0x7ff}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000000200)={r5}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f00000002c0)={0x8, 0xd7, 0x8}) dup3(r2, r4, 0x80000) close_range(r0, 0xffffffffffffffff, 0x0) 9.576420097s ago: executing program 4 (id=1957): setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000100)=[{0x28, 0x0, 0x0, 0xfffff034}]}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = memfd_create(&(0x7f0000000380)='\x103q}2\x9a\xce\xaf\x03\xdfyR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7R\x94\xaf\xbb\xdcM\x90k\xd6\x05\r\x84\x87\x1e?\x10\x95SWFO{\x1f\x1b!\xd5\x991D\x1c\b\x8c`\xeaSA\x90m\xb6&\xd0\xf1\xb3\xed:\x82\xbd\xe3i|BL\x1f\x9d\x00\x00\xc5\xb8$\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\r\xd6h\x80\x8fQ|\xf5d\x10\x10\xd7\t\x00\x00\x00\x00\x00\x00\x00<\xfeeS\xb2l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfaa\xd3\xf1\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7~x\xb8vo\xe6\x15@\xc9\"CY\x11\xb9u\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D4E^7%8\x94y\x90\xf0l\xa0\'L%\xd4\xda\xee\x81\x98\xcc\xfd\xa2\x89$\x9by\xf1\xbb\x01\xb7\xcd\xbf\x99\x1f\x90@b\x03\xb3\xe0CfU\x16{\xbey\xa1cs\x96U\x11\xdb*\xdf\xcdG\xc7z\x85\x8aE\xf7\xd5\x9dAj\xe3\xfb\xc4\xa0\x14\x87\x19\x17\xed\xd1\x185%Q%\x81\xfaK\x82\xec=\xa3\xb8~\xb6O\xbd\x19*\xdb\x1c\x10\xa4\x8dIl\xc1\xceG\xd0h\xa1\xab:dP\xb6\xa0BR\xbe\x03\xac\xd9\x87\x00@\x80\x94\xd88\xc9\x03\x97\x17r\x85#\x7f\x8cu\x8f\xcc\x7fF\xb5\xea\xa6\xc1\x9d\xac\x89\xc9\xa1tuJw\xee\x1a\xe73\xa8\xadS\xd1\x11#d\xc2\xcfdj\x9ec\x93\xd5K\x90*_3\x89\v\xab\x04ih\x12\x93\xc5m\x8f~{\xe5\x85\xa5g\x00\x00\x00\xe45Q\xab%\xa8[\xf3\x17\x94\xf8\xdfq\xff\xd2?\xafW\xde\x1bW]\x1f\aaV\xc5\xc82*\xc7\xc5\"C}L\x10e\xc6\x90\xc0\xf9z\xb6+/d\x86\xf2\xbe\xc9:u\t\\e\x05)\xe4\xd2\xc4\x1a\xc9\xac\xdb\x925\x02\x94@\xa2\xe1\xee\x16\xb4\x98\xff\x0f\xbb\xb2\x81\xcf\x13g6l\xcc\xc8\x02\v\xa2\xb2\xf6\xbf@d\xcecC\x9fVz\xf4\x14\xa5\x8b|\xe1\xc0\xfa3X\xf4\xd9L\xe6\x8f\x9dy\x0fX.\xc5EQ\xd1/\xa1\xd0\x03>\xf0\x90\x13B\xe2\x97\x8b!\xf7\"\xecX\x92\xab\xbc^\xb2\x80@\xcc+\xbbp\xdc|N\xd3[=G\xb2\xe1\x9c\xc5\x81y\x84\xef\xacQ\x01\xdd\xe7<\xb8\xf1Hn\x86\xa6\xe3\x18N\x19\"[-\xdb\xef\xc3\xe0\xa8}', 0x0) ftruncate(r3, 0x80079a0) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x0, @local}, 0x10) sendto$inet(r4, 0x0, 0x0, 0x404c802, &(0x7f0000000180)={0x2, 0x4e21, @multicast2}, 0x10) sendfile(r4, r3, 0x0, 0x10000000000) 9.312922803s ago: executing program 6 (id=1958): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, 0x0) mincore(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) 8.19243341s ago: executing program 3 (id=1959): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000006c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$tipc(0x1e, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000a80)=@newtfilter={0xb4, 0x2c, 0xd27, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {}, {0x8, 0xfff2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x80, 0x2, [@TCA_MATCHALL_ACT={0x7c, 0x2, [@m_tunnel_key={0x78, 0x1, 0x0, 0x0, {{0xf}, {0x48, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV6_SRC={0x14, 0x5, @empty}, @TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @ipv4={'\x00', '\xff\xff', @empty}}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x3, 0x8, 0x1, 0x7fff, 0x7}, 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}}]}, 0xb4}, 0x1, 0x0, 0x0, 0x80c0}, 0x20000000) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r5, &(0x7f0000000140)={&(0x7f0000000240)=@xdp={0x2c, 0x0, r7, 0x3f}, 0x80, &(0x7f0000000900)=[{&(0x7f0000000000)="27030200000214000e00002fb96dffff1144ee163cddcb000000800000827600000020000000", 0x26}, {&(0x7f00000004c0)="f058050000007f8f", 0x8}], 0x2}, 0x84) 8.189961881s ago: executing program 4 (id=1960): prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={0xffffffffffffffff, 0x0, 0x29, 0x0, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0x40) r3 = syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), 0xffffffffffffffff) r4 = socket$netlink(0x10, 0x3, 0x10) sendmsg$DEVLINK_CMD_PORT_GET(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)={0x3c, r3, 0x1, 0x70bd2b, 0x0, {0x35}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x73, 0x2}}}]}, 0x3c}}, 0x0) sendmsg$NFT_MSG_GETSETELEM(r4, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000002c0)={&(0x7f0000000180)={0x60, 0xd, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x5}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}]}, 0x60}, 0x1, 0x0, 0x0, 0x4805}, 0x4010) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000015c0)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000703000000feffff7a0af0ff1100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010001011404000011000000b7030000000000006a0a00fe000000008500000032000000b700000001000000950000000000000075cdc4b57b0c65752a3ad50000007ddd0000cb450063dedba767ade51f7f1f66acd19100002000000000000000ff7f0000b52f17cee19d0001000000000000000000cb04fcbb4e4d0b9bafe3ba431351a58a885ba9918d37b056b9bbd11b6b9f6cf7db6d574620260000000000008062d77e85cef4a2ab938f65aac33c4d620de2c9b7dc10d7d313f9f57606b83b994fc4051ade12f41deff6df6a936b4ec3827c739bb39aad16cc75fe369258673b5df11cc2afb53611cc32a790bc0b80e80eae8f5e64be2c9d2d29db3d36dd0cf8f79a015c7bd3f15aa6aadbeab2a01685108e61aa00000000000000000000000000c67c6c6a06e828e5216f601b19db1af1b5d356d0f062137d866d11be4ba3f0151fdbbd4e97d62ecc645e143a60f10800000000000000826151e3b42bcae95239ef5ca2a730a00c87c493db0300e63fda97a296820000000001000000eecc952a3fd2c46f3c1cde71a19d1a2982492a210e00d2bfea3b8d188df2eff8d56aaae7d32a2e180022537395019f02ec4b85f6aad7faca088de9b26797a8446b16c28d85f225992dbdd5bb01ba51508951c7a7d6ca0916c3a12912715649c2b1c7192a4251b59d378d3f00000000000000665c8b7e89eddfc3783f6c9129a7c5f8ee5f50579e2f638f7eb12f63be72a3d81ab324d6e417b1c2cbfdcada0a16e31790e26cf19588a7e0496ee2782224cf30f810da86cf1a3204f4c9404f5d7321a4fefc4d1c9139ca4b65b99909950000006b42077ca60fdecb2717e21f8f187b1866108b6e8c71e2603217606637ece1fa89917e131f4034a8383e99c3568fd04201b37cd92ca6ebf94a2d8310f7032775cfd75652f87b039d5430b3c6643e9146d2478ce31344b554aca7670000000000000010c65608fda6ed5d08e7a796042aa127d874105787d0347aa37801faff5b9050803a19ff6205aa5c263e407a2f7de56f7a0000e094fa4e3f05528caab5a430c08dd810bc97204b767dd969721a26aa740000000000bc433fe2d0a6ef2a8a91cd3cb305aa80dadef8b0caca780000000000000000863e21db415a222bb1a7ab94bfe4a74157d794f9d0430c2c0eb563350559829865a3dd08fb31bd0801e09aa3ee45e61a56fc83076451cff7632e49a41eadb5044a0d5f73d6932161ae"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x2}, 0x8, 0x10, &(0x7f0000000100), 0x10}, 0x94) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f00000004c0)=ANY=[@ANYBLOB="b702000047000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a876d839240d29c035055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7e8dc34f17e3946ef3bb622e03b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bb44b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334583239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd713089856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bf4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff22dc508afc9ffc2cc788bee1b47683db01a469398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd360000000000000000ae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae526aca54183fb01c73f979ca9857399537f5831808b0dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c97a088a22e8b15c3e233db00002e30d46a0024d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e4845535a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c29c5c0ed5bcdf510c3c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9003f07000099d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ced92052188bd1f285f653b621491dc6aaee0200e2ff08644fb94c06006eff1be2f68fa8d7c2dfb28e1f05e46b0933c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5dee734fe7da3770845cf442d588afd80e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367632952a93466ae595c6a8cda6900002a070886df42b27098773b45198b4a34ac97febd4450e121d01342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d63521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a8639034a75f4c7df3ea8fc2018d07afef12ef060cd4403a099f32468f658000b4082d43e12186195cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea209b53b230ef0f2ab85cbdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bd3339403004b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab900000000000000000000d71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdbf24a0c5441ce046078492b53467cfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89cb349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce1d9bc7ef3e3f40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb15f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c00c57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734137df47257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b558982016b0679b5d6fccbecfae5553d9950d48c774eaa35b24fce69a20d8b49e3d0168bf7eac90529cd6af061c9e53addddc620ce73c5d177e3d097159f2768636fc10276c6a0adc57483b3f7083f66b87ef296ee85a3009a5d30f479e293a3302e11350ea857b37e76ca3f50378e4092ce2c574ad278b9b7b717c571afb2077b019fd9d89efd59b41f051ec5a8ff87ecc8df917a1e386d849fcd10e2f9ca52e02339c2f4666b0c8ffe0d508dcee3070e8b42ac38545e25f1cd62421c28d25994be0cff7271a0dee38d7ac4ac736b090e1d29f98117919472b61b20026d7e646174b55d251f7f8ca5ccc22a5efb33b217eff5597a3c3a5f3a9bb54abb40e54593e1a7ce4cfa17b3c3fe91c06363496341eae20dcc59b6179b32ddddef5c34000096a54c0c571a91878f61f74912e2299e5501d4d6943bfd74c856511726f0ac8f7d17f1c6b4451c1bcdc6b6e1700e4cd87709d97afc5423c96fa981873d4369b04bbf1fb9f68f17991540868e408201ad1a74179e489aa61f021a437a3fa935588be2068f7ff9b253106326fde795e530b93626cc68e06e602198724249b4444e69902e4d8f5da4e94cc36794258fd4032de7ab36bc24000000000000000000000000000000000000cd3211b3842b68a4eddca2eae28529e97a98d7ec3fd902df1ba8fc2ad2377e72d4e7aeacbbccef5614cd965511558f40720025c022bc9c213e407f6bc4b673c55aa8e729299a37fd6339acd906ac861ba56c9fa9b8b12b5e68a3cdadb906355e1f1d336a243172affe50d0fb36c3718a7498eed3d398f405a34d494414e87ef1ce1845510d43d00171d6b4b762f89564c22d542a119878709cd6822c3a3eb47a849b0737929fe9e1eecd1bff5a2b9880e2a6d8a3b3b7e88a673c96cda4455eff1c530db0e6598a2686aa09aeaf0f1aed95aeb8b0a2cc5ca31c0f56285cc05f7090a0e0583cf540d18cd8817e685c7b4ff176178ac1234f23e54445ec20b2689832d78409897a0307e89ebcd5f4ba042a3d10237a5a8a9a6eda36d2f337dc54537b80e8433341b135b4c5bb0173ffde46ccd260e1d4f2c51e8b07bb256f1317912cb1fc9e491e0bb9109e475cc795c23ad9f4f0042c5e9c655a4d865bc4a266e6a1d3d2b7ee53be9efb33a98933b5ba74ee3ac8d34b6af8c1fdbffade3abc80842b74354162f5b994ab5254cb068bc5e2ae242a1d37d0d49947c9317fa1a46c9e259ce0e1f9db992c53f7830a5e8f4fac6b187eb9f15ba61f730f86d7d7b63bbc7a1d9ff37e87a90a14e0655304da069f9009b62717649b6c6af94fcba713f8ee6fcce25aef44d009966614b61be9369ffc589a79051b0a0000000000000003ebd34c41afe268c33c9322c3a783772aec998f51a6e70fb932a8019e72ef5ab127bb30c79ebfd867441083546305fb39449c40a166ea389a6b77b7c87f66e8bf5806726b8fc50b943627314803a12c33312dce0a10f852da3e000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x7}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000380)={r5, 0x18000000000002a0, 0x1c, 0x0, &(0x7f00000011c0)="b9ffddc1ddcccdf175537d53888edfcef6e296510cff24fc83423368", 0x0, 0x600, 0x60000009, 0x0, 0x0, 0x0, 0x0}, 0x50) 8.081737553s ago: executing program 6 (id=1961): r0 = socket$rds(0x15, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x12, &(0x7f0000000100)=0x8001, 0x4) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2122, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) close(r0) 8.081483753s ago: executing program 2 (id=1962): openat$ptmx(0xffffffffffffff9c, 0x0, 0x185201, 0x0) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x1e}, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x20}, {0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x4, 0x2}, {0x0, 0x0, 0xfffffffffffffff7, 0x4}, 0x0, 0x6e6bb9, 0x1}, {{@in=@broadcast, 0xfffffffc, 0x6c}, 0x0, @in=@empty, 0x0, 0x0, 0x2, 0x7, 0x200}}, 0xe8) sendmmsg(r1, &(0x7f0000000480), 0x2e9, 0x0) pipe(0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000300)={0x2, 0x0, @remote}, 0x10) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vcan0\x00'}) r3 = geteuid() lstat(&(0x7f0000002180)='./file0\x00', &(0x7f00000021c0)) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000600)=@newsa={0xf8, 0x16, 0x633, 0x0, 0x80000000, {{@in6=@mcast1, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, r3}, {@in=@broadcast, 0x4d2, 0x32}, @in6=@loopback, {}, {0x5, 0xffffffffffffffff, 0x0, 0x5}, {0x4, 0x2}, 0x6, 0x2, 0xa, 0x4, 0x18, 0x19}, [@mark={0xc, 0x15, {0x35075c, 0x1}}]}, 0xf8}}, 0x0) 8.036125554s ago: executing program 0 (id=1963): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) listen(0xffffffffffffffff, 0x4) listen(0xffffffffffffffff, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b80)={0x6, 0x11, &(0x7f0000000200)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2}, {}, {}, [@func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}, @ldst={0x2, 0x0, 0x0, 0xa, 0x8, 0x30, 0xc}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000300)='GPL\x00', 0x5, 0x0, 0x0, 0x41100, 0x42, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r3, &(0x7f0000001c80)=[{&(0x7f0000001bc0)=""/156, 0x9c}], 0x53, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/109, 0x20001c34}], 0x1, 0x0) 8.035111094s ago: executing program 3 (id=1973): r0 = socket$pppoe(0x18, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000300)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) connect$pppoe(r0, &(0x7f0000000000)={0x18, 0x0, {0x7, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}, 'macvlan1\x00'}}, 0x1e) chdir(&(0x7f0000000240)='./file0\x00') close(0x3) 7.041813318s ago: executing program 6 (id=1964): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000000)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) getrlimit(0xd, &(0x7f0000000040)) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', &(0x7f0000000840), 0x0, 0x0, 0x1) ptrace(0x10, r3) ptrace$pokeuser(0x6, r3, 0x358, 0x8) 5.262539312s ago: executing program 4 (id=1965): prlimit64(0x0, 0xe, &(0x7f0000000100)={0x7, 0x80000001}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = timerfd_create(0x0, 0x0) timerfd_settime(r3, 0x3, 0x0, 0x0) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x42202) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00'}) write$sndseq(r4, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick=0xffffff3f, {}, {}, @raw32}], 0xffc8) 4.988892348s ago: executing program 0 (id=1966): mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000001000}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = io_uring_setup(0x46eb, &(0x7f0000000100)={0x0, 0x1f8a, 0x0, 0x3, 0x28c}) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x3) 4.790765473s ago: executing program 6 (id=1967): r0 = socket$unix(0x1, 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r6) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000140)={'syzkaller0\x00', @multicast}) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000c00)=@newtfilter={0x44, 0x2c, 0xd3f, 0x70bd24, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0xfff3, 0xffe0}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x9, 0x3}]}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8848}, 0x4004880) sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x7, r8, 0x3e}, 0x80, &(0x7f0000000640)=[{&(0x7f0000000180)='\'', 0x1}], 0x1}, 0x20004014) 3.838617936s ago: executing program 4 (id=1968): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x40000) r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000000040)=0x7, 0x4) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r0, &(0x7f0000000600)=[{{&(0x7f0000000140)=@nfc_llcp, 0x0, &(0x7f0000000780)=[{&(0x7f00000001c0)=""/199}, {&(0x7f0000000340)=""/161}, {&(0x7f0000000400)=""/94}, {&(0x7f0000000480)=""/160}, {&(0x7f0000000640)=""/155}, {&(0x7f0000000700)=""/80}], 0x0, &(0x7f0000000580)=""/80, 0x11}}], 0x4000000000002ff, 0x2, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x3, 0x20132, 0xffffffffffffffff, 0xb299f000) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket(0xa, 0x3, 0x3a) timer_settime(0x0, 0x1, 0x0, 0x0) keyctl$KEYCTL_CAPABILITIES(0x1f, &(0x7f0000000000)=""/21, 0xfffffe0d) syz_usb_connect$uac3(0x1, 0x80, 0x0, 0x0) 3.396179877s ago: executing program 0 (id=1969): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setgroups(0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000440)=0x10) setsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000000000)={r4, 0x4, 0xfffffffe, 0x2}, 0x10) 3.301722319s ago: executing program 3 (id=1970): prlimit64(0x0, 0xe, &(0x7f0000000100)={0x7, 0x80000001}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='.