last executing test programs: 7.602354116s ago: executing program 0 (id=40): r0 = socket$kcm(0x1e, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) write$FUSE_INIT(0xffffffffffffffff, 0x0, 0x0) setsockopt$sock_attach_bpf(r0, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r1 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r1, 0x10f, 0x87, &(0x7f00000008c0), 0x43) r2 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r2, 0x10f, 0x87, &(0x7f00000008c0), 0x43) write$cgroup_subtree(r2, &(0x7f0000000040)=ANY=[], 0xfdef) close(r2) recvmsg(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000002a80)=""/4096, 0xfdef}], 0x1}, 0x10021) 6.421123892s ago: executing program 0 (id=42): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r1, 0x403c6f2b, &(0x7f0000001e40)={0x4, {"0dbad96fff01000008ff002084000100", "3dfab043e15fad27a639f105c45b24fd", "a7c947420000000000000000ff4a70f3"}, 0x4000c, 0x5}) preadv(r1, &(0x7f00000002c0)=[{&(0x7f0000000200)=""/192, 0xc0}], 0x1, 0x1, 0x8) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r1, 0x40146f2c, &(0x7f0000000000)={0x2, 0x1, 0x3, 0x2, 0x4}) sched_setattr(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) 6.159555536s ago: executing program 0 (id=36): socket$unix(0x1, 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/netlink\x00') openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0xaca82, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) ioctl$MEMERASE(r0, 0x40084d02, 0x0) r1 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r1, r2, r3, r4, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, &(0x7f0000000180)={0x0, 0x612d, 0x0, 0x3, 0xbd}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x102100, 0x10000004, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1, 0xfffffffe, 0xaf}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf911, 0x0, 0x20, 0x1f0, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xac1b, 0x8200, 0x2, 0x24c}}], 0x1, &(0x7f0000000340)={0x2e, 0x4c, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x1, {}, 0x1f, 0x0, '\x00', {0xfff6, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) 5.049935422s ago: executing program 0 (id=48): syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r1 = gettid() timer_create(0x2, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) read$char_usb(r0, &(0x7f00000002c0)=""/151, 0x97) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x1c) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) close(r0) eventfd2(0xb, 0x80800) 4.74497045s ago: executing program 1 (id=51): r0 = syz_ublk_setup_io_uring(0x2bcb, &(0x7f0000001540)={0x0, 0x6fef, 0x1, 0x3, 0xb9}, 0x0, 0x0, 0x0) r1 = syz_io_uring_setup(0x147c, &(0x7f0000000200)={0x0, 0x5410, 0x80, 0x1, 0x80, 0x0, r0}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f00000000c0)=0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) r6 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000300)={'batadv_slave_0\x00', 0x0}) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000000)={r7, 0x1, 0x6, @multicast}, 0x10) getsockopt$inet_sctp6_SCTP_MAX_BURST(r5, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000040)={r8, 0x3}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x48, 0x0, r1}) io_uring_enter(r1, 0x1, 0x1, 0x1, 0x0, 0x0) 4.65001126s ago: executing program 1 (id=52): syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x109202) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet(0xa, 0x801, 0x84) syz_open_dev$mtd(&(0x7f0000000080), 0x0, 0x80) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x5bb2, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) syz_ublk_setup_queues(r6, r4, &(0x7f0000000400)={0x0, 0x1, 0x400, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x40, 0x3, 0x45, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdca5, 0x6ed5cafd8ed59c07, 0x2000, 0x30b, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1ce, 0x0, 0x0, 0x40, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x399d, 0x8200, 0x20000002, 0x800367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0xac0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) 3.686916373s ago: executing program 1 (id=59): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0x2000) ioctl$DVB_DEMUX_DMX_SET_FILTER(r1, 0x403c6f2b, &(0x7f0000001e40)={0x4, {"0dbad96fff01000008ff002084000100", "3dfab043e15fad27a639f105c45b24fd", "a7c947420000000000000000ff4a70f3"}, 0x4000c, 0x5}) preadv(r1, &(0x7f00000002c0)=[{&(0x7f0000000200)=""/192, 0xc0}], 0x1, 0x1, 0x8) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r1, 0x40146f2c, &(0x7f0000000000)={0x2, 0x1, 0x3, 0x2, 0x4}) sched_setattr(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) 3.319004295s ago: executing program 0 (id=64): bpf$MAP_CREATE(0x0, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1, 0x1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) setresgid(0xee00, 0x0, 0xee00) setresgid(0xffffffffffffffff, 0x0, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000380), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000240)={0x50, 0x0, r1, {0x7, 0x1f, 0x1, 0x202, 0x0, 0x0, 0x2}}, 0x50) syz_fuse_handle_req(r0, &(0x7f0000008380)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x101081, 0x11) ioctl$TIOCGPTPEER(r2, 0x5441, 0x9) 3.238265912s ago: executing program 1 (id=66): signalfd(0xffffffffffffffff, &(0x7f0000000100)={[0x1446, 0x81]}, 0x8) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x800) socket$phonet_pipe(0x23, 0x5, 0x2) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) pselect6(0x40, &(0x7f0000000080)={0x5, 0x3, 0x248, 0x5d92, 0x9, 0x1ce, 0x7fff, 0x2}, 0x0, &(0x7f0000000140)={0x3ff, 0x80, 0x5, 0x0, 0x101, 0xafc2, 0x5, 0x1}, 0x0, 0x0) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000880)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0xc050}, 0x40) 3.128546736s ago: executing program 3 (id=67): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f680, 0x1, 0x39c}) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x90, 0x0, 0x5, {0x4, 0x3, 0x0, 0x7, 0xf, 0x10, {0x0, 0xfffffffffffffff7, 0x4b6, 0x1, 0x9, 0x1, 0x1, 0x200, 0x0, 0xa000, 0xf8}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r1, 0xc02064b9, &(0x7f0000000dc0)={&(0x7f0000000340)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000200), 0x4, r2}) ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=[r3], 0x0, 0x0, 0x2000}) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x143042, 