last executing test programs: 27m32.853755598s ago: executing program 0 (id=202): sendmmsg$alg(0xffffffffffffffff, &(0x7f0000001200)=[{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000240)="aac1c667980bacb85ff0df16951a5501523076ebe2b944529178d22b164563f7ff1ce7f7b143bf7d9bd7a4d205fd632f830272d3a78302205252b9ae7d8be5638396a0fa0583974f3f28302280b7b4d3c9e13d74dbc7b9e8718956dd5fe482", 0x5f}, {&(0x7f0000000100)="2e3b4d0793c0907a06a1c65afd96e5c997cc6fe980972c7c01fcfa7c85b0db039afd7c02884bfed5faf093fd548fca4f3a6e7391c8acfda620b96e71569873b28a43558b1c85f34b806418d36165411c9ebd6662", 0x54}, {&(0x7f0000000440)="126ce0a7ad2d3c4b1b140fc7402f00828a02ec6c4e59757eda3f13f9d8a4376f", 0x20}, {&(0x7f0000000340)="920c19715e7b63112a94919262715064bc2cd9548fab1c823575fc42bb47c202c216ca5ba5d30f7c657e1fb4bc1494b9c3af7da34476ae85425970a2b4accde6c711e12df583b7", 0x47}, {0x0}, {&(0x7f0000000840)="d04140dc4bd4a687ee1eb92a91", 0xd}], 0x6, 0x0, 0x0, 0xc40}], 0x1, 0x24000040) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="1e000000", @ANYRES64, @ANYRES32, @ANYRESHEX, @ANYRESHEX, @ANYRES32], 0x50) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000680)={'nicvf0\x00'}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) accept4(r1, &(0x7f0000000500)=@vsock={0x28, 0x0, 0x0, @hyper}, &(0x7f0000000600)=0x80, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 27m32.463630149s ago: executing program 0 (id=204): syz_mount_image$bfs(&(0x7f0000000000), &(0x7f0000000040)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x800006, &(0x7f0000000600)=ANY=[], 0x8, 0xb7, &(0x7f0000001a40)="$eJzs0rFJBUEQBuD/3Ts9DkELsAd7MDW3ggsNjRRBK7EDW7GE68DgUpOR5U7BxEAQFb4v2J2dYeGH3efXp9McJ3WfVFUdJhmz1tc3t1eXF23dJ8lj+gxZve/8c13q4y3rpJ2Tl/MMD1uvDeflbpp3meal/YqjqtqGB7+TGQAA+J4uZ1u1+9Qfv7rUJ9l3PxkLAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4M94CwAA///K8iH3") openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x101041, 0xf0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) 27m31.983254551s ago: executing program 0 (id=206): mknod$loop(&(0x7f0000000140)='./file0\x00', 0x8fff, 0x0) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) symlink(0x0, 0x0) 27m31.655157569s ago: executing program 0 (id=209): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000300)='.\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x185093, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000008080)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x152) 27m31.377741417s ago: executing program 0 (id=210): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x4d, 0xfffffffb, 0x7fffffff}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x28000000}, 0x20040084) sendmsg$nl_route_sched(r4, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@newqdisc={0x838, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdf8, {0x0, 0x0, 0x0, r6, {0x10}, {}, {0xa, 0x3}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x80c, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x200000, 0x1, 0x9, 0x9, 0x3, 0x5, 0x5, 0xb762, 0x4, 0x100007, 0x8, 0x10, 0x2, 0x2, 0x8001, 0x1007fc, 0xffff8080, 0x6, 0x403, 0x9, 0x8, 0xfffffff8, 0xd6, 0x4, 0xfffb, 0x40000007, 0x0, 0xfffff4f0, 0x9, 0x1, 0xfffffffc, 0x4, 0x1, 0x6f2151b1, 0x9, 0xc, 0x20001000, 0x4, 0xfffffffe, 0x7, 0x4, 0x99, 0x9, 0x5, 0x6, 0x7, 0xfffffff7, 0x1, 0x2, 0x9, 0x5, 0x1000044, 0x8, 0x8, 0x39e1, 0x4, 0x7ff, 0x8, 0x7, 0x7fbffffe, 0x400, 0x8, 0xfffffa72, 0xcd, 0x4, 0x80000000, 0xc, 0x6, 0x65, 0x91, 0x659, 0x9, 0xf, 0x9, 0xc28, 0x9, 0x7, 0x3, 0x401, 0x3, 0x2, 0xfffffffa, 0x1, 0x10001, 0x3, 0x1, 0x4, 0x7, 0x8, 0x7, 0x1, 0x1, 0x1, 0x5, 0x3c, 0x7, 0x12, 0x8000, 