last executing test programs: 13m50.07822914s ago: executing program 1 (id=76): r0 = openat$comedi(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000002c0)={'ni_at_a2150\x00', [0x10f, 0x6, 0x2, 0xc, 0x5, 0x5, 0x79, 0x3, 0x80008, 0xf, 0x2, 0x4, 0x7, 0x1, 0x1, 0xfd, 0xfffffffb, 0xd8, 0x3, 0x7ffffffe, 0xffffffff, 0xca9f, 0x7f, 0x3, 0xfffffffb, 0xf39e, 0xffffffff, 0x0, 0x80000040, 0x4, 0xfffffffb]}) 13m49.826301142s ago: executing program 1 (id=79): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x80480, 0x0) ioctl$COMEDI_INSNLIST(r1, 0x8010640b, &(0x7f000017ec00)={0x1, &(0x7f000017e980)=[{0x4000000, 0x0, 0x0, 0x0, 0x6}]}) 13m49.531839775s ago: executing program 1 (id=83): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ed) mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc_mnt/irq/11/smp_affinity\x00', 0x1, 0x0) write$P9_RREADDIR(r0, &(0x7f0000000400)={0x33, 0x29, 0x4, {0x10001, [{{0x28, 0x2, 0x7}, 0x1, 0x80, 0x10, './file0/../file0'}]}}, 0x33) 13m48.504537773s ago: executing program 1 (id=84): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000000)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x103c41, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./tracing\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/uprobe_events\x00', 0x401, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) write(r0, &(0x7f0000000180)='p:s/p ./file0:0', 0xf) 13m48.016776625s ago: executing program 1 (id=90): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) r2 = syz_io_uring_setup(0x80, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000180)=0x0) sendto$unix(r0, &(0x7f0000000600), 0x0, 0x804, 0x0, 0x0) syz_io_uring_submit(r3, r4, r5, &(0x7f0000000240)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x40, 0x0, r1, 0x0, &(0x7f00000002c0)="8a84", 0x2, 0x40000100, 0x1}) io_uring_enter(r2, 0x1, 0x1, 0x1, 0x0, 0x0) 13m46.801979742s ago: executing program 1 (id=93): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=ANY=[@ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001"], 0x48}}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1c, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$nfc_llcp_NFC_LLCP_RW(r1, 0x118, 0x0, 0x0, 0x0) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)={0x44, r5, 0x1, 0x70bd2f, 0x0, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_COALESCE_RX_USECS_IRQ={0x8, 0x4, 0x3}, @ETHTOOL_A_COALESCE_TX_USECS_HIGH={0x8, 0x15, 0xfffffff1}, @ETHTOOL_A_COALESCE_USE_CQE_MODE_TX={0x5, 0x18, 0x1}]}, 0x44}}, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) r6 = socket$inet(0x10, 0x2000000002, 0x0) sendmsg(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000380)="240000002e00074c8bfffd946fa2830022200afffffffffffff000e50c1be3a20400007e280000005e00ff03c81f8374b4a04181f2d0fdcad693d58d31d42c0b3ad0c1846e6db77c292ebfbf", 0x4c}], 0x1}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/net/veth0/threaded\x00', 0x2, 0x0) write$P9_RREADDIR(r8, &(0x7f0000000140)={0x30, 0x29, 0x1, {0x9}}, 0xb) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000006c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x40000, {0x0, 0x0, 0x0, r7, {0x0, 0xe}, {0xffff, 0xffff}, {0x0, 0xc}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0xffffff37, 0xc934, 0x0, 0x10001, 0x40003, 0x0, 0x42b, 0x8001}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x10) 13m45.058514152s ago: executing program 32 (id=93): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=ANY=[@ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001"], 0x48}}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1c, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$nfc_llcp_NFC_LLCP_RW(r1, 0x118, 0x0, 0x0, 0x0) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_COALESCE_SET(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)={0x44, r5, 0x1, 0x70bd2f, 0x0, {}, [@ETHTOOL_A_COALESCE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netdevsim0\x00'}]}, @ETHTOOL_A_COALESCE_RX_USECS_IRQ={0x8, 0x4, 0x3}, @ETHTOOL_A_COALESCE_TX_USECS_HIGH={0x8, 0x15, 0xfffffff1}, @ETHTOOL_A_COALESCE_USE_CQE_MODE_TX={0x5, 0x18, 0x1}]}, 0x44}}, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) r6 = socket$inet(0x10, 0x2000000002, 0x0) sendmsg(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000380)="240000002e00074c8bfffd946fa2830022200afffffffffffff000e50c1be3a20400007e280000005e00ff03c81f8374b4a04181f2d0fdcad693d58d31d42c0b3ad0c1846e6db77c292ebfbf", 0x4c}], 0x1}, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/net/veth0/threaded\x00', 0x2, 0x0) write$P9_RREADDIR(r8, &(0x7f0000000140)={0x30, 0x29, 0x1, {0x9}}, 0xb) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000006c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x40000, {0x0, 0x0, 0x0, r7, {0x0, 0xe}, {0xffff, 0xffff}, {0x0, 0xc}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x8, 0xffffff37, 0xc934, 0x0, 0x10001, 0x40003, 0x0, 0x42b, 0x8001}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x10) 10m35.346610264s ago: executing program 2 (id=741): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a48000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a310000000014000480080002403cb140bb0800014000000003080005400000000014000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000cc0)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a30000000050a0300683b8c08000000000a00000a0900010073797a31000000000c0002"], 0x5a}, 0x1, 0x0, 0x0, 0xb0}, 0x20008890) 10m34.919632654s ago: executing program 2 (id=746): write$tun(0xffffffffffffffff, &(0x7f0000000280)=ANY=[@ANYBLOB="04000000ffffffffff"], 0x86) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x121800, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) faccessat2(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6364, 0x200005, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0x10}, {0x1, 0xb}, {0xffff, 0x8}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x4, 0x10, 0x6, 0x8, 0x4fbee}, 0x13, 0x1, 0x3, 0x7, 0x10, 0x4, 0x1b, 0x18, 0x5, 0x402, {0x6, 0x8001, 0xfffffffc, 0x0, 0xffffffff, 0x5}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r4, &(0x7f0000000280)="05", 0x5dc, 0x4009, &(0x7f0000000140)={0x11, 0x8100, r5, 0x1, 0x3, 0x6, @remote}, 0x14) 10m32.645506901s ago: executing program 2 (id=751): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a00)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x64, 0x9, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x84}, @NFTA_SET_DESC={0x20, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_CONCAT={0x1c, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x4, 0x1, 0x1, 0x0, 0x4}]}]}]}]}, @NFT_MSG_NEWSETELEM={0x44, 0xc, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x10, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0xc, 0x1, '\x00\x00\x00\x00\x00\x00\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0xf0}}, 0x0) 10m31.128878741s ago: executing program 2 (id=756): mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='.\x00', 0x0, 0x8b7848, 0x0) mount$bpf(0x200000002000, &(0x7f0000000100)='./file0/../file0\x00', 0x0, 0x80000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x84000, 0x0) 10m30.860776644s ago: executing program 2 (id=760): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000800)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x10000, {{@in=@multicast2, @in=@private=0xa010102, 0x0, 0x0, 0x0, 0x0, 0xa, 0x20, 0x0, 0x33}, {0x20008, 0x10, 0x100000002, 0x0, 0x6, 0xffffffffffffb473, 0xffffffffffffffff, 0x4}, {0x1000000003, 0x2000000000000000, 0x2, 0xffffffffffffffff}, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x3}}, 0xb8}}, 0x4004) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast1=0xe0000002, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x5, 0xfffffffffffffffb}, {0x0, 0x40000000000000, 0x200000000000000}, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) 10m28.784989251s ago: executing program 2 (id=764): socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close(r0) setsockopt$sock_attach_bpf(r1, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close(r2) setsockopt$sock_attach_bpf(r3, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) r4 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000013c0)=[{&(0x7f0000000280)="39000000140081ae0000dc676f97daf01effffff0521018701546fabca1b4e8a06a6580e88370200c5090000009c40ebb3734b49bbc51245e7", 0x39}], 0x1}, 0x0) 10m28.138065792s ago: executing program 33 (id=764): socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close(r0) setsockopt$sock_attach_bpf(r1, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) close(r2) setsockopt$sock_attach_bpf(r3, 0x10f, 0x87, &(0x7f0000000180), 0x4bd) r4 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000013c0)=[{&(0x7f0000000280)="39000000140081ae0000dc676f97daf01effffff0521018701546fabca1b4e8a06a6580e88370200c5090000009c40ebb3734b49bbc51245e7", 0x39}], 0x1}, 0x0) 4m24.502826989s ago: executing program 0 (id=1964): r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4d, &(0x7f0000000100)=0x9, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, 0x0, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000180)={0xa, 0x4e1f, 0xffffffff, @loopback, 0xbf}, 0x1c) recvmmsg(r0, &(0x7f0000000140)=[{{0x0, 0x0, 0x0}, 0xb3}], 0x1, 0x40002000, 0x0) 4m24.333276597s ago: executing program 0 (id=1965): openat$procfs(0xffffffffffffff9c, &(0x7f0000000280)='/proc/crypto\x00', 0x0, 0x0) open(&(0x7f00009e1000)='./file0\x00', 0x149040, 0x40) socket$netlink(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f00000000c0)={0x8, 0xffe, 0x1ff, 0x42000}, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0xf, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="280000005200010004000000000000001c0000001400", @ANYRES16=r0], 0x28}}, 0x0) 4m23.449478898s ago: executing program 0 (id=1967): r0 = socket$inet_tcp(0x2, 0x1, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_emit_ethernet(0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x6, 0x9, &(0x7f00000002c0)={{0xd0e2c5a810d6485, @dev={0xac, 0x14, 0x14, 0x37}, 0x0, 0x2, 'wrr\x00', 0x0, 0x8001, 0x29}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e23, 0x1, 0x54b9, 0xbd47, 0x8}}, 0x44) 4m23.153064262s ago: executing program 0 (id=1971): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_GET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000680)=ANY=[@ANYBLOB], 0x40}, 0x1, 0x0, 0x0, 0x4040081}, 0x4000000) 4m22.98902963s ago: executing program 0 (id=1972): write$tun(0xffffffffffffffff, &(0x7f0000000280)=ANY=[@ANYBLOB="04000000ffffffffffffa2aaaaaaaaaa86dd"], 0x86) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x121800, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) faccessat2(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6364, 0x200005, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r3, {0x0, 0x10}, {0x1, 0xb}, {0xffff, 0x8}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x4, 0x10, 0x6, 0x8, 0x4fbee}, 0x13, 0x1, 0x3, 0x7, 0x10, 0x4, 0x1b, 0x18, 0x5, 0x402, {0x6, 0x8001, 0xfffffffc, 0x0, 0xffffffff, 0x5}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x240048e4}, 0x4890) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r4, 0x0, 0x0, 0x4009, &(0x7f0000000140)={0x11, 0x8100, r5, 0x1, 0x3, 0x6, @remote}, 0x14) 4m21.50233744s ago: executing program 0 (id=1980): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, 0x0, 0x108) 4m20.396487611s ago: executing program 34 (id=1980): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, 0x0, 0x108) 18.220488928s ago: executing program 5 (id=3125): socket$inet_tcp(0x2, 0x1, 0x6) openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x42) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$unix(0x1, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socket$netlink(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x15, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000fcffffff000000008000000018010000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000020000207b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 15.991218882s ago: executing program 5 (id=3128): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, 0x0}, &(0x7f00000007c0)=0x10) sendmsg$nl_route_sched(r1, 0x0, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000100)={'veth1_to_bridge\x00', {0x2, 0x4e24, @rand_addr=0x64010101}}) 15.148892572s ago: executing program 5 (id=3135): bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x19, 0x2000000000000216, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f00000018010000646c6c2400000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000005000000b703000000000000850000000600000095"], 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x1c, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0xc, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x50, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0a000000070000000080000001"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000001c0)={{r0, 0xffffffffffffffff}, &(0x7f00000002c0), &(0x7f0000000280)}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000d0039000000000000b4a518110000", @ANYRES32=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x26, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r2, 0x2000000, 0x7, 