\x00', 0x400017e) r3 = open(&(0x7f0000000040)='./file1\x00', 0x80242, 0x0) write$FUSE_CREATE_OPEN(r3, &(0x7f0000000280)={0xa0, 0x0, 0x0, {{0x3, 0x1, 0x5, 0xa, 0x3, 0x80, {0x2, 0x17d, 0xfffffffffffffffd, 0x0, 0x100, 0x7cf4, 0x9, 0x7ffffffd, 0x0, 0x1000, 0x20000000, 0x0, 0x0, 0x3ff, 0x3101}}, {0x0, 0x3}}}, 0xa0) listen(0xffffffffffffffff, 0x0) sendfile(r3, r3, &(0x7f0000000080)=0x2, 0x7f03) 2.429249851s ago: executing program 0 (id=1971): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) clock_settime(0x0, &(0x7f0000000240)={0x77359400}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x1d, 0x0) r4 = socket$phonet_pipe(0x23, 0x5, 0x2) getsockopt$PNPIPE_IFINDEX(r4, 0x113, 0x2, &(0x7f0000000240), 0x0) 2.416194721s ago: executing program 3 (id=1972): r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x12, r0, 0x100000000) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000000480)=""/74, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000400)) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000340)=""/185, &(0x7f0000000140)=""/92}) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000040)={@my=0x1}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000100)={0x1, 0x0, [{0x0, 0x6e, &(0x7f0000001540)=""/110}]}) r2 = socket$vsock_stream(0x28, 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000140)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x0, 0x0, 0x2}}, 0x0, 0x1a, 0x0, 0x6}, 0x28) connect$vsock_stream(r2, &(0x7f0000000200)={0x28, 0x0, 0xffffffff, @my=0x1}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x4e, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=""/51, 0x0, &(0x7f0000000500)=""/4092}) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000440)=0x8101) 2.105559558s ago: executing program 3 (id=1974): r0 = syz_mount_image$udf(&(0x7f0000000180), &(0x7f0000000100)='./bus\x00', 0x1014494, &(0x7f00000001c0)=ANY=[@ANYBLOB="696f636861727365743d63703933322c706172746974696f6e3d30303030303030303030303030303030303030332c6769643d666f726765742c6769643d666f726765742c6e6f6164696e6963622c756e64656c6574652c7569643d666f726765742c00fb5ebc1bbec00aea8217b7375ace1f91cad4e856ac3ce827902dd91a9a936650ca99205dc1adee73bc464ab6ea2dad7091eea47594f5ef5227a72684b2ed98640aa52eba3e04c81c829036f312ecb1c7483575d32ed9eef652c6b7284dc45cecea6a0ae3a01c5cd7b60af90431eddc00"/225], 0xfe, 0xc24, &(0x7f0000001480)="$eJzs3UFsHNd9B+D/Gy5Fym4rJk5Uu42LTVukMmO5sqSYilW4q5pmG0CWiVDMLQBX5EpdmFoSJNXIRtrQvfTQQ4Ci6CEnAq1RIEUDoymCHtnWBZKLD0VOPREtbARFD2wRIKeAxcy+lZY0ZcmmSFH299nUbznz3ux7b5YzkqA3LwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAiN976cKpZ9ODbgUAcJAuTX311Gn3fwD4RLnsz/8AAAAAAAAAAAAAAHDYpSjisUixeGkzzVTfdw1fbHdu3Jwen9i92tFU1Ryoypdfw8+ePnP2S8+NnevlB9e/356IV6YuX6i/uHB9cam1vNyaq0932rMLc617PsJe6+80Wg1A/fqrN+auXl2un37mzLbdN0feG3r0+Mj5sadOPtkrOz0+MTHVV6Y2+JHf/X3uNMPjSBRxMlI8/b2fpGZEFLH3sbjLZ2e/Ha06MVp1Ynp8ourIfLvZWSl3TvYGooio91Vq9MboAM7FnjQiVsvmlw0eLbs3tdhcal6Zb9Unm0sr7ZX2QmcydVtb9qceRZxLEWsRsTH0/sMNRhG1SPGdY5vpSkQM9Mbhi9XE4Du3o9jHPt6Dsp31wYi14iE4Z4fYUBTxcqT46dtFzJZjlr/iCxEvl/mDiDfLfCEilR+MsxHv7vI54uFUiyL+vDz/5zfTXHU96F1XLn6t/pXO1YW+sr3rykN/fzhIh/zaNBxFNKsr/mb66L/ZAQAAAAAAAAAAAAAAAOB+OxpFPBEpXvr3P6rmFUc1L/3Y+bHfH/nF/jnjj9/lOGXZZyJitbi3OblH8hTiyTSZ0gOeS/xJNhxF/HGe//fGg24MAAAAAAAAAAAAAAAAAADAJ9yPI8Xz75xIa9G/pni7c61+uXllvrsqbG/t396a6VtbW1v11M1GzpmcqznXcq7n3MgZRa6fs5FzJudqzrWc6zk3csZArp+zkXMm52rOtZzrOTdyRi3Xz9nIOZNzNedazvWcGznjkKzdCwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwcVJEET+PFN/+xmaKFBGNiJno5vpQrwwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8CANpSK+Hynqf9C4ta0WEan6v+tE+cvZaBwp89PRGCvzhWhcyNmsstZ44wG0n70ZTEX8KFIMDb9164Tn8z/Y/e7WxyDe/Obt736l1s2B3s6R94YePX7s/NjErz1+p9dptwaMXmx3btysT49PTEz1ba7ld/9037aR/L7F/ek6EbH82uuvNufnW0ufmBdFHIpmPKgXte6LWhyS9hzUi3y9il12FYfhp6BxWAaq9+IBX5g4EOX9/91I8dvv/Efvht+7//9C97tbd/j42Z/cvv8/v/NA+3T/f6xv2/P5dyODtYjhleuLg8cjhpdfe/1k+3rzWutaq3P21Kkvj419+cypwSMRw1fb862+V3seKgAAAAAAAAAAAAAAAICDlYr43UjR/NFmqkfEzWq+1sj5sadOPjkQA9V8q23ztl6Zunyh/uLC9cWl1vJya64+3WnPLsy17vXthqvpXtPjE/vSmbs6us/tPzr84sLia0vta3+4suv+R4YvXFleWWrO7r47jkYR0ejfMlo1eHp8omr0fLvZqapO7jqZ7sMbTEX8Z6SYPVs/0tuW5//tnOG/bf7/6s4D7dP8v0/1bSvfM6UifhYpfusvHo/PV+18JN43Zrnc30SK0XOfy+XiSFmu14bucwW6MwPLsv8bKf7h59vL9uZDPna77LP3Oq4Pi/L8H4sU3/+z78av523bn/+w+/l/ZOeB9un8f6Zv2yPbnlew566Tz//JSPHCY2/Fb+RtH/T8jyK2tra+FXEiF771fI59Ov+f7ds2Et33/c37130AAAAAAAAAAICH1mAq4m8jxZMTtfRc3nYv//5vbueB9unff/1y37a5A1qvaM+DCgAAAACHxGAq4seR4trKW7fmUG+f/903//N3bq+9Pp527K3+nu+XqucG3M+//+s3kt93Zu/dBgAAAAAAAAAAAAAAAAAAgEMlpSKey+upz9xlPfX1SPHSfz+dy6XjZbneOvAj1a/DlxY6Jy/Mzy/MNleaV+Zb9anF5myrrPuZSLH515/LdYtqffXP57rdNd6Ht3prsS9Fiom/65XtrsXeW5u8ux54dy32suynIsV//f32sr11rD97u+zpsuxfRYqv/9PuZY/fLnumLPvdSPHDr9d7ZR8py/aej9p9JulwLeZbz8wuzL/vUagAAAAAAAAAAAAAAAAAAADwYQ2mIv40UvzP9bVYrab9v3FrV85ab8Ob3+xb73+Hm9U6/yPV+v93ev1R1v8fuS+9BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAh0uKIl6PFIuXNtP6UPl91/DFdufGzenxid2rHU1VzYGqfPk1/OzpM2e/9NzYuV5+cP377Yl4ZeryhfqLC9cXl1rLy625+nSnPbsw17rnI+y1/u2h6xqtBqB+/dUbc1evLtdPP3Nm2+6bI+8NPXp85PzYUyef7JWdHp+YmOorUxv8EO/+oRp325Eo4i8jxdPf+0n656GIIvY+Fnf57Oy3o1UnRqtOTI9PVB2Zbzc7K+XOyd5AFBH1vkqN3hgdwLnYk0bEatn8ssGjZfemFptLzSvzrfpkc2mlvdJe6EymbmvL/tSjiHMpYi0iNob6D3QkZxGvRorvHNtM/zIUMdAbhy9emvrqqdN3bkexr728i29V7awPRqwVD8E5O8SGooh/jBQ/fftE/OtQRC26X/GFiJfL/EHEm2W+EJHKD8bZiHeHHnSruV9qUcT/lef//GZ6eyii+pGprisXv1b/SufqQl/Z3nVl5/1hKyIeqvvDQTrk16bhKOKH1RV/M/2bn2sAAAAAAAAAAAAAAACAQ6SIX40Uz79zIlXzg2/NKW53rtUvN6/Md6f19eb+9eZMb21tbdVTNxs5Z3Ku5lzLuZ5zI2cUuX7ORs6ZnKs513Ku59zIGQO5fs5GzpmcqznXcq7n3MgZtVw/ZyPnTM7VnGs513Nu5IxDMncPAAAAAAAAAAAAAAAAAAD4eCmq/1J8+xubaWuou770THRz3XqgH3v/HwAA//9wn/vk") bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) openat(r0, 0x0, 0x4000, 0x140) bpf$BPF_MAP_GET_NEXT_ID(0xc, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) openat(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={0x0, 0x0}, 0x28) syz_mount_image$vfat(&(0x7f0000000100), &(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x7e18a1, 0x0, 0x83, 0x0, &(0x7f0000000480)) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000180)=@fd={0x4, 0x2, 0x4, 0x1, 0x400, {}, {0x2, 0x0, 0x1, 0x4, 0x10, 0x0, "e27d63fd"}, 0x521}) 2.105289209s ago: executing program 6 (id=1975): pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000080), 0xfffffe13) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512-ssse3\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x800) splice(r0, 0x0, r3, 0x0, 0x1e8640, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001a40)=@newqdisc={0x154, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xfffffffe, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_choke={{0xa}, {0xffffffffffffffbb, 0x2, [@TCA_CHOKE_STAB={0x104, 0x2, "f38b7f869dc5c3e26ac45fddcba0ca9d8b1f049df651f99cae564df88a24d842876061dbdf47258e824d497e760b8f9cbe9125090dff51a2571d4dc8de8d09c8d7a0d142fcbe91b0816252d3e22656cfc65722a377c91594e0b8539e22c3bffb59e36f8245041a164c6c84ddc21798a522106e087bbdb7776f6e4d64596ca20200cd1b462c15473697813f5ecf263d6e0530300565b55f91ef6778d920386e698f98bb2d7eab2acec199eb22dff43085e4b72ae0a3a4dc3e54ea506f695d494ec0a6544905af790f39b1bd6cd89040d3d877025715674be73f7f7b985ac540ec4b274ccf55c6d69cb9c196c0a72e6c14a6bd22b1b65e04520800"}, @TCA_CHOKE_MAX_P={0x8, 0x3, 0x3c}, @TCA_CHOKE_PARMS={0x14, 0x1, {0x400, 0x80000000, 0x55, 0x9, 0x3, 0x12, 0x1}}]}}]}, 0x154}}, 0x0) r7 = socket$pppl2tp(0x18, 0x1, 0x1) getpid() fcntl$dupfd(r7, 0x0, r7) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="58000000020603000000000000000000000000000c000300686173683a69700005000400000000000900020073797a31000000001400078008001340000017e508001240000000090500050002000000050001000600"], 0x58}}, 0x4080) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c0007800c00018008000140fffffffe0c000280080001407f"], 0x44}}, 0x4000050) 1.271332818s ago: executing program 2 (id=1976): shmctl$IPC_RMID(0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socketpair$unix(0x1, 0x1, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r4}, &(0x7f00000006c0), &(0x7f0000000700)}, 0x20) close_range(r0, 0xffffffffffffffff, 0x0) 1.19538147s ago: executing program 0 (id=1977): r0 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000100)={0x6, 0x1f, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000000c0)={0xdb, 0x1ff, 0xb}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000000)={0x7fff, 0x8, 0x100}) r2 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000080)={0x8, 0x8169, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f00000001c0)={0x7, 0x1, 0x7}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000380)={0xff, 0x3, 0xd83f}) dup2(r2, r1) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f00000002c0)={0x8, 0xd7, 0x8}) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x2, 0xfe, 0x7fff0006}]}) r4 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r4, 0xc0184800, &(0x7f0000000100)={0x20004, r3, 0x2}) r6 = syz_open_dev$dri(&(0x7f0000000280), 0x1ff, 0x140) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r6, 0xc00c642e, &(0x7f00000000c0)={0x0, 0x0, r5}) 897.588128ms ago: executing program 0 (id=1978): mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x8, &(0x7f0000000080)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(0xffffffffffffffff, 0x4068aea3, &(0x7f00000001c0)={0x79, 0x0, 0xc45}) socket$inet6_udplite(0xa, 0x2, 0x88) r0 = openat$kvm(0xffffff9c, &(0x7f0000000540), 0x8000, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x71, 0x2, 0x7f, 0x2d7, 0x7d, 0x8000000000000000, 0x5, 0x0, 0x9, 0x401, 0x2, 0x2, 0x8d], 0xeeee8000, 0x201e87}) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000140)={0x0, &(0x7f0000000280)}, 0x10) ioctl$KVM_RUN(r2, 0xae80, 0x0) pipe(&(0x7f00000001c0)) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x42282, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 170.390505ms ago: executing program 2 (id=1979): r0 = socket$kcm(0x11, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7001}) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000640)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x104, 0xe}}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000c00)=@newtfilter={0x8c, 0x2c, 0xd2f, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_u32={{0x8}, {0x60, 0x2, [@TCA_U32_FLAGS={0x8, 0xb, 0x2}, @TCA_U32_SEL={0x54, 0x5, {0x4, 0x8, 0x4, 0x4, 0x2, 0x4, 0x6, 0x769, [{0x40, 0x2, 0x80000000, 0x401}, {0xfffffff9, 0x9, 0x2, 0x8}, {0x7, 0x7, 0x101, 0x2}, {0x1, 0x6, 0xfffffffc, 0xffff}]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x24008084}, 0x20000000) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r5) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r7, 0x3e, 0xffffffff}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 94.607757ms ago: executing program 6 (id=1980): mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000001000}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = io_uring_setup(0x46eb, &(0x7f0000000100)={0x0, 0x1f8a, 0x0, 0x3, 0x28c}) io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x3) 0s ago: executing program 3 (id=1981): r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x80080, 0x0) clock_adjtime(0xffffffd3, &(0x7f0000000000)={0xfffffffffffffffc, 0x6, 0xfffffffffffffffe, 0x9, 0x7, 0xb, 0x651, 0xfffffffffffffffc, 0x9657, 0x0, 0x7fffffff, 0x0, 0x8, 0xb, 0x80000000000000, 0xcc0, 0x1, 0x1, 0x94d6, 0x0, 0x0, 0x5, 0x0, 0xfffffffffffffffa, 0x5, 0x2000000000000}) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffffff, 0x84, 0x22, &(0x7f0000000100)={0x3}, 0x10) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) symlinkat(&(0x7f0000000180)='./file0/../file0/file0/file0\x00', 0xffffffffffffffff, &(0x7f0000000140)='./file0\x00') ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000040)={0x0, 0x7, 0x41, 0x0, 0x83, "00000000000000000000ffff00"}) r1 = syz_open_pts(0xffffffffffffffff, 0x40) ioctl$TIOCGICOUNT(r1, 0x545d, 0x0) inotify_init1(0x800) fcntl$setstatus(0xffffffffffffffff, 0x4, 0x2c00) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000280)={0x0, @in6={{0xa, 0x4e24, 0x2, @private2={0xfc, 0x2, '\x00', 0x1}, 0x4}}, 0xfffe, 0xef}, &(0x7f0000000200)=0x90) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DEL(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="e00000000a06010100000000000000000300000908000940800000010900020073797a310000000005000100070000000800094000000005880008800c000780080009"], 0x13a}, 0x1, 0x0, 0x0, 0x2000c880}, 0x48884) kernel console output (not intermixed with test programs): 01][ T5519] team0: Port device team_slave_1 removed [ 175.895251][ T5519] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 175.903456][ T5519] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 175.915517][ T5519] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 175.923088][ T5519] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 176.005068][ T5538] sch_tbf: burst 19872 is lower than device lo mtu (11337746) ! [ 177.019184][ T5552] loop0: detected capacity change from 0 to 256 [ 177.062793][ T5552] exFAT-fs (loop0): failed to load upcase table (idx : 0x00011bf5, chksum : 0xcea91b8a, utbl_chksum : 0xe619d30d) [ 177.183694][ T5552] exFAT-fs (loop0): bogus allocation bitmap size(need : 2, cur : 17179869186) [ 178.164328][ T5577] netlink: 4 bytes leftover after parsing attributes in process `syz.3.395'. [ 178.240384][ T5576] Invalid argument reading file caps for ./file0 [ 178.376768][ T5583] loop4: detected capacity change from 0 to 512 [ 178.414335][ T5583] EXT4-fs (loop4): external journal device major/minor numbers have changed [ 178.610818][ T5583] EXT4-fs (loop4): failed to open journal device unknown-block(11,127) -6 [ 179.902419][ T5597] loop2: detected capacity change from 0 to 512 [ 179.976149][ T5597] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 180.040441][ T5597] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 180.127645][ T5597] EXT4-fs (loop2): 1 truncate cleaned up [ 180.133498][ T5597] EXT4-fs (loop2): mounted filesystem without journal. Opts: minixdf,errors=remount-ro,. Quota mode: none. [ 180.173698][ T5603] overlayfs: failed to clone upperpath [ 180.275311][ T5604] overlayfs: failed to clone upperpath [ 181.584791][ T4970] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 182.005253][ T4970] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 182.086323][ T4970] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 10 [ 182.184639][ T4970] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 182.231764][ T4970] usb 5-1: New USB device found, idVendor=046d, idProduct=ca03, bcdDevice= 0.00 [ 182.274539][ T4970] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 182.366476][ T4970] usb 5-1: config 0 descriptor?? [ 182.814616][ T4970] usbhid 5-1:0.0: can't add hid device: -71 [ 182.822123][ T4970] usbhid: probe of 5-1:0.0 failed with error -71 [ 182.851915][ T4970] usb 5-1: USB disconnect, device number 2 [ 182.998011][ T5648] loop2: detected capacity change from 0 to 512 [ 183.081942][ T5648] EXT4-fs (loop2): external journal device major/minor numbers have changed [ 183.148253][ T5648] EXT4-fs (loop2): failed to open journal device unknown-block(11,127) -6 [ 184.386124][ T5662] tipc: Enabling of bearer rejected, failed to enable media [ 184.646054][ T5670] netlink: 'syz.2.431': attribute type 1 has an invalid length. [ 184.768609][ T5676] loop4: detected capacity change from 0 to 1024 [ 184.818145][ T5670] 8021q: adding VLAN 0 to HW filter on device bond4 [ 184.851325][ T5676] EXT4-fs (loop4): Ignoring removed bh option [ 185.084622][ T5676] EXT4-fs (loop4): mounted filesystem without journal. Opts: lazytime,dioread_lock,stripe=0x0000000000000005,nolazytime,debug_want_extra_isize=0x0000000000000080,errors=remount-ro,barrier=0x0000000000000004,grpquota,bh,init_itable,. Quota mode: writeback. [ 185.318073][ T5675] bond4: (slave vlan2): making interface the new active one [ 185.607152][ T5675] bond4: (slave vlan2): Enslaving as an active interface with an up link [ 185.929480][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): bond4: link becomes ready [ 185.956064][ T5682] netlink: 'syz.3.425': attribute type 1 has an invalid length. [ 185.963760][ T5682] netlink: 'syz.3.425': attribute type 4 has an invalid length. [ 185.976861][ T5682] netlink: 9462 bytes leftover after parsing attributes in process `syz.3.425'. [ 186.924893][ T4268] Bluetooth: hci5: command 0x0409 tx timeout [ 187.538106][ T5705] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 187.564089][ T5688] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 187.891290][ T5688] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 187.978558][ T5678] chnl_net:caif_netlink_parms(): no params data found [ 188.127101][ T5688] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 188.179703][ T5717] netlink: 'syz.2.433': attribute type 10 has an invalid length. [ 188.192641][ T5717] netlink: 4 bytes leftover after parsing attributes in process `syz.2.433'. [ 188.344092][ T5688] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 188.421227][ T5727] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 188.439912][ T5678] bridge0: port 1(bridge_slave_0) entered blocking state [ 188.448817][ T5678] bridge0: port 1(bridge_slave_0) entered disabled state [ 188.464081][ T5678] device bridge_slave_0 entered promiscuous mode [ 188.493166][ T5678] bridge0: port 2(bridge_slave_1) entered blocking state [ 188.516954][ T5678] bridge0: port 2(bridge_slave_1) entered disabled state [ 188.533142][ T5678] device bridge_slave_1 entered promiscuous mode [ 188.599087][ T5678] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 188.666010][ T5678] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 189.558004][ T4268] Bluetooth: hci5: command 0x041b tx timeout [ 189.677372][ T5688] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 189.691760][ T5678] team0: Port device team_slave_0 added [ 189.734011][ T5688] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 189.785445][ T5678] team0: Port device team_slave_1 added [ 189.813479][ T5688] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 189.856624][ T5678] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 189.873922][ T5678] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 189.903840][ T5678] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 189.944244][ T5678] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 189.953748][ T5678] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 189.980891][ T5678] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 189.997144][ T5688] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 190.104726][ T5678] device hsr_slave_0 entered promiscuous mode [ 190.161280][ T5678] device hsr_slave_1 entered promiscuous mode [ 190.173454][ T5741] loop4: detected capacity change from 0 to 2048 [ 190.185407][ T5678] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 190.193145][ T5678] Cannot create hsr debugfs directory [ 190.336707][ T5741] NILFS (loop4): invalid segment: Magic number mismatch [ 190.375271][ T5741] NILFS (loop4): trying rollback from an earlier position [ 190.518581][ T5741] NILFS (loop4): recovery complete [ 190.618225][ T5756] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 191.498037][ T5678] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 191.543118][ T5678] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 191.698940][ T5678] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 191.736334][ T4232] Bluetooth: hci5: command 0x040f tx timeout [ 191.842280][ T5678] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 192.885283][ T5777] Illegal XDP return value 4294967294, expect packet loss! [ 192.899288][ T5678] 8021q: adding VLAN 0 to HW filter on device bond0 [ 192.927324][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 192.942812][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 192.956101][ T5678] 8021q: adding VLAN 0 to HW filter on device team0 [ 193.036370][ T5011] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 193.046590][ T5011] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 193.072975][ T5011] bridge0: port 1(bridge_slave_0) entered blocking state [ 193.080190][ T5011] bridge0: port 1(bridge_slave_0) entered forwarding state [ 193.102498][ T5782] device bridge_slave_0 left promiscuous mode [ 193.110378][ T5782] bridge0: port 1(bridge_slave_0) entered disabled state [ 193.128588][ T5782] device bridge_slave_1 left promiscuous mode [ 193.136287][ T5782] bridge0: port 2(bridge_slave_1) entered disabled state [ 193.159257][ T5782] bond0: (slave bond_slave_0): Releasing backup interface [ 193.181868][ T5782] bond0: (slave bond_slave_1): Releasing backup interface [ 193.213468][ T5782] team0: Port device team_slave_0 removed [ 193.231551][ T5782] team0: Port device team_slave_1 removed [ 193.261971][ T5782] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 193.310031][ T5782] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 193.339196][ T5011] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 193.357742][ T5011] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 193.394578][ T5011] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 193.414079][ T5011] bridge0: port 2(bridge_slave_1) entered blocking state [ 193.421226][ T5011] bridge0: port 2(bridge_slave_1) entered forwarding state [ 193.449441][ T5011] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 193.489205][ T5785] team0: Port device xfrm0 added [ 193.505177][ T5787] tipc: Started in network mode [ 193.515266][ T5787] tipc: Node identity 2a038f7a8613, cluster identity 4711 [ 193.531274][ T5787] tipc: Enabled bearer , priority 0 [ 193.550827][ T5011] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 193.573459][ T5011] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 193.599444][ T5011] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 193.627119][ T5011] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 193.646779][ T5011] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 193.665710][ T5011] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 193.685381][ T5011] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 193.716007][ T5011] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 193.751659][ T5011] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 193.788642][ T5011] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 193.804770][ T23] Bluetooth: hci5: command 0x0419 tx timeout [ 193.825582][ T5678] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 193.850946][ T5796] netlink: 8 bytes leftover after parsing attributes in process `syz.2.454'. [ 