0x1, 0x4dc, 0x80, 0xffffff80, 0x7fffffff, 0xff, 0x9, 0xa7, 0xf, 0x1, 0x0, 0x6, 0x1001, 0xf8, 0x401, 0x7, 0x80000000, 0xffff, 0x6, 0x5, 0x4f, 0xffffffff, 0x80000000, 0x1966f9ad, 0x200, 0x20200, 0xed5, 0xfffffc00, 0x6, 0x4, 0x8, 0x485e, 0xa85, 0x80000040, 0x2, 0x7, 0x7, 0x102, 0x2d5421e8, 0x7, 0x10000, 0x2, 0x6, 0x3ff, 0x40000f04, 0x0, 0x2, 0x5, 0xfffffc00, 0x5, 0x8d, 0x4, 0x401, 0x4, 0x9, 0x50200523, 0xfffffffb, 0x1, 0x0, 0x3, 0x8, 0x5, 0x8, 0x3, 0x0, 0x800, 0x2, 0x8, 0x7ff, 0x1, 0x9, 0x6, 0x4, 0x400001, 0x4d15, 0x1ff, 0xfffff068, 0x3, 0x469, 0x3, 0x0, 0x200, 0x10000005, 0x7, 0x1, 0x8, 0x42ba, 0x4, 0x800009, 0x3, 0x8, 0x8, 0x53, 0x6, 0x4, 0x400, 0x8000, 0x0, 0x2c310b18, 0xfff, 0x0, 0x3, 0xcd34, 0x9, 0x81, 0xdf3, 0x2, 0x7, 0x8, 0x40fff, 0x1ff, 0x8000, 0x3, 0x8, 0x80, 0x6, 0x9a6, 0xe4cb, 0x402, 0x9, 0x1ff, 0x5, 0x9b4, 0x1, 0x6, 0x0, 0x9, 0x0, 0x9, 0x0, 0x100004, 0x10, 0x901, 0x5, 0x2, 0x7d, 0x7420, 0x6, 0x6, 0xc, 0x1000, 0x9, 0x9, 0xe6, 0xab, 0x400, 0x7fffffff, 0xed, 0x7ff, 0xd83, 0x68, 0x80000001, 0x6, 0x9fd, 0x6, 0x200, 0x4, 0x2]}, @TCA_TBF_PTAB={0x404, 0x3, [0x800, 0x1, 0x1, 0x0, 0xb, 0x196, 0x7ff, 0x6, 0x0, 0xe, 0x8, 0xc9cd, 0x2, 0x9, 0x0, 0x200, 0x3, 0x9, 0xd, 0x2, 0x7, 0x4, 0x6, 0x9, 0x8000000a, 0xc4, 0x60, 0x8000, 0x7, 0x2000db3a, 0x800, 0x3, 0x9, 0x3, 0x9, 0x0, 0x401, 0x3, 0x6, 0x33, 0x6, 0xfffffffc, 0x8001, 0x6, 0x6, 0x4, 0x5, 0xd, 0x2, 0x7, 0x1, 0x0, 0x3, 0x81, 0x3, 0x1ff, 0xfffffff5, 0xc9, 0x5, 0x65e1, 0x10001, 0xc, 0x8001, 0xffffb5ca, 0xe, 0x3, 0x97, 0x7, 0xb, 0x0, 0x1, 0x7ff, 0xb4, 0xf, 0x1, 0x3, 0xff, 0xfff, 0x0, 0xee3, 0x43, 0x9, 0x1, 0x3, 0x1, 0x3796, 0x8, 0x6, 0xbe, 0x3, 0x45, 0xdd1, 0x5, 0x7, 0x7de, 0x0, 0x3, 0x345, 0x4, 0x9da, 0x4, 0x6, 0xea6, 0x3, 0x5, 0x3, 0x3, 0xffffffff, 0xb, 0x96, 0x7, 0x2, 0xf, 0x9, 0xffffffff, 0x5, 0x3, 0xd7da, 0x82, 0x7f, 0x9, 0x1, 0xb8, 0x6, 0x4, 0x6, 0x3f0a, 0x4, 0x9, 0x5, 0x1ff, 0x4, 0x4, 0x1, 0x7, 0x2, 0xfffffffe, 0x3, 0xb, 0xfffffff7, 0x8, 0x101, 0xc57, 0x5, 0x2, 0x5, 0xc, 0xfffffffc, 0xf, 0x1982, 0x1, 0x80000000, 0x5, 0x9, 0x6, 0x8000, 0x40000002, 0x1, 0x2, 0x2, 0x5, 0x4, 0x2, 0x5, 0x5, 0x7, 0x692, 0x92, 0x4, 0x0, 0x2, 0x43d, 0x1b8c, 0x14, 0x65, 0xc00, 0x9, 0x9, 0x3, 0x7, 0x10001, 0x295, 0x6, 0x9, 0x1, 0xb7e, 0x10001, 0x2, 0x7, 0x4, 0x1, 0x2, 0x103ff, 0xfb5, 0x8, 0xa, 0x0, 0x9, 0xc, 0xc3d5, 0x2, 0x8000, 0xec, 0xd, 0x5, 0x84d3, 0xffdffeff, 0x2, 0x7ff, 0x7fffffff, 0x80, 0x2, 0x4, 0x2, 0x6, 0x3, 0x70, 0x0, 0x0, 0x400, 0x8, 0x10000, 0x9, 0x101, 0xefba, 0x7, 0x3, 0xbe4, 0xa4a, 0x7, 0x400, 0xc, 0xfffffff9, 0x8001, 0xd, 0x1, 0x9, 0xffe, 0x421, 0x3ff, 0x2, 0xd, 0x7, 0x5, 0xfffffffd, 0xac, 0x7fff, 0xa, 0x0, 0x6, 0x7f, 0x2dd, 0x7, 0x4, 0x7, 0x1]}]}}]}, 0x838}, 0x1, 0x0, 0x0, 0x40098}, 0x0) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0xdd86, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="80", 0x1}], 0x1}, 0x4) 27m29.893808145s ago: executing program 0 (id=219): kexec_load(0x3, 0x1, &(0x7f00000005c0)=[{0x0, 0x0, 0x5, 0xffffffff}], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000740)="bd9c629b909dddebc0508bf412865663aded7919352b141faa7dc00680ce5a44ff1ed1c813c6c1e58e28c509cd269d0e79fff4d2ea4c1da69fa672c4f5eb15788aa929e9f5c94e443cf68a1759ee805958a7c76c8c7f11a39ea32c019c2f2c8cce48d92d659f623081974c0135dc1fe2a057f725a843c083e0620ffa607d3b9570a5b4094fca255491844b3d5cb63bab3d76ad07f9503d1450f1fb860b18ac983285f983e51262c539312073482f1538d9588323b836e6e2b7704dff3cbf89c2b828c7613310eafd664c946b1a6728154b1877257a8abe3d983344da083b86aee35e6b9b0d93", 0xe6}], 0x1, 0x0, 0x0, 0x40800}, {0x0, 0x0, &(0x7f0000003900)=[{&(0x7f00000009c0)="c2debd9e2d4617d17e01e704d3576f8b26b757ffa164a105efcaa28e5d52d4383258c148e95e4ee927dab4ba9cdbf4dbf6b0e19f8b7e9a95211ec6aedfd78a09200b7076afabdae9c87c6837e202845b6cf3ac6b728856d66eef286087e0", 