0x0, &(0x7f0000000940)="63eced8e46dc92", 0x0, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 14.502230372s ago: executing program 5 (id=3138): socket$inet_tcp(0x2, 0x1, 0x6) openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x42) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$unix(0x1, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socket$netlink(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x15, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000fcffffff000000008000000018010000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000020000207b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 14.435371156s ago: executing program 5 (id=3140): socketpair$unix(0x1, 0x1, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x4e20, @local}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x31) mount(0x0, 0x0, &(0x7f0000000300)='devtmpfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r1, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0xc4042, 0x1ff) listen(0xffffffffffffffff, 0x10) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, &(0x7f0000000100)={0x2, 0x4e20, @local}, 0x10) syz_mount_image$vfat(&(0x7f0000001040), &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f0000001b80)=ANY=[@ANYBLOB="696f636861727365743d63703835372c73686f72746e616d653d77696e6e742c757466383d312c646f733178666c6f7070792c73686f72746e616d653d6d697865642c73686f72746e616d653d6d697865642c756e695f786c6174653d312c757466383d302c726f6469722c636f6465706167653d3935302c756e695f786c6174653d302c6572726f72733d72656d6f756e742d726f3c757466383d312c6e6f6e756d74618b6c3d302c757466383d302c756e695f786c6174653d312c00"], 0x1, 0x2a6, &(0x7f0000001140)="$eJzs3c2KW2UYAOD35D/tIlm4EqEHdOGqdLyCKVJBHBCULNSFFpuCTEIhgUBUjF15BV6BCN6MG/EGvADFnV2IR05OfstJTKQzGfR5Vh/vT7/3+3oms8qZT14ZXj56Mn789MtfotVKonIe5/EsiW5UYunrKPXzb+VxAOCGe5Zl8Xs212oWoel2RX1HZ61y5cMBAFdi4/d/dupZAIDr8f4HH75z/+LiwXtp2ooYfjPpJRGtdf7+4/gsBtGPe9GJPyOylWL91tsXD6KW5rrx2nA26U16EcOPf1z2/xox7z+LTnTL+8/y7u+T2OifTXr1uLXY/3wQ/Xe/i068VN7/RlrY7I9eI15/dWP+u9GJnz6NJzGIR4vZlv1fnaXpm9m3f3zxUR7N+5PZpNdc1S2qq9f2nwIAAAAAAAAAAAAAAAAAAAAAwH/e3XSlu/3+neWL//fk97wfaLbxfp57aZpmSVG/7q/Fy7WonfLsAAAAAAAAAAAAAAAAAAAAcFOMp59fPhwM+qMDFlE5tHj5tf6SVPy1HWlGxCG7N0tTd8qK66X/TjFPVBejDZKII84+Gk/r0Zx3/nNx9ZhbHY2n7Xye/iipxTFd+Ul3X12yirQ3U3ei2CuPtIvFRuTg3X+4Xdzi86lWEVk+XZcPk+hX9t5Yq+wheQGLrOTxq+7sajwfaUf5AfPUnt0bt//VzFlnRyqJiPrqMrdr5j9kt9YPZP3F3mHpx0XjCj6CAAAAAAAAAAAAAAAAAACAhfWXfkuST08wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACcwPrv/x+xmC2ad9Vk1XxRi0XkxEcEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgf+DvAAAA//+zu1nK") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) 12.972634164s ago: executing program 5 (id=3144): capset(&(0x7f0000000000)={0x20080522}, &(0x7f00000003c0)={0x0, 0x0, 0x800, 0x81, 0xffffffff}) bpf$MAP_CREATE(0x0, &(0x7f0000001000)=@base={0x6, 0x4, 0x8, 0xa, 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x50) 4.357533507s ago: executing program 3 (id=3202): syz_emit_ethernet(0x4a, &(0x7f0000000100)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x0, @remote, @local, {[], {{0xfffd, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2, 0x8100}}}}}}}, 0x0) 4.160241976s ago: executing program 3 (id=3205): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f0000000000)="0000000000000002", 0x8) syz_open_dev$vim2m(0x0, 0x0, 0x2) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000b00), 0x0, 0x20004801) socket$inet_sctp(0x2, 0x1, 0x84) syz_emit_vhci(&(0x7f0000000080)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0x4}, @HCI_OP_LE_CLEAR_ACCEPT_LIST={{0x1f}, 0xe}}}, 0x7) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @empty, 0x4}], 0x1c) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r3, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) sendto$inet6(r1, &(0x7f0000000040)='l', 0x1, 0x7ddfdbdfaba51c5d, &(0x7f0000000100)={0xa, 0x4e23, 0x2, @loopback, 0xffffffff}, 0x1c) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="9feb01001a000000000000000000000000000000021a00000000"], 0x0, 0x1a, 0x0, 0x1, 0x1}, 0x28) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000080)=ANY=[@ANYRES32], 0x9) socket(0x10, 0x803, 0x0) ioctl$MON_IOCX_MFETCH(0xffffffffffffffff, 0xc0109207, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x8}) 3.689922098s ago: executing program 7 (id=3207): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000040)={0x200000000000001}, 0x8) 3.281026817s ago: executing program 4 (id=3210): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x32}}, 0x0) getsockname$packet(r1, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000010000507000000000004000000000000", @ANYRES32, @ANYBLOB="00000016010000001800120008000100736974000c0002000800030036"], 0x38}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB="60000000100039042cbd7000eaffffff000003e4", @ANYRES32, @ANYBLOB="8300040000000000400012800800010073697400340002800500090029000000060010000b00000008000c000000008006000d000900000008000300e0"], 0x60}, 0x1, 0x0, 0x0, 0x8000}, 0x4040) 2.759547921s ago: executing program 4 (id=3211): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000004c0)={{{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@loopback, 0xfffffffd, 0x32}, 0x2, @in=@loopback, 0x0, 0x1}}, 0xe8) write(r0, &(0x7f0000000140), 0x0) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000001c0)={@rand_addr=0x64010100, @rand_addr=0x64010100, 0x1, 0xa, [@private=0xa010101, @local, @remote, @rand_addr=0x64010101, @multicast1, @rand_addr=0x64010100, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x2a}, @loopback]}, 0x38) 2.625305768s ago: executing program 7 (id=3212): socket$inet_tcp(0x2, 0x1, 0x6) openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x42) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB], 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$unix(0x1, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socket$netlink(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x15, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000fcffffff000000008000000018010000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000020000207b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 2.623490548s ago: executing program 3 (id=3213): socket$kcm(0x10, 0x2, 0x0) openat$ppp(0xffffffffffffff9c, 0x0, 0x42000, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000003c0)='cdg', 0x3) connect$inet(r0, &(0x7f00000001c0)={0x2, 0x4e20, @loopback}, 0x10) 2.328198251s ago: executing program 3 (id=3215): write$tun(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="0800886300000200b6e7140002004620021600680000030690780a010100e000000194", @ANYRES32=0x41424344, @ANYBLOB], 0x224) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15}, 0x94) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="050000000c0000004200000040"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100), &(0x7f00000001c0), 0x10f0, r0}, 0x38) 2.256460235s ago: executing program 4 (id=3216): r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x205, 0x2) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000000)=@urb_type_bulk={0x3, {0x8, 0x1}, 0x4, 0xa3, 0x0, 0x0, 0x1, 0xb4, 0x5, 0x2, 0xfff, 0x0}) 2.246507925s ago: executing program 7 (id=3217): mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./tracing/dynamic_events\x00', 0x1, 0x0) write(r0, &(0x7f00000002c0)="65486d795fe26defdeed7dda726561645f74b9ffa2e37786fe66e431205f2e760c05f9b2ec4dc32f0c69", 0x2a) 2.113555052s ago: executing program 6 (id=3218): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xf, 0x4, 0x4, 0x100, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xd, 0x9, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3}, [@generic={0xbf, 0x3, 0xa}, @generic={0x7, 0x3, 0x0, 0x0, 0xfffffff8}, @map_fd={0x18, 0x2, 0x1, 0x0, r0}, @generic={0xb7, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x46}]}, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2.015112887s ago: executing program 7 (id=3219): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000000)=[{0xf, 0x6, 0x7, 0xa}, {0x9, 0xa, 0x8, 0x8c}]}, 0x10) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x1) 1.990809647s ago: executing program 4 (id=3220): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0, 0x32}}, 0x0) getsockname$packet(r1, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="3800000010000507000000000004000000000000", @ANYRES32, @ANYBLOB="00000016010000001800120008000100736974000c0002000800030036"], 0x38}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000180)=ANY=[@ANYBLOB="60000000100039042cbd7000eaffffff000003e4", @ANYRES32, @ANYBLOB="8300040000000000400012800800010073697400340002800500090029000000060010000b00000008000c000000008006000d000900000008000300e0"], 0x60}, 0x1, 0x0, 0x0, 0x8000}, 0x4040) 1.869596993s ago: executing program 3 (id=3221): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r3, 0x1, 0x3c, &(0x7f0000000040)={0x200000000000001}, 0x8) 1.844222545s ago: executing program 6 (id=3222): r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmsg$802154_dgram(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x44090}, 0x80) 1.762525208s ago: executing program 7 (id=3223): r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000020303000000000000000000000100000800010001"], 0x1c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, 0x2, 0x3, 0x3, 0x0, 0x0, {0x0, 0x0, 0x10}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}]}, 0x1c}}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x2b0, 0x0, 0x2b8, 0x25c, 0xf0, 0x7, 0x1e0, 0x3a8, 0x3a8, 0x1e0, 0x3a8, 0x7fffffe, 0x0, {[{{@ipv6={@private1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, [0xff, 0x0, 0xffffffff], [], 'macvlan1\x00', 'dvmrp0\x00', {}, {}, 0x0, 0x0, 0x4, 0x2}, 0x16c, 0xa8, 0xf0, 0xa010000}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0xfffffffb}}}, {{@ipv6={@ipv4={'\x00', '\xff\xff', @local}, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', [0xffffff00, 0xffffff00, 0xffffff], [0xff000000, 0xff000000, 0xff, 0xffffff00], 'veth0_virt_wifi\x00', 'wlan1\x00', {0xff}, {0xff}, 0x88, 0xa, 0x5, 0x40}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x310) close(r0) socket$inet6_sctp(0xa, 0x5, 0x84) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000006800e97800000000000000000a0000000000000004000400b6a7706a0b3bb3e1505c2f2166e68bfd7b004e0d7d"], 0x1c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newnexthop={0x24, 0x68, 0x1, 0x2, 0x7ffffffc, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x4}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x24008000}, 0x4000) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@delnexthop={0x20, 0x69, 0xb, 0xfffffffd, 0x0, {}, [{0x8, 0x1, 0x1}]}, 0x20}}, 0x4000000) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000040)='./bus\x00', 0x10, &(0x7f0000000340)=ANY=[], 0x1, 0x251, &(0x7f0000000540)="$eJzs2s9rHGUYB/BnaktiaroRf9GC+KIH9TI08eqhQVoQA4o2QhWkUzPRJeNuyCyBFTE56dU/wbN49CZIj15y8S/w4C0gOVYQR8zGdHeJlGB1l/bzuezDPvNdnnfn3eU9zP6rX32ysV7n60UvzmRZZFdiN+5ksRBn4m+78fKLN3589p0b772xvLJy9e2Uri1fX1xKKV147of3P/v2+du98+9+d+H7mdhb+GD/YOmXvaf3Lu7/cf3jdp3adep0e6lIt7rdXnGrKtNau97IU3qrKou6TO1OXW6N9Ner7uZmPxWdtfm5za2yrlPR6aeNsp963dTb6qfio6LdSXmep/m54N9Y/eZO08RBc+5mNE3z6Ndx/nbM/xytyB5P2RNXsqduZs/sZhcPmqY16VH5T7j/D7ehP/XZiOrL7dXt1cHroL+8Hu2ooozL0Yrf469tcmRQX3t95erldGghvqh2jvI726uPjOYXoxULJ+cXB/lzo/mZmBvOL0UrnozsaOyR/NIgn0bzs/HSC0P5PFrx04fRjSrWDj/gbv7zxZRee3NlLH/p8DoAgAdNno6deH7L83/qD/KnOB+Ona/OxqWzk107EXX/042iqsqtexWzce9rpre438PvnOarUwwVsxExBWMcF78e/RDGWjP3ZdftRhy/88pj07LkseK3pmlOGp6HwN2bPulJAAAAAAAAAAAAOI3/4wHDSa8RAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACYbn8GAAD///z+yAU=") r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./file2\x00', 0x105040, 0x198) setreuid(0xee01, 0xee01) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r6, 0x40047211, &(0x7f0000000400)) setsockopt$sock_linger(r5, 0x1, 0xd, &(0x7f00000000c0)={0x1}, 0x8) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4, @multicast2}, 0x10) 1.630318884s ago: executing program 4 (id=3224): r0 = socket$inet(0xa, 0x801, 0x84) listen(r0, 0xfffffffd) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r2, 0x1, &(0x7f0000000300)=[&(0x7f0000000380)={0x0, 0x0, 0x0, 0x5, 0x6, r1, 0x0}]) 1.515710169s ago: executing program 6 (id=3225): syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) prlimit64(0x0, 0x7, &(0x7f0000000440)={0x4, 0x9b}, 0x0) socket$kcm(0x21, 0x2, 0xa) 1.088622389s ago: executing program 7 (id=3226): socket$inet_tcp(0x2, 0x1, 0x6) openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x42) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="03000000040000"], 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$unix(0x1, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socket$netlink(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x1f, 0x15, &(0x7f0000000580)=ANY=[@ANYBLOB="18000000fcffffff000000008000000018010000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000020000207b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) 1.0862158s ago: executing program 4 (id=3227): socketpair$unix(0x1, 0x1, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x4e20, @local}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xa, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x8) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x31) mount(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x1214040, 