193.987238][ T5801] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 194.112174][ T5801] CIFS: Attempting to mount \\127.0.0.1\share [ 194.160977][ T5806] loop2: detected capacity change from 0 to 2048 [ 194.219839][ T4241] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 194.227860][ T4241] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 194.291612][ T5678] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 194.327078][ T5811] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 194.647551][ T23] tipc: Node number set to 2886766458 [ 194.722923][ T5820] loop2: detected capacity change from 0 to 2048 [ 194.821068][ T5820] NILFS (loop2): invalid segment: Magic number mismatch [ 194.846285][ T5801] CIFS: VFS: Error connecting to socket. Aborting operation. [ 194.854346][ T5801] CIFS: VFS: cifs_mount failed w/return code = -4 [ 194.862907][ T5820] NILFS (loop2): trying rollback from an earlier position [ 194.905822][ T5820] NILFS (loop2): recovery complete [ 194.915314][ T5004] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 194.932669][ T5004] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 194.941761][ T5826] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 195.044402][ T5004] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 195.056120][ T5004] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 195.074007][ T5678] device veth0_vlan entered promiscuous mode [ 195.101044][ T5004] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 195.117756][ T5004] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 195.169470][ T5678] device veth1_vlan entered promiscuous mode [ 196.119850][ T4241] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 196.131360][ T4241] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 196.141513][ T5678] device veth0_macvtap entered promiscuous mode [ 196.182624][ T5678] device veth1_macvtap entered promiscuous mode [ 196.271810][ T5678] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 196.292593][ T5678] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 196.319574][ T5678] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 196.334665][ T5678] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 196.377793][ T5678] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 196.394746][ T5837] netlink: 140 bytes leftover after parsing attributes in process `syz.3.467'. [ 196.411340][ T5837] netlink: 28 bytes leftover after parsing attributes in process `syz.3.467'. [ 196.422343][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 196.479066][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 196.513107][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 196.561322][ T5678] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 196.600014][ T5678] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 196.622280][ T5678] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 196.643294][ T5678] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 196.844400][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 196.850822][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 196.882908][ T5678] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 197.899962][ T5846] netlink: 'syz.4.470': attribute type 10 has an invalid length. [ 197.918618][ T5846] team0: Device dummy0 is of different type [ 198.019166][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 198.036541][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 198.055094][ T5851] netlink: 'syz.4.470': attribute type 10 has an invalid length. [ 198.070280][ T5851] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 198.087488][ T5678] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 198.103665][ T5678] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 198.124572][ T5678] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 198.192774][ T5678] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 198.230404][ T5878] IPVS: sync thread started: state = BACKUP, mcast_ifn = bridge0, syncid = 1, id = 0 [ 198.256589][ T5871] device macvtap1 entered promiscuous mode [ 198.343022][ T5872] device macvtap2 entered promiscuous mode [ 198.778181][ T4241] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 198.794893][ T4241] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 198.813314][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 198.868113][ T5026] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 198.883652][ T5026] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 198.897210][ T5886] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(6) [ 198.904234][ T5886] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 198.943197][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 198.983155][ T5886] vhci_hcd vhci_hcd.0: Device attached [ 199.782106][ T4232] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 199.799983][ T5900] netlink: 12 bytes leftover after parsing attributes in process `syz.3.485'. [ 199.824331][ T5900] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 199.842669][ T5900] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 199.859712][ T5904] loop2: detected capacity change from 0 to 1024 [ 199.921753][ T5900] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 199.935329][ T4268] usb 41-1: new low-speed USB device number 2 using vhci_hcd [ 199.948623][ T5900] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 200.024763][ T4232] usb 5-1: Using ep0 maxpacket: 16 [ 200.078862][ T5900] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 200.178425][ T5906] ptrace attach of "ci2-linux-5-15-kasan/syz-executor exec"[4199] was attempted by "ci2-linux-5-15-kasan/syz-executor exec"[5906] [ 200.584790][ T4268] usb 41-1: device descriptor read/64, error -71 [ 200.844866][ T5892] vhci_hcd: connection closed [ 200.851712][ T5004] vhci_hcd: stop threads [ 200.864682][ T4268] usb 41-1: new low-speed USB device number 3 using vhci_hcd [ 200.894905][ T4232] usb 5-1: unable to get BOS descriptor or descriptor too short [ 200.902655][ T4232] usb 5-1: no configurations [ 200.920882][ T5004] vhci_hcd: release socket [ 200.963893][ T5004] vhci_hcd: disconnect device [ 200.972121][ T4232] usb 5-1: can't read configurations, error -22 [ 202.757977][ T5941] UBIFS error (pid: 5941): cannot open "", error -22 [ 203.095130][ T4282] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 203.604579][ T4282] usb 3-1: Using ep0 maxpacket: 32 [ 203.815112][ T4282] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 203.831546][ T4282] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 203.906267][ T5955] netlink: 32 bytes leftover after parsing attributes in process `syz.3.504'. [ 203.920808][ T5957] netlink: 4 bytes leftover after parsing attributes in process `syz.0.505'. [ 203.973706][ T4232] Bluetooth: hci3: command 0x0406 tx timeout [ 203.982718][ T4232] Bluetooth: hci2: command 0x0406 tx timeout [ 203.994241][ T4232] Bluetooth: hci4: command 0x0406 tx timeout [ 204.042026][ T5955] netlink: 32 bytes leftover after parsing attributes in process `syz.3.504'. [ 204.814881][ T4282] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 204.832258][ T5964] netlink: 40 bytes leftover after parsing attributes in process `syz.3.507'. [ 204.849597][ T5964] netlink: 40 bytes leftover after parsing attributes in process `syz.3.507'. [ 204.859534][ T5964] netlink: 40 bytes leftover after parsing attributes in process `syz.3.507'. [ 204.895825][ T4282] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 204.923019][ T4282] usb 3-1: Product: syz [ 205.145748][ T4282] usb 3-1: Manufacturer: syz [ 205.150802][ T4282] usb 3-1: SerialNumber: syz [ 205.164305][ T4282] usb 3-1: config 0 descriptor?? [ 205.624682][ T4282] usb 3-1: can't set config #0, error -71 [ 205.647204][ T4282] usb 3-1: USB disconnect, device number 4 [ 205.959928][ T7] hid (null): unknown global tag 0xd [ 205.965785][ T4268] vhci_hcd: vhci_device speed not set [ 205.973429][ T5989] netlink: 'syz.5.516': attribute type 7 has an invalid length. [ 205.988109][ T7] hid (null): unknown global tag 0xda [ 206.011632][ T7] hid-generic 0005:0001:0002.0002: collection stack underflow [ 206.019677][ T7] hid-generic 0005:0001:0002.0002: item 0 1 0 12 parsing failed [ 206.028312][ T7] hid-generic: probe of 0005:0001:0002.0002 failed with error -22 [ 206.055073][ T5989] netlink: 'syz.5.516': attribute type 7 has an invalid length. [ 206.163248][ T5996] device syzkaller0 entered promiscuous mode [ 206.398974][ T6005] netlink: 4 bytes leftover after parsing attributes in process `syz.3.522'. [ 206.599208][ T6014] device syzkaller0 entered promiscuous mode [ 207.857973][ T6030] binder_alloc: 6027: pid 6027 spamming oneway? 2 buffers allocated for a total size of 5120 [ 207.921877][ T6034] binder_alloc: 6027: pid 6027 spamming oneway? 3 buffers allocated for a total size of 5128 [ 210.470433][ T6058] netlink: 20 bytes leftover after parsing attributes in process `syz.4.538'. [ 212.021799][ T6070] loop5: detected capacity change from 0 to 32768 [ 212.116121][ T6070] (syz.5.541,6070,1):ocfs2_find_slot:468 ERROR: no free slots available! [ 212.160136][ T6070] (syz.5.541,6070,0):ocfs2_mount_volume:1811 ERROR: status = -22 [ 212.189949][ T6070] (syz.5.541,6070,0):ocfs2_fill_super:1177 ERROR: status = -22 [ 212.700243][ T6026] netdevsim netdevsim0 eth0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 212.709030][ T6026] netdevsim netdevsim0 eth1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 212.718063][ T6026] netdevsim netdevsim0 eth2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 212.727037][ T6026] netdevsim netdevsim0 eth3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 212.881639][ T6026] device ip6gre1 left promiscuous mode [ 212.923322][ T6032] netlink: 8 bytes leftover after parsing attributes in process `syz.0.529'. [ 212.974132][ T6032] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 212.982558][ T6032] 8021q: adding VLAN 0 to HW filter on device team0 [ 212.991411][ T6032] IPv6: ADDRCONF(NETDEV_CHANGE): dummy0: link becomes ready [ 213.000449][ T6032] A link change request failed with some changes committed already. Interface 60ªX¹¦À may have been left with an inconsistent configuration, please check. [ 213.017258][ T6040] netlink: 'syz.3.533': attribute type 7 has an invalid length. [ 213.026551][ T6044] batman_adv: batadv0: Adding interface: dummy0 [ 213.032998][ T6044] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 213.060490][ T6044] batman_adv: batadv0: Interface activated: dummy0 [ 213.080039][ T6045] batadv0: mtu less than device minimum [ 213.093693][ T6045] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 213.106367][ T6045] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 213.118529][ T6045] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 213.130607][ T6045] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 213.143201][ T6045] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 213.155557][ T6045] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 213.168192][ T6045] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 213.180609][ T6045] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 213.228070][ T6040] netlink: 'syz.3.533': attribute type 7 has an invalid length. [ 213.302990][ T6032] syz.0.529 (6032) used greatest stack depth: 19664 bytes left [ 213.341970][ T6077] netlink: 'syz.4.545': attribute type 1 has an invalid length. [ 213.401584][ T6080] netlink: 'syz.2.543': attribute type 10 has an invalid length. [ 213.420861][ T6080] batman_adv: batadv0: Interface deactivated: dummy0 [ 213.450652][ T6080] batman_adv: batadv0: Removing interface: dummy0 [ 213.483788][ T6080] team0: Port device dummy0 added [ 213.493960][ T6086] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 20000 - 0 [ 213.494027][ T6086] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 20000 - 0 [ 213.494050][ T6086] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 20000 - 0 [ 213.494073][ T6086] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 20000 - 0 [ 213.520695][ T6086] bond1: (slave geneve2): making interface the new active one [ 213.522067][ T6086] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 213.522292][ T6087] netlink: 'syz.2.543': attribute type 10 has an invalid length. [ 213.528567][ T6087] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 213.558024][ T6087] team0: Failed to send options change via netlink (err -105) [ 213.558176][ T6087] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 213.571733][ T6087] team0: Port device dummy0 removed [ 213.575772][ T6087] device dummy0 entered promiscuous mode [ 213.576156][ T6087] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 213.579330][ T6077] bond1 (unregistering): (slave geneve2): Releasing active interface [ 213.580437][ T6077] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 20000 - 0 [ 213.580491][ T6077] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 20000 - 0 [ 213.580522][ T6077] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 20000 - 0 [ 213.580553][ T6077] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 20000 - 0 [ 213.600851][ T6077] bond1 (unregistering): Released all slaves [ 213.733895][ T6095] 9pnet: Insufficient options for proto=fd [ 214.987904][ T6108] netlink: 4 bytes leftover after parsing attributes in process `syz.2.555'. [ 216.104303][ T6128] netlink: 'syz.0.560': attribute type 10 has an invalid length. [ 216.189796][ T6128] team0: Port device dummy0 added [ 216.198480][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 216.208381][ T6131] netlink: 'syz.0.560': attribute type 10 has an invalid length. [ 216.303914][ T6131] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 216.344956][ T6131] team0: Failed to send options change via netlink (err -105) [ 216.579757][ T6131] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 216.882298][ T6131] team0: Port device dummy0 removed [ 217.240293][ T6143] loop2: detected capacity change from 0 to 8192 [ 218.065235][ T6149] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 218.138248][ T6149] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 218.175722][ T6149] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 218.186249][ T6149] device bridge_slave_0 left promiscuous mode [ 218.192516][ T6149] bridge0: port 1(bridge_slave_0) entered disabled state [ 218.399638][ T6149] device bridge_slave_1 left promiscuous mode [ 218.438451][ T6149] bridge0: port 2(bridge_slave_1) entered disabled state [ 218.483288][ T6149] bond0: (slave bond_slave_0): Releasing backup interface [ 218.602730][ T6149] bond0: (slave bond_slave_1): Releasing backup interface [ 219.202605][ T6149] team0: Port device team_slave_0 removed [ 219.264314][ T6149] team0: Port device team_slave_1 removed [ 219.278779][ T6149] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 219.289834][ T6149] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 219.302386][ T6149] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 219.311983][ T6149] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 220.713877][ T6188] netlink: 4 bytes leftover after parsing attributes in process `syz.5.579'. [ 220.863594][ T6192] device ip6gretap0 entered promiscuous mode [ 220.878056][ T6192] device vlan2 entered promiscuous mode [ 220.989301][ T6194] netlink: 14 bytes leftover after parsing attributes in process `syz.4.583'. [ 221.122077][ T6201] netlink: 'syz.3.585': attribute type 4 has an invalid length. [ 223.089225][ T6216] Cannot find set identified by id 0 to match [ 223.811946][ T6226] netlink: 'syz.3.593': attribute type 11 has an invalid length. [ 223.932804][ T6226] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 225.077924][ T6226] net_ratelimit: 11 callbacks suppressed [ 225.077934][ T6226] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 226.237599][ T6233] loop0: detected capacity change from 0 to 32768 [ 229.803508][ T6288] netlink: 12 bytes leftover after parsing attributes in process `syz.4.611'. [ 229.823367][ T6287] netlink: 48 bytes leftover after parsing attributes in process `syz.3.612'. [ 232.372072][ T6295] 8021q: adding VLAN 0 to HW filter on device team0 [ 232.441066][ T6295] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 233.685648][ T6319] xt_TPROXY: Can be used only with -p tcp or -p udp [ 236.809254][ T6339] loop5: detected capacity change from 0 to 1024 [ 236.884182][ T6339] EXT4-fs (loop5): Ignoring removed oldalloc option [ 236.905388][ T6339] EXT4-fs (loop5): ext4_check_descriptors: Block bitmap for group 0 overlaps superblock [ 236.931199][ T6339] EXT4-fs (loop5): ext4_check_descriptors: Checksum for group 0 failed (4996!=20869) [ 237.019277][ T6339] EXT4-fs (loop5): INFO: recovery required on readonly filesystem [ 237.057974][ T6339] EXT4-fs (loop5): write access will be enabled during recovery [ 237.088416][ T6339] EXT4-fs (loop5): barriers disabled [ 237.127773][ T6339] JBD2: no valid journal superblock found [ 237.133571][ T6339] EXT4-fs (loop5): error loading journal [ 237.787586][ T6339] loop5: detected capacity change from 0 to 24 [ 237.991898][ T6356] netlink: 'syz.4.631': attribute type 4 has an invalid length. [ 238.990791][ T6362] netlink: 12 bytes leftover after parsing attributes in process `syz.4.633'. [ 239.253322][ T6368] binder: 6366:6368 unknown command 0 [ 239.259190][ T6368] binder: 6366:6368 ioctl c0306201 2000000004c0 returned -22 [ 239.270880][ T6368] binder: 6366:6368 ioctl c0306201 0 returned -14 [ 240.325536][ T6377] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 246.080607][ T6447] 9pnet: p9_fd_create_tcp (6447): problem connecting socket to 127.0.0.1 [ 246.092744][ T6447] 9pnet: p9_fd_create_tcp (6447): problem connecting socket to 127.0.0.1 [ 246.103069][ T6447] 9pnet: p9_fd_create_tcp (6447): problem connecting socket to 127.0.0.1 [ 246.113613][ T6447] 9pnet: p9_fd_create_tcp (6447): problem connecting socket to 127.0.0.1 [ 246.285894][ T6451] netlink: 4 bytes leftover after parsing attributes in process `syz.3.660'. [ 246.463267][ T6457] netlink: 40 bytes leftover after parsing attributes in process `syz.5.661'. [ 248.542720][ T6491] netlink: 72 bytes leftover after parsing attributes in process `syz.2.670'. [ 249.563370][ T6503] MPTCP: kernel_bind error, err=-99 [ 252.623588][ T6460] ODEBUG: Out of memory. ODEBUG disabled [ 252.728687][ T6531] netlink: 8 bytes leftover after parsing attributes in process `syz.2.682'. [ 253.232204][ T6548] xt_TPROXY: Can be used only with -p tcp or -p udp [ 253.471203][ T6541] loop2: detected capacity change from 0 to 4096 [ 253.922138][ T6550] netlink: 'syz.5.687': attribute type 1 has an invalid length. [ 253.995492][ T6550] 8021q: adding VLAN 0 to HW filter on device bond1 [ 254.130870][ T6541] ntfs3: loop2: Different NTFS' sector size (4096) and media sector size (512) [ 254.282726][ T6550] bond1: (slave geneve2): making interface the new active one [ 254.803289][ T6541] ntfs3: loop2: Mark volume as dirty due to NTFS errors [ 255.252340][ T6550] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 255.329196][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 255.441481][ T6541] device vlan3 entered promiscuous mode [ 255.553753][ T5004] device hsr_slave_0 left promiscuous mode [ 255.615010][ T5004] device hsr_slave_1 left promiscuous mode [ 255.660061][ T5004] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 255.721153][ T5004] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 255.762990][ T5004] device bridge_slave_1 left promiscuous mode [ 255.778344][ T5004] bridge0: port 2(bridge_slave_1) entered disabled state [ 255.855054][ T6550] syz.5.687 (6550) used