0x5e}, {&(0x7f0000000ac0)="3fe4c8a3288f097706", 0x9}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e02801", 0x4d}, {&(0x7f0000000c40)="176d6b3905505e2a41391bf6fd66d8ad4ebc86e07694005204b0151bfa8dc581a5be209d8850a950791f10f76de79651272a11f6d7267276ff1596a47826a90a0b74b425d8ff2bbea5c5732f69a908c45b4b348abc24d2cd2031a9508ef8e3594bd12ebc38c466f76d6ff3618471f4f6574e1043766375eb889750ca25429f976089462bf1b689280ebc67640f4534eef4b7ffd85963bc5d8b114670c00f76cbdd722662dce5fc58daf323bf987ef7d646a99794c02b62b3", 0xb8}, {&(0x7f0000000d40)="7edb39aa76e39c9fc185dd49e1d028ba5e90ec3bb54d3c486f189f406945a495fe7b4ad51446c162f581368e4d711db9add53f7917e1dc55ae9543ea21d63f85d9a5a996f6fa32ead42a9b7e97a7ae1b4a8f76ff9321b4ec76606f9709bb57eda4e8c45e797ff2cabc03a3d03ca57b5239833610ac4306ac2a443c768b9365de67f9f9be49fe7d6f4d71abedeb55ab91ddd31154758fcaa8f25a56126152b9ba46d9bd4cd0d67de6fda9f72a37319681c1750045b363a3b90faecc5b5cbc0a241152a62edc2d081937058931cfb823591b49c610995a895f214c473ef6e1d49051b919", 0xe3}], 0x5, 0x0, 0x0, 0xc0}], 0x2, 0x48040) r2 = socket$alg(0x26, 0x5, 0x0) syz_open_dev$dri(&(0x7f0000000180), 0x1, 0xc0400) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 27m28.743761085s ago: executing program 32 (id=219): kexec_load(0x3, 0x1, &(0x7f00000005c0)=[{0x0, 0x0, 0x5, 0xffffffff}], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000740)="bd9c629b909dddebc0508bf412865663aded7919352b141faa7dc00680ce5a44ff1ed1c813c6c1e58e28c509cd269d0e79fff4d2ea4c1da69fa672c4f5eb15788aa929e9f5c94e443cf68a1759ee805958a7c76c8c7f11a39ea32c019c2f2c8cce48d92d659f623081974c0135dc1fe2a057f725a843c083e0620ffa607d3b9570a5b4094fca255491844b3d5cb63bab3d76ad07f9503d1450f1fb860b18ac983285f983e51262c539312073482f1538d9588323b836e6e2b7704dff3cbf89c2b828c7613310eafd664c946b1a6728154b1877257a8abe3d983344da083b86aee35e6b9b0d93", 0xe6}], 0x1, 0x0, 0x0, 0x40800}, {0x0, 0x0, &(0x7f0000003900)=[{&(0x7f00000009c0)="c2debd9e2d4617d17e01e704d3576f8b26b757ffa164a105efcaa28e5d52d4383258c148e95e4ee927dab4ba9cdbf4dbf6b0e19f8b7e9a95211ec6aedfd78a09200b7076afabdae9c87c6837e202845b6cf3ac6b728856d66eef286087e0", 0x5e}, {&(0x7f0000000ac0)="3fe4c8a3288f097706", 0x9}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e02801", 0x4d}, {&(0x7f0000000c40)="176d6b3905505e2a41391bf6fd66d8ad4ebc86e07694005204b0151bfa8dc581a5be209d8850a950791f10f76de79651272a11f6d7267276ff1596a47826a90a0b74b425d8ff2bbea5c5732f69a908c45b4b348abc24d2cd2031a9508ef8e3594bd12ebc38c466f76d6ff3618471f4f6574e1043766375eb889750ca25429f976089462bf1b689280ebc67640f4534eef4b7ffd85963bc5d8b114670c00f76cbdd722662dce5fc58daf323bf987ef7d646a99794c02b62b3", 0xb8}, {&(0x7f0000000d40)="7edb39aa76e39c9fc185dd49e1d028ba5e90ec3bb54d3c486f189f406945a495fe7b4ad51446c162f581368e4d711db9add53f7917e1dc55ae9543ea21d63f85d9a5a996f6fa32ead42a9b7e97a7ae1b4a8f76ff9321b4ec76606f9709bb57eda4e8c45e797ff2cabc03a3d03ca57b5239833610ac4306ac2a443c768b9365de67f9f9be49fe7d6f4d71abedeb55ab91ddd31154758fcaa8f25a56126152b9ba46d9bd4cd0d67de6fda9f72a37319681c1750045b363a3b90faecc5b5cbc0a241152a62edc2d081937058931cfb823591b49c610995a895f214c473ef6e1d49051b919", 0xe3}], 0x5, 0x0, 0x0, 0xc0}], 0x2, 0x48040) r2 = socket$alg(0x26, 0x5, 0x0) syz_open_dev$dri(&(0x7f0000000180), 0x1, 0xc0400) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 18m26.327531044s ago: executing program 3 (id=4567): syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x10000, &(0x7f0000000080), 0x1, 