0x0) mount$overlay(0x0, 0x0, &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r1, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0xc4042, 0x1ff) listen(0xffffffffffffffff, 0x10) r2 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r2, &(0x7f0000000100)={0x2, 0x4e20, @local}, 0x10) syz_mount_image$vfat(&(0x7f0000001040), &(0x7f0000000240)='./file0\x00', 0x0, &(0x7f0000001b80)=ANY=[@ANYBLOB="696f636861727365743d63703835372c73686f72746e616d653d77696e6e742c757466383d312c646f733178666c6f7070792c73686f72746e616d653d6d697865642c73686f72746e616d653d6d697865642c756e695f786c6174653d312c757466383d302c726f6469722c636f6465706167653d3935302c756e695f786c6174653d302c6572726f72733d72656d6f756e742d726f3c757466383d312c6e6f6e756d74618b6c3d302c757466383d302c756e695f786c6174653d312c00"], 0x1, 0x2a6, &(0x7f0000001140)="$eJzs3c2KW2UYAOD35D/tIlm4EqEHdOGqdLyCKVJBHBCULNSFFpuCTEIhgUBUjF15BV6BCN6MG/EGvADFnV2IR05OfstJTKQzGfR5Vh/vT7/3+3oms8qZT14ZXj56Mn789MtfotVKonIe5/EsiW5UYunrKPXzb+VxAOCGe5Zl8Xs212oWoel2RX1HZ61y5cMBAFdi4/d/dupZAIDr8f4HH75z/+LiwXtp2ooYfjPpJRGtdf7+4/gsBtGPe9GJPyOylWL91tsXD6KW5rrx2nA26U16EcOPf1z2/xox7z+LTnTL+8/y7u+T2OifTXr1uLXY/3wQ/Xe/i068VN7/RlrY7I9eI15/dWP+u9GJnz6NJzGIR4vZlv1fnaXpm9m3f3zxUR7N+5PZpNdc1S2qq9f2nwIAAAAAAAAAAAAAAAAAAAAAwH/e3XSlu/3+neWL//fk97wfaLbxfp57aZpmSVG/7q/Fy7WonfLsAAAAAAAAAAAAAAAAAAAAcFOMp59fPhwM+qMDFlE5tHj5tf6SVPy1HWlGxCG7N0tTd8qK66X/TjFPVBejDZKII84+Gk/r0Zx3/nNx9ZhbHY2n7Xye/iipxTFd+Ul3X12yirQ3U3ei2CuPtIvFRuTg3X+4Xdzi86lWEVk+XZcPk+hX9t5Yq+wheQGLrOTxq+7sajwfaUf5AfPUnt0bt//VzFlnRyqJiPrqMrdr5j9kt9YPZP3F3mHpx0XjCj6CAAAAAAAAAAAAAAAAAACAhfWXfkuST08wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACcwPrv/x+xmC2ad9Vk1XxRi0XkxEcEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgf+DvAAAA//+zu1nK") openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.io_service_time_recursive\x00', 0x275a, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) 1.061089651s ago: executing program 6 (id=3228): mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./tracing/dynamic_events\x00', 0x1, 0x0) write(r0, &(0x7f00000002c0)="65486d795fe26defdeed7dda726561645f74b9ffa2e37786fe66e431205f2e760c05f9b2ec4dc32f0c69", 0x2a) 426.76662ms ago: executing program 3 (id=3229): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x82c03, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0x88, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0xfff3}, {}, {0x8, 0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x58, 0x2, [@TCA_BASIC_ACT={0x54, 0x3, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x6, 0x60000000, 0xffffffffffffffff, 0x1, 0x7}, 0x2, r3}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x8080) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000600), 0x56) sendmsg$kcm(r6, &(0x7f0000000280)={&(0x7f0000000540)=@xdp={0x2c, 0x0, r5, 0x42}, 0x80, &(0x7f0000000440)=[{&(0x7f00000001c0)="27030200dc0f14000e0003000024c1020000ff1107c2fb7fe0400018534b4f6b3d327db412f40000000000000000", 0x2e}], 0x1}, 0x4005) 73.237137ms ago: executing program 6 (id=3230): timer_create(0x3, 0x0, &(0x7f0000000040)=0x0) ioctl$SIOCX25SCALLUSERDATA(0xffffffffffffffff, 0x89e5, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) write(0xffffffffffffffff, 0x0, 0x0) timer_gettime(r0, &(0x7f0000000080)) 0s ago: executing program 6 (id=3231): sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x28, 0x2, 0x3, 0x101, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0x0, 0x2}}]}, 0x28}}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000080)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @remote, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x10, 0x0, 0x0, 0x7}}}}}}, 0x0) kernel console output (not intermixed with test programs): 295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12537 comm="syz.3.2314" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdacbf9e159 code=0x7ffc0000 [ 731.264105][ T26] audit: type=1326 audit(1789948556.424:232): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12537 comm="syz.3.2314" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdacbf9e159 code=0x7ffc0000 [ 731.432803][ T26] audit: type=1326 audit(1789948557.844:233): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12537 comm="syz.3.2314" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7fdacbf9e159 code=0x7ffc0000 [ 731.495535][T12551] scsi_dev_info_list_add_str: bad dev info string 'F P?o;I5ozo"Ӣژ' 'rTegɁxRrba* [ 731.495535][T12551] HƬ`UbE6X,Yud,^5hUaי' ^)OlRqGVA4!y ѐS [ 731.495535][T12551] '@H>3&w' '(null)' [ 731.551231][ T26] audit: type=1326 audit(1789948557.844:234): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12537 comm="syz.3.2314" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdacbf9e159 code=0x7ffc0000 [ 731.587139][ T26] audit: type=1326 audit(1789948557.844:235): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12537 comm="syz.3.2314" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdacbf9e159 code=0x7ffc0000 [ 732.023682][T12569] loop5: detected capacity change from 0 to 512 [ 732.098184][T12569] EXT4-fs error (device loop5): ext4_orphan_get:1409: inode #15: comm syz.5.2323: iget: bad i_size value: 38620345925642 [ 732.122848][T12569] EXT4-fs error (device loop5): ext4_orphan_get:1414: comm syz.5.2323: couldn't read orphan inode 15 (err -117) [ 732.142201][T12569] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 732.320071][ T4693] EXT4-fs error (device loop5): ext4_validate_block_bitmap:429: comm kworker/u4:13: bg 0: block 5: invalid block bitmap [ 732.618747][ T4693] EXT4-fs (loop5): Delayed block allocation failed for inode 18 at logical offset 131587 with max blocks 1 with error 28 [ 732.654137][ T4693] EXT4-fs (loop5): This should not happen!! Data will be lost [ 732.654137][ T4693] [ 732.664457][ T4693] EXT4-fs (loop5): Total free blocks count 0 [ 732.678427][T12577] loop6: detected capacity change from 0 to 256 [ 732.703490][ T4693] EXT4-fs (loop5): Free/Dirty block details [ 732.715900][T12577] FAT-fs (loop6): Unrecognized mount option "errors=remount-ro3&w' '(null)' [ 735.412689][T12618] loop7: detected capacity change from 0 to 512 [ 735.556477][T12618] EXT4-fs (loop7): 1 orphan inode deleted [ 735.565826][T12618] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 735.575498][ T4302] Quota error (device loop7): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 735.612821][ T4302] EXT4-fs error (device loop7): ext4_release_dquot:6877: comm kworker/u4:5: Failed to release dquot type 1 [ 735.662944][T12618] ext4 filesystem being mounted at /46/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 736.106205][T11423] EXT4-fs (loop7): unmounting filesystem. [ 737.922459][ T14] hid-generic 0000:0000:0000.0005: unknown main item tag 0x0 [ 737.965461][T12650] loop6: detected capacity change from 0 to 512 [ 737.973313][ T14] hid-generic 0000:0000:0000.0005: hidraw0: HID v0.00 Device [syz1] on syz0 [ 738.043223][T12650] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 738.133597][T12650] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c118, mo2=0002] [ 738.158622][T12650] System zones: 1-12 [ 738.174561][T12650] EXT4-fs error (device loop6): ext4_orphan_get:1435: comm syz.6.2346: bad orphan inode 131072 [ 738.234861][T12650] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 738.455295][ T7013] EXT4-fs (loop6): unmounting filesystem. [ 738.647894][T12666] loop5: detected capacity change from 0 to 128 [ 738.693336][T12666] FAT-fs (loop5): Unrecognized mount option "" or missing value [ 740.670562][T12677] loop3: detected capacity change from 0 to 512 [ 740.794647][T12677] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349) [ 740.894433][T12677] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=c802e02c, mo2=0002] [ 740.903544][T12677] EXT4-fs (loop3): orphan cleanup on readonly fs [ 741.040146][T12677] EXT4-fs error (device loop3): ext4_validate_block_bitmap:438: comm syz.3.2354: bg 0: block 361: padding at end of block bitmap is not set [ 741.133272][T12696] scsi_dev_info_list_add_str: bad dev info string 'F P?o;I5ozo"Ӣژ' 'rTegɁxRrba* [ 741.133272][T12696] HƬ`UbE6X,Yud,^5hUaי' ^)OlRqGVA4!y ѐS [ 741.133272][T12696] '@H>3&w' '(null)' [ 741.154167][T12677] EXT4-fs (loop3): Remounting filesystem read-only [ 741.234466][T12697] siw: device registration error -23 [ 741.284259][T12677] EXT4-fs error (device loop3) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 741.396722][T12677] EXT4-fs (loop3): Remounting filesystem read-only [ 741.496248][T12677] EXT4-fs error (device loop3): ext4_clear_blocks:883: inode #11: comm syz.3.2354: attempt to clear invalid blocks 33619980 len 1 [ 741.670950][T12677] EXT4-fs (loop3): Remounting filesystem read-only [ 741.971687][T12677] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #11: comm syz.3.2354: invalid indirect mapped block 1811939328 (level 0) [ 742.012077][T12677] EXT4-fs (loop3): Remounting filesystem read-only [ 742.027350][T12677] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #11: comm syz.3.2354: invalid indirect mapped block 2185560079 (level 1) [ 742.072050][T12677] EXT4-fs (loop3): Remounting filesystem read-only [ 742.090328][T12677] EXT4-fs (loop3): 1 truncate cleaned up [ 742.096233][T12677] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 742.131938][ T4272] EXT4-fs (loop3): unmounting filesystem. [ 742.385833][ T4321] hid-generic 0000:0000:0000.0006: unknown main item tag 0x0 [ 742.429676][ T4321] hid-generic 0000:0000:0000.0006: hidraw0: HID v0.00 Device [syz1] on syz0 [ 742.448091][T12714] loop6: detected capacity change from 0 to 128 [ 742.488762][T12714] FAT-fs (loop6): Unrecognized mount option "" or missing value [ 742.611703][T12720] loop3: detected capacity change from 0 to 128 [ 744.663320][T12739] scsi_dev_info_list_add_str: bad dev info string 'F P?o;I5ozo"Ӣژ' 'rTegɁxRrba* [ 744.663320][T12739] HƬ`UbE6X,Yud,^5hUaי' ^)OlRqGVA4!y ѐS [ 744.663320][T12739] '@H>3&w' '(null)' [ 744.807903][T12736] FAULT_INJECTION: forcing a failure. [ 744.807903][T12736] name failslab, interval 1, probability 0, space 0, times 0 [ 744.866421][T12736] CPU: 1 PID: 12736 Comm: syz.5.2358 Not tainted syzkaller #0 [ 744.873981][T12736] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 744.884116][T12736] Call Trace: [ 744.887448][T12736] [ 744.890425][T12736] dump_stack_lvl+0x188/0x24e [ 744.895170][T12736] ? show_regs_print_info+0x12/0x12 [ 744.900454][T12736] ? load_image+0x410/0x410 [ 744.905028][T12736] ? __might_sleep+0xd0/0xd0 [ 744.909673][T12736] ? __lock_acquire+0x7c40/0x7c40 [ 744.914771][T12736] should_fail_ex+0x390/0x4c0 [ 744.919513][T12736] should_failslab+0x5/0x20 [ 744.924066][T12736] slab_pre_alloc_hook+0x59/0x300 [ 744.929152][T12736] ? kvmalloc_node+0x6c/0x180 [ 744.933894][T12736] __kmem_cache_alloc_node+0x4f/0x270 [ 744.939340][T12736] ? kvmalloc_node+0x6c/0x180 [ 744.944093][T12736] __kmalloc_node+0xa2/0x240 [ 744.948786][T12736] kvmalloc_node+0x6c/0x180 [ 744.953357][T12736] pfifo_fast_init+0x234/0x6a0 [ 744.958203][T12736] qdisc_create_dflt+0x11a/0x490 [ 744.963226][T12736] mq_init+0x2c3/0x650 [ 744.967394][T12736] ? trace_net_dev_xmit_timeout+0x240/0x240 [ 744.973370][T12736] ? qdisc_alloc+0x776/0xa40 [ 744.978033][T12736] qdisc_create_dflt+0x11a/0x490 [ 744.983063][T12736] ? dev_activate+0x1b7/0x1150 [ 744.987895][T12736] dev_activate+0x1dc/0x1150 [ 744.992562][T12736] __dev_open+0x343/0x430 [ 744.996965][T12736] ? dev_open+0x190/0x190 [ 745.001372][T12736] __dev_change_flags+0x1e4/0x6a0 [ 745.006469][T12736] ? trace_raw_output_contention_end+0xd0/0xd0 [ 745.012698][T12736] ? dev_get_flags+0x1c0/0x1c0 [ 745.017532][T12736] ? rcu_is_watching+0x11/0xa0 [ 745.022373][T12736] ? trace_contention_end+0x5f/0x170 [ 745.027731][T12736] dev_change_flags+0x78/0x1a0 [ 745.032597][T12736] dev_ifsioc+0x130/0xd50 [ 745.036988][T12736] ? dev_ioctl+0xe80/0xe80 [ 745.041505][T12736] ? apparmor_capable+0x12c/0x190 [ 745.046592][T12736] ? full_name_hash+0x8e/0xe0 [ 745.051332][T12736] ? dev_load+0x1d/0x1e0 [ 745.055640][T12736] ? dev_load+0x1d/0x1e0 [ 745.059943][T12736] dev_ioctl+0x55e/0xe80 [ 745.064242][T12736] sock_do_ioctl+0x245/0x320 [ 745.068897][T12736] ? sock_show_fdinfo+0xb0/0xb0 [ 745.073815][T12736] sock_ioctl+0x48a/0x700 [ 745.078215][T12736] ? sock_poll+0x420/0x420 [ 745.082703][T12736] ? bpf_lsm_file_ioctl+0x5/0x10 [ 745.087713][T12736] ? security_file_ioctl+0x7c/0xa0 [ 745.092880][T12736] ? sock_poll+0x420/0x420 [ 745.097354][T12736] __se_sys_ioctl+0xfa/0x170 [ 745.102017][T12736] do_syscall_64+0x4c/0xa0 [ 745.106488][T12736] ? clear_bhb_loop+0x60/0xb0 [ 745.111212][T12736] ? clear_bhb_loop+0x60/0xb0 [ 745.115945][T12736] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 745.121906][T12736] RIP: 0033:0x7fae29b9e159 [ 745.126373][T12736] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 745.146036][T12736] RSP: 002b:00007fae2a986028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 745.154520][T12736] RAX: ffffffffffffffda RBX: 00007fae29e25fa0 RCX: 00007fae29b9e159 [ 745.162543][T12736] RDX: 00002000000000c0 RSI: 0000000000008914 RDI: 0000000000000005 [ 745.170576][T12736] RBP: 00007fae29c3506b