greatest stack depth: 19360 bytes left [ 255.996902][ T5004] device bridge_slave_0 left promiscuous mode [ 256.026735][ T5004] bridge0: port 1(bridge_slave_0) entered disabled state [ 256.170060][ T5004] bond1 (unregistering): Released all slaves [ 258.462194][ T5004] team0 (unregistering): Port device team_slave_1 removed [ 258.485397][ T5004] team0 (unregistering): Port device team_slave_0 removed [ 258.511085][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 258.517562][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 258.576242][ T5004] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 258.653559][ T5004] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 258.796396][ T5004] bond0 (unregistering): Released all slaves [ 259.082408][ T6607] xt_TPROXY: Can be used only with -p tcp or -p udp [ 259.802276][ T6609] binder: BC_ACQUIRE_RESULT not supported [ 259.809219][ T6609] binder: 6608:6609 ioctl c0306201 200000000240 returned -22 [ 259.819918][ T6609] loop0: detected capacity change from 0 to 128 [ 259.949041][ T6605] bridge1: port 1(gretap1) entered blocking state [ 259.977994][ T6605] bridge1: port 1(gretap1) entered disabled state [ 259.987872][ T6605] device gretap1 entered promiscuous mode [ 260.195864][ T6624] netlink: 24 bytes leftover after parsing attributes in process `syz.5.705'. [ 260.350452][ T6627] netlink: 4 bytes leftover after parsing attributes in process `syz.5.705'. [ 260.839862][ T6656] netlink: 40 bytes leftover after parsing attributes in process `syz.0.709'. [ 260.875706][ T6653] IPVS: Error connecting to the multicast addr [ 261.859213][ T6680] netlink: 'syz.5.717': attribute type 3 has an invalid length. [ 261.910133][ T6680] netlink: 24 bytes leftover after parsing attributes in process `syz.5.717'. [ 261.956455][ T6682] netlink: 'syz.0.718': attribute type 1 has an invalid length. [ 262.040653][ T6682] 8021q: adding VLAN 0 to HW filter on device bond0 [ 262.116128][ T6683] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 262.124751][ T6683] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 262.133154][ T6683] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 262.149609][ T6683] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 262.163048][ T6683] bond0: (slave geneve2): making interface the new active one [ 262.189899][ T6683] bond0: (slave geneve2): Enslaving as an active interface with an up link [ 262.214142][ T4320] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 262.287231][ T6691] loop5: detected capacity change from 0 to 128 [ 262.416914][ T6693] netlink: 8 bytes leftover after parsing attributes in process `syz.4.721'. [ 264.015487][ T7] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 264.524746][ T7] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 264.744698][ T7] usb 3-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice=83.9c [ 264.774680][ T7] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 264.782774][ T7] usb 3-1: Product: syz [ 264.823996][ T7] usb 3-1: Manufacturer: syz [ 264.844690][ T7] usb 3-1: SerialNumber: syz [ 264.867038][ T7] usb 3-1: config 0 descriptor?? [ 264.938145][ T7] ims_pcu 3-1:0.0: Missing CDC union descriptor [ 264.954914][ T7] ims_pcu: probe of 3-1:0.0 failed with error -22 [ 265.230968][ T6712] udc-core: couldn't find an available UDC or it's busy [ 265.267745][ T6712] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 265.299029][ T6757] loop0: detected capacity change from 0 to 128 [ 265.342034][ T7] usb 3-1: USB disconnect, device number 5 [ 266.067131][ T6791] netlink: 4 bytes leftover after parsing attributes in process `syz.3.742'. [ 269.403199][ T6800] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 271.340508][ T6821] bridge0: port 2(bridge_slave_1) entered disabled state [ 271.348070][ T6821] bridge0: port 1(bridge_slave_0) entered disabled state [ 271.437485][ T6829] overlayfs: failed to clone upperpath [ 271.662868][ T6835] overlayfs: failed to clone upperpath [ 272.154790][ T4282] usb 5-1: new full-speed USB device number 5 using dummy_hcd [ 272.468343][ T5011] bond4: (slave vlan2): link status definitely down, disabling slave [ 272.488024][ T5011] bond4: now running without any active interface! [ 272.574806][ T4282] usb 5-1: config 0 interface 0 has no altsetting 0 [ 272.595031][ T4282] usb 5-1: New USB device found, idVendor=146b, idProduct=0902, bcdDevice= 0.00 [ 272.637302][ T6850] netlink: 4 bytes leftover after parsing attributes in process `syz.3.755'. [ 272.684490][ T4282] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 272.738177][ T4282] usb 5-1: config 0 descriptor?? [ 273.032049][ T6863] device vlan2 entered promiscuous mode [ 273.293294][ T4282] bigben 0003:146B:0902.0003: unexpected rdesc, please submit for review [ 273.330871][ T4282] bigben 0003:146B:0902.0003: unexpected long global item [ 273.405323][ T4282] bigben 0003:146B:0902.0003: parse failed [ 273.419397][ T4282] bigben: probe of 0003:146B:0902.0003 failed with error -22 [ 274.064573][ T6874] udc-core: couldn't find an available UDC or it's busy [ 274.303366][ T6874] misc raw-gadget: fail, usb_gadget_probe_driver returned -16 [ 274.368583][ T4282] usb 5-1: USB disconnect, device number 5 [ 275.727689][ T6893] uffd: Set unprivileged_userfaultfd sysctl knob to 1 if kernel faults must be handled without obtaining CAP_SYS_PTRACE capability [ 276.413175][ T6918] loop5: detected capacity change from 0 to 128 [ 276.610190][ T6918] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 276.709419][ T6918] ext4 filesystem being mounted at /58/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 278.280939][ T6909] loop2: detected capacity change from 0 to 32768 [ 278.691086][ T6949] Invalid ELF header magic: != ELF [ 279.021450][ T6909] (syz.2.768,6909,1):ocfs2_initialize_super:2311 ERROR: status = -12 [ 279.205889][ T6909] (syz.2.768,6909,1):ocfs2_fill_super:1177 ERROR: status = -12 [ 280.323250][ T6961] device syzkaller0 entered promiscuous mode [ 285.034642][ T26] audit: type=1800 audit(1785215946.132:87): pid=7016 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.795" name="bus" dev="ramfs" ino=43096 res=0 errno=0 [ 286.205453][ T7063] loop0: detected capacity change from 0 to 256 [ 288.618367][ T7088] uffd: Set unprivileged_userfaultfd sysctl knob to 1 if kernel faults must be handled without obtaining CAP_SYS_PTRACE capability [ 290.138211][ T7] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 290.287863][ T7109] loop4: detected capacity change from 0 to 256 [ 290.394601][ T7] usb 6-1: Using ep0 maxpacket: 16 [ 290.534896][ T7] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 290.545518][ T13] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 290.622805][ T7] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 290.926621][ T7] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 291.015697][ T13] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 291.040757][ T7] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 291.127458][ T13] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 291.301472][ T7] usb 6-1: Product: syz [ 291.339072][ T7] usb 6-1: Manufacturer: syz [ 291.343749][ T7] usb 6-1: SerialNumber: syz [ 291.359067][ T13] usb 1-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 291.448971][ T13] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 291.492361][ T13] usb 1-1: config 0 descriptor?? [ 292.735373][ T26] audit: type=1800 audit(1785215953.842:88): pid=7111 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.817" name="bus" dev="ramfs" ino=42307 res=0 errno=0 [ 292.814919][ T7] usb 6-1: 0:2 : does not exist [ 293.800051][ T13] elan 0003:04F3:0755.0004: unknown main item tag 0x0 [ 293.844810][ T7] usb 6-1: USB disconnect, device number 2 [ 293.851660][ T13] elan 0003:04F3:0755.0004: unknown main item tag 0x0 [ 293.860642][ T13] elan 0003:04F3:0755.0004: unknown main item tag 0x0 [ 293.871917][ T13] elan 0003:04F3:0755.0004: unknown main item tag 0x0 [ 293.879090][ T13] elan 0003:04F3:0755.0004: unknown main item tag 0x0 [ 293.888251][ T13] elan 0003:04F3:0755.0004: failed to start in urb: -90 [ 293.903146][ T13] elan 0003:04F3:0755.0004: hidraw0: USB HID v1.01 Device [HID 04f3:0755] on usb-dummy_hcd.0-1/input0 [ 293.926042][ T13] usb 1-1: USB disconnect, device number 4 [ 295.164303][ T4179] udevd[4179]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 295.444474][ T7165] overlayfs: statfs failed on './file0' [ 296.442808][ T7162] fido_id[7162]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 296.518265][ T7177] netlink: 148 bytes leftover after parsing attributes in process `syz.3.832'. [ 296.843273][ T7189] loop4: detected capacity change from 0 to 256 [ 296.893621][ T7189] exFAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 296.914733][ T7189] exFAT-fs (loop4): Medium has reported failures. Some data may be lost. [ 296.947265][ T7189] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 297.840508][ T7203] netlink: 4 bytes leftover after parsing attributes in process `syz.5.837'. [ 297.996559][ T7206] netlink: 12 bytes leftover after parsing attributes in process `syz.5.837'. [ 298.805666][ T7220] xt_hashlimit: size too large, truncated to 1048576 [ 298.815144][ T7220] xt_CT: You must specify a L4 protocol and not use inversions on it [ 299.705383][ T7235] loop2: detected capacity change from 0 to 2048 [ 300.268814][ T7235] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 300.463051][ T7244] netlink: 8 bytes leftover after parsing attributes in process `syz.3.848'. [ 300.717131][ T7246] loop0: detected capacity change from 0 to 256 [ 300.826122][ T7246] FAT-fs (loop0): Directory bread(block 64) failed [ 300.839114][ T7262] UBIFS error (pid: 7262): cannot open "ubi0_0", error -19 [ 300.847028][ T7246] FAT-fs (loop0): Directory bread(block 65) failed [ 300.875943][ T7246] FAT-fs (loop0): Directory bread(block 66) failed [ 300.882645][ T7246] FAT-fs (loop0): Directory bread(block 67) failed [ 300.889870][ T7246] FAT-fs (loop0): Directory bread(block 68) failed [ 300.897002][ T7246] FAT-fs (loop0): Directory bread(block 69) failed [ 300.903869][ T7246] FAT-fs (loop0): Directory bread(block 70) failed [ 300.910987][ T7246] FAT-fs (loop0): Directory bread(block 71) failed [ 300.918449][ T7246] FAT-fs (loop0): Directory bread(block 72) failed [ 300.926992][ T7246] FAT-fs (loop0): Directory bread(block 73) failed [ 301.134569][ T4268] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 301.384577][ T4268] usb 3-1: Using ep0 maxpacket: 16 [ 301.504815][ T4268] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 301.523546][ T4268] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 301.853555][ T7297] bridge0: port 2(bridge_slave_1) entered disabled state [ 301.860845][ T7297] bridge0: port 1(bridge_slave_0) entered disabled state [ 301.877857][ T4268] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 301.894545][ T4268] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 301.902895][ T4268] usb 3-1: Product: syz [ 301.907178][ T4268] usb 3-1: Manufacturer: syz [ 301.911808][ T4268] usb 3-1: SerialNumber: syz [ 302.799526][ T4268] usb 3-1: 0:2 : does not exist [ 303.133637][ T4268] usb 3-1: USB disconnect, device number 6 [ 303.352211][ T7312] netlink: 16 bytes leftover after parsing attributes in process `syz.4.862'. [ 303.402808][ T7317] xt_hashlimit: size too large, truncated to 1048576 [ 303.425365][ T7312] netlink: 17 bytes leftover after parsing attributes in process `syz.4.862'. [ 303.443054][ T7312] tipc: Invalid UDP bearer configuration [ 303.443104][ T7312] tipc: Enabling of bearer rejected, failed to enable media [ 303.464586][ T7317] xt_CT: You must specify a L4 protocol and not use inversions on it [ 303.476364][ T7318] netlink: 48 bytes leftover after parsing attributes in process `syz.0.865'. [ 303.487560][ T7318] netlink: 48 bytes leftover after parsing attributes in process `syz.0.865'. [ 303.705916][ T7326] device bridge_slave_1 left promiscuous mode [ 303.778873][ T7326] bridge0: port 2(bridge_slave_1) entered disabled state [ 305.656602][ T7326] device bridge_slave_0 left promiscuous mode [ 305.664084][ T7326] bridge0: port 1(bridge_slave_0) entered disabled state [ 306.709903][ T4179] udevd[4179]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 306.886867][ T7334] netlink: 'syz.0.867': attribute type 4 has an invalid length. [ 306.965984][ T7336] netlink: 'syz.0.867': attribute type 4 has an invalid length. [ 309.736394][ T7382] loop4: detected capacity change from 0 to 2048 [ 309.818999][ T7382] EXT4-fs (loop4): couldn't mount as ext3 due to feature incompatibilities [ 309.907972][ T7382] loop4: detected capacity change from 0 to 256 [ 309.985709][ T7382] exfat: Deprecated parameter 'namecase' [ 309.991450][ T7382] exfat: Deprecated parameter 'namecase' [ 310.067434][ T7382] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0x8300b014, utbl_chksum : 0xe619d30d) [ 310.441974][ T7405] bond0: (slave dummy0): Releasing backup interface [ 310.669796][ T7405] team0: Port device xfrm0 removed [ 310.748414][ T144] tipc: Resetting bearer [ 310.844886][ T7407] team0: Mode changed to "activebackup" [ 315.684121][ T7451] device syzkaller0 entered promiscuous mode [ 316.388151][ T7461] xt_connbytes: Forcing CT accounting to be enabled [ 316.574751][ T7461] xt_CT: No such helper "netbios-ns" [ 318.223170][ T7494] loop2: detected capacity change from 0 to 1024 [ 319.038806][ T7494] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 319.359192][ T7494] IPv6: sit1: Disabled Multicast RS [ 319.413855][ T7507] netlink: 16 bytes leftover after parsing attributes in process `syz.3.905'. [ 319.444049][ T7507] netlink: 17 bytes leftover after parsing attributes in process `syz.3.905'. [ 319.462530][ T7510] loop0: detected capacity change from 0 to 2048 [ 319.483978][ T7507] tipc: Invalid UDP bearer configuration [ 319.484027][ T7507] tipc: Enabling of bearer rejected, failed to enable media [ 319.650651][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 319.657049][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 319.681358][ T7510] EXT4-fs (loop0): mounted filesystem without journal. Opts: bsddf,user_xattr,debug_want_extra_isize=0x0000000000000006,,errors=continue. Quota mode: none. [ 319.738511][ T7519] netlink: 8 bytes leftover after parsing attributes in process `syz.4.908'. [ 319.896610][ T7527] netlink: 8 bytes leftover after parsing attributes in process `syz.4.908'. [ 319.926300][ T7510] mmap: syz.0.906 (7510) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 321.138540][ T4268] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 321.229622][ T7543] device macsec1 entered promiscuous mode [ 321.315230][ T7543] device virt_wifi0 entered promiscuous mode [ 322.365312][ T4268] Bluetooth: hci1: command 0x0409 tx timeout [ 323.177950][ T7526] chnl_net:caif_netlink_parms(): no params data found [ 323.633563][ T7526] bridge0: port 1(bridge_slave_0) entered blocking state [ 323.640865][ T7526] bridge0: port 1(bridge_slave_0) entered disabled state [ 323.695852][ T7526] device bridge_slave_0 entered promiscuous mode [ 323.758038][ T7526] bridge0: port 2(bridge_slave_1) entered blocking state [ 323.806596][ T7526] bridge0: port 2(bridge_slave_1) entered disabled state [ 323.834033][ T7526] device bridge_slave_1 entered promiscuous mode [ 323.858540][ T7526] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 323.870452][ T7526] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 324.535963][ T7526] team0: Port device team_slave_0 added [ 324.605033][ T7526] team0: Port device team_slave_1 added [ 324.636300][ T4230] Bluetooth: hci1: command 0x041b tx timeout [ 324.679916][ T7579] loop0: detected capacity change from 0 to 512 [ 324.833058][ T7579] EXT4-fs (loop0): Ignoring removed bh option [ 324.906546][ T7579] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 325.084859][ T7526] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 325.112598][ T7526] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 325.318481][ T7579] EXT4-fs (loop0): 1 truncate cleaned up [ 325.324218][ T7579] EXT4-fs (loop0): mounted filesystem without journal. Opts: noload,max_dir_size_kb=0x0000000000000001,bh,noload,data_err=ignore,usrjquota=,,errors=continue. Quota mode: none. [ 325.325071][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 325.484784][ T7526] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 325.959268][ T7598] tipc: Failed to remove unknown binding: 66,0,0/0:2461805133/2461805134 [ 326.054662][ T7601] tipc: Failed to remove unknown binding: 66,0,0/0:890566173/890566175 [ 326.131989][ T7598] tipc: Failed to remove unknown binding: 66,0,0/0:2461805133/2461805134 [ 326.673855][ T7526] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 326.691546][ T4232] Bluetooth: hci1: command 0x040f tx timeout [ 326.724938][ T7526] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 326.935136][ T7526] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 327.719938][ T7610] device syzkaller0 entered promiscuous mode [ 327.906600][ T7526] device hsr_slave_0 entered promiscuous mode [ 327.980393][ T7526] device hsr_slave_1 entered promiscuous mode [ 327.997725][ T7526] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 328.012350][ T7526] Cannot create hsr debugfs directory [ 328.866168][ T4268] Bluetooth: hci1: command 0x0419 tx timeout [ 330.404886][ T7526] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 330.638797][ T7654] tipc: Resetting bearer [ 330.656996][ T7654] tipc: Resetting bearer [ 330.694343][ T7526] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 331.449016][ T7526] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 331.879604][ T7526] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 333.182262][ T7526] 8021q: adding VLAN 0 to HW filter on device bond0 [ 333.200302][ T7526] 8021q: adding VLAN 0 to HW filter on device team0 [ 333.224772][ T4241] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 333.233127][ T4241] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 333.711423][ T4241] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 333.734159][ T4241] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 333.793787][ T4241] bridge0: port 1(bridge_slave_0) entered blocking state [ 333.801039][ T4241] bridge0: port 1(bridge_slave_0) entered forwarding state [ 333.990088][ T4241] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 334.016638][ T4241] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 334.050915][ T4241] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 334.069972][ T4241] bridge0: port 2(bridge_slave_1) entered blocking state [ 334.077258][ T4241] bridge0: port 2(bridge_slave_1) entered forwarding state [ 334.114461][ T26] audit: type=1804 audit(1785215995.192:89): pid=7706 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.950" name="bus" dev="ramfs" ino=44236 res=1 errno=0 [ 334.203407][ T26] audit: type=1804 audit(1785215995.192:90): pid=7710 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.950" name="bus" dev="ramfs" ino=44236 res=1 errno=0 [ 334.348131][ T5011] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 334.364556][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 334.380169][ T7716] netlink: 8 bytes leftover after parsing attributes in process `syz.0.952'. [ 334.500821][ T5011] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 334.812880][ T5011] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 335.004740][ T5011] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 335.141336][ T5011] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 335.313083][ T7526] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 335.344408][ T7526] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 335.981203][ T4241] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 336.005040][ T4241] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 336.018220][ T4241] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 336.027389][ T4241] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 336.036920][ T4241] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 336.078118][ T4241] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 336.133622][ T4241] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 336.327400][ T7735] device syzkaller0 entered promiscuous mode [ 337.946242][ T7526] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 337.954356][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 337.966077][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 337.978150][ T26] audit: type=1326 audit(1785215999.082:91): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7767 comm="syz.4.966" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fe7615b1e99 code=0x0 [ 338.109004][ T7778] overlayfs: bad mount option "redirect_dir=off:/" [ 338.187870][ T7781] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 338.242409][ T7781] bond0: (slave team0): Releasing backup interface [ 338.291017][ T7781] bond0: (slave bond_slave_0): Releasing backup interface [ 338.311994][ T7781] bond0: (slave bond_slave_1): Releasing backup interface [ 338.378643][ T7781] team0: Port device team_slave_0 removed [ 338.406199][ T7781] team0: Port device team_slave_1 removed [ 338.415910][ T7781] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 338.423817][ T7781] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 338.433636][ T7781] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 338.447364][ T7781] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 338.905282][ T7795] netlink: 16 bytes leftover after parsing attributes in process `syz.0.973'. [ 338.914504][ T7795] netlink: 16 bytes leftover after parsing attributes in process `syz.0.973'. [ 338.951990][ T7795] netlink: 16 bytes leftover after parsing attributes in process `syz.0.973'. [ 338.961191][ T7795] netlink: 16 bytes leftover after parsing attributes in process `syz.0.973'. [ 339.450437][ T7795] netlink: 16 bytes leftover after parsing attributes in process `syz.0.973'. [ 339.459546][ T7795] netlink: 16 bytes leftover after parsing attributes in process `syz.0.973'. [ 340.281580][ T7795] netlink: 16 bytes leftover after parsing attributes in process `syz.0.973'. [ 340.290765][ T7795] netlink: 16 bytes leftover after parsing attributes in process `syz.0.973'. [ 340.453803][ T7795] netlink: 16 bytes leftover after parsing attributes in process `syz.0.973'. [ 340.463062][ T7795] netlink: 16 bytes leftover after parsing attributes in process `syz.0.973'. [ 340.558952][ T7795] netlink: 16 bytes leftover after parsing attributes in process `syz.0.973'. [ 340.568087][ T7795] netlink: 16 bytes leftover after parsing attributes in process `syz.0.973'. [ 340.627144][ T7795] netlink: 16 bytes leftover after parsing attributes in process `syz.0.973'. [ 340.636426][ T7795] netlink: 16 bytes leftover after parsing attributes in process `syz.0.973'. [ 341.155806][ T7809] netlink: 'syz.4.976': attribute type 1 has an invalid length. [ 342.421578][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 342.434863][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 342.449536][ T7526] device veth0_vlan entered promiscuous mode [ 342.458326][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 342.472440][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 342.499226][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 342.523170][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 342.569478][ T7526] device veth1_vlan entered promiscuous mode [ 342.683361][ T7526] device veth0_macvtap entered promiscuous mode [ 342.704117][ T7526] device veth1_macvtap entered promiscuous mode [ 342.721921][ T7526] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 342.733380][ T7526] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 342.745430][ T7526] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 342.755395][ T4232] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 342.761464][ T7526] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 342.774000][ T7526] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 342.786344][ T7526] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 342.795247][ T7842] netlink: 'syz.3.991': attribute type 40 has an invalid length. [ 342.994826][ T4232] usb 3-1: Using ep0 maxpacket: 32 [ 343.275600][ T4232] usb 3-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 343.299151][ T4232] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 343.342344][ T4232] usb 3-1: Product: syz [ 343.419381][ T4232] usb 3-1: Manufacturer: syz [ 343.424211][ T4232] usb 3-1: SerialNumber: syz [ 343.432864][ T4232] usb 3-1: config 0 descriptor?? [ 343.641910][ T4232] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 343.650484][ T4232] dvb-usb: bulk message failed: -22 (4/0) [ 343.683597][ T4232] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 344.767273][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 344.785389][ T4232] dvb-usb: bulk message failed: -22 (5/0) [ 344.791262][ T4232] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 344.813085][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 344.838996][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 344.873104][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 344.892573][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 344.943125][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 344.992036][ T4232] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 345.015193][ T4232] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 345.024060][ T4232] usb 3-1: media controller created [ 345.042260][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 345.050386][ T4232] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 345.084956][ T4232] usb 3-1: selecting invalid altsetting 3 [ 345.090772][ T4232] ttusb2: set interface to alts=3 failed [ 345.112347][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 345.122249][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 345.147984][ T5026] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 345.176089][ T7526] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.176144][ T7526] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.176176][ T7526] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.176215][ T7526] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 345.222368][ T4232] DVB: Unable to find symbol tda10086_attach() [ 345.222435][ T4232] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 345.254723][ T4232] dvb-usb: bulk message failed: -22 (4/0) [ 345.254832][ T4232] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 345.254972][ T4232] dvb-usb: bulk message failed: -22 (5/0) [ 345.254994][ T4232] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 345.255041][ T4232] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 345.264272][ T4232] usb 3-1: USB disconnect, device number 7 [ 345.434035][ T7874] loop0: detected capacity change from 0 to 8 [ 345.488692][ T7874] SQUASHFS error: lzo decompression failed, data probably corrupt [ 345.511345][ T4232] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 345.521288][ T7874] SQUASHFS error: Failed to read block 0x62b: -5 [ 345.528248][ T7874] SQUASHFS error: Unable to read metadata cache entry [629] [ 345.536309][ T5009] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 345.544246][ T5009] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 345.566902][ T7874] SQUASHFS error: Unable to read inode 0x11f [ 345.608056][ T5009] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 345.661952][ T5009] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 345.676505][ T5009] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 345.687210][ T7877] netlink: 'syz.2.1003': attribute type 3 has an invalid length. [ 345.726441][ T7877] netlink: 'syz.2.1003': attribute type 3 has an invalid length. [ 345.985610][ T5009] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 348.572748][ T7913] netlink: 'syz.4.1002': attribute type 10 has an invalid length. [ 350.043969][ T7929] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 350.121848][ T7931] __nla_validate_parse: 18 callbacks suppressed [ 350.121910][ T7931] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1010'. [ 350.583307][ T26] audit: type=1326 audit(1785216011.682:92): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7947 comm="syz.0.1015" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff78ed86e99 code=0x7ffc0000 [ 350.654420][ T26] audit: type=1326 audit(1785216011.682:93): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7947 comm="syz.0.1015" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff78ed86e99 code=0x7ffc0000 [ 350.720630][ T26] audit: type=1326 audit(1785216011.722:94): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7947 comm="syz.0.1015" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff78ed86e99 code=0x7ffc0000 [ 350.848598][ T26] audit: type=1326 audit(1785216011.722:96): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7947 comm="syz.0.1015" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7ff78ed86e99 code=0x7ffc0000 [ 350.969720][ T26] audit: type=1326 audit(1785216011.722:95): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7947 comm="syz.0.1015" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff78ed86e99 code=0x7ffc0000 [ 351.038200][ T26] audit: type=1326 audit(1785216011.722:97): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7947 comm="syz.0.1015" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff78ed86e99 code=0x7ffc0000 [ 351.110309][ T26] audit: type=1326 audit(1785216011.722:98): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7947 comm="syz.0.1015" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff78ed86e99 code=0x7ffc0000 [ 351.194576][ T26] audit: type=1326 audit(1785216011.732:99): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7947 comm="syz.0.1015" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff78ed86e99 code=0x7ffc0000 [ 351.274647][ T26] audit: type=1326 audit(1785216011.732:100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7947 comm="syz.0.1015" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff78ed86e99 code=0x7ffc0000 [ 351.811651][ T26] audit: type=1326 audit(1785216011.732:101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7947 comm="syz.0.1015" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7ff78ed86e99 code=0x7ffc0000 [ 352.106726][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 352.243983][ T7961] loop0: detected capacity change from 0 to 1024 [ 352.345532][ T7961] hfsplus: invalid btree flag [ 352.351316][ T7961] hfsplus: failed to load extents file [ 354.205704][ T8020] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1034'. [ 355.681868][ T8042] bridge0: port 3(syz_tun) entered blocking state [ 355.724129][ T8042] bridge0: port 3(syz_tun) entered disabled state [ 355.830717][ T8042] device syz_tun entered promiscuous mode [ 356.005206][ T8042] bridge0: port 3(syz_tun) entered blocking state [ 356.011796][ T8042] bridge0: port 3(syz_tun) entered forwarding state [ 356.302769][ T8058] device syzkaller0 left promiscuous mode [ 356.424210][ T8061] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 357.104652][ T8047] netlink: 'syz.6.1044': attribute type 12 has an invalid length. [ 357.112640][ T8047] netlink: 'syz.6.1044': attribute type 29 has an invalid length. [ 357.204515][ T8047] netlink: 148 bytes leftover after parsing attributes in process `syz.6.1044'. [ 359.141255][ T8086] netlink: 'syz.3.1057': attribute type 1 has an invalid length. [ 359.269768][ T8095] loop4: detected capacity change from 0 to 2048 [ 359.398084][ T8096] bond1: (slave bridge0): making interface the new active one [ 359.437286][ T8100] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 360.198960][ T8096] bond1: (slave bridge0): Enslaving as an active interface with an up link [ 361.687118][ T8127] netlink: 209844 bytes leftover after parsing attributes in process `syz.4.1065'. [ 362.609845][ T8141] device syzkaller0 entered promiscuous mode [ 362.830987][ T8149] loop4: detected capacity change from 0 to 2048 [ 362.952264][ T8149] EXT4-fs (loop4): mounted filesystem without journal. Opts: bsdgroups,jqfmt=vfsv1,,errors=continue. Quota mode: none. [ 363.335272][ T1107] usb 5-1: new full-speed USB device number 6 using dummy_hcd [ 364.751301][ T21] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 366.884694][ T1107] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 366.894929][ T1107] usb 5-1: can't read configurations, error -71 [ 367.074444][ T21] usb 3-1: device not accepting address 8, error -71 [ 367.091188][ T26] kauditd_printk_skb: 119 callbacks suppressed [ 367.091310][ T26] audit: type=1326 audit(1785216028.192:221): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8180 comm="syz.2.1084" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd739779e99 code=0x7ffc0000 [ 367.268980][ T26] audit: type=1326 audit(1785216028.242:222): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8180 comm="syz.2.1084" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd739779e99 code=0x7ffc0000 [ 367.357372][ T8185] binder: 8184:8185 ioctl 4018620d 0 returned -22 [ 367.397879][ T8185] binder: 8184:8185 ioctl c0306201 0 returned -14 [ 367.426037][ T26] audit: type=1326 audit(1785216028.242:223): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8180 comm="syz.2.1084" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd739779e99 code=0x7ffc0000 [ 367.595885][ T26] audit: type=1326 audit(1785216028.242:224): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8180 comm="syz.2.1084" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7fd739779e99 code=0x7ffc0000 [ 367.786891][ T26] audit: type=1326 audit(1785216028.242:225): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8180 comm="syz.2.1084" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd739779e99 code=0x7ffc0000 [ 368.147725][ T26] audit: type=1326 audit(1785216028.242:226): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8180 comm="syz.2.1084" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd739779e99 code=0x7ffc0000 [ 368.186261][ T26] audit: type=1326 audit(1785216028.242:227): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8180 comm="syz.2.1084" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7fd739779e99 code=0x7ffc0000 [ 368.218717][ T26] audit: type=1326 audit(1785216028.242:228): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8180 comm="syz.2.1084" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7fd739779e99 code=0x7ffc0000 [ 368.433707][ T8212] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1093'. [ 369.086833][ T8212] bridge3: port 1(erspan0) entered blocking state [ 369.174155][ T8212] bridge3: port 1(erspan0) entered disabled state [ 369.235587][ T8212] device erspan0 entered promiscuous mode [ 369.268120][ T8212] bridge3: port 1(erspan0) entered blocking state [ 369.274708][ T8212] bridge3: port 1(erspan0) entered forwarding state [ 369.293457][ T8220] FAULT_INJECTION: forcing a failure. [ 369.293457][ T8220] name fail_futex, interval 1, probability 0, space 0, times 1 [ 369.362431][ T8220] CPU: 1 PID: 8220 Comm: syz.4.1095 Not tainted syzkaller #0 [ 369.369875][ T8220] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 369.380058][ T8220] Call Trace: [ 369.383463][ T8220] [ 369.386446][ T8220] dump_stack_lvl+0x188/0x250 [ 369.391275][ T8220] ? lockdep_hardirqs_on+0x94/0x140 [ 369.396509][ T8220] ? show_regs_print_info+0x20/0x20 [ 369.401735][ T8220] ? load_image+0x410/0x410 [ 369.406312][ T8220] ? timerqueue_del+0xaa/0x100 [ 369.411168][ T8220] ? __remove_hrtimer+0x140/0x3a0 [ 369.416323][ T8220] should_fail+0x383/0x4b0 [ 369.420843][ T8220] get_futex_key+0x1a1/0x12d0 [ 369.425612][ T8220] ? futex_wait_restart+0x250/0x250 [ 369.430836][ T8220] ? __lock_acquire+0x13dc/0x7b50 [ 369.435959][ T8220] futex_wake+0x101/0x540 [ 369.440363][ T8220] ? futex_wait+0x680/0x680 [ 369.444898][ T8220] ? verify_lock_unused+0x140/0x140 [ 369.450126][ T8220] ? verify_lock_unused+0x140/0x140 [ 369.455351][ T8220] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 369.461366][ T8220] do_futex+0xd83/0x12b0 [ 369.465636][ T8220] ? __lock_acquire+0x7b50/0x7b50 [ 369.470694][ T8220] ? seqcount_lockdep_reader_access+0x127/0x1d0 [ 369.476961][ T8220] ? lockdep_hardirqs_on+0x94/0x140 [ 369.482201][ T8220] ? futex_exit_release+0x1c0/0x1c0 [ 369.487440][ T8220] ? __context_tracking_exit+0x4c/0x80 [ 369.492936][ T8220] __se_sys_futex+0x389/0x420 [ 369.497648][ T8220] ? __x64_sys_futex+0xf0/0xf0 [ 369.502443][ T8220] ? __x64_sys_futex+0x1d/0xf0 [ 369.507240][ T8220] do_syscall_64+0x4c/0xa0 [ 369.511685][ T8220] ? clear_bhb_loop+0x30/0x80 [ 369.516485][ T8220] ? clear_bhb_loop+0x30/0x80 [ 369.521195][ T8220] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 369.527126][ T8220] RIP: 0033:0x7fe7615b1e99 [ 369.531640][ T8220] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 369.551300][ T8220] RSP: 002b:00007ffd0fe079b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 369.559819][ T8220] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe7615b1e99 [ 369.567816][ T8220] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe761839fa8 [ 369.575842][ T8220] RBP: 0000000000000085 R08: 0000000000000000 R09: 0000000000000000 [ 369.583851][ T8220] R10: 00007fe761839fa0 R11: 0000000000000246 R12: 0000000000000000 [ 369.591854][ T8220] R13: 00007fe761839fac R14: 00007fe761839fa8 R15: 00007fe761839fa0 [ 369.599872][ T8220] [ 369.618553][ T8223] bond0: option arp_validate: invalid value (695) [ 369.695619][ T8226] netlink: 'syz.2.1099': attribute type 10 has an invalid length. [ 369.795539][ T8220] FAULT_INJECTION: forcing a failure. [ 369.795539][ T8220] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 369.856097][ T8220] CPU: 1 PID: 8220 Comm: syz.4.1095 Not tainted syzkaller #0 [ 369.863542][ T8220] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 369.873628][ T8220] Call Trace: [ 369.876940][ T8220] [ 369.879890][ T8220] dump_stack_lvl+0x188/0x250 [ 369.884609][ T8220] ? show_regs_print_info+0x20/0x20 [ 369.889835][ T8220] ? load_image+0x410/0x410 [ 369.894371][ T8220] ? __lock_acquire+0x7b50/0x7b50 [ 369.899426][ T8220] ? lockdep_hardirqs_on+0x94/0x140 [ 369.904882][ T8220] should_fail+0x383/0x4b0 [ 369.909356][ T8220] _copy_from_user+0x2e/0x170 [ 369.914168][ T8220] get_timespec64+0x93/0x1b0 [ 369.918877][ T8220] ? timespec64_add_safe+0x1f0/0x1f0 [ 369.924203][ T8220] ? __context_tracking_exit+0x4c/0x80 [ 369.929761][ T8220] __se_sys_futex+0x1c5/0x420 [ 369.934486][ T8220] ? __x64_sys_futex+0xf0/0xf0 [ 369.939288][ T8220] ? __x64_sys_futex+0x1d/0xf0 [ 369.944086][ T8220] do_syscall_64+0x4c/0xa0 [ 369.948531][ T8220] ? clear_bhb_loop+0x30/0x80 [ 369.953249][ T8220] ? clear_bhb_loop+0x30/0x80 [ 369.957971][ T8220] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 369.963898][ T8220] RIP: 0033:0x7fe7615b1e99 [ 369.968368][ T8220] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 369.983320][ T8226] device wlan1 entered promiscuous mode [ 369.988018][ T8220] RSP: 002b:00007ffd0fe079b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 369.988051][ T8220] RAX: ffffffffffffffda RBX: 000000000005a457 