0x50a, &(0x7f0000001f40)="$eJzs3M9vVNUeAPDvnXZoC49HH49HQh/vvQLP2JjYQkFh4QYTExeaGHEhy6YdSGUAQ7sQ0siQGFyTuDcujTtN3OrSuPIPwIULE0NClA1gYjLmztw7nc6PzrTW1rafTzJwzp17z7nfuefMnHtP7w1g1xpP/0ki/hYR9yPiQD27coXx+n9PHi3NPn20NBuVavXCz0ltvcdpPpNvty/LTBQiCh8kLQXWLdy8dWWmXC7diEotP7V49d2phZu3np+/OnO5dLl0bfrcuTOnT519cfqFFWVHxHDPoDrUl8b1eOz960ePvHrx3uuzg62FNcfRVb7VL5Weq0b+2XbxTHN5O8D+pnTSHtftTd0Z+jacNcNi2v+XyscvbvUOAZumWq1Wh7q/Xam2utO2BNi2ktjqPQC2Rv5Dn57/5q/6kuJmDD+23MPz9ROgx4+WqrdjcPZJI/7BKGTrFFvOb1OrjJnWZDwi3q78+nH6itWuQ/ywQRUCALve1+ezYWASLeO/QhxuWu/v2RzKaET8IyIORsQ/I+JQRPwrYsW6KyQR1VXqP9S6oFH/F9ksQuHBemPrRzr+eymb28pfWb35KqMDWW5/RD5gLp3MPpOJKA5dmi+XTnUpf0+P+pvHf+krrT8fC2b78WCwZbA5N7M4s75o2z28EzE22Bp/MpgeuHwaJ4mIIxExtoZyR5vS8899erSRaTmt6B1/TbXDlN6GzJ9VP4l4tn78K9GIf2TFJGLSPD9ZaJufnBqOcunkVNoKTnbcyW+/u/tGt/p7xv/lj62bvHL2qwt/PPBMevz3NrX/yOdvl+MfTSKSxnztQkR1YG113P3+w1q54yfa31tv+9+TvFVL5/3rvZnFxRunIvYkr7Uvn17eNs/n66fxT5zo3P8PZtukn8S/IyJtxP+JiP9GDOT7fiwijkdEh9Aavnn5/+90e6/P9v+nSeOf6/j9l2TtoHb8l+fr+0zk5adLBq4cu/90rPPEfRb/gdWP/5laaiJb0vn7L1nxFdHvnm7ARwgAAAB/eYWo/e1/YbKRLhQmJ+vXgA7F3kL5+sLi/yLi2lz9HoHRKBYuzZdL+QW50Sgm+fXP0ab8dEv+dHbd+KOBkVp+cvZ6eW6rg4ddbl+tzydt/T/10xqv8wLb0A66Dw1Yo179//C9TdoRYNP5/Yfdq6n/d3uyRcVfysDO5Pcfdq9O/f92fLbqvQu+M2D7q+rLsKut3v97P28T2L4G481Gunbbc8e7bYGdqPvvvzMD2MF63yQ/tOZ7/5cT1aHObw1HhycGDK+rip6JkQ51bUkiHVltYIHFiOhv5ZH1VJEPAbs/4aGwtgKHov2tgVhtq6TzcxwiotJ1q/RT6bk/lw/32/hLN5Kn9Qdl9ggwfybKRjebz5f7abHPw90l8Vu/zc/5PgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsKP8HgAA//87jdA6") bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x1, 0x11) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$DVB_DEMUX_DMX_SET_FILTER(0xffffffffffffffff, 0x403c6f2b, &(0x7f0000001e40)={0x6, {"4772ffacff04856ec9e8776f8ee906be", "2dfad343e15ead11f40c897700", "0000b3f88813da82b4cf00"}, 0x3eaf, 0x4}) ioctl$DVB_DEMUX_DMX_SET_FILTER(0xffffffffffffffff, 0x403c6f2b, &(0x7f0000000000)={0x6, {"771c2e01f8ffffffffffee00", "000900000000000200"}, 0x7, 0x4}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x4, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}}, &(0x7f0000000080)='syzkaller\x00', 0x8, 0x0, 0x0, 0x41000}, 0x94) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.effective_mems\x00', 0x275a, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) write$binfmt_script(r3, &(0x7f0000000040), 0x208e24b) 18m25.105815085s ago: executing program 3 (id=4574): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x1}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) capset(0x0, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="1c0000001900010000010000020000008020203efd04000500070000"], 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x48050) sched_setscheduler(r0, 0x6, &(0x7f0000000080)=0x6) write(r3, &(0x7f0000000000)="240000001a005f0214f9f407000904001f00000000000002000000000800040001000000", 0x24) 18m23.458922758s ago: executing program 3 (id=4579): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]}) prctl$PR_SET_THP_DISABLE(0x51, 0x1) 18m22.785714726s ago: executing program 3 (id=4583): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd21, 0xfbffffff, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x400) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000001300)=@newtfilter={0x60, 0x2c, 0xd27, 0x70bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r2, {0x6, 0xffe0}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_fw={{0x7}, {0x34, 0x2, [@TCA_FW_ACT={0x30, 0x4, [@m_ct={0x2c, 0x1, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x4000000}, 0x4800) 18m22.310134218s ago: executing program 3 (id=4587): prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) ptrace$peeksig(0x4209, r0, 0xffffffffffffffff, 0x0) 18m21.714783944s ago: executing program 3 (id=4589): socket$nl_route(0x10, 0x3, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) socket$pptp(0x18, 0x1, 0x2) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) socket$inet(0xa, 0x801, 0x84) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80042, 0x1bf) close(r0) r1 = socket(0x23, 0x5, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000080), 0x9, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESDEC=r1]) 18m6.544261629s ago: executing program 33 (id=4589): socket$nl_route(0x10, 0x3, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="120000000c0000000800000002"], 0x50) socket$nl_generic(0x10, 0x3, 0x10) socket$pptp(0x18, 0x1, 0x2) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) socket$inet(0xa, 0x801, 0x84) r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x80042, 0x1bf) close(r0) r1 = socket(0x23, 0x5, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000080), 0x9, &(0x7f0000000100)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESDEC=r1]) 4m1.209397468s ago: executing program 5 (id=7023): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0xf5d1b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x6b4, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)={0x58, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x58}, 0x1, 0x0, 0x0, 0x20044000}, 0x0) 4m0.180166254s ago: executing program 5 (id=7024): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6d71b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r3 = syz_open_dev$vim2m(0x0, 0x7, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r3, 0xc0405602, &(0x7f0000000000)={0x21, 0x1, 0x1, "ff00000000000000050040000000000700ef3809000000000000000000000004", 0x494e4f4b}) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000100)={0x7, 'vlan0\x00', {0xa}, 0x1fb}) r4 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r4, &(0x7f0000001200)=[{{&(0x7f0000000280)={0x2, 0x4e20, @private=0xa010101}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000200)="9c", 0x1}], 0x1}}, {{&(0x7f0000000880)={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000900)=[{&(0x7f00000008c0)}], 0x1}}], 0x2, 0x8080) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r4, 0x84, 0x19, &(0x7f0000000240)={r5, 0x1d07}, 0x8) r6 = getpid() syz_open_procfs$pagemap(r6, &(0x7f0000000000)) syz_mount_image$vfat(&(0x7f0000000400), &(0x7f0000000540)='./file0\x00', 0x2008404, &(0x7f0000001280)=ANY=[@ANYBLOB="6e6f6e756d7461696c2c6e66732c73686f72746e616d653d6c6f7765722c757466383d312c64656275672c696f636861727365743d757466382c73686f72746e616d653d6d697865642c757466383d312c004845160000000000", @ANYBLOB="999c07c03c5bc6a3d07b90faae21d196274f93a6593a9830472d5633665f2f51cfb24aaad481c74e142cd734ec6fd04935a94af71c756dbd6f5e2f39b2c4c30725d103d40d7e65129bb928ef73849dae618e438695e0a9078605ba418298145bf2fec11b0d16763288e7ecfe663aa5ff450d1e46d251160109c0378e04fe2629890c28366a6489e706ecf23195dc7f19e03fad", @ANYRES32=r3, @ANYRES8=r6, @ANYBLOB="c5ce1b9733c91520022860834995bd440de70a56f9b17205184d3be668bd36e2d9b2c62fb43e3a2a12e69d2eea55d9a2bb426304b9bbf1debf4d593fe50000000000000000"], 0x51, 