0x80) io_uring_enter(r0, 0x124, 0x14, 0x17, 0x0, 0x0) 3.021167184s ago: executing program 2 (id=68): mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r0 = open(&(0x7f0000000040)='./file0\x00', 0x400, 0x43) mknodat$loop(r0, &(0x7f0000000200)='./file1\x00', 0x800, 0x1) r1 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x718bb647156ec3b7) chdir(&(0x7f0000000000)='./bus\x00') linkat(r1, &(0x7f0000000100)='./file1\x00', r1, &(0x7f0000000180)='./file0\x00', 0x1000) open(&(0x7f0000000040)='./file0\x00', 0x400, 0x43) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x718bb647156ec3b7) 2.991976938s ago: executing program 3 (id=69): syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x109202) socket$inet6_sctp(0xa, 0x1, 0x84) socket$inet(0xa, 0x801, 0x84) syz_open_dev$mtd(&(0x7f0000000080), 0x0, 0x80) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x5bb2, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={0x0}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) syz_ublk_setup_queues(r6, r4, &(0x7f0000000400)={0x0, 0x1, 0x400, 0x3, 0x257}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x40, 0x3, 0x45, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xdca5, 0x6ed5cafd8ed59c07, 0x2000, 0x30b, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc1ce, 0x0, 0x0, 0x40, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x399d, 0x8200, 0x20000002, 0x800367}}], 0x1, &(0x7f0000000340)={0x2e, 0x44, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0xac0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) 2.950779411s ago: executing program 2 (id=70): bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000040)=@base={0x16, 0x0, 0xb4, 0x7f, 0x0, 0xffffffffffffffff, 0x2}, 0x50) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$nl_audit(0x10, 0x3, 0x9) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'wg0\x00'}) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x2000e844) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x2, 0xa, &(0x7f0000000680)=ANY=[@ANYBLOB="18080000000000000000000000000000851000000600000018100000", @ANYRES32=r0, @ANYBLOB="0000000000000000790057ed0000000018000000190000000000000000000000950020000000000095"], &(0x7f0000000000)='GPL\x00', 0x4, 0xee, &(0x7f00000034c0)=""/238, 0x100, 0x11}, 0x94) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xe, 0x6, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x6}, 0x94) 2.829910829s ago: executing program 2 (id=71): pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x2) fchdir(r2) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r3, r3) setpgid(0x0, r3) fchmodat(r2, &(0x7f0000000180)='./file0\x00', 0x20) creat(&(0x7f00000001c0)='./file0\x00', 0x1b7) 2.31982482s ago: executing program 1 (id=72): r0 = syz_io_uring_setup(0x2, &(0x7f0000000000), &(0x7f0000000100)=0x0, &(0x7f0000000200)=0x0, &(0x7f0000000300)=0x0) io_uring_register$IORING_REGISTER_FILES(r0, 0x2, &(0x7f0000000400)=[0xffffffff], 0x1) r4 = socket(0x2, 0x1, 0x0) bind(r4, &(0x7f0000000500)=@in={0x2, 0x1a85, @loopback=0x0}, 0x10) listen(r4, 0xa) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000080)=@IORING_OP_ACCEPT={0xd, 0x4, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x1}}) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000140)=@IORING_OP_WRITEV={0x2, 0x11, 0x0, @fd_index, 0x0, &(0x7f0000002100)=[{&(0x7f0000002200)="636570682076320a100001000000000000000000000000000000010101000000000000000000000000000000000000000000000000008fb12f570029688bd0", 0x3f}], 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}}) io_uring_enter(r0, 0x2, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000003000)='./dir0\x00', 0x1ff) mount(&(0x7f0000003100)=@filename='127.0.0.1:6789:/\x00', &(0x7f0000003000)='./dir0\x00', &(0x7f0000003200)='ceph\x00', 0x0, &(0x7f0000003300)='ms_mode=crc\x00') (async) nanosleep(&(0x7f0000000300)={0xa}, 0x0) 1.993134007s ago: executing program 2 (id=73): syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) r1 = gettid() timer_create(0x2, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) read$char_usb(r0, &(0x7f00000002c0)=""/151, 0x97) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x1c) timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) close(r0) eventfd2(0xb, 0x80800) 1.992110021s ago: executing program 3 (id=74): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) r1 = fsopen(&(0x7f0000000180)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x1, 0x0) fchdir(r2) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r3, &(0x7f0000000000), 0xffffff6a) sendfile(r0, r3, 0x0, 0xffffffff004) 1.717754955s ago: executing program 3 (id=76): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x8082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) readv(r0, &(0x7f00000003c0)=[{&(0x7f0000000340)=""/84, 0x54}], 0x1) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r3, r3) wait4(r2, 0x0, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=@newlink={0x30, 0x10, 0x1, 0x70bd28, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x48815, 0x3}, [@IFLA_TXQLEN={0x8, 0xd, 0x1}, @IFLA_GROUP={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) 1.431228686s ago: executing program 1 (id=77): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./debug/failslab/task-filter\x00', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000000)='./debug/failslab/probability\x00', 0x1, 0x50) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="4c00000002060108000034e4000000000000000805000400030000000900020073797a3100000000050005000200000014000300686173683a69702c706f72742c6970000500010007"], 0x4c}, 0x1, 0x0, 0x0, 0x200080c5}, 0x8042) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="60000000090603000000000000000000050000000900020073797a3100000000050001000700000038000780060004404e21000005000700ff0000000c000180080001400a0101010c000280080001401a9600020c00148008000140"], 0x60}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) 1.415089358s ago: executing program 3 (id=78): syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0xfffff34, 0x0, [{0xf88e470f, 0xed}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000002c0)={[0x10000000000002, 0x9, 0xfffffffffffffff9, 0x2, 0x0, 0x0, 0x4002004c4, 0x1004, 0x76, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb3, 0x90], 0xeeee8000, 0x2018d3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0xfffa, @local}, 0x10) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 132.157942ms ago: executing program 0 (id=79): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={0xffffffffffffffff, 0x58}, 0x10) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f680, 0x1, 0x39c}) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)={0x90, 0x0, 0x5, {0x4, 0x3, 0x0, 0x7, 0xf, 0x10, {0x0, 0xfffffffffffffff7, 0x4b6, 0x1, 0x9, 0x1, 0x1, 0x200, 0x0, 0xa000, 0xf8}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r1, 0xc02064b9, &(0x7f0000000dc0)={&(0x7f0000000340)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000200), 0x4, r2}) ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000580)=[r3], 0x0, 0x0, 0x2000}) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x143042, 0x80) io_uring_enter(r0, 0x124, 0x14, 0x17, 0x0, 0x0) 131.966919ms ago: executing program 2 (id=80): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000140)=[{0x6, 0x5, 0x87, 0x7ffc0201}]}) rseq(&(0x7f0000001080)={0x0, 0x0, 0x0, 0x1}, 0x20, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket(0x2a, 0x800, 0x7fff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0xc00) recvfrom(0xffffffffffffffff, &(0x7f00000001c0)=""/62, 0xfeb5, 0x10120, 0x0, 0x0) 131.790298ms ago: executing program 3 (id=81): socket$nl_generic(0x10, 0x3, 0x10) openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) io_uring_setup(0x267, &(0x7f0000000000)={0x0, 0xa14a, 0x1000, 0x2, 0x235}) socket$tipc(0x1e, 0x5, 0x0) socket$kcm(0x21, 0x7, 0x2) r0 = syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0xb04, 0x0, 0x2, 0x158}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0x4d}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0xae0c, 0x800, 0x3, 0x255}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7ffffe, 0x400, 0x3, 0x10000004, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x11e0, 0x1000, 0xfffffffe, 0x346}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf912, 0x2, 0x0, 0x1f0, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x587e, 0x8200, 0x2, 0x1367}}], 0x1, &(0x7f0000000340)={0x2e, 0x1b, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x6, 0x0, &(0x7f0000000000)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) 0s ago: executing program 2 (id=82): r0 = socket$inet(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1a85, @loopback}, 0x10) listen(r0, 0x5) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./ceph_mnt\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='127.0.0.1:6789:/\x00', &(0x7f0000000100)='./ceph_mnt\x00', &(0x7f0000000300)='ceph\x00', 0x0, &(0x7f0000000400)='abort_on_full,ms_mode=legacy,nocephx_sign_messages,nocrc,mount_timeout=2\x00') r1 = accept4$inet(r0, 0x0, 0x0, 0x0) write(r1, &(0x7f0000000500)='ceph v027', 0x9) write(r1, &(0x7f0000000600)='\x00'/272, 0x110) write(r1, &(0x7f0000000800)="01ffff7fffffffff3f00"/26, 0x1a) write(r1, &(0x7f0000000900)="070100000000000000000000000000000029000000010018000000000000000000000000000100000000000000000100000000000000000000000000000000000000000000000000000000000000b0e68b83000000000000000000", 0x5b) nanosleep(&(0x7f0000000a00)={0x1}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:18880' (ED25519) to the list of known hosts. syzkaller login: [ 43.080057][ T5729] cgroup: Unknown subsys name 'net' [ 43.260929][ T5729] cgroup: Unknown subsys name 'cpuset' [ 43.263541][ T5729] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 44.420601][ T5729] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 48.480496][ T5747] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 48.497364][ T5752] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 48.498674][ T5754] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 48.500137][ T5754] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 48.501361][ T5754] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 48.501636][ T5754] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 48.501766][ T5754] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 48.503003][ T5754] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 48.504330][ T5754] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 48.504771][ T5754] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 48.505295][ T5754] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 48.508331][ T5752] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 48.509392][ T5752] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 48.510064][ T5752] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 48.516304][ T5754] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 48.519874][ T5755] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 48.521929][ T5752] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 48.522469][ T66] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 48.523412][ T66] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 48.525409][ T66] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 49.239662][ T5751] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.240325][ T5751] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.240397][ T5751] bridge_slave_0: entered allmulticast mode [ 49.241245][ T5751] bridge_slave_0: entered promiscuous mode [ 49.247586][ T5743] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.247653][ T5743] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.247714][ T5743] bridge_slave_0: entered allmulticast mode [ 49.248474][ T5743] bridge_slave_0: entered promiscuous mode [ 49.249928][ T5743] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.249967][ T5743] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.250019][ T5743] bridge_slave_1: entered allmulticast mode [ 49.250720][ T5743] bridge_slave_1: entered promiscuous mode [ 49.257076][ T5751] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.257257][ T5751] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.257313][ T5751] bridge_slave_1: entered allmulticast mode [ 49.258168][ T5751] bridge_slave_1: entered promiscuous mode [ 49.303250][ T5741] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.303369][ T5741] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.303457][ T5741] bridge_slave_0: entered allmulticast mode [ 49.305223][ T5741] bridge_slave_0: entered promiscuous mode [ 49.329180][ T5743] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 49.330737][ T5743] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 49.330854][ T5741] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.330899][ T5741] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.330965][ T5741] bridge_slave_1: entered allmulticast mode [ 49.331697][ T5741] bridge_slave_1: entered promiscuous mode [ 49.335458][ T5751] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 49.345820][ T5749] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.345863][ T5749] bridge0: port 1(bridge_slave_0) entered disabled state [ 49.345917][ T5749] bridge_slave_0: entered allmulticast mode [ 49.346601][ T5749] bridge_slave_0: entered promiscuous mode [ 49.349728][ T5749] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.349795][ T5749] bridge0: port 2(bridge_slave_1) entered disabled state [ 49.349881][ T5749] bridge_slave_1: entered allmulticast mode [ 49.351276][ T5749] bridge_slave_1: entered promiscuous mode [ 49.370284][ T5751] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 49.390463][ T5743] team0: Port device team_slave_0 added [ 49.400076][ T5741] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 49.420395][ T5743] team0: Port device team_slave_1 added [ 49.422049][ T5749] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 49.423281][ T5741] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 49.424588][ T5751] team0: Port device team_slave_0 added [ 49.426279][ T5749] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 49.465878][ T5751] team0: Port device team_slave_1 added [ 49.482332][ T5743] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 49.482344][ T5743] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.482357][ T5743] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 49.484813][ T5741] team0: Port device team_slave_0 added [ 49.486323][ T5749] team0: Port device team_slave_0 added [ 49.494245][ T5743] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 49.494256][ T5743] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.494270][ T5743] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 49.496025][ T5741] team0: Port device team_slave_1 added [ 49.497694][ T5749] team0: Port device team_slave_1 added [ 49.504825][ T5751] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 49.504839][ T5751] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.504858][ T5751] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 49.506330][ T5751] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 49.506341][ T5751] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.506357][ T5751] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 49.541767][ T5741] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 49.541783][ T5741] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.541805][ T5741] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 49.542622][ T5749] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 49.542633][ T5749] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.542646][ T5749] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 49.558116][ T5741] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 49.558127][ T5741] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.558138][ T5741] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 49.558925][ T5749] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 49.558938][ T5749] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 49.558958][ T5749] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 49.587345][ T5743] hsr_slave_0: entered promiscuous mode [ 49.589484][ T5743] hsr_slave_1: entered promiscuous mode [ 49.625634][ T5741] hsr_slave_0: entered promiscuous mode [ 49.626073][ T5741] hsr_slave_1: entered promiscuous mode [ 49.626358][ T5741] debugfs: 'hsr0' already exists in 'hsr' [ 49.626405][ T5741] Cannot create hsr debugfs directory [ 49.632323][ T5751] hsr_slave_0: entered promiscuous mode [ 49.633059][ T5751] hsr_slave_1: entered promiscuous mode [ 49.633547][ T5751] debugfs: 'hsr0' already exists in 'hsr' [ 49.633563][ T5751] Cannot create hsr debugfs directory [ 49.658151][ T5749] hsr_slave_0: entered promiscuous mode [ 49.659575][ T5749] hsr_slave_1: entered promiscuous mode [ 49.660137][ T5749] debugfs: 'hsr0' already exists in 'hsr' [ 49.660154][ T5749] Cannot create hsr debugfs directory [ 50.001955][ T5743] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 50.009044][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 50.010813][ T5743] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 50.015905][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 50.016643][ T5743] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 50.023001][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 50.036538][ T5743] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 50.040940][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 50.093290][ T5741] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 50.099168][ T5741] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 50.100069][ T5741] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 50.104961][ T5741] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 50.106450][ T5741] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 50.109884][ T5741] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 50.121297][ T5741] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 50.123141][ T5741] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 50.156078][ T5749] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 50.158088][ T5749] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 50.158617][ T5749] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 50.161733][ T5749] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 50.164819][ T5749] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 50.168860][ T5749] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 50.170215][ T5749] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 50.172537][ T5749] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 50.234591][ T5751] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 50.238753][ T5751] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 50.246495][ T5751] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 50.252643][ T5751] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 50.257008][ T5751] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 50.263595][ T5751] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 50.264120][ T5751] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 50.266272][ T5751] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 50.320096][ T5743] 8021q: adding