RCX: 00007fe7615b1e99 [ 369.988066][ T8220] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fe76183a09c [ 369.988080][ T8220] RBP: 0000000000000032 R08: 002c5deb65fe2078 R09: 0000000000000000 [ 369.988095][ T8220] R10: 00007ffd0fe07ac0 R11: 0000000000000246 R12: 00007ffd0fe07ae0 [ 369.988110][ T8220] R13: 00007fe76183a09c R14: 000000000005a489 R15: 00007ffd0fe07ac0 [ 369.988140][ T8220] [ 370.065619][ T8226] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 371.995252][ T8266] ipt_CLUSTERIP: Please specify destination IP [ 373.415008][ T8285] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1115'. [ 374.706277][ T8302] bridge0: port 3(syz_tun) entered disabled state [ 374.740927][ T8302] device syz_tun left promiscuous mode [ 374.769152][ T8302] bridge0: port 3(syz_tun) entered disabled state [ 376.448469][ T8333] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1129'. [ 376.480486][ T8333] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1129'. [ 376.526168][ T8333] netdevsim netdevsim6 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 376.536485][ T8333] netdevsim netdevsim6 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 376.545578][ T8333] netdevsim netdevsim6 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 376.554408][ T8333] netdevsim netdevsim6 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 376.633418][ T8333] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1129'. [ 376.684544][ T8333] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1129'. [ 376.911354][ T8347] device syzkaller0 entered promiscuous mode [ 376.950790][ T8347] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 377.003037][ T4232] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 377.080961][ T8349] netlink: 'syz.4.1134': attribute type 10 has an invalid length. [ 377.105782][ T8349] wlan1: mtu greater than device maximum [ 377.112971][ T8349] bond0: (slave wlan1): Error -22 calling dev_set_mtu [ 377.120466][ T8353] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1131'. [ 378.713660][ T8377] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1144'. [ 378.876257][ T8356] infiniband syz0: set down [ 378.892605][ T8356] infiniband syz0: added ipvlan1 [ 379.087873][ T8356] infiniband syz0: Couldn't open port 1 [ 379.686838][ T8356] RDS/IB: syz0: added [ 379.691828][ T8356] smc: adding ib device syz0 with port count 1 [ 379.708910][ T8356] smc: ib device syz0 port 1 has pnetid [ 379.976511][ T8396] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1148'. [ 380.024609][ T8396] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1148'. [ 380.326733][ T8383] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1145'. [ 381.104037][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 381.113372][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 383.312661][ T8435] loop2: detected capacity change from 0 to 4096 [ 383.495314][ T8435] ntfs3: loop2: Different NTFS' sector size (4096) and media sector size (512) [ 385.019976][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 386.366679][ T4191] ntfs3: loop2: ntfs_evict_inode r=3 failed, -22. [ 386.373336][ T4191] ntfs3: loop2: Mark volume as dirty due to NTFS errors [ 386.454788][ T4191] ntfs3: loop2: ntfs_set_state r=3 failed, -22. [ 387.939227][ T8507] smc: net device lo applied user defined pnetid SYZ0 [ 388.175251][ T5029] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 389.220417][ T5029] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 389.553419][ T8522] cgroup: No subsys list or none specified [ 390.546785][ T5029] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 391.667812][ T5029] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 391.700214][ T8543] loop4: detected capacity change from 0 to 512 [ 391.725537][ T8540] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1185'. [ 391.832551][ T8543] EXT4-fs (loop4): 1 truncate cleaned up [ 391.871690][ T8543] EXT4-fs (loop4): mounted filesystem without journal. Opts: noauto_da_alloc,,errors=continue. Quota mode: none. [ 391.902411][ T8551] loop2: detected capacity change from 0 to 512 [ 392.013677][ T8551] EXT4-fs (loop2): Cannot turn on journaled quota: type 1: error -2 [ 392.022540][ T8551] EXT4-fs error (device loop2): ext4_iget_extra_inode:4573: inode #15: comm syz.2.1188: corrupted in-inode xattr [ 392.114175][ T8551] EXT4-fs error (device loop2): ext4_orphan_get:1411: comm syz.2.1188: couldn't read orphan inode 15 (err -117) [ 392.188433][ T8551] EXT4-fs (loop2): mounted filesystem without journal. Opts: min_batch_time=0x0000000000000009,jqfmt=vfsv0,min_batch_time=0x00000000000003ff,noload,grpjquota=.,noblock_validity,resgid=0x0000000000000000,nobarrier,errors=continue,abort,,errors=continue. Quota mode: writeback. [ 393.040514][ T8560] device wlan0 entered promiscuous mode [ 394.250757][ T8575] netlink: 'syz.2.1194': attribute type 1 has an invalid length. [ 394.441677][ T8580] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1194'. [ 394.545639][ T8589] cgroup: No subsys list or none specified [ 394.745828][ T8580] bond5: (slave veth3): Enslaving as an active interface with a down link [ 395.019387][ T8575] bond5: (slave veth0_to_bond): making interface the new active one [ 395.048474][ T8575] bond5: (slave veth0_to_bond): Enslaving as an active interface with an up link [ 395.158869][ T8590] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1194'. [ 395.162874][ T8575] syz.2.1194 (8575) used greatest stack depth: 19184 bytes left [ 395.183444][ T8590] 8021q: adding VLAN 0 to HW filter on device bond5 [ 395.203366][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bond5: link becomes ready [ 395.483404][ T8601] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 396.965287][ T8629] device syzkaller0 entered promiscuous mode [ 397.797052][ T8653] netlink: 'syz.3.1213': attribute type 25 has an invalid length. [ 397.889945][ T8654] cgroup: No subsys list or none specified [ 398.365902][ T8650] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1212'. [ 398.759927][ T5029] device gretap1 left promiscuous mode [ 398.795584][ T5029] bridge1: port 1(gretap1) entered disabled state [ 398.996957][ T8648] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1212'. [ 400.898055][ T8697] tipc: Resetting bearer [ 401.187843][ T8701] device syzkaller0 entered promiscuous mode [ 401.417051][ T5029] device hsr_slave_0 left promiscuous mode [ 401.478736][ T5029] device hsr_slave_1 left promiscuous mode [ 401.534825][ T5029] device veth1_macvtap left promiscuous mode [ 401.541722][ T5029] device veth0_macvtap left promiscuous mode [ 401.582755][ T5029] device veth1_vlan left promiscuous mode [ 401.633440][ T5029] device veth0_vlan left promiscuous mode [ 402.385221][ T5029] bond1 (unregistering): (slave geneve2): Releasing active interface [ 402.440191][ T5029] bond1 (unregistering): Released all slaves [ 404.541707][ T5029] bond0 (unregistering): Released all slaves [ 404.703472][ T8724] netlink: 'syz.3.1229': attribute type 1 has an invalid length. [ 404.742772][ T8725] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1229'. [ 404.794620][ T8746] device wlan0 entered promiscuous mode [ 405.102048][ T8757] netlink: 'syz.3.1239': attribute type 1 has an invalid length. [ 405.168677][ T8757] device bond2 entered promiscuous mode [ 406.072571][ T8757] 8021q: adding VLAN 0 to HW filter on device bond2 [ 406.643030][ T8768] bond2: (slave bridge2): making interface the new active one [ 406.670421][ T8768] device bridge2 entered promiscuous mode [ 406.678874][ T8768] bond2: (slave bridge2): Enslaving as an active interface with an up link [ 406.703773][ T154] IPv6: ADDRCONF(NETDEV_CHANGE): bond2: link becomes ready [ 409.559692][ T8817] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1249'. [ 409.597829][ T8817] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 409.795661][ T8817] 8021q: adding VLAN 0 to HW filter on device team0 [ 409.833628][ T8817] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 410.357669][ T8826] netlink: 'syz.2.1251': attribute type 10 has an invalid length. [ 413.750308][ T21] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 414.278925][ T21] usb 5-1: Using ep0 maxpacket: 16 [ 414.424641][ T21] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 415.014742][ T21] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 415.026298][ T21] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 415.221399][ T21] usb 5-1: Product: syz [ 415.507053][ T21] usb 5-1: Manufacturer: syz [ 415.914581][ T21] usb 5-1: SerialNumber: syz [ 416.027593][ T21] usb 5-1: config 0 descriptor?? [ 416.104689][ T21] usb 5-1: can't set config #0, error -71 [ 416.112040][ T8914] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 416.146461][ T21] usb 5-1: USB disconnect, device number 8 [ 420.767734][ T8965] MPTCP: kernel_bind error, err=-99 [ 420.773946][ T8965] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 421.904512][ T4232] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 422.037462][ T8974] loop2: detected capacity change from 0 to 512 [ 422.234379][ T8974] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 422.304511][ T4232] usb 7-1: Using ep0 maxpacket: 16 [ 422.450429][ T4232] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 422.851716][ T8974] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c018, mo2=0002] [ 422.981904][ T8974] System zones: 1-12 [ 423.046878][ T4232] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 423.076603][ T4232] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 423.108803][ T8974] EXT4-fs (loop2): 1 truncate cleaned up [ 423.124575][ T8974] EXT4-fs (loop2): mounted filesystem without journal. Opts: max_batch_time=0x0000000000000004,max_batch_time=0x0000000000000002,debug_want_extra_isize=0x000000000000006a,mb_optimize_scan=0x0000000000000001,debug,data=journal,,errors=continue. Quota mode: none. [ 423.171293][ T4232] usb 7-1: config 0 descriptor?? [ 423.254721][ T4232] usb 7-1: can't set config #0, error -71 [ 423.304616][ T4232] usb 7-1: USB disconnect, device number 2 [ 423.340422][ T8997] device vlan0 entered promiscuous mode [ 424.695392][ T9010] device syzkaller0 entered promiscuous mode [ 424.786936][ T9015] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 424.796373][ T9015] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 424.884498][ T9015] tipc: Enabled bearer , priority 0 [ 424.925569][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 424.934876][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 425.203457][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 425.234687][ T9008] tipc: Resetting bearer [ 426.330825][ T9008] tipc: Disabling bearer [ 426.715686][ T9053] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1308'. [ 426.928798][ T9061] netlink: 'syz.6.1311': attribute type 1 has an invalid length. [ 427.004497][ T4230] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 427.056517][ T9061] device bond1 entered promiscuous mode [ 427.063541][ T9061] 8021q: adding VLAN 0 to HW filter on device bond1 [ 427.119835][ T9064] bond1: (slave bridge1): making interface the new active one [ 427.127696][ T9064] device bridge1 entered promiscuous mode [ 427.135762][ T9064] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 427.146215][ T5012] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 427.500016][ T4230] usb 5-1: config 127 has an invalid interface number: 138 but max is 0 [ 427.508605][ T4230] usb 5-1: config 127 has no interface number 0 [ 427.515352][ T4230] usb 5-1: config 127 interface 138 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 40 [ 427.525830][ T4230] usb 5-1: config 127 interface 138 altsetting 0 bulk endpoint 0xC has invalid maxpacket 1024 [ 428.053548][ T9074] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1313'. [ 428.355367][ T4230] usb 5-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice=4e.40 [ 428.774478][ T4230] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 428.782545][ T4230] usb 5-1: Product: syz [ 429.064632][ T4230] usb 5-1: Manufacturer: syz [ 429.069313][ T4230] usb 5-1: SerialNumber: syz [ 429.175758][ T9055] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 429.196473][ T9084] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1324'. [ 429.200630][ T9055] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 430.604796][ T4230] usb 5-1: probing VID:PID(0424:012C) [ 430.756512][ T4230] usb 5-1: vub300 testing BULK OUT EndPoint(0) 0F [ 430.763124][ T4230] usb 5-1: vub300 testing BULK OUT EndPoint(1) 09 [ 430.770622][ T4230] usb 5-1: vub300 testing BULK OUT EndPoint(2) 0C [ 430.777579][ T4230] usb 5-1: ignoring unexpected bulk_out endpoint [ 430.784058][ T4230] usb 5-1: Could not find two sets of bulk-in/out endpoint pairs [ 430.798178][ T4230] vub300: probe of 5-1:127.138 failed with error -22 [ 430.855951][ T4230] usb 5-1: USB disconnect, device number 9 [ 432.367215][ T9122] netlink: 209844 bytes leftover after parsing attributes in process `syz.3.1322'. [ 433.082985][ T26] audit: type=1326 audit(1785216094.182:229): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9123 comm="syz.3.1325" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f359ca2be99 code=0x7ffc0000 [ 433.205047][ T26] audit: type=1326 audit(1785216094.182:230): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9123 comm="syz.3.1325" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f359ca2be99 code=0x7ffc0000 [ 433.315810][ T26] audit: type=1326 audit(1785216094.242:231): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9123 comm="syz.3.1325" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=281 compat=0 ip=0x7f359ca2be99 code=0x7ffc0000 [ 433.525754][ T26] audit: type=1326 audit(1785216094.242:232): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9123 comm="syz.3.1325" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f359ca2be99 code=0x7ffc0000 [ 434.305558][ T26] audit: type=1326 audit(1785216094.242:233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9123 comm="syz.3.1325" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f359ca2be99 code=0x7ffc0000 [ 434.446226][ T9139] tipc: Started in network mode [ 434.451364][ T26] audit: type=1326 audit(1785216094.242:234): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9123 comm="syz.3.1325" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f359ca2be99 code=0x7ffc0000 [ 434.565568][ T9139] tipc: Node identity 84e, cluster identity 4711 [ 434.571977][ T9139] tipc: Node number set to 2126 [ 434.656639][ T26] audit: type=1326 audit(1785216094.242:235): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9123 comm="syz.3.1325" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f359ca2be99 code=0x7ffc0000 [ 434.687144][ T9152] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 434.715878][ T26] audit: type=1326 audit(1785216094.242:236): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9123 comm="syz.3.1325" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f359ca2be99 code=0x7ffc0000 [ 434.749019][ T9152] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 434.762702][ T26] audit: type=1326 audit(1785216094.242:237): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9123 comm="syz.3.1325" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f359ca2be99 code=0x7ffc0000 [ 434.850984][ T9152] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 434.878830][ T26] audit: type=1326 audit(1785216094.242:238): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9123 comm="syz.3.1325" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f359ca2be99 code=0x7ffc0000 [ 435.083005][ T9152] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 435.902874][ T9152] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 435.971317][ T9152] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 435.998178][ T9152] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 436.161554][ T9170] 9pnet_virtio: no channels available for device syz [ 438.175465][ T9198] siw: device registration error -23 [ 438.189321][ T9204] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1346'. [ 438.323087][ T9208] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 440.760346][ T9247] netlink: 'syz.0.1355': attribute type 10 has an invalid length. [ 443.126205][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 443.133953][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 443.554525][ T9271] netlink: 'syz.0.1358': attribute type 1 has an invalid length. [ 443.740210][ T9271] device bond1 entered promiscuous mode [ 443.778604][ T9271] 8021q: adding VLAN 0 to HW filter on device bond1 [ 444.519028][ T9279] bond1: (slave bridge2): making interface the new active one [ 444.569193][ T9279] device bridge2 entered promiscuous mode [ 444.576833][ T9279] bond1: (slave bridge2): Enslaving as an active interface with an up link [ 444.594840][ T5024] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 445.774371][ T4232] Bluetooth: hci1: command 0x0406 tx timeout [ 447.033793][ T9320] tipc: Started in network mode [ 447.124684][ T9320] tipc: Node identity 080211000001, cluster identity 4711 [ 447.207082][ T9320] tipc: Enabled bearer , priority 0 [ 449.202361][ T4268] tipc: Node number set to 134418688 [ 452.931498][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 453.198376][ T9383] netlink: 14 bytes leftover after parsing attributes in process `syz.4.1386'. [ 453.320877][ T9388] loop2: detected capacity change from 0 to 512 [ 453.431757][ T9388] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 453.562855][ T9383] bond0 (unregistering): Released all slaves [ 453.580973][ T9390] tipc: Enabling of bearer rejected, already enabled [ 453.590519][ T9388] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.1387: invalid indirect mapped block 9 (level 0) [ 453.647612][ T9388] EXT4-fs (loop2): 1 truncate cleaned up [ 453.653626][ T9388] EXT4-fs (loop2): mounted filesystem without journal. Opts: init_itable,inode_readahead_blks=0x0000000008000000,nodiscard,,errors=continue. Quota mode: none. [ 454.524693][ T4282] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 455.184541][ T4282] usb 5-1: Using ep0 maxpacket: 16 [ 456.138881][ T4282] usb 5-1: config 0 interface 0 altsetting 254 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 456.188577][ T4282] usb 5-1: config 0 interface 0 has no altsetting 0 [ 456.214483][ T4282] usb 5-1: New USB device found, idVendor=05ac, idProduct=0269, bcdDevice= 0.00 [ 456.257860][ T4282] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 456.268365][ T9427] netlink: 240 bytes leftover after parsing attributes in process `syz.2.1394'. [ 456.292713][ T4282] usb 5-1: config 0 descriptor?? [ 457.606285][ T4282] usbhid 5-1:0.0: can't add hid device: -71 [ 457.612359][ T4282] usbhid: probe of 5-1:0.0 failed with error -71 [ 457.645729][ T4282] usb 5-1: USB disconnect, device number 10 [ 462.452280][ T9494] loop4: detected capacity change from 0 to 4096 [ 462.780362][ T9494] EXT4-fs (loop4): mounted filesystem without journal. Opts: grpquota,,errors=continue. Quota mode: writeback. [ 465.891858][ T9560] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1427'. [ 466.310183][ T9565] bond2: (slave veth3): Enslaving as an active interface with an up link [ 466.369992][ T9560] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1427'. [ 466.457232][ T9560] 8021q: adding VLAN 0 to HW filter on device bond2 [ 466.566042][ T9583] 9pnet: p9_errstr2errno: server reported unknown error 1844674407 [ 472.650027][ T9664] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1459'. [ 474.724992][ T9693] netlink: 