0x2c9, &(0x7f0000000a80)="$eJzs3M9rE1sUwPHzkr4mTWmTB48HT1APutFNaOPCpQZpQQwotSnqQpjaiYaMSZkJlYjYbMStf0fp0p2g/gPdiBv37ooguOlCHOnMpJ20adrUNEnb7wfKPcm5h7nzo+XMQGf93punpYKTLhhVicRVIiJ12RBJbUaBv4Ix4sXDElaXy6M/vpy9e//BrWwuNzWjOp2dvZJR1fHz75+9WL3wsTo693b8XUzWUg/Xv2e+rg2v/b/+a/ZJ0dGio+VKVQ2dr1Sqxrxl6kLRKaVV71im4ZhaLDum3ZQvWJXFxZoa5YWxxKJtOo4a5ZqWzJpWK1q1a2o8NoplTafTOpaQdobaZo+p1a0ocrA9zK/MzBjZPdNutEsLQ4+MtPrStrP11sn8Sg/WBAAABkz7/t/v9ffu/3Nz/thJ///f/v2/yJH3/6dVvenTPv0/jqur4avftrNGIvj9bUb/DwAAAAAAAAAAAAAAAAAAAADAcbDhuknXdZObY/CV9zkmInERcYN8n5eJIxI+/27oZ5/zf61Py0WXhf5xLy5ivV7KL+X90c9nC1IUS0yZkKT89K6HgB9P38xNTagnJR+s5aB+eSkflVijviHVqv7cP5N+vTbX/y2J8PYzkpR/W28/07J+WC5dDNWnJSmfHklFLFnwruvt+peTqjdu53bUj3jzAAAAAAA4CdK6Zdf9u5f3JsRld96vDz0fcF13ud3zgR3310Ny5kS+hBMAAAAAgMHj1J6XDMsy7UMEMRH5g/LuB64r0v9lRGUwjkZzcF1EBmAZvQri4r+42rT1MOXfRKSDKvcAc4ZEpO+HpYOg33+ZAAAAAHTbdtPfQdHnV0e4IgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAATp+Dvg+sMX9XqpFoUx7aXLTnOwgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMkN8BAAD//9EDG+8=") syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000800)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x380c07b, 0x0, 0x1, 0x0, &(0x7f0000000140)) mount$bind(0x0, &(0x7f0000000100)='.\x00', 0x0, 0x21, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) quotactl$Q_SYNC(0xffffffff80000102, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x442, 0x40) r7 = socket$netlink(0x10, 0x3, 0x9) bind$netlink(r7, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbfb}, 0xc) bind$netlink(r7, &(0x7f0000000480)={0x10, 0x0, 0x25dfdbfb, 0x1}, 0xc) 3m57.691891317s ago: executing program 5 (id=7025): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000001c0)='./file1\x00', 0x800714, &(0x7f00000000c0)={[{@test_dummy_encryption}]}, 0x1, 0x4c0, &(0x7f00000006c0)="$eJzs3M1rXFUfAODfnXz0K23y9u3b923fVqNVLH4kTfphFy5UFAQVBF3UZUzSWjttpInQlqBRpK4L7sWl4NKVOzeiLsQ/QMGlFIoGoakgRO5XOklm0nx22szzwGTOuffce86595zJmXvm3gBaVm/6J4noioifI6I7j85P0Ju/zUxPDt+anhxOYnb29d+TLN3N6cnhMmm53Y4icrgSUfk4iWeTxfmOX75ybqhaHb1YxPsnzr/bP375ylNnzw+dGT0zemHw5MljRweePjF4fN52dXa1yLY6y9J63dz//tiBfS+9ee3V4VPX3vr+y3Rfew/m62vrcUe3FpXi5XrJetOj9sdsZuG6R5ed2f1hZ004aW9iQViRtohIT1dH1v+7oy1un7zuePGjphYO2FDp/6YtjVdPzQKbWBLNLgHQHOU/+vT7b/mKv+/S4OMecOO5iM4iPDM9OTwzdx2gPSrF8o4NzL83Ik5N/fVZ+oqVXocAAFiFbGzz5ILxX6YSe7P3fK5jVzGH0hMR/4qI3RHx74jYExH/icjS/jci/pdvPNu9zPx7F8QXj38q1+uWeZ2k479nasZ+MzX1L9562orYzqz+Hcnps9XRI8UxORwdW9L4wBJ5fPNCZ8N1teO/9JXmX44FiwJcb88v0M3tZGRoYmi9DsKNDyP2t9erfzI3E5C2gH0RsX9lu95VBs4+/sWBRonuXP8lrMM80+znEY/l538qFtS/lDSYn0zb+InB4/1bozp6pL9sFYv98NPV1xrlv6b6r4P0/G+f3/4XpOj+M8nnazuiWh29OL7yPK7+8knD7zQraP9z0vbfmbyRzVn/+Ha+7NLQxMTFgYjO5JUsXnSWrZEuH7y97aUiXqZP63/4UP3+v7vYJq3//yMibcQHI3Y9EBEPFmV/KCIejohDS9T/u+cfeWeJ+ieRRFPP/0jdz7+59t+T1M7XryLQdu7brxvN2y/v/B+LqeyzNpd9/t3Bcgu4xsMHAAAA94VKRHRFUunLw71dUan09eW/4d8T2yvVsfGJJ06PvXdhJL9HoCc6KuWVru6a66EDyVSxxzw+WFwrLtcfLa4bf9q2LYv3DY9VR5pcd2h1O+b3/yj7f+q3tmaXDthwjefRlrg1ANgUFvb/SpPKAdx9y/kdje8CsDnV6f/1nqEBbEKe1wKtq17//2BBfNH43wgBNoXF/f/XOo+sAzYj439oXfo/tC79H1rSWu7rX32gvFlgycRlEeum2brsO/xbJVA+HmYj89oWt5dEJQt0xT1Q99UEupeTOCK+WnNebetQ5rTH3N3jU/PAIQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgPvYPwEAAP//O47fqw==") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = syz_io_uring_setup(0x141c, &(0x7f0000000200)={0x0, 0x2af2, 0x1, 0x1, 0x139}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_modify_offsets$generic(r4, r5, 0x2c, 0x10000) io_uring_enter(r3, 0x4119, 0x869e, 0xc, 0x0, 0x0) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000340)={0x2e, 0x52, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000300)=@any_dev={0x2, 0xda4, 0x0, 0x0, 0x1000, 0x100, 0x0, 0x0, 0xde}}}, 0x0) syz_io_uring_complete(r4, r5) io_uring_enter(r3, 0x20, 0x20, 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c2) mount$overlay(0x0, 0x0, &(0x7f0000000b80), 0x848, &(0x7f0000000280)={[], [{@fowner_lt}, {@dont_measure}, {@flag='nolazytime'}]}) syz_mount_image$fuse(&(0x7f00000001c0), 0x0, 0x322020, 0x0, 0x1, 0x0, 0x0) 3m56.613801725s ago: executing program 5 (id=7026): sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10008000}, 0x40095) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x40f00, 