VLAN 0 to HW filter on device bond0 [ 50.327635][ T5741] 8021q: adding VLAN 0 to HW filter on device bond0 [ 50.342780][ T5743] 8021q: adding VLAN 0 to HW filter on device team0 [ 50.355503][ T5741] 8021q: adding VLAN 0 to HW filter on device team0 [ 50.359187][ T104] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.359250][ T104] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.370512][ T104] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.370558][ T104] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.381408][ T104] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.381451][ T104] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.393318][ T104] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.393418][ T104] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.410125][ T5749] 8021q: adding VLAN 0 to HW filter on device bond0 [ 50.444238][ T5751] 8021q: adding VLAN 0 to HW filter on device bond0 [ 50.466258][ T5749] 8021q: adding VLAN 0 to HW filter on device team0 [ 50.477227][ T104] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.477308][ T104] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.487326][ T104] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.487372][ T104] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.499286][ T5751] 8021q: adding VLAN 0 to HW filter on device team0 [ 50.509164][ T104] bridge0: port 1(bridge_slave_0) entered blocking state [ 50.509209][ T104] bridge0: port 1(bridge_slave_0) entered forwarding state [ 50.518600][ T104] bridge0: port 2(bridge_slave_1) entered blocking state [ 50.518723][ T104] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.579066][ T5747] Bluetooth: hci0: command tx timeout [ 50.588757][ T66] Bluetooth: hci3: command tx timeout [ 50.589242][ T66] Bluetooth: hci2: command tx timeout [ 50.589389][ T5747] Bluetooth: hci1: command tx timeout [ 50.789589][ T5743] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.812197][ T5749] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.824458][ T5741] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.845419][ T5743] veth0_vlan: entered promiscuous mode [ 50.861321][ T5743] veth1_vlan: entered promiscuous mode [ 50.894038][ T5749] veth0_vlan: entered promiscuous mode [ 50.904666][ T5741] veth0_vlan: entered promiscuous mode [ 50.911920][ T5749] veth1_vlan: entered promiscuous mode [ 50.915254][ T5751] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.920349][ T5743] veth0_macvtap: entered promiscuous mode [ 50.923874][ T5743] veth1_macvtap: entered promiscuous mode [ 50.928810][ T5741] veth1_vlan: entered promiscuous mode [ 50.951838][ T5743] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 50.968382][ T5743] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 51.022178][ T5741] veth0_macvtap: entered promiscuous mode [ 51.026955][ T5751] veth0_vlan: entered promiscuous mode [ 51.033135][ T5749] veth0_macvtap: entered promiscuous mode [ 51.047140][ T5741] veth1_macvtap: entered promiscuous mode [ 51.060002][ T5749] veth1_macvtap: entered promiscuous mode [ 51.065619][ T5751] veth1_vlan: entered promiscuous mode [ 51.096627][ T5741] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 51.118149][ T220] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.118169][ T220] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.118314][ T5749] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 51.122437][ T5741] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 51.140665][ T5749] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 51.160746][ T676] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.160771][ T676] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.168307][ T5794] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.168554][ T5794] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.191966][ T5751] veth0_macvtap: entered promiscuous mode [ 51.205236][ T5751] veth1_macvtap: entered promiscuous mode [ 51.228425][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.228519][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.228625][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.228690][ T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.228750][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.269144][ T5743] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 51.275561][ T5743] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 51.278324][ T56] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.278342][ T56] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.281651][ T5743] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 51.284490][ T5743] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 51.309537][ T5743] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 51.311768][ T5751] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 51.324208][ T5751] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 51.331494][ T220] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.331506][ T220] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.360675][ T220] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.360688][ T220] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.387741][ T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.388028][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.388224][ T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.388814][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.388947][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.389232][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.409738][ T220] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.409758][ T220] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.411855][ T12] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.412057][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.412253][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 51.444536][ T104] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.444557][ T104] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.481833][ T104] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 51.481851][ T104] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.616368][ T5897] FAULT_INJECTION: forcing a failure. [ 51.616368][ T5897] name failslab, interval 1, probability 0, space 0, times 1 [ 51.616397][ T5897] CPU: 3 UID: 0 PID: 5897 Comm: syz.1.5 Not tainted syzkaller #0 PREEMPT(full) [ 51.616416][ T5897] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 