'syz.6.1465': attribute type 12 has an invalid length. [ 474.755145][ T9693] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1465'. [ 476.554863][ T9722] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1460'. [ 476.691835][ T9724] bond2: (slave veth5): Enslaving as an active interface with an up link [ 476.859801][ T9722] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1460'. [ 476.882448][ T9722] 8021q: adding VLAN 0 to HW filter on device bond2 [ 479.469202][ T9754] ecryptfs_parse_options: eCryptfs: unrecognized option [³] [ 479.476838][ T9754] ecryptfs_parse_options: eCryptfs: unrecognized option [z\)] [ 479.484599][ T9754] ecryptfs_parse_options: You must supply at least one valid auth tok signature as a mount parameter; see the eCryptfs README [ 479.500789][ T9754] Error parsing options; rc = [-22] [ 480.682529][ T9757] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1468'. [ 480.987576][ T9760] hugetlbfs: syz.4.1471 (9760): Using mlock ulimits for SHM_HUGETLB is deprecated [ 482.365208][ T9783] device ipip0 entered promiscuous mode [ 483.925422][ T9796] cgroup: Invalid name [ 484.932148][ T9812] device hsr0 entered promiscuous mode [ 485.035572][ T9812] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1486'. [ 489.843155][ T9868] cgroup: Invalid name [ 492.787946][ T9906] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 494.245906][ T9929] cgroup: Invalid name [ 497.145912][ T9949] sch_tbf: burst 19872 is lower than device lo mtu (11337746) ! [ 498.404086][ T9962] netlink: 76 bytes leftover after parsing attributes in process `syz.0.1525'. [ 500.162960][ T9978] loop6: detected capacity change from 0 to 512 [ 501.138215][ T9978] EXT4-fs (loop6): Ignoring removed bh option [ 501.226640][ T9978] EXT4-fs warning (device loop6): dx_probe:878: Directory (ino: 2) htree depth 0x0002 exceedsupported value [ 501.276510][ T9993] device hsr0 entered promiscuous mode [ 501.292984][ T9978] EXT4-fs warning (device loop6): dx_probe:881: Enable large directory feature to access it [ 501.377579][ T9978] EXT4-fs warning (device loop6): dx_probe:966: inode #2: comm syz.6.1529: Corrupt directory, running e2fsck is recommended [ 501.450805][ T9993] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1531'. [ 501.554000][ T9978] EXT4-fs (loop6): Cannot turn on journaled quota: type 1: error -117 [ 501.564681][ T9993] device hsr_slave_0 left promiscuous mode [ 501.592457][ T9978] EXT4-fs error (device loop6): ext4_iget_extra_inode:4573: inode #15: comm syz.6.1529: corrupted in-inode xattr [ 502.252089][ T9999] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 502.284931][ T9978] EXT4-fs error (device loop6): ext4_orphan_get:1411: comm syz.6.1529: couldn't read orphan inode 15 (err -117) [ 502.345428][ T9978] EXT4-fs (loop6): mounted filesystem without journal. Opts: dioread_lock,noblock_validity,commit=0x0000000000000000,jqfmt=vfsold,nolazytime,grpjquota=.nouid32,resuid=0x0000000000000000,bh,grpid,,,errors=continue. Quota mode: writeback. [ 503.594647][T10011] netlink: 76 bytes leftover after parsing attributes in process `syz.4.1538'. [ 503.894804][T10023] af_packet: tpacket_rcv: packet too big, clamped from 28 to 4294967272. macoff=96 [ 503.977133][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 503.983545][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 505.125937][T10044] loop6: detected capacity change from 0 to 512 [ 505.284544][ T4229] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 505.354031][T10048] xt_hashlimit: max too large, truncated to 1048576 [ 505.470383][T10050] loop4: detected capacity change from 0 to 32768 [ 505.517682][T10044] EXT4-fs (loop6): mounted filesystem without journal. Opts: errors=remount-ro,grpquota,. Quota mode: writeback. [ 505.606138][T10050] BTRFS info (device loop4): using crc32c (crc32c-intel) checksum algorithm [ 505.610923][T10044] ext4 filesystem being mounted at /109/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 505.616576][T10050] BTRFS info (device loop4): turning on sync discard [ 505.633014][T10050] BTRFS info (device loop4): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 505.643645][T10050] BTRFS info (device loop4): use zstd compression, level 3 [ 505.651771][T10050] BTRFS info (device loop4): turning on async discard [ 505.659235][T10050] BTRFS warning (device loop4): 'usebackuproot' is deprecated, use 'rescue=usebackuproot' instead [ 505.669967][T10050] BTRFS info (device loop4): trying to use backup root at mount time [ 505.678478][T10050] BTRFS info (device loop4): enabling auto defrag [ 505.685117][T10050] BTRFS info (device loop4): using free space tree [ 505.691676][T10050] BTRFS info (device loop4): has skinny extents [ 505.737266][ T4229] usb 3-1: Using ep0 maxpacket: 16 [ 505.800442][ T154] BTRFS warning (device loop4): checksum verify failed on 5337088 wanted 0xe63dbdda found 0xc926492d level 0 [ 505.833315][T10050] BTRFS warning (device loop4): failed to read root (objectid=2): -5 [ 505.843754][ T5029] BTRFS warning (device loop4): checksum verify failed on 5324800 wanted 0x9f73850b found 0x80379423 level 0 [ 505.861162][T10050] BTRFS warning (device loop4): couldn't read tree root [ 505.869704][T10050] BTRFS error (device loop4): parent transid verify failed on 5255168 wanted 5 found 7 [ 505.880187][T10050] BTRFS warning (device loop4): couldn't read tree root [ 505.888652][ T4229] usb 3-1: config 0 has an invalid interface number: 133 but max is 0 [ 505.912916][T10050] BTRFS info (device loop4): enabling ssd optimizations [ 505.921014][T10050] BTRFS info (device loop4): clearing free space tree [ 505.929299][T10050] BTRFS info (device loop4): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 505.940294][T10050] BTRFS info (device loop4): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 505.970947][ T4229] usb 3-1: config 0 has no interface number 0 [ 505.977208][ T4229] usb 3-1: config 0 interface 133 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 506.033312][T10050] BTRFS info (device loop4): creating free space tree [ 506.045717][T10050] BTRFS info (device loop4): setting compat-ro feature flag for FREE_SPACE_TREE (0x1) [ 506.055393][T10050] BTRFS info (device loop4): setting compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2) [ 506.154979][ T4229] usb 3-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 506.177919][ T4229] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 506.305606][ T4229] usb 3-1: Product: syz [ 506.309858][ T4229] usb 3-1: Manufacturer: syz [ 506.460867][T10083] autofs4:pid:10083:autofs_fill_super: called with bogus options [ 506.983484][ T4229] usb 3-1: SerialNumber: syz [ 507.000181][ T4229] usb 3-1: config 0 descriptor?? [ 507.138770][T10041] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 507.149726][T10090] netlink: 14 bytes leftover after parsing attributes in process `syz.3.1555'. [ 507.200798][T10089] netlink: 76 bytes leftover after parsing attributes in process `syz.6.1554'. [ 507.226230][T10089] device syzkaller0 entered promiscuous mode [ 507.457366][ T4229] keyspan 3-1:0.133: Keyspan 1 port adapter converter detected [ 507.489294][ T4229] keyspan 3-1:0.133: found no endpoint descriptor for endpoint 81 [ 507.508835][ T4229] keyspan 3-1:0.133: found no endpoint descriptor for endpoint 1 [ 507.520327][ T4229] keyspan 3-1:0.133: found no endpoint descriptor for endpoint 2 [ 507.789947][ T4229] usb 3-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 508.445429][ T4229] usb 3-1: USB disconnect, device number 10 [ 508.470580][ T4229] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 508.496823][ T4229] keyspan 3-1:0.133: device disconnected [ 508.692610][T10102] tipc: Started in network mode [ 508.701087][T10102] tipc: Node identity 080211000001, cluster identity 4711 [ 508.709533][T10102] tipc: Enabled bearer , priority 0 [ 508.792559][T10111] overlayfs: failed to clone upperpath [ 511.449499][ T4282] tipc: Node number set to 134418688 [ 511.572066][T10143] loop4: detected capacity change from 0 to 64 [ 511.665370][T10134] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 511.798742][ T4185] hfs: node 4:3 still has 1 user(s)! [ 512.914863][T10134] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 513.070669][T10158] tipc: Enabled bearer , priority 0 [ 513.081001][T10134] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 513.101540][T10134] usb 7-1: New USB device found, idVendor=04b4, idProduct=07b1, bcdDevice= 0.00 [ 513.121801][T10134] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 513.160580][T10134] usb 7-1: config 0 descriptor?? [ 514.384630][T10134] usbhid 7-1:0.0: can't add hid device: -71 [ 514.391038][T10134] usbhid: probe of 7-1:0.0 failed with error -71 [ 515.415516][T10134] usb 7-1: USB disconnect, device number 3 [ 516.296524][T10172] syz.6.1576 (10172) used greatest stack depth: 17232 bytes left [ 516.421653][T10193] tipc: Enabling of bearer rejected, already enabled [ 516.464542][T10129] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 518.620097][T10212] overlayfs: failed to clone lowerpath [ 519.464589][T10129] usb 3-1: unable to read config index 0 descriptor/all [ 519.477066][T10129] usb 3-1: can't read configurations, error -71 [ 521.403479][T10253] netlink: 'syz.4.1603': attribute type 1 has an invalid length. [ 521.833476][T10264] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 524.079509][T10292] xt_TPROXY: Can be used only with -p tcp or -p udp [ 525.052351][T10298] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1614'. [ 525.090723][T10273] tipc: Failed to remove unknown binding: 66,0,0/134418688:3112917726/3112917728 [ 525.115168][T10273] tipc: Failed to remove unknown binding: 66,0,0/134418688:3112917726/3112917727 [ 525.158224][T10293] tipc: Failed to remove unknown binding: 66,0,0/134418688:3112917726/3112917728 [ 525.230771][T10293] tipc: Failed to remove unknown binding: 66,0,0/134418688:3112917726/3112917727 [ 525.263813][T10307] xt_hashlimit: max too large, truncated to 1048576 [ 528.114771][ T21] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 528.269719][T10334] netlink: 24 bytes leftover after parsing attributes in process `syz.6.1626'. [ 528.364515][ T21] usb 3-1: Using ep0 maxpacket: 32 [ 528.484691][ T21] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 528.529119][ T21] usb 3-1: New USB device found, idVendor=17ef, idProduct=6062, bcdDevice= 0.00 [ 528.560791][ T21] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 528.605475][ T21] usb 3-1: config 0 descriptor?? [ 528.647280][ T21] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 528.784438][ T26] kauditd_printk_skb: 16 callbacks suppressed [ 528.784459][ T26] audit: type=1326 audit(1785216189.882:255): auid=4294967295 uid=255 gid=0 ses=4294967295 subj=unconfined pid=10345 comm="syz.3.1630" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f359ca2be99 code=0x0 [ 529.045254][T10352] overlayfs: failed to clone lowerpath [ 529.487128][ T155] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 530.893913][ T13] usb 3-1: USB disconnect, device number 13 [ 531.229102][T10377] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1650'. [ 539.718427][T10435] CIFS mount error: No usable UNC path provided in device string! [ 539.718427][T10435] [ 539.744789][T10435] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 540.399314][T10432] loop4: detected capacity change from 0 to 8 [ 540.950903][T10432] squashfs image failed sanity check [ 541.092506][T10432] loop4: detected capacity change from 0 to 512 [ 541.121067][T10432] EXT4-fs (loop4): Ignoring removed nomblk_io_submit option [ 541.148695][T10432] EXT4-fs (loop4): Ignoring removed mblk_io_submit option [ 541.220729][T10432] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -2 [ 541.409319][T10432] EXT4-fs (loop4): Cannot turn on journaled quota: type 1: error -2 [ 541.494859][T10432] EXT4-fs (loop4): 1 truncate cleaned up [ 541.500575][T10432] EXT4-fs (loop4): mounted filesystem without journal. Opts: nomblk_io_submit,usrjquota="errors=continue,noload,mblk_io_submit,grpjquota="errors=continue,errors=remount-ro,jqfmt=vfsv1,. Quota mode: writeback. [ 541.669912][T10432] EXT4-fs (loop4): Remounting file system with no journal so ignoring journalled data option [ 541.680341][T10432] EXT4-fs (loop4): group quota file already specified [ 541.694937][T10432] EXT4-fs (loop4): re-mounted. Opts: . Quota mode: writeback. [ 541.881945][T10456] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1661'. [ 542.067091][T10458] device erspan0 left promiscuous mode [ 543.233238][T10458] bridge3: port 1(erspan0) entered disabled state [ 543.270065][T10470] netlink: 'syz.6.1663': attribute type 11 has an invalid length. [ 543.313540][T10458] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 543.678667][T10458] bond0: (slave dummy0): Releasing backup interface [ 543.858811][T10458] device dummy0 left promiscuous mode [ 544.306763][T10480] loop4: detected capacity change from 0 to 512 [ 544.313777][T10458] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 544.332007][T10458] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 544.361788][T10458] device bridge_slave_0 left promiscuous mode [ 544.409964][T10480] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 544.428766][T10458] bridge0: port 1(bridge_slave_0) entered disabled state [ 544.447364][T10458] device bridge_slave_1 left promiscuous mode [ 544.454789][T10480] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=c802e02c, mo2=0002] [ 544.478683][T10480] EXT4-fs (loop4): orphan cleanup on readonly fs [ 544.485409][T10458] bridge0: port 2(bridge_slave_1) entered disabled state [ 544.495201][T10480] EXT4-fs error (device loop4): ext4_orphan_get:1432: comm syz.4.1666: bad orphan inode 267 [ 544.527621][T10480] EXT4-fs (loop4): Remounting filesystem read-only [ 544.542141][T10458] bond5: (slave veth0_to_bond): Releasing active interface [ 544.563843][T10480] EXT4-fs (loop4): mounted filesystem without journal. Opts: nojournal_checksum,noblock_validity,discard,errors=remount-ro,inode_readahead_blks=0x0000000001000000. Quota mode: none. [ 544.600030][T10458] bond0: (slave bond_slave_0): Releasing backup interface [ 544.617395][T10480] ip6t_srh: unknown srh invflags 4000 [ 544.623677][T10458] device bond_slave_0 left promiscuous mode [ 544.650799][T10458] bond0: (slave bond_slave_1): Releasing backup interface [ 544.660097][T10458] device bond_slave_1 left promiscuous mode [ 544.741275][T10490] EXT4-fs warning (device loop4): dx_probe:893: inode #2: comm syz.4.1666: dx entry: limit 0 != root limit 125 [ 544.784747][T10490] EXT4-fs warning (device loop4): dx_probe:966: inode #2: comm syz.4.1666: Corrupt directory, running e2fsck is recommended [ 544.807784][T10458] team0: Port device team_slave_1 removed [ 544.818953][T10458] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 544.832028][T10458] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 544.842046][T10458] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 544.851297][T10458] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 544.872726][T10458] bond0: (slave wlan1): Releasing backup interface [ 544.908625][T10458] device wlan1 left promiscuous mode [ 544.952070][T10458] bond1: (slave macvlan2): Releasing active interface [ 544.973871][T10458] bond2: (slave bond3): Releasing backup interface [ 544.980996][T10458] bond2: (slave bond3): the permanent HWaddr of slave - 76:91:a9:17:5a:e2 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts [ 545.029880][T10458] bond2: (slave gretap1): making interface the new active one [ 545.057265][T10458] bond2: (slave gretap1): Releasing backup interface [ 545.072008][T10458] bond4: (slave vlan2): Releasing active interface [ 545.088704][T10458] bond5: (slave veth3): Releasing active interface [ 547.321071][ T26] audit: type=1326 audit(1785216208.422:256): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10519 comm="syz.6.1679" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc89a00ce99 code=0x7ffc0000 [ 547.364017][T10522] loop2: detected capacity change from 0 to 7 [ 547.623423][ T26] audit: type=1326 audit(1785216208.452:257): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10519 comm="syz.6.1679" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=428 compat=0 ip=0x7fc89a00ce99 code=0x7ffc0000 [ 547.651140][ T4179] loop2: [ 547.695913][ T4179] loop2: partition table partially beyond EOD, truncated [ 547.785670][ T26] audit: type=1326 audit(1785216208.452:258): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10519 comm="syz.6.1679" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc89a00ce99 code=0x7ffc0000 [ 547.790720][T10522] loop2: [ 547.811796][ T26] audit: type=1326 audit(1785216208.462:259): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10519 comm="syz.6.1679" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc89a00ce99 code=0x7ffc0000 [ 547.837631][ T26] audit: type=1326 audit(1785216208.562:260): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10519 comm="syz.6.1679" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fc89a00ce99 code=0x7ffc0000 [ 547.865198][ T26] audit: type=1326 audit(1785216208.572:261): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10519 comm="syz.6.1679" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc89a00ce99 code=0x7ffc0000 [ 547.891514][ T26] audit: type=1326 audit(1785216208.592:262): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10519 comm="syz.6.1679" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc89a00ce99 code=0x7ffc0000 [ 547.940418][T10522] loop2: partition table partially beyond EOD, truncated [ 549.085752][T10551] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1686'. [ 549.142808][T10551] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1686'. [ 550.714023][T10572] netlink: 'syz.2.1693': attribute type 1 has an invalid length. [ 550.744636][T10572] device bond6 entered promiscuous mode [ 550.750665][T10572] 8021q: adding VLAN 0 to HW filter on device bond6 [ 550.761205][T10570] sctp: [Deprecated]: syz.6.1692 (pid 10570) Use of struct sctp_assoc_value in delayed_ack socket option. [ 550.761205][T10570] Use struct sctp_sack_info instead [ 550.789980][T10572] bond6: (slave erspan1): making interface the new active one [ 550.797612][T10572] device erspan1 entered promiscuous mode [ 550.810921][T10572] bond6: (slave erspan1): Enslaving as an active interface with an up link [ 550.820863][ T5029] IPv6: ADDRCONF(NETDEV_CHANGE): bond6: link becomes ready [ 550.892394][T10570] sctp: [Deprecated]: syz.6.1692 (pid 10570) Use of struct sctp_assoc_value in delayed_ack socket option. [ 550.892394][T10570] Use struct sctp_sack_info instead [ 550.921296][T10575] CIFS mount error: No usable UNC path provided in device string! [ 550.921296][T10575] [ 550.947161][T10575] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 553.031853][T10599] netlink: 56 bytes leftover after parsing attributes in process `syz.6.1703'. [ 553.100634][T10603] loop6: detected capacity change from 0 to 16 [ 553.178613][T10603] erofs: (device loop6): mounted with root inode @ nid 36. [ 553.206215][ T7] kernel write not supported for file /464/net/ip6_tables_matches (pid: 7 comm: kworker/0:0) [ 554.143807][ C1] vxcan1: j1939_tp_rxtimer: 0xffff8880241e7800: rx timeout, send abort [ 555.093650][ C1] vxcan1: j1939_tp_rxtimer: 0xffff8880241e7800: abort rx timeout. Force session deactivation [ 555.112343][ T26] audit: type=1800 audit(1785216216.192:263): pid=10603 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.1703" name="file2" dev="loop6" ino=89 res=0 errno=0 [ 