0x24, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 3m55.153784102s ago: executing program 5 (id=7031): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="4400000010000400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b000100697036746e6c00001400028006001300000000000800"], 0x44}}, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) 3m54.796641391s ago: executing program 5 (id=7033): mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000340)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/threads\x00', 0x1, 0x0) write(r0, &(0x7f0000000480)='1\n', 0x2) 3m37.135732759s ago: executing program 34 (id=7033): mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./nfsd\x00', &(0x7f0000000340)='nfsd\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./nfsd/threads\x00', 0x1, 0x0) write(r0, &(0x7f0000000480)='1\n', 0x2) 3m3.554824532s ago: executing program 6 (id=7152): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setitimer(0x1, &(0x7f0000000340)={{}, {0x0, 0x2710}}, &(0x7f0000000380)) 3m0.921804588s ago: executing program 6 (id=7157): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b000100697036746e6c0000140002800600130000000000080014"], 0x44}}, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) 2m59.477654105s ago: executing program 6 (id=7162): r0 = socket$inet(0x2, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdir(&(0x7f0000000000)='my_tracefs\x00', 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount(0x0, &(0x7f0000000200)='my_tracefs\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='my_tracefs/events/task/task_rename/filter\x00', 0x1, 0x0) write(r4, &(0x7f0000000540)="28217e5f73638f33952a8fbf3318c5f56f6df3ae4b291d6e0cc9e7961db414a8914f6df033df38d627d906f474a6aed40310ef326e2d98a5d1ba7ac41ffd68ab3ad8dd0c808f64e3f4bc5be6513ef1ac66a6aaa17bd4918a20c7ed9fbf12b64c", 0x60) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000180)=@raw={'raw\x00', 0x8, 0x3, 0x1e8, 0x0, 0x8, 0xfa04, 0xc0, 0x6c02, 0x150, 0x194, 0x194, 0x150, 0x194, 0x3, 0x0, {[{{@ip={@remote, @dev, 0x0, 0x0, 'team_slave_0\x00', 'veth0_virt_wifi\x00', {}, {}, 0x6}, 0x0, 0xa0, 0xc0, 0x0, {0x0, 0x74020000}, [@common=@inet=@tcp={{0x30}, {[], [], 0x0, 0x0, 0x2, 0xc}}]}, @unspec=@TRACE={0x20}}, {{@ip={@multicast2, @empty, 0x0, 0x0, 'geneve1\x00', 'tunl0\x00', {}, {0xff}}, 0x0, 0x70, 0x90}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0xffffffffffffffd3) 2m58.338254524s ago: executing program 6 (id=7168): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf21f1000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0xc000201d}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000300)=ANY=[@ANYBLOB], 0x11}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe80000000000000000003"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) connect$pptp(0xffffffffffffffff, 0x0, 0x0) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r6, 0xc01864b0, &(0x7f000000a100)={0x0, 0x0, 0xc, 0x8, 0x7}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='sysfs\x00', &(0x7f00000000c0)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r7 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r7, &(0x7f0000000180)='1234 1111 ffffffff ffffffff 0 0', 0x1f) 2m57.097930385s ago: executing program 6 (id=7170): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="0000000000000000240012800b000100697036746e6c0000140002800600130000000000080014"], 0x44}}, 0x0) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) 2m56.717362665s ago: executing program 6 (id=7173): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000370)='./nfsd/nfsv4gracetime\x00', 