R08: 0000000000000000 R09: 0000000000000000 [ 745.178610][T12736] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 745.186639][T12736] R13: 00007fae29e26038 R14: 00007fae29e25fa0 R15: 00007ffc79bfad18 [ 745.194691][T12736] [ 745.276440][T12747] random: crng reseeded on system resumption [ 745.322191][T12749] FAULT_INJECTION: forcing a failure. [ 745.322191][T12749] name failslab, interval 1, probability 0, space 0, times 0 [ 745.335825][T12749] CPU: 1 PID: 12749 Comm: syz.6.2369 Not tainted syzkaller #0 [ 745.343357][T12749] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 745.353557][T12749] Call Trace: [ 745.356881][T12749] [ 745.359859][T12749] dump_stack_lvl+0x188/0x24e [ 745.364592][T12749] ? show_regs_print_info+0x12/0x12 [ 745.369846][T12749] ? load_image+0x410/0x410 [ 745.374417][T12749] ? __might_sleep+0xd0/0xd0 [ 745.379064][T12749] ? __lock_acquire+0x7c40/0x7c40 [ 745.384217][T12749] should_fail_ex+0x390/0x4c0 [ 745.389213][T12749] should_failslab+0x5/0x20 [ 745.393792][T12749] slab_pre_alloc_hook+0x59/0x300 [ 745.398902][T12749] ? x509_cert_parse+0x3b4/0x7a0 [ 745.404194][T12749] __kmem_cache_alloc_node+0x4f/0x270 [ 745.409652][T12749] ? x509_cert_parse+0x3b4/0x7a0 [ 745.414685][T12749] __kmalloc_node_track_caller+0xa0/0x240 [ 745.420485][T12749] kmemdup+0x27/0x60 [ 745.424452][T12749] x509_cert_parse+0x3b4/0x7a0 [ 745.429287][T12749] x509_key_preparse+0x60/0x660 [ 745.434202][T12749] ? down_read+0x1a8/0x2d0 [ 745.438759][T12749] asymmetric_key_preparse+0xa5/0x140 [ 745.444197][T12749] key_create_or_update+0x432/0xa40 [ 745.449460][T12749] ? security_key_permission+0x7c/0xa0 [ 745.454994][T12749] ? key_type_put+0x20/0x20 [ 745.459562][T12749] ? lookup_user_key_possessed+0x40/0x40 [ 745.465287][T12749] ? __might_fault+0xc2/0x120 [ 745.470032][T12749] ? __might_fault+0xa6/0x120 [ 745.474774][T12749] __se_sys_add_key+0x34b/0x410 [ 745.479684][T12749] ? __x64_sys_add_key+0xc0/0xc0 [ 745.484686][T12749] ? lockdep_hardirqs_on+0x94/0x140 [ 745.489952][T12749] ? __x64_sys_add_key+0x1c/0xc0 [ 745.494952][T12749] do_syscall_64+0x4c/0xa0 [ 745.499423][T12749] ? clear_bhb_loop+0x60/0xb0 [ 745.504157][T12749] ? clear_bhb_loop+0x60/0xb0 [ 745.508898][T12749] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 745.514862][T12749] RIP: 0033:0x7fee3a19e159 [ 745.519334][T12749] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 745.539432][T12749] RSP: 002b:00007fee3b073028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 745.547910][T12749] RAX: ffffffffffffffda RBX: 00007fee3a426090 RCX: 00007fee3a19e159 [ 745.555941][T12749] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 745.563965][T12749] RBP: 00007fee3a23506b R08: ffffffffffffffff R09: 0000000000000000 [ 745.572000][T12749] R10: 0000000000000559 R11: 0000000000000246 R12: 0000000000000000 [ 745.580044][T12749] R13: 00007fee3a426128 R14: 00007fee3a426090 R15: 00007ffde76194b8 [ 745.588103][T12749] [ 746.168881][T12736] syzkaller0: default qdisc (pfifo_fast) fail, fallback to noqueue [ 746.804672][T12763] netlink: 32 bytes leftover after parsing attributes in process `syz.6.2376'. [ 747.153206][T12763] netlink: 32 bytes leftover after parsing attributes in process `syz.6.2376'. [ 747.172379][T12774] loop7: detected capacity change from 0 to 512 [ 747.195827][T12774] EXT4-fs: Ignoring removed i_version option [ 747.226169][T12774] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 747.276763][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.283455][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.402178][T12779] loop3: detected capacity change from 0 to 128 [ 748.875476][T12779] FAT-fs (loop3): Unrecognized mount option "" or missing value [ 748.938656][T12774] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 748.996977][T12774] ext4 filesystem being mounted at /57/dev supports timestamps until 2038-01-19 (0x7fffffff) [ 749.008626][ T8038] I/O error, dev loop3, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 749.294818][T12774] EXT4-fs error (device loop7): ext4_validate_block_bitmap:438: comm syz.7.2380: bg 0: block 217: padding at end of block bitmap is not set [ 749.500172][T11423] EXT4-fs (loop7): unmounting filesystem. [ 749.668762][T12805] scsi_dev_info_list_add_str: bad dev info string 'F P?o;I5ozo"Ӣژ' 'rTegɁxRrba* [ 749.668762][T12805] HƬ`UbE6X,Yud,^5hUaי' ^)OlRqGVA4!y ѐS [ 749.668762][T12805] '@H>3&wk' '(null)' [ 750.126433][T12810] loop7: detected capacity change from 0 to 512 [ 750.199196][T12810] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 750.207835][ T8857] hid-generic 0000:0000:0000.0007: unknown main item tag 0x0 [ 750.226762][T12810] ext4 filesystem being mounted at /60/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 750.233360][ T8857] hid-generic 0000:0000:0000.0007: hidraw0: HID v0.00 Device [syz1] on syz0 [ 750.443833][T11423] EXT4-fs (loop7): unmounting filesystem. [ 753.771200][T12819] siw: device registration error -23 [ 755.928617][T12847] scsi_dev_info_list_add_str: bad dev info string 'F P?o;I5ozo"Ӣژ' 'rTegɁxRrba* [ 755.928617][T12847] HƬ`UbE6X,Yud,^5hUaי' ^)OlRqGVA4!y ѐS [ 755.928617][T12847] '@H>3&wk' '(null)' [ 756.132327][T12851] IPVS: Error connecting to the multicast addr [ 756.483303][T12861] loop4: detected capacity change from 0 to 128 [ 756.527018][T12861] FAT-fs (loop4): Unrecognized mount option "" or missing value [ 756.611223][ T127] hid-generic 0000:0000:0000.0008: unknown main item tag 0x0 [ 756.630559][ T127] hid-generic 0000:0000:0000.0008: hidraw0: HID v0.00 Device [syz1] on syz0 [ 757.103721][T12877] 9pnet_fd: Insufficient options for proto=fd [ 759.112775][T12897] scsi_dev_info_list_add_str: bad dev info string 'F P?o;I5ozo"Ӣژ' 'rTegɁxRrba* [ 759.112775][T12897] HƬ`UbE6X,Yud,^5hUaי' ^)OlRqGVA4!y ѐS [ 759.112775][T12897] '@H>3&wk' '(null)' [ 759.287463][T12904] loop6: detected capacity change from 0 to 512 [ 759.320382][T12904] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 759.373893][T12903] loop5: detected capacity change from 0 to 2048 [ 759.408731][T12904] EXT4-fs (loop6): 1 truncate cleaned up [ 759.474279][T12904] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 759.571745][T12903] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 760.027263][T12919] loop3: detected capacity change from 0 to 256 [ 760.036914][T12919] FAT-fs (loop3): Unrecognized mount option "errors=remount-ro HID v0.00 Device [syz1] on syz0 [ 770.974384][T13010] EXT4-fs error (device loop5): ext4_xattr_inode_iget:406: comm syz.5.2436: error while reading EA inode 2 err=-117 [ 771.062802][T13010] EXT4-fs (loop5): 1 orphan inode deleted [ 771.089232][T13010] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 771.136376][T13022] loop4: detected capacity change from 0 to 512 [ 771.184315][T13022] EXT4-fs (loop4): ext4_check_descriptors: Block bitmap for group 0 not in group (block 2)! [ 771.226335][T13022] EXT4-fs (loop4): group descriptors corrupted! [ 771.649646][ T26] audit: type=1800 audit(1789948598.364:237): pid=13010 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.2436" name="bus" dev="loop5" ino=18 res=0 errno=0 [ 772.066237][T13031] loop4: detected capacity change from 0 to 512 [ 772.085446][T13031] ext3: Unknown parameter 'fsname' [ 772.650897][ T26] audit: type=1800 audit(1789948599.364:238): pid=13053 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.7.2444" name=08 dev="sda1" ino=2054 res=0 errno=0 [ 772.961646][T13039] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input16 [ 773.252503][T13064] 9pnet_fd: Insufficient options for proto=fd [ 773.380614][ T4669] EXT4-fs (loop5): unmounting filesystem. [ 773.527556][T13070] netlink: 72 bytes leftover after parsing attributes in process `syz.5.2448'. [ 774.559545][T13078] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 774.587185][T13078] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 774.637561][T13078] Bluetooth: hci2: Suspend notifier action (1) failed: -4 [ 774.654300][T13078] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 774.682374][T13078] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 774.710648][T13078] Bluetooth: hci0: Suspend notifier action (1) failed: -4 [ 774.833130][T13098] 9pnet_fd: Insufficient options for proto=fd [ 774.970499][T13103] device batadv_slave_1 entered promiscuous mode [ 774.982595][T13104] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2462'. [ 775.029039][T13103] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2463'. [ 775.531501][T13103] device batadv_slave_1 left promiscuous mode [ 775.924197][ T9736] Bluetooth: hci2: command 0x0c1a tx timeout [ 776.714089][ T9736] Bluetooth: hci0: command 0x0c1a tx timeout [ 777.651101][T13123] loop6: detected capacity change from 0 to 256 [ 777.661081][T13123] FAT-fs (loop6): Unrecognized mount option "errors=remount-ro HID v0.00 Device [syz1] on syz0 [ 783.079233][T13211] loop3: detected capacity change from 0 to 512 [ 783.161519][T13211] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 783.251934][ T9736] Bluetooth: hci0: unexpected event for opcode 0x2010 [ 783.262799][T13211] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c118, mo2=0002] [ 783.309112][T13212] fido_id[13212]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 783.319365][T13211] System zones: 1-12 [ 783.545945][T13211] EXT4-fs error (device loop3): ext4_orphan_get:1435: comm syz.3.2500: bad orphan inode 131072 [ 783.595478][T13211] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 783.611642][T13222] loop5: detected capacity change from 0 to 128 [ 784.761642][ T4272] EXT4-fs (loop3): unmounting filesystem. [ 785.086287][T13236] loop5: detected capacity change from 0 to 256 [ 785.096106][T13236] FAT-fs (loop5): Unrecognized mount option "errors=remount-ro HID v0.00 Device [syz1] on syz0 [ 786.544721][T13256] loop7: detected capacity change from 0 to 512 [ 786.742874][T13250] fido_id[13250]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 786.758246][T13256] EXT4-fs (loop7): encrypted files will use data=ordered instead of data journaling mode [ 786.776549][T13256] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c118, mo2=0002] [ 786.786077][T13256] System zones: 1-12 [ 786.835601][T13256] EXT4-fs error (device loop7): ext4_orphan_get:1435: comm syz.7.2515: bad orphan inode 131072 [ 786.874180][T13256] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none. [ 787.927077][T11423] EXT4-fs (loop7): unmounting filesystem. [ 788.779820][ T127] hid-generic 0000:0000:0000.000C: unknown main item tag 0x0 [ 788.809459][ T127] hid-generic 0000:0000:0000.000C: hidraw0: HID v0.00 Device [syz1] on syz0 [ 789.187354][T13289] fido_id[13289]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 789.276811][T13292] loop6: detected capacity change from 0 to 2048 [ 789.400746][T13292] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 789.738833][T13303] loop7: detected capacity change from 0 to 512 [ 789.774737][T13303] EXT4-fs (loop7): encrypted files will use data=ordered instead of data journaling mode [ 789.830684][T13303] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c118, mo2=0002] [ 789.851416][T13303] System zones: 1-12 [ 789.882939][T13303] EXT4-fs error (device loop7): ext4_orphan_get:1435: comm syz.7.2532: bad orphan inode 131072 [ 789.914875][T13303] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: none. [ 790.059482][ T7013] EXT4-fs (loop6): unmounting filesystem. [ 790.138790][T11423] EXT4-fs (loop7): unmounting filesystem. [ 790.400823][T13311] loop5: detected capacity change from 0 to 512 [ 790.436222][T13311] EXT4-fs (loop5): feature flags set on rev 0 fs, running e2fsck is recommended [ 790.505326][T13311] EXT4-fs (loop5): warning: maximal mount count reached, running e2fsck is recommended [ 790.660489][T13311] EXT4-fs error (device loop5): ext4_orphan_get:1409: comm syz.5.2535: inode #15: comm syz.5.2535: iget: illegal inode # [ 790.680950][T13311] EXT4-fs (loop5): Remounting filesystem read-only [ 790.700545][T13311] EXT4-fs error (device loop5): ext4_orphan_get:1414: comm syz.5.2535: couldn't read orphan inode 15 (err -117) [ 790.914217][T13311] EXT4-fs (loop5): Remounting filesystem read-only [ 791.704091][T13311] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 791.765597][T13263] EXT4-fs error (device loop5): ext4_validate_block_bitmap:429: comm ext4lazyinit: bg 0: block 19: invalid block bitmap [ 791.938664][T13263] EXT4-fs (loop5): Remounting filesystem read-only [ 792.200320][ T7266] hid-generic 0000:0000:0000.000D: unknown main item tag 0x0 [ 792.256867][ T7266] hid-generic 0000:0000:0000.000D: hidraw0: HID v0.00 Device [syz1] on syz0 [ 792.607838][T13332] Config c/1 of g1 needs at least one function. [ 792.634316][T13332] udc usbip-vudc.0: failed to start g1: -22 [ 792.640553][T13332] configfs-gadget.g1: probe of gadget.32 failed with error -22 [ 792.659046][ T4669] EXT4-fs (loop5): unmounting filesystem. [ 792.716796][T13332] UDC core: g1: couldn't find an available UDC or it's busy [ 792.762490][T13330] fido_id[13330]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 792.936333][T13340] loop5: detected capacity change from 0 to 512 [ 793.025338][T13340] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 