555.324749][T10621] device syzkaller0 entered promiscuous mode [ 556.839368][T10646] No source specified [ 559.267296][T10669] loop6: detected capacity change from 0 to 40427 [ 559.431943][T10669] F2FS-fs (loop6): Invalid log_blocksize (268), supports only 12 [ 559.440412][T10669] F2FS-fs (loop6): Can't find valid F2FS filesystem in 1th superblock [ 559.648628][T10669] F2FS-fs (loop6): Found nat_bits in checkpoint [ 559.782556][T10669] F2FS-fs (loop6): Try to recover 1th superblock, ret: 0 [ 559.790491][T10669] F2FS-fs (loop6): Mounted with checkpoint version = 48b305e5 [ 560.016885][T10669] attempt to access beyond end of device [ 560.016885][T10669] loop6: rw=2049, want=78408, limit=40427 [ 560.037578][T10677] attempt to access beyond end of device [ 560.037578][T10677] loop6: rw=2049, want=79272, limit=40427 [ 560.707079][ T4284] attempt to access beyond end of device [ 560.707079][ T4284] loop6: rw=1, want=45104, limit=40427 [ 562.106029][T10693] netlink: 276 bytes leftover after parsing attributes in process `syz.0.1726'. [ 562.265568][T10695] tipc: Enabling of bearer rejected, failed to enable media [ 562.513525][T10703] set match dimension is over the limit! [ 563.750611][T10723] ipt_REJECT: TCP_RESET invalid for non-tcp [ 564.717835][T10727] tipc: Resetting bearer [ 564.784245][T10727] tipc: Resetting bearer [ 565.510047][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 565.531155][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 566.464870][T10756] netlink: 276 bytes leftover after parsing attributes in process `syz.6.1746'. [ 566.551626][T10763] set match dimension is over the limit! [ 566.670036][T10762] device ip6_vti0 entered promiscuous mode [ 566.819209][T10762] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1748'. [ 567.017602][T10756] tipc: Enabling of bearer rejected, failed to enable media [ 567.465374][T10771] device syzkaller0 entered promiscuous mode [ 567.487033][T10769] device syzkaller0 entered promiscuous mode [ 568.601108][T10791] tipc: Enabling of bearer rejected, already enabled [ 572.273462][T10845] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 574.843476][T10883] netlink: 79 bytes leftover after parsing attributes in process `syz.4.1783'. [ 574.920814][T10883] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1783'. [ 574.950617][T10883] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1783'. [ 574.963704][T10883] netlink: 'syz.4.1783': attribute type 11 has an invalid length. [ 577.014652][T10897] device syzkaller0 entered promiscuous mode [ 581.821682][T10956] tipc: Enabling of bearer rejected, already enabled [ 581.890566][T10939] ceph: No mds server is up or the cluster is laggy [ 583.236764][T10967] IPVS: Error connecting to the multicast addr [ 585.899832][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 585.989838][T10990] loop6: detected capacity change from 0 to 128 [ 586.144979][T10990] UDF-fs: error (device loop6): udf_read_tagged: read failed, block=256, location=256 [ 587.655962][T11027] fuse: Bad value for 'fd' [ 590.509605][T11046] loop4: detected capacity change from 0 to 40427 [ 591.084498][T11046] F2FS-fs (loop4): Invalid log_blocksize (268), supports only 12 [ 591.092375][T11046] F2FS-fs (loop4): Can't find valid F2FS filesystem in 1th superblock [ 591.347467][T11046] F2FS-fs (loop4): Found nat_bits in checkpoint [ 591.479246][T11046] F2FS-fs (loop4): Try to recover 1th superblock, ret: 0 [ 591.486571][T11046] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5 [ 591.816893][T11046] attempt to access beyond end of device [ 591.816893][T11046] loop4: rw=2049, want=78728, limit=40427 [ 591.846745][T11062] attempt to access beyond end of device [ 591.846745][T11062] loop4: rw=2049, want=80856, limit=40427 [ 592.150307][ T9] attempt to access beyond end of device [ 592.150307][ T9] loop4: rw=1, want=45104, limit=40427 [ 594.240010][T11081] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1835'. [ 594.250995][T11081] siw: device registration error -23 [ 594.574968][T11088] program syz.2.1839 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 594.649829][T11089] device vlan0 entered promiscuous mode [ 597.538511][T11112] loop2: detected capacity change from 0 to 40427 [ 598.019934][T11122] loop6: detected capacity change from 0 to 2048 [ 598.084992][T11112] F2FS-fs (loop2): Invalid log_blocksize (268), supports only 12 [ 598.092815][T11112] F2FS-fs (loop2): Can't find valid F2FS filesystem in 1th superblock [ 598.166900][T11112] F2FS-fs (loop2): Found nat_bits in checkpoint [ 598.251831][T11122] EXT4-fs (loop6): mounted filesystem without journal. Opts: delalloc,noload,acl,mb_optimize_scan=0x0000000000000001,,errors=continue. Quota mode: none. [ 598.272019][T11112] F2FS-fs (loop2): Try to recover 1th superblock, ret: 0 [ 598.279249][T11112] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e5 [ 598.584130][T11137] attempt to access beyond end of device [ 598.584130][T11137] loop2: rw=2049, want=80328, limit=40427 [ 598.616117][T11137] attempt to access beyond end of device [ 598.616117][T11137] loop2: rw=2049, want=81920, limit=40427 [ 598.658906][T11137] attempt to access beyond end of device [ 598.658906][T11137] loop2: rw=2049, want=53240, limit=40427 [ 598.675344][T11137] attempt to access beyond end of device [ 598.675344][T11137] loop2: rw=2049, want=53248, limit=40427 [ 598.719863][T11137] attempt to access beyond end of device [ 598.719863][T11137] loop2: rw=2049, want=62168, limit=40427 [ 600.829806][ T7526] EXT4-fs error (device loop6): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 600.967875][ T4284] attempt to access beyond end of device [ 600.967875][ T4284] loop2: rw=1, want=77928, limit=40427 [ 605.882005][T11178] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1852'. [ 605.956114][T11178] device dummy0 entered promiscuous mode [ 605.983805][T11178] device macvtap2 entered promiscuous mode [ 609.604028][T11245] tipc: Enabling of bearer rejected, already enabled [ 609.630063][T11245] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 612.224735][T11287] UBIFS error (pid: 11287): cannot open "./file0", error -22 [ 615.142822][T11324] tipc: Enabling of bearer rejected, already enabled [ 615.167449][T11324] sch_tbf: burst 255 is lower than device syzkaller0 mtu (1514) ! [ 615.330974][ T1110] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 616.368494][T11344] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1906'. [ 617.999183][T11365] device syzkaller0 entered promiscuous mode [ 618.540805][ T1110] usb 5-1: device not accepting address 11, error -71 [ 619.585786][T11387] blk_update_request: I/O error, dev loop1, sector 2 op 0x0:(READ) flags 0x800 phys_seg 1 prio class 0 [ 619.598159][T11387] hfsplus: unable to find HFS+ superblock [ 621.293265][T11411] hub 1-0:1.0: USB hub found [ 621.304583][T11411] hub 1-0:1.0: 1 port detected [ 622.495540][T11419] gfs2: gfs2 mount does not exist [ 622.924725][T11427] loop6: detected capacity change from 0 to 1764 [ 624.935950][T11449] device syzkaller0 entered promiscuous mode [ 626.860502][ T1422] ieee802154 phy0 wpan0: encryption failed: -22 [ 626.868811][ T1422] ieee802154 phy1 wpan1: encryption failed: -22 [ 628.209680][T11491] loop4: detected capacity change from 0 to 512 [ 628.236510][T11494] netlink: 'syz.2.1949': attribute type 1 has an invalid length. [ 628.273225][T11494] 8021q: adding VLAN 0 to HW filter on device bond7 [ 628.388545][T11494] bond7: (slave veth7): Enslaving as an active interface with a down link [ 628.419598][T11494] device bond7 entered promiscuous mode [ 628.429692][T11491] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 628.747969][T11491] EXT4-fs (loop4): 1 truncate cleaned up [ 628.753758][T11491] EXT4-fs (loop4): mounted filesystem without journal. Opts: debug_want_extra_isize=0x000000000000002e,min_batch_time=0x0000000000000fff,jqfmt=vfsv0,stripe=0x0000000000004000,errors=remount-ro,max_batch_time=0x0000000000000004,. Quota mode: none. [ 629.245183][T11496] device macvlan3 entered promiscuous mode [ 629.252747][T11496] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 636.552364][T11572] device syzkaller0 entered promiscuous mode [ 640.116096][T11604] netlink: 292 bytes leftover after parsing attributes in process `syz.6.1975'. [ 641.259761][T11614] ================================================================== [ 641.268476][T11614] BUG: KASAN: slab-out-of-bounds in ieee80211_monitor_select_queue+0x23a/0x240 [ 641.277614][T11614] Read of size 2 at addr ffff8880249a6dfb by task syz.2.1979/11614 [ 641.285600][T11614] [ 641.288035][T11614] CPU: 1 PID: 11614 Comm: syz.2.1979 Not tainted syzkaller #0 [ 641.295536][T11614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 641.305643][T11614] Call Trace: [ 641.308989][T11614] [ 641.311937][T11614] dump_stack_lvl+0x188/0x250 [ 641.316676][T11614] ? show_regs_print_info+0x20/0x20 [ 641.321931][T11614] ? _printk+0xda/0x130 [ 641.326233][T11614] ? ieee80211_monitor_select_queue+0x23a/0x240 [ 641.332514][T11614] ? load_image+0x410/0x410 [ 641.337040][T11614] print_address_description+0x60/0x2d0 [ 641.342604][T11614] ? ieee80211_monitor_select_queue+0x23a/0x240 [ 641.348858][T11614] kasan_report+0xdf/0x130 [ 641.353425][T11614] ? ieee80211_monitor_select_queue+0x23a/0x240 [ 641.359692][T11614] ieee80211_monitor_select_queue+0x23a/0x240 [ 641.365768][T11614] ? ieee80211_recalc_smps_work+0x20/0x20 [ 641.371510][T11614] netdev_core_pick_tx+0x12c/0x300 [ 641.376761][T11614] __dev_queue_xmit+0x797/0x2e50 [ 641.381731][T11614] ? __might_sleep+0xf0/0xf0 [ 641.386439][T11614] ? dev_queue_xmit+0x20/0x20 [ 641.391136][T11614] ? virtio_net_hdr_to_skb+0xb00/0x11e0 [ 641.396791][T11614] ? packet_cached_dev_get+0x270/0x270 [ 641.402285][T11614] packet_sendmsg+0x3cf9/0x50b0 [ 641.407178][T11614] ? place_entity+0x4f0/0x4f0 [ 641.411863][T11614] ? __might_sleep+0xf0/0xf0 [ 641.416492][T11614] ? aa_sk_perm+0x7dc/0x910 [ 641.421114][T11614] ? packet_getsockopt+0x9a0/0x9a0 [ 641.426236][T11614] ? unpack_trans_table+0xb76/0x1690 [ 641.431545][T11614] ? apparmor_socket_sendmsg+0x88/0x230 [ 641.437104][T11614] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 641.442532][T11614] ? security_socket_sendmsg+0x7c/0xa0 [ 641.448078][T11614] ? packet_getsockopt+0x9a0/0x9a0 [ 641.453215][T11614] ____sys_sendmsg+0x5be/0x8f0 [ 641.458064][T11614] ? __sys_sendmsg_sock+0x30/0x30 [ 641.463151][T11614] ? import_iovec+0x6f/0xa0 [ 641.467680][T11614] ___sys_sendmsg+0x236/0x2e0 [ 641.472392][T11614] ? __sys_sendmsg+0x290/0x290 [ 641.477200][T11614] __se_sys_sendmsg+0x1b7/0x2a0 [ 641.482095][T11614] ? __x64_sys_sendmsg+0x80/0x80 [ 641.487064][T11614] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 641.493066][T11614] ? lockdep_hardirqs_on+0x94/0x140 [ 641.498297][T11614] do_syscall_64+0x4c/0xa0 [ 641.502737][T11614] ? clear_bhb_loop+0x30/0x80 [ 641.507420][T11614] ? clear_bhb_loop+0x30/0x80 [ 641.512108][T11614] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 641.518011][T11614] RIP: 0033:0x7fd739779e99 [ 641.522438][T11614] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 641.542065][T11614] RSP: 002b:00007fd7379d2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 641.550495][T11614] RAX: ffffffffffffffda RBX: 00007fd739a01fa0 RCX: 00007fd739779e99 [ 641.558478][T11614] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 641.566465][T11614] RBP: 00007fd73980feaf R08: 0000000000000000 R09: 0000000000000000 [ 641.574469][T11614] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 641.582446][T11614] R13: 00007fd739a02038 R14: 00007fd739a01fa0 R15: 00007ffdc59cd068 [ 641.590438][T11614] [ 641.593461][T11614] [ 641.595786][T11614] Allocated by task 4199: [ 641.600134][T11614] __kasan_kmalloc+0xaf/0xe0 [ 641.604731][T11614] kvmalloc_node+0x84/0x130 [ 641.609321][T11614] pfifo_fast_init+0x234/0x6a0 [ 641.614118][T11614] qdisc_create_dflt+0x11a/0x410 [ 641.619059][T11614] mq_init+0x2c4/0x650 [ 641.623133][T11614] qdisc_create_dflt+0x11a/0x410 [ 641.628071][T11614] dev_activate+0x192/0x1330 [ 641.632658][T11614] __dev_open+0x33b/0x430 [ 641.636993][T11614] __dev_change_flags+0x1e4/0x6a0 [ 641.642028][T11614] dev_change_flags+0x78/0x1a0 [ 641.646817][T11614] devinet_ioctl+0x810/0x1ba0 [ 641.651620][T11614] inet_ioctl+0x2fa/0x460 [ 641.655971][T11614] sock_do_ioctl+0xfb/0x320 [ 641.660488][T11614] sock_ioctl+0x48a/0x700 [ 641.664847][T11614] __se_sys_ioctl+0xfa/0x170 [ 641.669479][T11614] do_syscall_64+0x4c/0xa0 [ 641.673908][T11614] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 641.679824][T11614] [ 641.682151][T11614] The buggy address belongs to the object at ffff8880249a4000 [ 641.682151][T11614] which belongs to the cache kmalloc-8k of size 8192 [ 641.696270][T11614] The buggy address is located 3579 bytes to the right of [ 641.696270][T11614] 8192-byte region [ffff8880249a4000, ffff8880249a6000) [ 641.710255][T11614] The buggy address belongs to the page: [ 641.715906][T11614] page:ffffea0000926800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x249a0 [ 641.726058][T11614] head:ffffea0000926800 order:3 compound_mapcount:0 compound_pincount:0 [ 641.734384][T11614] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 641.742375][T11614] raw: 00fff00000010200 ffffea00009afe00 0000000300000003 ffff888016c42280 [ 641.750963][T11614] raw: 0000000000000000 0000000080020002 00000001ffffffff 0000000000000000 [ 641.759542][T11614] page dumped because: kasan: bad access detected [ 641.765974][T11614] page_owner tracks the page as allocated [ 641.771703][T11614] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4015, ts 58634842749, free_ts 58633194976 [ 641.790027][T11614] get_page_from_freelist+0x24f6/0x2670 [ 641.795668][T11614] __alloc_pages+0x1ee/0x480 [ 641.800257][T11614] new_slab+0xc0/0x4b0 [ 641.804335][T11614] ___slab_alloc+0x807/0xdd0 [ 641.808928][T11614] kmem_cache_alloc_trace+0xf9/0x290 [ 641.814250][T11614] tomoyo_init_log+0x1008/0x1e90 [ 641.819272][T11614] tomoyo_supervisor+0x38d/0x1190 [ 641.824309][T11614] tomoyo_env_perm+0x14e/0x1f0 [ 641.829084][T11614] tomoyo_find_next_domain+0x12f6/0x1a50 [ 641.834720][T11614] tomoyo_bprm_check_security+0xdd/0x120 [ 641.840352][T11614] security_bprm_check+0x5e/0x90 [ 641.845290][T11614] bprm_execve+0x9f2/0x1740 [ 641.850013][T11614] do_execveat_common+0x504/0x6b0 [ 641.855045][T11614] __x64_sys_execve+0x8e/0xa0 [ 641.859720][T11614] do_syscall_64+0x4c/0xa0 [ 641.864158][T11614] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 641.870055][T11614] page last free stack trace: [ 641.874735][T11614] free_unref_page_prepare+0x637/0x6c0 [ 641.880205][T11614] free_unref_page+0x8f/0x2a0 [ 641.884882][T11614] qlist_free_all+0x35/0x90 [ 641.889441][T11614] kasan_quarantine_reduce+0x150/0x160 [ 641.894937][T11614] __kasan_slab_alloc+0x2f/0xc0 [ 641.899791][T11614] slab_post_alloc_hook+0x4c/0x380 [ 641.904903][T11614] __kmalloc+0x189/0x340 [ 641.909147][T11614] tomoyo_supervisor+0xc5f/0x1190 [ 641.914171][T11614] tomoyo_env_perm+0x14e/0x1f0 [ 641.918946][T11614] tomoyo_find_next_domain+0x12f6/0x1a50 [ 641.924583][T11614] tomoyo_bprm_check_security+0xdd/0x120 [ 641.930251][T11614] security_bprm_check+0x5e/0x90 [ 641.935208][T11614] bprm_execve+0x9f2/0x1740 [ 641.939709][T11614] do_execveat_common+0x504/0x6b0 [ 641.944731][T11614] __x64_sys_execve+0x8e/0xa0 [ 641.949410][T11614] do_syscall_64+0x4c/0xa0 [ 641.953828][T11614] [ 641.956152][T11614] Memory state around the buggy address: [ 641.961792][T11614] ffff8880249a6c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 641.969872][T11614] ffff8880249a6d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 641.977947][T11614] >ffff8880249a6d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 641.986002][T11614] ^ [ 641.993975][T11614] ffff8880249a6e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 642.002030][T11614] ffff8880249a6e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 642.010084][T11614] ================================================================== [ 642.018235][T11614] Disabling lock debugging due to kernel taint [ 642.024460][T11614] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 642.031647][T11614] CPU: 1 PID: 11614 Comm: syz.2.1979 Tainted: G B syzkaller #0 [ 642.040490][T11614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 642.050544][T11614] Call Trace: [ 642.053842][T11614] [ 642.056773][T11614] dump_stack_lvl+0x188/0x250 [ 642.061481][T11614] ? show_regs_print_info+0x20/0x20 [ 642.066680][T11614] ? load_image+0x410/0x410 [ 642.071225][T11614] panic+0x2f8/0x850 [ 642.075148][T11614] ? bpf_jit_dump+0xd0/0xd0 [ 642.079651][T11614] ? _raw_spin_unlock_irqrestore+0xbc/0x120 [ 642.085549][T11614] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 642.091477][T11614] ? _raw_spin_unlock+0x40/0x40 [ 642.096327][T11614] ? print_memory_metadata+0x314/0x400 [ 642.101787][T11614] ? ieee80211_monitor_select_queue+0x23a/0x240 [ 642.108049][T11614] check_panic_on_warn+0x80/0xa0 [ 642.113073][T11614] ? ieee80211_monitor_select_queue+0x23a/0x240 [ 642.119324][T11614] end_report+0x6d/0xf0 [ 642.123485][T11614] kasan_report+0x102/0x130 [ 642.128007][T11614] ? ieee80211_monitor_select_queue+0x23a/0x240 [ 642.134268][T11614] ieee80211_monitor_select_queue+0x23a/0x240 [ 642.140468][T11614] ? ieee80211_recalc_smps_work+0x20/0x20 [ 642.146194][T11614] netdev_core_pick_tx+0x12c/0x300 [ 642.151316][T11614] __dev_queue_xmit+0x797/0x2e50 [ 642.156324][T11614] ? __might_sleep+0xf0/0xf0 [ 642.160923][T11614] ? dev_queue_xmit+0x20/0x20 [ 642.165720][T11614] ? virtio_net_hdr_to_skb+0xb00/0x11e0 [ 642.171278][T11614] ? packet_cached_dev_get+0x270/0x270 [ 642.176744][T11614] packet_sendmsg+0x3cf9/0x50b0 [ 642.181602][T11614] ? place_entity+0x4f0/0x4f0 [ 642.186314][T11614] ? __might_sleep+0xf0/0xf0 [ 642.190911][T11614] ? aa_sk_perm+0x7dc/0x910 [ 642.195438][T11614] ? packet_getsockopt+0x9a0/0x9a0 [ 642.200640][T11614] ? unpack_trans_table+0xb76/0x1690 [ 642.205933][T11614] ? apparmor_socket_sendmsg+0x88/0x230 [ 642.211479][T11614] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 642.216764][T11614] ? security_socket_sendmsg+0x7c/0xa0 [ 642.222224][T11614] ? packet_getsockopt+0x9a0/0x9a0 [ 642.227354][T11614] ____sys_sendmsg+0x5be/0x8f0 [ 642.232141][T11614] ? __sys_sendmsg_sock+0x30/0x30 [ 642.237173][T11614] ? import_iovec+0x6f/0xa0 [ 642.241702][T11614] ___sys_sendmsg+0x236/0x2e0 [ 642.246401][T11614] ? __sys_sendmsg+0x290/0x290 [ 642.251195][T11614] __se_sys_sendmsg+0x1b7/0x2a0 [ 642.256064][T11614] ? __x64_sys_sendmsg+0x80/0x80 [ 642.261003][T11614] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 642.267254][T11614] ? lockdep_hardirqs_on+0x94/0x140 [ 642.272545][T11614] do_syscall_64+0x4c/0xa0 [ 642.276962][T11614] ? clear_bhb_loop+0x30/0x80 [ 642.281642][T11614] ? clear_bhb_loop+0x30/0x80 [ 642.286318][T11614] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 642.292234][T11614] RIP: 0033:0x7fd739779e99 [ 642.296652][T11614] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 642.316261][T11614] RSP: 002b:00007fd7379d2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 642.324696][T11614] RAX: ffffffffffffffda RBX: 00007fd739a01fa0 RCX: 00007fd739779e99 [ 642.332667][T11614] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000003 [ 642.340652][T11614] RBP: 00007fd73980feaf R08: 0000000000000000 R09: 0000000000000000 [ 642.348625][T11614] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 642.356593][T11614] R13: 00007fd739a02038 R14: 00007fd739a01fa0 R15: 00007ffdc59cd068 [ 642.364576][T11614] [ 642.368033][T11614] Kernel Offset: disabled [ 642.384415][T11614] Rebooting in 86400 seconds..