51.616428][ T5897] Call Trace: [ 51.616434][ T5897] [ 51.616441][ T5897] dump_stack_lvl+0x100/0x190 [ 51.616469][ T5897] should_fail_ex.cold+0x5/0xa [ 51.616493][ T5897] should_failslab+0xc2/0x120 [ 51.616516][ T5897] kmem_cache_alloc_noprof+0x92/0x6a0 [ 51.616535][ T5897] ? d_instantiate+0x8a/0xb0 [ 51.616556][ T5897] ? alloc_empty_file+0x5b/0x1c0 [ 51.616590][ T5897] alloc_empty_file+0x5b/0x1c0 [ 51.616614][ T5897] alloc_file_pseudo+0x183/0x290 [ 51.616639][ T5897] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 51.616671][ T5897] __anon_inode_getfile+0xe8/0x280 [ 51.616698][ T5897] bpf_link_prime+0x200/0x4c0 [ 51.616720][ T5897] bpf_xdp_link_attach+0x27a/0x8f0 [ 51.616745][ T5897] ? __pfx_bpf_xdp_link_attach+0x10/0x10 [ 51.616766][ T5897] ? find_held_lock+0x2b/0x80 [ 51.616784][ T5897] ? __fget_files+0x215/0x3d0 [ 51.616812][ T5897] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 51.616840][ T5897] __sys_bpf+0x3cbf/0x4a30 [ 51.616863][ T5897] ? __pfx___sys_bpf+0x10/0x10 [ 51.616879][ T5897] ? find_held_lock+0x2b/0x80 [ 51.616896][ T5897] ? futex_wake+0x4ea/0x5e0 [ 51.616931][ T5897] ? rcu_read_lock_any_held+0x6a/0x90 [ 51.616950][ T5897] ? find_held_lock+0x2b/0x80 [ 51.616966][ T5897] ? ksys_write+0x190/0x250 [ 51.616983][ T5897] ? ksys_write+0x190/0x250 [ 51.617014][ T5897] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 51.617034][ T5897] ? xfd_validate_state+0x129/0x190 [ 51.617063][ T5897] ? __ia32_sys_bpf+0xcc/0x170 [ 51.617080][ T5897] __ia32_sys_bpf+0xcc/0x170 [ 51.617098][ T5897] ? __do_fast_syscall_32+0xb3/0x8b0 [ 51.617130][ T5897] __do_fast_syscall_32+0x13a/0x8b0 [ 51.617160][ T5897] do_fast_syscall_32+0x32/0x70 [ 51.617187][ T5897] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 51.617208][ T5897] RIP: 0023:0xf7fb2fec [ 51.617228][ T5897] Code: Unable to access opcode bytes at 0xf7fb2fc2. [ 51.617237][ T5897] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 51.617255][ T5897] RAX: ffffffffffffffda RBX: 000000000000001c RCX: 0000000080000300 [ 51.617267][ T5897] RDX: 000000000000001c RSI: 0000000000000000 RDI: 0000000000000000 [ 51.617278][ T5897] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 51.617288][ T5897] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 51.617298][ T5897] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 51.617322][ T5897] [ 51.730035][ T5899] 0: reclassify loop, rule prio 0, protocol 03 [ 52.182509][ T5927] ipvlan2: entered allmulticast mode [ 52.182564][ T5927] batadv_slave_1: entered allmulticast mode [ 52.206805][ T5927] batman_adv: batadv0: Adding interface: ipvlan2 [ 52.206868][ T5927] batman_adv: batadv0: The MTU of interface ipvlan2 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 52.206927][ T5927] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 52.206975][ T5927] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 52.207074][ T5927] batman_adv: batadv0: Interface activated: ipvlan2 [ 52.657745][ T5098] Bluetooth: hci1: command tx timeout [ 52.657783][ T5098] Bluetooth: hci3: command tx timeout [ 52.657790][ T66] Bluetooth: hci0: command tx timeout [ 52.657869][ T5747] Bluetooth: hci2: command tx timeout [ 53.329841][ T5942] Bluetooth: MGMT ver 1.23 [ 53.597170][ T5948] zram0: detected capacity change from 0 to 8 [ 53.710779][ T5950] netlink: 12 bytes leftover after parsing attributes in process `syz.3.15'. [ 53.791346][ T5952] Zero length message leads to an empty skb [ 54.187488][ T5965] sch_tbf: burst 32855 is lower than device lo mtu (65550) ! [ 54.351555][ T58] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 54.517485][ T58] usb 8-1: Using ep0 maxpacket: 16 [ 54.518764][ T58] usb 8-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 54.520745][ T58] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 54.524522][ T58] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 54.524542][ T58] usb 8-1: Product: syz [ 54.524553][ T58] usb 8-1: Manufacturer: syz [ 54.524566][ T58] usb 8-1: SerialNumber: syz [ 54.560554][ T58] usb 8-1: config 0 descriptor?? [ 54.566399][ T58] em28xx 8-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 54.566427][ T58] em28xx 8-1:0.0: DVB interface 0 found: bulk [ 54.747784][ T5747] Bluetooth: hci2: command tx timeout [ 54.747816][ T5747] Bluetooth: hci0: command tx timeout [ 54.747836][ T5747] Bluetooth: hci3: command tx timeout [ 54.788797][ T5997] FAULT_INJECTION: forcing a failure. [ 54.788797][ T5997] name failslab, interval 1, probability 0, space 0, times 0 [ 54.788822][ T5997] CPU: 2 UID: 0 PID: 5997 Comm: syz.2.27 Not tainted syzkaller #0 PREEMPT(full) [ 54.788835][ T5997] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 54.788843][ T5997] Call Trace: [ 54.788846][ T5997] [ 54.788851][ T5997] dump_stack_lvl+0x100/0x190 [ 54.788870][ T5997] should_fail_ex.cold+0x5/0xa [ 54.788883][ T5997] ? lockdep_hardirqs_on+0x7d/0x110 [ 54.788902][ T5997] should_failslab+0xc2/0x120 [ 54.788918][ T5997] __kmalloc_cache_noprof+0x91/0x6d0 [ 54.788935][ T5997] ? tipc_topsrv_queue_evt+0x125/0x3f0 [ 54.788956][ T5997] tipc_topsrv_queue_evt+0x125/0x3f0 [ 54.788976][ T5997] tipc_sub_report_overlap+0x54c/0x9b0 [ 54.788995][ T5997] tipc_nametbl_insert_publ+0xd5a/0x1570 [ 54.789013][ T5997] tipc_nametbl_publish+0x18b/0x300 [ 54.789026][ T5997] tipc_sk_publish+0x1d8/0x430 [ 54.789039][ T5997] ? __pfx_tipc_sk_publish+0x10/0x10 [ 54.789052][ T5997] ? tipc_group_create+0x4c0/0x660 [ 54.789070][ T5997] tipc_setsockopt+0x7af/0xe30 [ 54.789083][ T5997] ? __pfx_tipc_setsockopt+0x10/0x10 [ 54.789095][ T5997] ? lock_acquire+0x1d1/0x380 [ 54.789109][ T5997] ? __fget_files+0x34/0x3d0 [ 54.789126][ T5997] ? __pfx_tipc_setsockopt+0x10/0x10 [ 54.789139][ T5997] do_sock_setsockopt+0xf3/0x1d0 [ 54.789158][ T5997] __sys_setsockopt+0x119/0x190 [ 54.789174][ T5997] __ia32_sys_setsockopt+0xbc/0x160 [ 54.789188][ T5997] ? __do_fast_syscall_32+0xb3/0x8b0 [ 54.789205][ T5997] ? lockdep_hardirqs_on+0x7d/0x110 [ 54.789220][ T5997] __do_fast_syscall_32+0x13a/0x8b0 [ 54.789239][ T5997] do_fast_syscall_32+0x32/0x70 [ 54.789259][ T5997] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 54.789277][ T5997] RIP: 0023:0xf7f87fec [ 54.789295][ T5997] Code: Unable to access opcode bytes at 0xf7f87fc2. [ 54.789302][ T5997] RSP: 002b:00000000f544650c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 54.789319][ T5997] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000010f [ 54.789331][ T5997] RDX: 