793.109450][T13340] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c118, mo2=0002] [ 793.214258][T13340] System zones: 1-12 [ 793.226006][T13340] EXT4-fs error (device loop5): ext4_orphan_get:1435: comm syz.5.2544: bad orphan inode 131072 [ 793.279653][T13340] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 793.557446][ T4669] EXT4-fs (loop5): unmounting filesystem. [ 793.713549][T13355] FAULT_INJECTION: forcing a failure. [ 793.713549][T13355] name failslab, interval 1, probability 0, space 0, times 0 [ 793.727493][T13355] CPU: 1 PID: 13355 Comm: syz.5.2549 Not tainted syzkaller #0 [ 793.735029][T13355] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 793.745129][T13355] Call Trace: [ 793.748501][T13355] [ 793.751458][T13355] dump_stack_lvl+0x188/0x24e [ 793.756171][T13355] ? show_regs_print_info+0x12/0x12 [ 793.761389][T13355] ? load_image+0x410/0x410 [ 793.765925][T13355] ? __might_sleep+0xd0/0xd0 [ 793.770552][T13355] ? __lock_acquire+0x7c40/0x7c40 [ 793.775664][T13355] should_fail_ex+0x390/0x4c0 [ 793.780382][T13355] should_failslab+0x5/0x20 [ 793.784920][T13355] slab_pre_alloc_hook+0x59/0x300 [ 793.790003][T13355] kmem_cache_alloc_lru+0x49/0x2e0 [ 793.795258][T13355] ? shmem_alloc_inode+0x24/0x40 [ 793.800259][T13355] shmem_alloc_inode+0x24/0x40 [ 793.805237][T13355] ? shmem_match+0x160/0x160 [ 793.809864][T13355] new_inode_pseudo+0x5f/0x1c0 [ 793.814656][T13355] new_inode+0x25/0x1d0 [ 793.818849][T13355] shmem_get_inode+0x327/0xbc0 [ 793.823698][T13355] shmem_mknod+0x54/0x1c0 [ 793.828077][T13355] shmem_mkdir+0x27/0x60 [ 793.832349][T13355] vfs_mkdir+0x386/0x570 [ 793.836634][T13355] do_mkdirat+0x1d8/0x440 [ 793.841010][T13355] ? vfs_mkdir+0x570/0x570 [ 793.845479][T13355] __x64_sys_mkdirat+0x85/0x90 [ 793.850268][T13355] do_syscall_64+0x4c/0xa0 [ 793.854704][T13355] ? clear_bhb_loop+0x60/0xb0 [ 793.859503][T13355] ? clear_bhb_loop+0x60/0xb0 [ 793.864233][T13355] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 793.870201][T13355] RIP: 0033:0x7fae29b9e159 [ 793.874642][T13355] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 793.894288][T13355] RSP: 002b:00007fae2a986028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 [ 793.902748][T13355] RAX: ffffffffffffffda RBX: 00007fae29e25fa0 RCX: 00007fae29b9e159 [ 793.910779][T13355] RDX: 00000000000001ff RSI: 0000200000000040 RDI: ffffffffffffff9c [ 793.918771][T13355] RBP: 00007fae29c3506b R08: 0000000000000000 R09: 0000000000000000 [ 793.926763][T13355] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 793.934745][T13355] R13: 00007fae29e26038 R14: 00007fae29e25fa0 R15: 00007ffc79bfad18 [ 793.942742][T13355] [ 797.130868][T13377] loop6: detected capacity change from 0 to 1024 [ 797.224640][T13377] EXT4-fs (loop6): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock [ 797.255022][T13377] EXT4-fs (loop6): group descriptors corrupted! [ 797.650481][T13385] loop6: detected capacity change from 0 to 512 [ 797.793385][T13385] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 797.886453][T13385] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c118, mo2=0002] [ 797.915855][T13387] loop7: detected capacity change from 0 to 128 [ 797.923276][T13387] FAT-fs (loop7): Unrecognized mount option "" or missing value [ 798.024188][T13385] System zones: 1-12 [ 798.059132][T13385] EXT4-fs error (device loop6): ext4_orphan_get:1435: comm syz.6.2559: bad orphan inode 131072 [ 798.127403][ T8059] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 798.150014][T13391] loop3: detected capacity change from 0 to 512 [ 798.173649][T13385] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 798.216411][T13391] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 798.385543][T13391] EXT4-fs (loop3): 1 truncate cleaned up [ 798.391299][T13391] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 798.535226][ T7013] EXT4-fs (loop6): unmounting filesystem. [ 798.812332][T13397] EXT4-fs error (device loop3): ext4_generic_delete_entry:2731: inode #2: block 13: comm syz.3.2561: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0 [ 798.881571][T13396] loop7: detected capacity change from 0 to 256 [ 798.969439][T13396] FAT-fs (loop7): Unrecognized mount option "errors=remount-ro HID v0.00 Device [syz1] on syz0 [ 812.754586][T13568] FAULT_INJECTION: forcing a failure. [ 812.754586][T13568] name failslab, interval 1, probability 0, space 0, times 0 [ 812.767899][T13568] CPU: 1 PID: 13568 Comm: syz.7.2621 Not tainted syzkaller #0 [ 812.775421][T13568] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 812.785532][T13568] Call Trace: [ 812.788861][T13568] [ 812.791839][T13568] dump_stack_lvl+0x188/0x24e [ 812.796574][T13568] ? show_regs_print_info+0x12/0x12 [ 812.801835][T13568] ? load_image+0x410/0x410 [ 812.806404][T13568] ? __lock_acquire+0x7c40/0x7c40 [ 812.811497][T13568] ? asn1_ber_decoder+0x1f8a/0x21b0 [ 812.816765][T13568] should_fail_ex+0x390/0x4c0 [ 812.821507][T13568] should_failslab+0x5/0x20 [ 812.826069][T13568] slab_pre_alloc_hook+0x59/0x300 [ 812.831152][T13568] ? mpi_alloc+0x4e/0x130 [ 812.835546][T13568] __kmem_cache_alloc_node+0x4f/0x270 [ 812.840990][T13568] ? mpi_alloc+0x4e/0x130 [ 812.845383][T13568] kmalloc_trace+0x26/0xe0 [ 812.849862][T13568] mpi_alloc+0x4e/0x130 [ 812.854090][T13568] mpi_read_raw_data+0x13f/0x970 [ 812.859100][T13568] ? do_syscall_64+0x4c/0xa0 [ 812.863748][T13568] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 812.869895][T13568] rsa_set_pub_key+0x2c0/0x5b0 [ 812.874737][T13568] ? rsa_dec+0x5d0/0x5d0 [ 812.879059][T13568] pkcs1pad_set_pub_key+0xc0/0x1b0 [ 812.884411][T13568] public_key_verify_signature+0x572/0xd20 [ 812.890279][T13568] ? x509_cert_parse+0x53a/0x7a0 [ 812.895270][T13568] ? x509_key_preparse+0x60/0x660 [ 812.900365][T13568] ? public_key_free+0x80/0x80 [ 812.905243][T13568] ? asymmetric_key_generate_id+0x52/0xd0 [ 812.911060][T13568] ? asymmetric_key_id_same+0x63/0xe0 [ 812.916511][T13568] x509_check_for_self_signed+0x317/0x420 [ 812.922303][T13568] x509_cert_parse+0x59c/0x7a0 [ 812.927137][T13568] x509_key_preparse+0x60/0x660 [ 812.932055][T13568] ? down_read+0x1a8/0x2d0 [ 812.936546][T13568] asymmetric_key_preparse+0xa5/0x140 [ 812.941997][T13568] key_create_or_update+0x432/0xa40 [ 812.947260][T13568] ? security_key_permission+0x7c/0xa0 [ 812.952789][T13568] ? key_type_put+0x20/0x20 [ 812.957363][T13568] ? lookup_user_key_possessed+0x40/0x40 [ 812.963080][T13568] ? __might_fault+0xc2/0x120 [ 812.967819][T13568] ? __might_fault+0xa6/0x120 [ 812.972566][T13568] __se_sys_add_key+0x34b/0x410 [ 812.977485][T13568] ? __x64_sys_add_key+0xc0/0xc0 [ 812.982495][T13568] ? lockdep_hardirqs_on+0x94/0x140 [ 812.987757][T13568] ? __x64_sys_add_key+0x1c/0xc0 [ 812.992764][T13568] do_syscall_64+0x4c/0xa0 [ 812.997238][T13568] ? clear_bhb_loop+0x60/0xb0 [ 813.001981][T13568] ? clear_bhb_loop+0x60/0xb0 [ 813.006730][T13568] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 813.012707][T13568] RIP: 0033:0x7f570cd9e159 [ 813.017179][T13568] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 813.036882][T13568] RSP: 002b:00007f570aff6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 813.045366][T13568] RAX: ffffffffffffffda RBX: 00007f570d025fa0 RCX: 00007f570cd9e159 [ 813.053402][T13568] RDX: 0000200000000200 RSI: 0000000000000000 RDI: 0000200000000000 [ 813.061431][T13568] RBP: 00007f570ce3506b R08: ffffffffffffffff R09: 0000000000000000 [ 813.069465][T13568] R10: 0000000000000559 R11: 0000000000000246 R12: 0000000000000000 [ 813.077493][T13568] R13: 00007f570d026038 R14: 00007f570d025fa0 R15: 00007ffd63affab8 [ 813.085540][T13568] [ 813.370141][T13575] fido_id[13575]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 813.521167][T13585] loop3: detected capacity change from 0 to 128 [ 813.552270][ T26] audit: type=1800 audit(1789948640.264:240): pid=13585 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2628" name="file2" dev="loop3" ino=1048636 res=0 errno=0 [ 813.579848][T13587] ip_tables: iptables: counters copy to user failed while replacing table [ 813.691664][T13593] device-mapper: table: 248:0: mirror: Invalid number of mirrors (-EINVAL) [ 813.702842][T13593] device-mapper: ioctl: error adding target to table [ 814.941921][T13616] loop4: detected capacity change from 0 to 1024 [ 815.001578][T13616] EXT4-fs: Ignoring removed i_version option [ 815.010698][T13619] loop5: detected capacity change from 0 to 512 [ 815.026242][T13620] loop6: detected capacity change from 0 to 128 [ 815.068850][T13619] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 815.084970][T13616] EXT4-fs: Ignoring removed bh option [ 815.116707][T13616] ext4: Unknown parameter 'uid<00000000000000000000' [ 815.128993][ T26] audit: type=1800 audit(1789948641.844:241): pid=13620 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.2643" name="file2" dev="loop6" ino=1048637 res=0 errno=0 [ 815.164123][T13619] EXT4-fs (loop5): couldn't mount as ext2 due to feature incompatibilities [ 815.232563][T13619] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2644'. [ 816.954944][T13649] FAULT_INJECTION: forcing a failure. [ 816.954944][T13649] name failslab, interval 1, probability 0, space 0, times 0 [ 816.968158][T13649] CPU: 1 PID: 13649 Comm: syz.7.2655 Not tainted syzkaller #0 [ 816.975691][T13649] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 816.985792][T13649] Call Trace: [ 816.989117][T13649] [ 816.992089][T13649] dump_stack_lvl+0x188/0x24e [ 816.996824][T13649] ? show_regs_print_info+0x12/0x12 [ 817.002077][T13649] ? load_image+0x410/0x410 [ 817.006642][T13649] ? __might_sleep+0xd0/0xd0 [ 817.011296][T13649] ? __lock_acquire+0x7c40/0x7c40 [ 817.016384][T13649] ? memset+0x1e/0x40 [ 817.020421][T13649] should_fail_ex+0x390/0x4c0 [ 817.025203][T13649] should_failslab+0x5/0x20 [ 817.029796][T13649] slab_pre_alloc_hook+0x59/0x300 [ 817.034873][T13649] ? __raw_spin_lock_init+0x41/0x100 [ 817.040207][T13649] ? security_task_alloc+0x42/0x130 [ 817.045470][T13649] __kmem_cache_alloc_node+0x4f/0x270 [ 817.050896][T13649] ? debug_mutex_init+0x34/0x70 [ 817.055818][T13649] ? security_task_alloc+0x42/0x130 [ 817.061077][T13649] __kmalloc+0xa3/0x240 [ 817.065298][T13649] security_task_alloc+0x42/0x130 [ 817.070388][T13649] copy_process+0x17b8/0x4070 [ 817.075126][T13649] ? copy_process+0x974/0x4070 [ 817.079941][T13649] ? preempt_schedule_thunk+0x16/0x18 [ 817.085384][T13649] ? idle_dummy+0x10/0x10 [ 817.089770][T13649] ? wake_up_q+0x8c/0xc0 [ 817.094079][T13649] kernel_clone+0x24b/0x900 [ 817.098632][T13649] ? futex_wake_mark+0x150/0x150 [ 817.103621][T13649] ? create_io_thread+0x170/0x170 [ 817.108711][T13649] ? do_futex+0x2e2/0x320 [ 817.113092][T13649] ? _copy_from_user+0x12f/0x170 [ 817.118105][T13649] __x64_sys_clone+0x1a7/0x220 [ 817.122938][T13649] ? __ia32_sys_vfork+0x140/0x140 [ 817.128036][T13649] ? lock_chain_count+0x20/0x20 [ 817.132978][T13649] ? lockdep_hardirqs_on+0x94/0x140 [ 817.138250][T13649] do_syscall_64+0x4c/0xa0 [ 817.142727][T13649] ? clear_bhb_loop+0x60/0xb0 [ 817.147476][T13649] ? clear_bhb_loop+0x60/0xb0 [ 817.152218][T13649] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 817.158203][T13649] RIP: 0033:0x7f570cd9e159 [ 817.162684][T13649] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 817.182785][T13649] RSP: 002b:00007f570aff5fd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 817.191273][T13649] RAX: ffffffffffffffda RBX: 00007f570d025fa0 RCX: 00007f570cd9e159 [ 817.199342][T13649] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000800000 [ 817.207373][T13649] RBP: 00007f570ce3506b R08: 0000000000000000 R09: 0000000000000000 [ 817.215406][T13649] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 817.223432][T13649] R13: 00007f570d026038 R14: 00007f570d025fa0 R15: 00007ffd63affab8 [ 817.231474][T13649] [ 817.427354][T13649] batman_adv: batadv0: Adding interface: syzkaller0 [ 817.448554][T13649] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 817.583008][T13658] loop7: detected capacity change from 0 to 512 [ 817.623422][T13649] batman_adv: batadv0: Interface activated: syzkaller0 [ 817.647359][T13658] FAT-fs (loop7): Unrecognized mount option "umask=0000000000000000017777" or missing value [ 817.758503][T13647] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 817.797862][ T4321] hid-generic 0000:0000:0000.000F: unknown main item tag 0x0 [ 817.823926][ T4321] hid-generic 0000:0000:0000.000F: hidraw0: HID v0.00 Device [syz1] on syz0 [ 817.845677][T13674] loop4: detected capacity change from 0 to 2048 [ 817.886800][T13647] batman_adv: batadv0: Removing interface: syzkaller0 [ 817.900412][T13674] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 818.862792][T13680] fido_id[13680]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 818.914984][ T4291] EXT4-fs (loop4): unmounting filesystem. [ 818.966059][T13688] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2670'. [ 819.437427][T13704] FAULT_INJECTION: forcing a failure. [ 819.437427][T13704] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 819.489512][ T4321] hid-generic 0000:0000:0000.0010: unknown main item tag 0x0 [ 819.500053][T13704] CPU: 0 PID: 13704 Comm: syz.4.2676 Not tainted syzkaller #0 [ 819.507604][T13704] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 819.517722][T13704] Call Trace: [ 819.521037][T13704] [ 819.523999][T13704] dump_stack_lvl+0x188/0x24e [ 819.528741][T13704] ? show_regs_print_info+0x12/0x12 [ 819.533987][T13704] ? load_image+0x410/0x410 [ 819.538545][T13704] ? __lock_acquire+0x7c40/0x7c40 [ 819.543628][T13704] ? __kmem_cache_alloc_node+0x19d/0x270 [ 819.549326][T13704] should_fail_ex+0x390/0x4c0 [ 819.554077][T13704] _copy_from_user+0x2c/0x170 [ 819.558814][T13704] io_sqe_files_register+0x4a9/0x8a0 [ 819.564169][T13704] ? __se_sys_io_uring_register+0x2c9/0xeb0 [ 819.570144][T13704] ? io_register_rsrc_update+0x1c0/0x1c0 [ 819.575852][T13704] ? io_run_task_work+0x267/0x310 [ 819.580249][ T4321] hid-generic 0000:0000:0000.0010: hidraw0: HID v0.00 Device [syz1] on syz0 [ 819.580952][T13704] __se_sys_io_uring_register+0x5c1/0xeb0 [ 819.596317][T13704] ? __x64_sys_io_uring_register+0xa0/0xa0 [ 819.602194][T13704] ? lockdep_hardirqs_on+0x94/0x140 [ 819.607469][T13704] do_syscall_64+0x4c/0xa0 [ 819.611984][T13704] ? clear_bhb_loop+0x60/0xb0 [ 819.617101][T13704] ? clear_bhb_loop+0x60/0xb0 [ 819.621861][T13704] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 819.627836][T13704] RIP: 0033:0x7fea6199e159 [ 819.632325][T13704] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 819.652075][T13704] RSP: 002b:00007fea627f8028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab [ 819.660553][T13704] RAX: ffffffffffffffda RBX: 00007fea61c25fa0 RCX: 00007fea6199e159 [ 819.668582][T13704] RDX: 0000200000002d40 RSI: 0000000000000002 RDI: 0000000000000003 [ 819.676604][T13704] RBP: 00007fea61a3506b R08: 0000000000000000 R09: 0000000000000000 [ 819.684635][T13704] R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000000 [ 819.692657][T13704] R13: 00007fea61c26038 R14: 00007fea61c25fa0 R15: 00007ffc6a205a88 [ 819.700707][T13704] [ 819.810646][T13715] IPv6: ADDRCONF(NETDEV_CHANGE): lo: link becomes ready [ 819.838745][T13715] IPv6: ADDRCONF(NETDEV_CHANGE): tunl0: link becomes ready [ 819.883487][T13717] sctp: sctp_transport_update_pmtu: Reported pmtu 68 too low, using default minimum of 512 [ 819.912676][T13715] IPv6: ADDRCONF(NETDEV_CHANGE): gre0: link becomes ready [ 819.937330][T13711] fido_id[13711]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 819.957135][T13715] IPv6: ADDRCONF(NETDEV_CHANGE): gretap0: link becomes ready [ 820.003210][T13715] IPv6: ADDRCONF(NETDEV_CHANGE): erspan0: link becomes ready [ 820.023322][T13715] IPv6: ADDRCONF(NETDEV_CHANGE): ip_vti0: link becomes ready [ 820.056909][T13715] IPv6: ADDRCONF(NETDEV_CHANGE): ip6_vti0: link becomes ready [ 820.237711][T13708] loop4: detected capacity change from 0 to 4096 [ 820.280644][T13725] loop7: detected capacity change from 0 to 1024 [ 820.293686][T13708] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 820.304719][T13725] EXT4-fs: Ignoring removed i_version option [ 820.352609][T13725] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled [ 820.433022][T13725] EXT4-fs (loop7): revision level too high, forcing read-only mode [ 820.446928][T13725] EXT4-fs (loop7): orphan cleanup on readonly fs [ 820.464832][T13725] EXT4-fs error (device loop7): ext4_free_blocks:6220: comm syz.7.2684: Freeing blocks not in datazone - block = 0, count = 4096 [ 820.494374][T13725] EXT4-fs (loop7): Remounting filesystem read-only [ 820.507560][T13725] EXT4-fs (loop7): 1 orphan inode deleted [ 820.520265][T13725] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 820.575602][T13725] EXT4-fs error (device loop7): ext4_search_dir:1551: inode #2: block 16: comm syz.7.2684: bad entry in directory: inode out of bounds - offset=44, inode=40, rec_len=16, size=1024 fake=0 [ 820.620305][ T4291] EXT4-fs (loop4): unmounting filesystem. [ 820.821599][T11423] EXT4-fs (loop7): unmounting filesystem. [ 820.974313][T13743] loop3: detected capacity change from 0 to 512 [ 821.013834][T13745] loop5: detected capacity change from 0 to 128 [ 821.026927][T13743] EXT4-fs (loop3): 1 truncate cleaned up [ 821.032673][T13743] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 821.045988][T13745] FAT-fs (loop5): Unrecognized mount option "" or missing value [ 821.128076][ T8059] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 821.138783][T13748] Config c/1 of g1 needs at least one function. [ 821.194117][T13748] udc usbip-vudc.0: failed to start g1: -22 [ 821.200427][T13748] configfs-gadget.g1: probe of gadget.32 failed with error -22 [ 821.221145][T13748] UDC core: g1: couldn't find an available UDC or it's busy [ 821.462570][T13759] random: crng reseeded on system resumption [ 821.584790][T13761] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2697'. [ 821.764888][ T4272] EXT4-fs (loop3): unmounting filesystem. [ 822.127419][T13777] siw: device registration error -23 [ 822.969207][ T7266] hid-generic 0000:0000:0000.0011: unknown main item tag 0x0 [ 822.979960][ T7266] hid-generic 0000:0000:0000.0011: hidraw0: HID v0.00 Device [syz1] on syz0 [ 823.232848][T13789] team0: Port device vlan0 removed [ 823.297382][T13800] loop3: detected capacity change from 0 to 128 [ 823.331666][T13800] FAT-fs (loop3): Unrecognized mount option "" or missing value [ 823.384792][T13803] netlink: 48 bytes leftover after parsing attributes in process `syz.7.2713'. [ 823.438902][T13795] fido_id[13795]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 824.059863][T13824] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2723'. [ 824.993544][T13839] loop4: detected capacity change from 0 to 128 [ 825.045769][T13839] FAT-fs (loop4): Unrecognized mount option "" or missing value [ 825.912813][ T9736] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 825.925456][ T9736] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 825.934937][ T9736] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 825.957055][ T9736] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 825.969655][ T9736] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 825.977118][ T9736] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 827.003125][T13849] chnl_net:caif_netlink_parms(): no params data found [ 827.079206][T13873] loop7: detected capacity change from 0 to 128 [ 827.125973][T13873] FAT-fs (loop7): Unrecognized mount option "" or missing value [ 827.194749][T13849] bridge0: port 1(bridge_slave_0) entered blocking state [ 827.202043][T13849] bridge0: port 1(bridge_slave_0) entered disabled state [ 827.211830][T13849] device bridge_slave_0 entered promiscuous mode [ 827.222118][T13849] bridge0: port 2(bridge_slave_1) entered blocking state [ 827.229745][T13849] bridge0: port 2(bridge_slave_1) entered disabled state [ 827.238857][T13849] device bridge_slave_1 entered promiscuous mode [ 827.267161][T13849] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 827.281587][T13849] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 827.336021][T13849] team0: Port device team_slave_0 added [ 827.358703][T13849] team0: Port device team_slave_1 added [ 827.460299][T13849] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 827.482405][T13849] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 827.584953][T13888] ip_tables: iptables: counters copy to user failed while replacing table [ 827.945956][T13849] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 828.076270][ T4283] Bluetooth: hci5: command 0x0409 tx timeout [ 828.146512][T13895] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2748'. [ 828.202702][T13849] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 828.295289][T13849] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 828.418088][T13849] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 828.713212][T13849] device hsr_slave_0 entered promiscuous mode [ 828.742681][T13849] device hsr_slave_1 entered promiscuous mode [ 828.749854][T13849] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 828.757807][T13849] Cannot create hsr debugfs directory [ 828.951093][T13910] loop5: detected capacity change from 0 to 512 [ 828.962862][T13910] EXT4-fs (loop5): invalid inodes per group: 462880 [ 828.962862][T13910] [ 829.003289][T13911] hub 8-0:1.0: USB hub found [ 829.036391][T13911] hub 8-0:1.0: 1 port detected [ 829.320875][T13849] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 829.379364][T13915] loop6: detected capacity change from 0 to 128 [ 829.428832][T13915] FAT-fs (loop6): Unrecognized mount option "" or missing value [ 829.559161][T13849] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 829.764432][T13849] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 829.864736][T13927] device-mapper: table: 248:0: zero-length target [ 829.871255][T13927] device-mapper: ioctl: error adding target to table [ 829.966640][T13849] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 830.947021][ T4283] Bluetooth: hci5: command 0x041b tx timeout [ 831.330999][ T4283] Bluetooth: hci0: unexpected event for opcode 0x2010 [ 831.508369][T13849] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 831.544974][T13849] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 831.565626][T13849] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 831.583222][T13849] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 831.798887][T13849] 8021q: adding VLAN 0 to HW filter on device bond0 [ 831.831648][ T4302] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 831.850272][ T4302] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 831.882906][T13849] 8021q: adding VLAN 0 to HW filter on device team0 [ 831.922738][ T4436] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 831.952228][ T4436] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 831.970973][ T4436] bridge0: port 1(bridge_slave_0) entered blocking state [ 831.978216][ T4436] bridge0: port 1(bridge_slave_0) entered forwarding state [ 832.021770][ T4436] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 832.052280][ T4436] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 832.078455][ T4436] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 832.100073][ T4436] bridge0: port 2(bridge_slave_1) entered blocking state [ 832.107335][ T4436] bridge0: port 2(bridge_slave_1) entered forwarding state [ 832.131681][ T7293] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 832.171312][ T7293] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 832.182308][T13947] loop4: detected capacity change from 0 to 128 [ 832.196795][ T7293] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 832.216653][T13947] FAT-fs (loop4): Unrecognized mount option "" or missing value [ 832.253203][ T7293] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 832.338807][T13849] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 832.378900][T13849] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 832.425062][ T7293] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 832.434889][ T7293] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 832.492139][ T7293] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 832.521392][ T7293] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 832.568097][ T7293] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 832.591068][ T7293] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 832.618316][ T7293] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 832.653593][ T7293] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 833.765743][ T4283] Bluetooth: hci5: command 0x040f tx timeout [ 835.432761][T14000] loop4: detected capacity change from 0 to 256 [ 835.458462][T14000] FAT-fs (loop4): Unrecognized mount option "errors=remount-ro 1 [ 890.764221][ T49] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 890.780576][ T49] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 890.788783][ T49] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 890.797759][ T49] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 890.807156][ T49] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 890.942059][T14702] bond0 speed is unknown, defaulting to 1000 [ 890.980874][T14701] loop5: detected capacity change from 0 to 32768 [ 891.026214][T14701] (syz.5.3023,14701,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 891.089720][T14701] (syz.5.3023,14701,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 891.156600][T14701] JBD2: Ignoring recovery information on journal [ 891.301645][T14701] ocfs2: Mounting device (7,5) on (node local, slot 0) with ordered data mode. [ 891.567397][ T4669] ocfs2: Unmounting device (7,5) on (node local) [ 892.043436][T14702] chnl_net:caif_netlink_parms(): no params data found [ 892.266619][T14702] bridge0: port 1(bridge_slave_0) entered blocking state [ 892.295929][T14702] bridge0: port 1(bridge_slave_0) entered disabled state [ 892.305444][T14702] device bridge_slave_0 entered promiscuous mode [ 892.313107][T13849] EXT4-fs (loop3): unmounting filesystem. [ 892.318712][T14702] bridge0: port 2(bridge_slave_1) entered blocking state [ 892.340954][T14702] bridge0: port 2(bridge_slave_1) entered disabled state [ 892.367961][T14702] device bridge_slave_1 entered promiscuous mode [ 892.387091][T13849] EXT4-fs error (device loop3): __ext4_get_inode_loc:4520: comm syz-executor: Invalid inode table block 1 in block_group 0 [ 892.457443][T14728] loop7: detected capacity change from 0 to 256 [ 