0000000000000087 RSI: 00000000800002c0 RDI: 0000000000000010 [ 54.789341][ T5997] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 54.789350][ T5997] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 54.789360][ T5997] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 54.789389][ T5997] [ 54.998356][ T43] audit: type=1800 audit(1789172216.662:2): pid=6003 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.28" name="file1" dev="sda1" ino=2038 res=0 errno=0 [ 55.190169][ T58] em28xx 8-1:0.0: unknown em28xx chip ID (0) [ 55.507564][ T5460] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 55.601951][ T58] em28xx 8-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 55.602243][ T58] em28xx 8-1:0.0: board has no eeprom [ 55.658122][ T5960] em28xx 8-1:0.0: reading from i2c device at 0xe failed (error=-5) [ 55.658794][ T5460] usb 7-1: New USB device found, idVendor=1286, idProduct=2046, bcdDevice= 1.00 [ 55.661984][ T5460] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 55.662001][ T5460] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 55.664172][ T5460] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 55.664187][ T5460] usb 7-1: Product: syz [ 55.664194][ T5460] usb 7-1: Manufacturer: syz [ 55.664201][ T5460] usb 7-1: SerialNumber: syz [ 55.670653][ T5460] usb 7-1: NFC: intf ffff8880611de000 id ffffffff8fe92bc0 [ 55.683200][ T5460] nfcmrvl 7-1:1.0: NFC: registered with nci successfully [ 55.717729][ T58] em28xx 8-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 55.717757][ T58] em28xx 8-1:0.0: dvb set to bulk mode. [ 55.719662][ T25] em28xx 8-1:0.0: Binding DVB extension [ 55.729849][ T58] usb 8-1: USB disconnect, device number 2 [ 55.731765][ T58] em28xx 8-1:0.0: Disconnecting em28xx [ 55.759818][ T25] em28xx 8-1:0.0: Registering input extension [ 55.760970][ T58] em28xx 8-1:0.0: Closing input extension [ 55.797640][ T58] em28xx: Freeing device [ 55.878535][ T6014] jffs2: notice: (6014) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 55.892734][ T1348] usb 7-1: USB disconnect, device number 2 [ 55.894363][ T1348] usb 7-1: NFC: intf ffff8880611de000 qemu-system-x86_64: warning: 9p: degraded performance: a reasonable high msize should be chosen on client/guest side (chosen msize is <= 8192). See https://wiki.qemu.org/Documentation/9psetup#msize for details. [ 56.767888][ T6043] kvm: emulating exchange as write [ 56.768670][ T6043] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 56.817982][ T5752] Bluetooth: hci0: command tx timeout [ 56.818004][ T5752] Bluetooth: hci2: command tx timeout [ 56.818016][ T5752] Bluetooth: hci3: command tx timeout [ 57.231731][ T6055] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for gretap1 [ 57.232318][ T6055] batman_adv: batadv0: Adding interface: gretap1 [ 57.232330][ T6055] batman_adv: batadv0: The MTU of interface gretap1 is too small (1462) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 57.232353][ T6055] batman_adv: batadv0: Interface activated: gretap1 [ 58.067538][ T5840] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 58.095737][ T6079] netlink: 4 bytes leftover after parsing attributes in process `syz.2.50'. [ 58.219272][ T6086] syzkaller0: entered promiscuous mode [ 58.219292][ T6086] syzkaller0: entered allmulticast mode [ 58.231930][ T5840] usb 5-1: Using ep0 maxpacket: 32 [ 58.232736][ T5840] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 58.233951][ T5840] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 58.236146][ T5840] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 58.236165][ T5840] usb 5-1: Product: syz [ 58.236176][ T5840] usb 5-1: Manufacturer: syz [ 58.236187][ T5840] usb 5-1: SerialNumber: syz [ 58.240894][ T5840] usb 5-1: config 0 descriptor?? [ 58.241382][ T6074] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 58.958266][ T58] usb 5-1: USB disconnect, device number 2 [ 60.532950][ T6149] ceph: No mds server is up or the cluster is laggy [ 61.128777][ T58] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 61.287523][ T58] usb 7-1: Using ep0 maxpacket: 32 [ 61.288294][ T58] usb 7-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 61.289272][ T58] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 61.291268][ T58] usb 7-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 61.291288][ T58] usb 7-1: Product: syz [ 61.291301][ T58] usb 7-1: Manufacturer: syz [ 61.291313][ T58] usb 7-1: SerialNumber: syz [ 61.295989][ T58] usb 7-1: config 0 descriptor?? [ 61.296614][ T6157] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 61.822539][ T5820] usb 7-1: USB disconnect, device number 3 [ 62.727176][ T43] audit: type=1326 audit(1789172224.382:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6170 comm="syz.2.80" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f87fec code=0x7ffc0000 [ 62.727827][ T43] audit: type=1326 audit(1789172224.382:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6170 comm="syz.2.80" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f87fec code=0x7ffc0000 [ 62.750501][ T43] audit: type=1326 audit(1789172224.412:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6170 comm="syz.2.80" exe="/syz-executor" sig=0 arch=40000003 syscall=386 compat=1 ip=0xf7f87fec code=0x7ffc0000 [ 62.750681][ T43] audit: type=1326 audit(1789172224.412:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6170 comm="syz.2.80" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f87fec code=0x7ffc0000 [ 62.750939][ T43] audit: type=1326 audit(1789172224.412:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6170 comm="syz.2.80" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f87fec code=0x7ffc0000 [ 62.751391][ T43] audit: type=1326 audit(1789172224.412:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6170 comm="syz.2.80" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7f87fec code=0x7ffc0000 [ 62.751720][ T43] audit: type=1326 audit(1789172224.412:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6170 comm="syz.2.80" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f87fec code=0x7ffc0000 [ 62.751899][ T43] audit: type=1326 audit(1789172224.412:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6170 comm="syz.2.80" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f87fec code=0x7ffc0000 [ 62.752354][ T43] audit: type=1326 audit(1789172224.412:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6170 comm="syz.2.80" exe="/syz-executor" sig=0 