892.464701][T14728] FAT-fs (loop7): Unrecognized mount option "errors=remount-ro [ 913.458627][T14980] dump_stack_lvl+0x188/0x24e [ 913.463417][T14980] ? show_regs_print_info+0x12/0x12 [ 913.468705][T14980] ? load_image+0x410/0x410 [ 913.473279][T14980] ? __might_sleep+0xd0/0xd0 [ 913.477930][T14980] ? __lock_acquire+0x7c40/0x7c40 [ 913.483030][T14980] should_fail_ex+0x390/0x4c0 [ 913.487786][T14980] should_failslab+0x5/0x20 [ 913.492387][T14980] slab_pre_alloc_hook+0x59/0x300 [ 913.497479][T14980] kmem_cache_alloc+0x56/0x2f0 [ 913.502294][T14980] ? getname_flags+0xb7/0x500 [ 913.507008][T14980] getname_flags+0xb7/0x500 [ 913.511543][T14980] user_path_at_empty+0x28/0x60 [ 913.516451][T14980] __se_sys_mount+0x2a4/0x3d0 [ 913.521171][T14980] ? __x64_sys_mount+0xc0/0xc0 [ 913.525977][T14980] ? lockdep_hardirqs_on+0x94/0x140 [ 913.531212][T14980] ? __x64_sys_mount+0x1c/0xc0 [ 913.536020][T14980] do_syscall_64+0x4c/0xa0 [ 913.540471][T14980] ? clear_bhb_loop+0x60/0xb0 [ 913.545197][T14980] ? clear_bhb_loop+0x60/0xb0 [ 913.549915][T14980] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 913.555853][T14980] RIP: 0033:0x7fc46a39e159 [ 913.560295][T14980] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 913.579986][T14980] RSP: 002b:00007fc46b1cd028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 913.588472][T14980] RAX: ffffffffffffffda RBX: 00007fc46a625fa0 RCX: 00007fc46a39e159 [ 913.596476][T14980] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 913.604573][T14980] RBP: 00007fc46a43506b R08: 0000000000000000 R09: 0000000000000000 [ 913.612590][T14980] R10: 0000000000800006 R11: 0000000000000246 R12: 0000000000000000 [ 913.620602][T14980] R13: 00007fc46a626038 R14: 00007fc46a625fa0 R15: 00007fffd7143ba8 [ 913.628618][T14980] [ 913.935677][T14996] loop3: detected capacity change from 0 to 1024 [ 913.963016][T14996] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 914.010840][T14996] EXT4-fs (loop3): barriers disabled [ 914.016433][T14996] JBD2: no valid journal superblock found [ 914.026546][T14996] EXT4-fs (loop3): error loading journal [ 914.217177][T15002] loop7: detected capacity change from 0 to 512 [ 914.342867][T15007] FAULT_INJECTION: forcing a failure. [ 914.342867][T15007] name fail_futex, interval 1, probability 0, space 0, times 0 [ 914.358501][T15002] EXT4-fs (loop7): feature flags set on rev 0 fs, running e2fsck is recommended [ 914.420761][T15007] CPU: 0 PID: 15007 Comm: syz.4.3118 Not tainted syzkaller #0 [ 914.428347][T15007] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 914.438449][T15007] Call Trace: [ 914.441773][T15007] [ 914.444746][T15007] dump_stack_lvl+0x188/0x24e [ 914.449481][T15007] ? show_regs_print_info+0x12/0x12 [ 914.454738][T15007] ? load_image+0x410/0x410 [ 914.459314][T15007] should_fail_ex+0x390/0x4c0 [ 914.464053][T15007] get_futex_key+0x1b1/0x1000 [ 914.468788][T15007] ? futex_setup_timer+0xc0/0xc0 [ 914.473788][T15007] futex_wake+0x123/0x4f0 [ 914.478355][T15007] ? __up_read+0x2b4/0x6b0 [ 914.482835][T15007] ? futex_wake_mark+0x150/0x150 [ 914.487848][T15007] ? __mm_populate+0x310/0x380 [ 914.492675][T15007] do_futex+0x2e2/0x320 [ 914.496882][T15007] ? __ia32_sys_get_robust_list+0x100/0x100 [ 914.502831][T15007] ? vm_mmap_pgoff+0x212/0x2d0 [ 914.507667][T15007] __se_sys_futex+0x381/0x410 [ 914.512411][T15007] ? __x64_sys_futex+0xf0/0xf0 [ 914.517229][T15007] ? __x64_sys_futex+0x1d/0xf0 [ 914.522079][T15007] do_syscall_64+0x4c/0xa0 [ 914.526580][T15007] ? clear_bhb_loop+0x60/0xb0 [ 914.531313][T15007] ? clear_bhb_loop+0x60/0xb0 [ 914.536048][T15007] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 914.542021][T15007] RIP: 0033:0x7f82fa99e159 [ 914.546484][T15007] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 914.566143][T15007] RSP: 002b:00007f82f8bf60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 914.574604][T15007] RAX: ffffffffffffffda RBX: 00007f82fac25fa8 RCX: 00007f82fa99e159 [ 914.582624][T15007] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f82fac25fac [ 914.590636][T15007] RBP: 00007f82fac25fa0 R08: 001117d289fa1d28 R09: 0000000000000000 [ 914.598664][T15007] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000000 [ 914.606687][T15007] R13: 00007f82fac26038 R14: 00007ffef3958660 R15: 00007ffef3958748 [ 914.614755][T15007] [ 914.801796][ T26] audit: type=1326 audit(1789948741.514:280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14995 comm="syz.3.3114" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc46a39e159 code=0x7ffc0000 [ 915.412757][ T26] audit: type=1326 audit(1789948741.514:281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14995 comm="syz.3.3114" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc46a39e159 code=0x7ffc0000 [ 915.438671][ T26] audit: type=1326 audit(1789948741.514:282): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14995 comm="syz.3.3114" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fc46a35e98e code=0x7ffc0000 [ 915.464127][ T26] audit: type=1326 audit(1789948741.514:283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14995 comm="syz.3.3114" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fc46a35e98e code=0x7ffc0000 [ 915.502582][T15010] siw: device registration error -23 [ 915.558643][ T26] audit: type=1326 audit(1789948741.544:284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14995 comm="syz.3.3114" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fc46a35e98e code=0x7ffc0000 [ 915.570146][T15002] EXT4-fs (loop7): warning: maximal mount count reached, running e2fsck is recommended [ 915.584508][ T26] audit: type=1326 audit(1789948741.544:285): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14995 comm="syz.3.3114" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fc46a35e98e code=0x7ffc0000 [ 915.618371][ T26] audit: type=1326 audit(1789948741.544:286): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14995 comm="syz.3.3114" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fc46a35e98e code=0x7ffc0000 [ 915.702899][ T26] audit: type=1326 audit(1789948741.554:287): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14995 comm="syz.3.3114" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fc46a35e98e code=0x7ffc0000 [ 915.908030][ T26] audit: type=1326 audit(1789948741.554:288): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14995 comm="syz.3.3114" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fc46a35e98e code=0x7ffc0000 [ 915.943251][T15002] EXT4-fs error (device loop7): ext4_orphan_get:1409: comm syz.7.3117: inode #15: comm syz.7.3117: iget: illegal inode # [ 916.004298][ T26] audit: type=1326 audit(1789948741.554:289): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14995 comm="syz.3.3114" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=230 compat=0 ip=0x7fc46a35e98e code=0x7ffc0000 [ 916.030280][T15002] EXT4-fs (loop7): Remounting filesystem read-only [ 916.039288][T15002] EXT4-fs error (device loop7): ext4_orphan_get:1414: comm syz.7.3117: couldn't read orphan inode 15 (err -117) [ 916.051952][T15002] EXT4-fs (loop7): Remounting filesystem read-only [ 916.059109][T15002] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 916.100340][T15002] EXT4-fs error (device loop7): ext4_lookup:1860: comm syz.7.3117: inode #15: comm syz.7.3117: iget: illegal inode # [ 916.146937][T15013] EXT4-fs error (device loop7): ext4_validate_block_bitmap:429: comm ext4lazyinit: bg 0: block 19: invalid block bitmap [ 916.148890][T15002] EXT4-fs (loop7): Remounting filesystem read-only [ 916.194302][T15013] EXT4-fs (loop7): Remounting filesystem read-only [ 916.220557][T15022] FAULT_INJECTION: forcing a failure. [ 916.220557][T15022] name failslab, interval 1, probability 0, space 0, times 0 [ 916.329521][T15022] CPU: 1 PID: 15022 Comm: syz.6.3124 Not tainted syzkaller #0 [ 916.337094][T15022] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 916.347210][T15022] Call Trace: [ 916.350535][T15022] [ 916.353551][T15022] dump_stack_lvl+0x188/0x24e [ 916.358291][T15022] ? show_regs_print_info+0x12/0x12 [ 916.363561][T15022] ? load_image+0x410/0x410 [ 916.368131][T15022] ? __might_sleep+0xd0/0xd0 [ 916.372783][T15022] ? __lock_acquire+0x7c40/0x7c40 [ 916.377878][T15022] should_fail_ex+0x390/0x4c0 [ 916.382633][T15022] should_failslab+0x5/0x20 [ 916.387194][T15022] slab_pre_alloc_hook+0x59/0x300 [ 916.392289][T15022] kmem_cache_alloc+0x56/0x2f0 [ 916.397101][T15022] ? getname_flags+0xb7/0x500 [ 916.401830][T15022] getname_flags+0xb7/0x500 [ 916.406404][T15022] user_path_at_empty+0x28/0x60 [ 916.411310][T15022] __se_sys_mount+0x2a4/0x3d0 [ 916.416045][T15022] ? __x64_sys_mount+0xc0/0xc0 [ 916.420871][T15022] ? lockdep_hardirqs_on+0x94/0x140 [ 916.426138][T15022] ? __x64_sys_mount+0x1c/0xc0 [ 916.430998][T15022] do_syscall_64+0x4c/0xa0 [ 916.435488][T15022] ? clear_bhb_loop+0x60/0xb0 [ 916.440225][T15022] ? clear_bhb_loop+0x60/0xb0 [ 916.444959][T15022] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 916.450924][T15022] RIP: 0033:0x7fee3a19e159 [ 916.455396][T15022] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 916.475070][T15022] RSP: 002b:00007fee3b094028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 916.483546][T15022] RAX: ffffffffffffffda RBX: 00007fee3a425fa0 RCX: 00007fee3a19e159 [ 916.491615][T15022] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 916.499641][T15022] RBP: 00007fee3a23506b R08: 0000000000000000 R09: 0000000000000000 [ 916.507685][T15022] R10: 0000000000800006 R11: 0000000000000246 R12: 0000000000000000 [ 916.515709][T15022] R13: 00007fee3a426038 R14: 00007fee3a425fa0 R15: 00007ffde76194b8 [ 916.523758][T15022] [ 916.553895][T15025] overlayfs: overlapping lowerdir path [ 916.623873][T15026] loop4: detected capacity change from 0 to 256 [ 916.633522][T15026] FAT-fs (loop4): Unrecognized mount option "errors=remount-ro [ 921.237473][T15080] dump_stack_lvl+0x188/0x24e [ 921.242268][T15080] ? show_regs_print_info+0x12/0x12 [ 921.247524][T15080] ? load_image+0x410/0x410 [ 921.252101][T15080] ? __might_sleep+0xd0/0xd0 [ 921.256750][T15080] ? __lock_acquire+0x7c40/0x7c40 [ 921.261860][T15080] should_fail_ex+0x390/0x4c0 [ 921.266608][T15080] should_failslab+0x5/0x20 [ 921.271162][T15080] slab_pre_alloc_hook+0x59/0x300 [ 921.276252][T15080] kmem_cache_alloc+0x56/0x2f0 [ 921.281080][T15080] ? getname_flags+0xb7/0x500 [ 921.285822][T15080] getname_flags+0xb7/0x500 [ 921.290397][T15080] user_path_at_empty+0x28/0x60 [ 921.295312][T15080] __se_sys_mount+0x2a4/0x3d0 [ 921.300063][T15080] ? __x64_sys_mount+0xc0/0xc0 [ 921.304892][T15080] ? lockdep_hardirqs_on+0x94/0x140 [ 921.310155][T15080] ? __x64_sys_mount+0x1c/0xc0 [ 921.314991][T15080] do_syscall_64+0x4c/0xa0 [ 921.319473][T15080] ? clear_bhb_loop+0x60/0xb0 [ 921.324211][T15080] ? clear_bhb_loop+0x60/0xb0 [ 921.328938][T15080] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 921.334898][T15080] RIP: 0033:0x7fc46a39e159 [ 921.339370][T15080] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 921.359041][T15080] RSP: 002b:00007fc46b1cd028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 921.367507][T15080] RAX: ffffffffffffffda RBX: 00007fc46a625fa0 RCX: 00007fc46a39e159 [ 921.375516][T15080] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 921.383519][T15080] RBP: 00007fc46a43506b R08: 0000000000000000 R09: 0000000000000000 [ 921.391523][T15080] R10: 0000000000800006 R11: 0000000000000246 R12: 0000000000000000 [ 921.399529][T15080] R13: 00007fc46a626038 R14: 00007fc46a625fa0 R15: 00007fffd7143ba8 [ 921.407560][T15080] [ 921.511973][ T7013] EXT4-fs (loop6): unmounting filesystem. [ 921.536662][T15084] FAULT_INJECTION: forcing a failure. [ 921.536662][T15084] name failslab, interval 1, probability 0, space 0, times 0 [ 921.669099][T15088] loop6: detected capacity change from 0 to 128 [ 921.685553][T15088] FAT-fs (loop6): Unrecognized mount option "" or missing value [ 921.700904][T15084] CPU: 1 PID: 15084 Comm: syz.4.3142 Not tainted syzkaller #0 [ 921.708472][T15084] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 921.718582][T15084] Call Trace: [ 921.721917][T15084] [ 921.724908][T15084] dump_stack_lvl+0x188/0x24e [ 921.729646][T15084] ? show_regs_print_info+0x12/0x12 [ 921.734905][T15084] ? load_image+0x410/0x410 [ 921.739480][T15084] ? __lock_acquire+0x7c40/0x7c40 [ 921.744596][T15084] should_fail_ex+0x390/0x4c0 [ 921.749351][T15084] should_failslab+0x5/0x20 [ 921.753916][T15084] slab_pre_alloc_hook+0x59/0x300 [ 921.759012][T15084] kmem_cache_alloc+0x56/0x2f0 [ 921.763843][T15084] ? vm_area_alloc+0x20/0xe0 [ 921.768491][T15084] vm_area_alloc+0x20/0xe0 [ 921.773041][T15084] mmap_region+0xcbc/0x1c50 [ 921.777601][T15084] ? file_mmap_ok+0x170/0x170 [ 921.782327][T15084] ? validate_mm+0x23f/0x2e0 [ 921.786965][T15084] ? vma_expand+0x850/0x850 [ 921.791505][T15084] ? cap_mmap_addr+0x153/0x2c0 [ 921.796307][T15084] ? file_mmap_ok+0x11c/0x170 [ 921.801034][T15084] do_mmap+0x9ce/0x10d0 [ 921.805247][T15084] ? mlock_future_check+0x100/0x100 [ 921.810488][T15084] ? ima_file_mmap+0xf7/0x140 [ 921.815209][T15084] ? ima_file_free+0x3e0/0x3e0 [ 921.820015][T15084] ? common_file_perm+0x171/0x1c0 [ 921.825099][T15084] vm_mmap_pgoff+0x1c1/0x2d0 [ 921.829745][T15084] ? account_locked_vm+0xe0/0xe0 [ 