arch=40000003 syscall=3 compat=1 ip=0xf7f87fec code=0x7ffc0000 [ 62.752560][ T43] audit: type=1326 audit(1789172224.412:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6170 comm="syz.2.80" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f87fec code=0x7ffc0000 [ 62.903513][ T5460] ------------[ cut here ]------------ [ 62.903527][ T5460] con->v1.connect_seq != le32_to_cpu(con->v1.in_reply.connect_seq) [ 62.903537][ T5460] WARNING: net/ceph/messenger_v1.c:901 at ceph_con_v1_try_read+0x447d/0x6ca0, CPU#0: kworker/0:3/5460 [ 62.915074][ T5460] Modules linked in: [ 62.916976][ T5460] CPU: 0 UID: 0 PID: 5460 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full) [ 62.921064][ T5460] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 62.925382][ T5460] Workqueue: ceph-msgr ceph_con_workfn [ 62.927958][ T5460] RIP: 0010:ceph_con_v1_try_read+0x447d/0x6ca0 [ 62.930703][ T5460] Code: f6 84 db 0f 84 1b ee ff ff e9 fc a6 e1 f5 e8 fa 4f 78 f6 90 0f 0b 90 e9 9f db ff ff e8 ec 4f 78 f6 90 0f 0b e8 e4 4f 78 f6 90 <0f> 0b 90 e9 84 e5 ff ff e8 d6 4f 78 f6 90 0f 0b e8 ce 4f 78 f6 90 [ 62.939058][ T5460] RSP: 0018:ffffc900036ff9e8 EFLAGS: 00010293 [ 62.941696][ T5460] RAX: 0000000000000000 RBX: ffff888071b8088b RCX: 0000000000000000 [ 62.945122][ T5460] RDX: ffff888025a5a580 RSI: ffffffff8b9311ec RDI: ffff888025a5a580 [ 62.948958][ T5460] RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000000000 [ 62.952484][ T5460] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001 [ 62.955912][ T5460] R13: ffff888071b80950 R14: ffff888071b80418 R15: dffffc0000000000 [ 62.959413][ T5460] FS: 0000000000000000(0000) GS:ffff888096960000(0000) knlGS:0000000000000000 [ 62.963026][ T5460] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 62.965695][ T5460] CR2: 0000000033b18ff8 CR3: 0000000060afd000 CR4: 0000000000352ef0 [ 62.969078][ T5460] Call Trace: [ 62.970490][ T5460] [ 62.971743][ T5460] ? ceph_con_workfn+0x48/0x13e0 [ 62.973797][ T5460] ? register_lock_class+0x3f/0x7b0 [ 62.976015][ T5460] ? __lock_acquire+0x5c0/0x1f40 [ 62.978233][ T5460] ? __pfx___mutex_lock+0x10/0x10 [ 62.980342][ T5460] ? __pfx_ceph_con_v1_try_read+0x10/0x10 [ 62.983067][ T5460] ceph_con_workfn+0x9a5/0x13e0 [ 62.985304][ T5460] process_one_work+0xac7/0x1b10 [ 62.987906][ T5460] ? __pfx_process_one_work+0x10/0x10 [ 62.990184][ T5460] ? lock_acquire+0x1d1/0x380 [ 62.992219][ T5460] ? __pfx_ceph_con_workfn+0x10/0x10 [ 62.994243][ T5460] worker_thread+0x5ef/0xe50 [ 62.996142][ T5460] ? __pfx_worker_thread+0x10/0x10 [ 62.998310][ T5460] ? kthread+0x13a/0x450 [ 62.999789][ T5460] ? __pfx_worker_thread+0x10/0x10 [ 63.001822][ T5460] kthread+0x373/0x450 [ 63.003160][ T5460] ? __pfx_kthread+0x10/0x10 [ 63.004629][ T5460] ret_from_fork+0x730/0xd60 [ 63.006196][ T5460] ? __pfx_ret_from_fork+0x10/0x10 [ 63.008447][ T5460] ? __switch_to+0x800/0x10f0 [ 63.010419][ T5460] ? __pfx_kthread+0x10/0x10 [ 63.012430][ T5460] ret_from_fork_asm+0x1a/0x30 [ 63.014354][ T5460] [ 63.015597][ T5460] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 63.018023][ T5460] CPU: 0 UID: 0 PID: 5460 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full) [ 63.020944][ T5460] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 63.024279][ T5460] Workqueue: ceph-msgr ceph_con_workfn [ 63.026184][ T5460] Call Trace: [ 63.027453][ T5460] [ 63.028576][ T5460] dump_stack_lvl+0x100/0x190 [ 63.030069][ T5460] vpanic+0x553/0x970 [ 63.031620][ T5460] ? __pfx_vpanic+0x10/0x10 [ 63.033040][ T5460] panic+0xd1/0xe0 [ 63.034262][ T5460] ? __pfx_panic+0x10/0x10 [ 63.035727][ T5460] check_panic_on_warn.cold+0x19/0x34 [ 63.037509][ T5460] ? ceph_con_v1_try_read+0x447d/0x6ca0 [ 63.039521][ T5460] __warn.cold+0x191/0x318 [ 63.040986][ T5460] __report_bug+0x30f/0x440 [ 63.042491][ T5460] ? ceph_con_v1_try_read+0x447d/0x6ca0 [ 63.044426][ T5460] ? __pfx___report_bug+0x10/0x10 [ 63.046211][ T5460] ? __pfx_tcp_recvmsg+0x10/0x10 [ 63.048309][ T5460] ? inet_recvmsg+0xdc/0x4c0 [ 63.050392][ T5460] ? bpf_lsm_socket_recvmsg+0x9/0x10 [ 63.052682][ T5460] ? rcu_is_watching+0x13/0xc0 [ 63.054720][ T5460] ? ceph_con_v1_try_read+0x447d/0x6ca0 [ 63.057072][ T5460] report_bug+0xb3/0x220 [ 63.058886][ T5460] ? ceph_con_v1_try_read+0x447d/0x6ca0 [ 63.061084][ T5460] handle_bug+0x16a/0x2a0 [ 63.062808][ T5460] exc_invalid_op+0x17/0x50 [ 63.064728][ T5460] asm_exc_invalid_op+0x1a/0x20 [ 63.066850][ T5460] RIP: 0010:ceph_con_v1_try_read+0x447d/0x6ca0 [ 63.069432][ T5460] Code: f6 84 db 0f 84 1b ee ff ff e9 fc a6 e1 f5 e8 fa 4f 78 f6 90 0f 0b 90 e9 9f db ff ff e8 ec 4f 78 f6 90 0f 0b e8 e4 4f 78 f6 90 <0f> 0b 90 e9 84 e5 ff ff e8 d6 4f 78 f6 90 0f 0b e8 ce 4f 78 f6 90 [ 63.077361][ T5460] RSP: 0018:ffffc900036ff9e8 EFLAGS: 00010293 [ 63.080033][ T5460] RAX: 0000000000000000 RBX: ffff888071b8088b RCX: 0000000000000000 [ 63.083393][ T5460] RDX: ffff888025a5a580 RSI: ffffffff8b9311ec RDI: ffff888025a5a580 [ 63.086671][ T5460] RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000000000 [ 63.089963][ T5460] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000001 [ 63.093356][ T5460] R13: ffff888071b80950 R14: ffff888071b80418 R15: dffffc0000000000 [ 63.096974][ T5460] ? ceph_con_v1_try_read+0x447c/0x6ca0 [ 63.099722][ T5460] ? ceph_con_v1_try_read+0x447c/0x6ca0 [ 63.102046][ T5460] ? ceph_con_workfn+0x48/0x13e0 [ 63.104124][ T5460] ? register_lock_class+0x3f/0x7b0 [ 63.106213][ T5460] ? __lock_acquire+0x5c0/0x1f40 [ 63.108229][ T5460] ? __pfx___mutex_lock+0x10/0x10 [ 63.110287][ T5460] ? __pfx_ceph_con_v1_try_read+0x10/0x10 [ 63.112675][ T5460] ceph_con_workfn+0x9a5/0x13e0 [ 63.114448][ T5460] process_one_work+0xac7/0x1b10 [ 63.116254][ T5460] ? __pfx_process_one_work+0x10/0x10 [ 63.118121][ T5460] ? lock_acquire+0x1d1/0x380 [ 63.120078][ T5460] ? __pfx_ceph_con_workfn+0x10/0x10 [ 63.122253][ T5460] worker_thread+0x5ef/0xe50 [ 63.123794][ T5460] ? __pfx_worker_thread+0x10/0x10 [ 63.125378][ T5460] ? kthread+0x13a/0x450 [ 63.126826][ T5460] ? __pfx_worker_thread+0x10/0x10 [ 63.128733][ T5460] kthread+0x373/0x450 [ 63.130383][ T5460] ? __pfx_kthread+0x10/0x10 [ 63.132166][ T5460] ret_from_fork+0x730/0xd60 [ 63.133894][ T5460] ? __pfx_ret_from_fork+0x10/0x10 [ 63.136020][ T5460] ? __switch_to+0x800/0x10f0 [ 63.137863][ T5460] ? __pfx_kthread+0x10/0x10 [ 63.139452][ T5460] ret_from_fork_asm+0x1a/0x30 [ 63.141045][ T5460] [ 63.142674][ T5460] Kernel Offset: disabled [ 63.144164][ T5460] Rebooting in 86400 seconds..