921.834734][T15084] ? hugetlb_file_setup+0x415/0x610 [ 921.839978][T15084] ksys_mmap_pgoff+0x55b/0x720 [ 921.844806][T15084] do_syscall_64+0x4c/0xa0 [ 921.849261][T15084] ? clear_bhb_loop+0x60/0xb0 [ 921.853979][T15084] ? clear_bhb_loop+0x60/0xb0 [ 921.858707][T15084] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 921.864652][T15084] RIP: 0033:0x7f82fa99e159 [ 921.869129][T15084] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 921.888779][T15084] RSP: 002b:00007f82f8bf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 921.897242][T15084] RAX: ffffffffffffffda RBX: 00007f82fac25fa0 RCX: 00007f82fa99e159 [ 921.905248][T15084] RDX: 0000000001000003 RSI: 0000000000ff5000 RDI: 0000200000000000 [ 921.913285][T15084] RBP: 00007f82faa3506b R08: ffffffffffffffff R09: 0000000000000000 [ 921.921296][T15084] R10: 000000000004c831 R11: 0000000000000246 R12: 0000000000000000 [ 921.929314][T15084] R13: 00007f82fac26038 R14: 00007f82fac25fa0 R15: 00007ffef3958748 [ 921.937350][T15084] [ 922.221708][T15094] loop6: detected capacity change from 0 to 512 [ 922.458793][T15094] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 922.504737][T15094] ext4 filesystem being mounted at /451/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 922.875915][T15108] loop3: detected capacity change from 0 to 256 [ 922.891622][ T4283] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 922.914892][ T4283] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 922.927362][ T4283] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 922.944008][ T4283] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 922.955836][ T4283] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 922.963333][ T4283] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 923.039302][ T7013] EXT4-fs (loop6): unmounting filesystem. [ 923.095817][T15108] FAT-fs (loop3): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 923.200862][ T26] audit: type=1800 audit(1789948749.914:329): pid=15108 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.3152" name="file1" dev="loop3" ino=1048644 res=0 errno=0 [ 923.383349][T15104] bond0 speed is unknown, defaulting to 1000 [ 923.614792][T15118] loop7: detected capacity change from 0 to 128 [ 923.622258][T15118] FAT-fs (loop7): Unrecognized mount option "" or missing value [ 923.704722][ T8038] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 923.724400][ T26] audit: type=1800 audit(1789948750.444:330): pid=15108 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.3152" name="file1" dev="loop3" ino=1048644 res=0 errno=0 [ 924.193341][T15131] netlink: 100 bytes leftover after parsing attributes in process `syz.7.3163'. [ 924.348340][T15104] chnl_net:caif_netlink_parms(): no params data found [ 924.380713][T15137] loop7: detected capacity change from 0 to 1024 [ 924.434589][T15137] EXT4-fs (loop7): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 924.459658][T15137] EXT4-fs (loop7): ext4_check_descriptors: Checksum for group 0 failed (38281!=20869) [ 924.492924][T15137] EXT4-fs error (device loop7): ext4_ext_check_inode:520: inode #3: comm syz.7.3164: pblk 82 bad header/extent: invalid extent entries - magic f30a, entries 2, max 4(4), depth 0(0) [ 924.575210][T15137] EXT4-fs (loop7): no journal found [ 924.590824][T15137] EXT4-fs (loop7): can't get journal size [ 924.599928][T15104] bridge0: port 1(bridge_slave_0) entered blocking state [ 924.632092][T15104] bridge0: port 1(bridge_slave_0) entered disabled state [ 924.646984][T15137] EXT4-fs (loop7): mounted filesystem without journal. Quota mode: writeback. [ 924.692282][T15104] device bridge_slave_0 entered promiscuous mode [ 924.734477][T15137] EXT4-fs (loop7): ext4_remount: Checksum for group 0 failed (38281!=20869) [ 924.749733][T15104] bridge0: port 2(bridge_slave_1) entered blocking state [ 924.787299][T15104] bridge0: port 2(bridge_slave_1) entered disabled state [ 924.837257][T15104] device bridge_slave_1 entered promiscuous mode [ 924.945620][T11423] EXT4-fs (loop7): unmounting filesystem. [ 924.974810][T15104] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 924.997178][T15104] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 925.034398][ T4283] Bluetooth: hci4: command 0x0409 tx timeout [ 925.133223][T15153] loop6: detected capacity change from 0 to 128 [ 925.197385][T15153] FAT-fs (loop6): Unrecognized mount option "" or missing value [ 925.305261][T15104] team0: Port device team_slave_0 added [ 925.352037][T15104] team0: Port device team_slave_1 added [ 925.515163][T15104] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 925.522196][T15104] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 925.659319][T15104] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 925.704767][T15104] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 925.716305][T15104] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 925.818399][T15104] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 926.009003][T15104] device hsr_slave_0 entered promiscuous mode [ 926.047087][T15104] device hsr_slave_1 entered promiscuous mode [ 926.061754][T15104] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 926.099807][T15104] Cannot create hsr debugfs directory [ 926.537926][T15183] loop6: detected capacity change from 0 to 128 [ 926.732793][T15183] FAT-fs (loop6): Unrecognized mount option "" or missing value [ 927.135915][ T49] Bluetooth: hci4: command 0x041b tx timeout [ 927.968355][T15104] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 928.296032][T15209] loop4: detected capacity change from 0 to 8192 [ 928.336308][T15104] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 928.484922][T15220] loop6: detected capacity change from 0 to 128 [ 928.522347][T15220] FAT-fs (loop6): Unrecognized mount option "" or missing value [ 929.188467][T15232] overlayfs: overlapping lowerdir path [ 929.204277][ T49] Bluetooth: hci4: command 0x040f tx timeout [ 929.276743][T15104] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 929.403272][T15232] loop4: detected capacity change from 0 to 256 [ 929.423495][T15232] FAT-fs (loop4): Unrecognized mount option "errors=remount-roroot_lock_key#469){+...}-{2:2}, at: __dev_queue_xmit+0xe46/0x3810 [ 934.555572][T15322] [ 934.555572][T15322] but task is already holding lock: [ 934.562981][T15322] ffff888038574108 (&sch->root_lock_key#469){+...}-{2:2}, at: __dev_queue_xmit+0xe46/0x3810 [ 934.573165][T15322] [ 934.573165][T15322] other info that might help us debug this: [ 934.581350][T15322] Possible unsafe locking scenario: [ 934.581350][T15322] [ 934.588847][T15322] CPU0 [ 934.592167][T15322] ---- [ 934.595485][T15322] lock(&sch->root_lock_key#469); [ 934.600655][T15322] lock(&sch->root_lock_key#469); [ 934.605831][T15322] [ 934.605831][T15322] *** DEADLOCK *** [ 934.605831][T15322] [ 934.614014][T15322] May be due to missing lock nesting notation [ 934.614014][T15322] [ 934.622373][T15322] 3 locks held by syz.3.3229/15322: [ 934.627610][T15322] #0: ffffffff8cb2d840 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x281/0x3810 [ 934.637621][T15322] #1: ffff888038574108 (&sch->root_lock_key#469){+...}-{2:2}, at: __dev_queue_xmit+0xe46/0x3810 [ 934.648239][T15322] #2: ffffffff8cb2d840 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x281/0x3810 [ 934.658212][T15322] [ 934.658212][T15322] stack backtrace: [ 934.664132][T15322] CPU: 1 PID: 15322 Comm: syz.3.3229 Not tainted syzkaller #0 [ 934.672149][T15322] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 934.682253][T15322] Call Trace: [ 934.685583][T15322] [ 934.688566][T15322] dump_stack_lvl+0x188/0x24e [ 934.693281][T15322] ? show_regs_print_info+0x12/0x12 [ 934.698541][T15322] ? load_image+0x410/0x410 [ 934.703093][T15322] __lock_acquire+0x12c8/0x7c40 [ 934.708059][T15322] ? lockdep_lock+0x1f0/0x1f0 [ 934.712785][T15322] ? verify_lock_unused+0x140/0x140 [ 934.718022][T15322] ? add_lock_to_list+0x191/0x280 [ 934.723086][T15322] ? verify_lock_unused+0x140/0x140 [ 934.728322][T15322] ? __lock_acquire+0x28d6/0x7c40 [ 934.733386][T15322] ? cpu_attach_domain+0x730/0x1090 [ 934.738625][T15322] lock_acquire+0x1bb/0x4a0 [ 934.743217][T15322] ? __dev_queue_xmit+0xe46/0x3810 [ 934.748402][T15322] ? read_lock_is_recursive+0x10/0x10 [ 934.753816][T15322] ? rcu_lockdep_current_cpu_online+0x33/0x120 [ 934.760014][T15322] ? rcu_read_lock_bh_held+0x76/0xf0 [ 934.765340][T15322] ? rcu_read_lock_held+0x40/0x40 [ 934.770407][T15322] _raw_spin_lock+0x2a/0x40 [ 934.774949][T15322] ? __dev_queue_xmit+0xe46/0x3810 [ 934.780106][T15322] __dev_queue_xmit+0xe46/0x3810 [ 934.785097][T15322] ? __dev_queue_xmit+0x281/0x3810 [ 934.790259][T15322] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 934.796295][T15322] ? __lock_acquire+0x7c40/0x7c40 [ 934.801363][T15322] ? netdev_core_pick_tx+0x360/0x360 [ 934.806687][T15322] ? _raw_spin_unlock_irqrestore+0x82/0x120 [ 934.812650][T15322] ? lockdep_hardirqs_on+0x94/0x140 [ 934.817978][T15322] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 934.823935][T15322] ? _raw_spin_unlock+0x40/0x40 [ 934.828845][T15322] ? stack_trace_save+0xa6/0xf0 [ 934.833767][T15322] ? stack_trace_snprint+0xe0/0xe0 [ 934.838945][T15322] ? tcf_mirred_offload_act_setup+0xb00/0xb00 [ 934.845092][T15322] sch_frag_xmit_hook+0x2a4/0x11c0 [ 934.850251][T15322] ? kasan_set_track+0x60/0x70 [ 934.855048][T15322] ? kasan_set_track+0x4b/0x70 [ 934.859851][T15322] ? slab_post_alloc_hook+0x4b/0x490 [ 934.865176][T15322] ? kmem_cache_alloc+0x18b/0x2f0 [ 934.870234][T15322] ? skb_clone+0x1e7/0x370 [ 934.874684][T15322] ? tcf_mirred_act+0x563/0x1640 [ 934.879661][T15322] ? tcf_action_exec+0x174/0x590 [ 934.884644][T15322] ? basic_classify+0x1ae/0x2c0 [ 934.889552][T15322] ? tcf_classify+0x33e/0xbf0 [ 934.894271][T15322] ? qfq_enqueue+0x31c/0x12c0 [ 934.898973][T15322] ? dev_qdisc_enqueue+0x4c/0x2b0 [ 934.904028][T15322] ? __dev_queue_xmit+0x1031/0x3810 [ 934.909312][T15322] ? packet_sendmsg+0x3a9e/0x4c30 [ 934.914373][T15322] ? ____sys_sendmsg+0x5ed/0x9a0 [ 934.919348][T15322] ? mq_dump_class_stats+0x490/0x490 [ 934.924674][T15322] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 934.930823][T15322] ? lockdep_lock+0xf1/0x1f0 [ 934.935465][T15322] ? __copy_skb_header+0x3ba/0x4f0 [ 934.940606][T15322] ? memcpy+0x3c/0x60 [ 934.944622][T15322] ? __copy_skb_header+0x3ba/0x4f0 [ 934.949762][T15322] ? __skb_clone+0x446/0x6c0 [ 934.954384][T15322] ? skb_clone+0x21b/0x370 [ 934.958823][T15322] ? tcf_mirred_act+0x552/0x1640 [ 934.963804][T15322] tcf_mirred_act+0xb1c/0x1640 [ 934.968620][T15322] tcf_action_exec+0x174/0x590 [ 934.973426][T15322] basic_classify+0x1ae/0x2c0 [ 934.978153][T15322] tcf_classify+0x33e/0xbf0 [ 934.982723][T15322] qfq_enqueue+0x31c/0x12c0 [ 934.987260][T15322] ? sch_tree_lock+0x1b0/0x1b0 [ 934.992056][T15322] ? do_raw_spin_lock+0x128/0x2f0 [ 934.997113][T15322] ? __rwlock_init+0x140/0x140 [ 935.001921][T15322] dev_qdisc_enqueue+0x4c/0x2b0 [ 935.006815][T15322] __dev_queue_xmit+0x1031/0x3810 [ 935.011880][T15322] ? __dev_queue_xmit+0x281/0x3810 [ 935.017030][T15322] ? _copy_from_iter+0x5df/0x1130 [ 935.022104][T15322] ? netdev_core_pick_tx+0x360/0x360 [ 935.027446][T15322] ? virtio_net_hdr_to_skb+0x938/0x12b0 [ 935.033035][T15322] ? packet_extra_vlan_len_allowed+0x200/0x200 [ 935.039226][T15322] ? dev_get_by_index+0x1e/0x2d0 [ 935.044212][T15322] ? skb_put+0x10e/0x200 [ 935.048497][T15322] packet_sendmsg+0x3a9e/0x4c30 [ 935.053394][T15322] ? lock_chain_count+0x20/0x20 [ 935.058291][T15322] ? verify_lock_unused+0x140/0x140 [ 935.063533][T15322] ? aa_sk_perm+0x81f/0x950 [ 935.068074][T15322] ? aa_af_perm+0x340/0x340 [ 935.072610][T15322] ? packet_getsockopt+0x980/0x980 [ 935.077760][T15322] ? apparmor_socket_sendmsg+0x8a/0x330 [ 935.083344][T15322] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 935.088662][T15322] ? security_socket_sendmsg+0x7c/0xa0 [ 935.094164][T15322] ? packet_getsockopt+0x980/0x980 [ 935.099314][T15322] ____sys_sendmsg+0x5ed/0x9a0 [ 935.104110][T15322] ? __sys_sendmsg_sock+0x30/0x30 [ 935.109180][T15322] ? __import_iovec+0x306/0x510 [ 935.114075][T15322] ? import_iovec+0x6f/0xa0 [ 935.118616][T15322] ___sys_sendmsg+0x2a2/0x360 [ 935.123330][T15322] ? __sys_sendmsg+0x2a0/0x2a0 [ 935.128151][T15322] __se_sys_sendmsg+0x1c3/0x2b0 [ 935.133045][T15322] ? __x64_sys_sendmsg+0x80/0x80 [ 935.138022][T15322] ? lockdep_hardirqs_on+0x94/0x140 [ 935.143254][T15322] do_syscall_64+0x4c/0xa0 [ 935.147731][T15322] ? clear_bhb_loop+0x60/0xb0 [ 935.152441][T15322] ? clear_bhb_loop+0x60/0xb0 [ 935.157156][T15322] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 935.163098][T15322] RIP: 0033:0x7fc46a39e159 [ 935.167544][T15322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 935.187188][T15322] RSP: 002b:00007fc46b1cd028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 935.195645][T15322] RAX: ffffffffffffffda RBX: 00007fc46a625fa0 RCX: 00007fc46a39e159 [ 935.203669][T15322] RDX: 0000000000004005 RSI: 0000200000000280 RDI: 0000000000000006 [ 935.212039][T15322] RBP: 00007fc46a43506b R08: 0000000000000000 R09: 0000000000000000 [ 935.220048][T15322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 935.228055][T15322] R13: 00007fc46a626038 R14: 00007fc46a625fa0 R15: 00007fffd7143ba8 [ 935.236061][T15322]