0x1, 0x0) write(r0, &(0x7f0000000470)='10\n', 0x3) 2m39.906372922s ago: executing program 35 (id=7173): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./nfsd\x00', &(0x7f00000000c0)='nfsd\x00', 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000370)='./nfsd/nfsv4gracetime\x00', 0x1, 0x0) write(r0, &(0x7f0000000470)='10\n', 0x3) 1m34.923305221s ago: executing program 7 (id=7376): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000018c0)=ANY=[@ANYBLOB="0a000000d2cf00003d36000002"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000140), 0x9, r1}, 0x38) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000380)={r1, &(0x7f0000001940), &(0x7f00000002c0)=""/187}, 0x20) 1m34.55578535s ago: executing program 7 (id=7377): socket(0x840000000002, 0x3, 0x100) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffff9c, 0x0, 0x4) r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) r2 = open(0x0, 0x143142, 0x80) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x1c1040, 0x0) bind$unix(0xffffffffffffffff, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) r4 = openat(0xffffffffffffff9c, &(0x7f0000000e80)='./bus\x00', 0x1c1002, 0x40) write(r4, &(0x7f0000004200)='t', 0x1) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x10, &(0x7f0000000340)={[{@rodir}, {@rodir}, {@iocharset={'iocharset', 0x3d, 'cp874'}}, {@shortname_lower}, {@numtail}, {@utf8}, {@numtail}, {@utf8no}, {@fat=@nocase}, {@fat=@errors_continue}, {@fat=@check_strict}, {@iocharset={'iocharset', 0x3d, 'cp863'}}, {@utf8}, {@iocharset={'iocharset', 0x3d, 'cp1250'}}, {@utf8no}, {@uni_xlate}, {@numtail}, {@fat=@nocase}, {@rodir}]}, 0x3, 0x27b, &(0x7f0000000640)="$eJzs3cFqK1UYAOB/mqRJdJEsXInQAV24Kq1P0CIVxIKgZKEutNgUpAmFFgJVMXblE/gEPo8b8QV8AC93d7u43LmkM0nTyyQlvWlT7v2+TQ//+f85/5kZ2tWc/vBB//jw5Ozo4tf/otFIYm0nduIyiXasxdjvUerfJ+VxAOCRu8yyeJrl6nno/GZGbUZlde3emwMA7sX03/9V9wIAPIyvv/n2i939/b2v0rQR0f9j0Eki/5nP7x7FT9GLbmxFK55HZBP5+LPP9/eimo6046P+cNAZVfa//7u4/u7/EVf129GKdnn9dpqbqh8OOrV4p1h/pxfdL/+KVrxXXv9JSX101uPjD6f634xW/PNjnEQvDovexvW/bafpp9mfz375bhQd1SfDQac+ySuyKw/6YAAAAAAAAAAAAAAAAAAAAAAAeKNtphPtm+fvjA/+nzM/53yg4dT5PFtpmmZJnn9dX433q1Fd5d4BAAAAAAAAAAAAAAAAAADgsTg7//n4oNfrni51MP6sv2QqXtyM1CPi7mttLFoVlaK1XhKx2Fq1qF9V3p5cWXAXzVE/3dOkGst7BMkk0pye2oh8rVGkmQ+mIq+9eiOuBuO36/ggue3hNspekiUMspLXrzKzav3VSLPYQUlyc87q6+/eqeesNWMqiYja5GbOv05tuffw4X4HAQAAAAAAAAAAAAAAAAAAueuPfksmL1bQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACswPX//19gMCyKZ+VkldGgGkVkxVsEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLfAyAAD//0MUZ+o=") syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0xd280, 0x0, 0x1, 0x0, &(0x7f00000007c0)) sendfile(r4, r3, 0x0, 0x7fffffff) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x8004) ftruncate(r2, 0x2007ffb) sendfile(r2, r2, 0x0, 0x1000000201005) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) 1m33.185826695s ago: executing program 7 (id=7379): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r0, 0x220c) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = socket(0xa, 0x1, 0x0) listen(r4, 0x7f) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r6, 0x9) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r7, 0x0) r8 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r8, &(0x7f0000000040)=[{&(0x7f0000000200)="580000001400192340834b80040d8c560a06e7bc45ff810500000000000058000b480000945f64009400050028925a01000000000000008000f0fffeffa809000000fff5dd0000001000010002081000418e00000004fc", 0x57}], 0x1) 1m32.039351694s ago: executing program 7 (id=7382): syz_mount_image$ext4(&(0x7f0000000780)='ext4\x00', &(0x7f0000000480)='./file1\x00', 0x0, &(0x7f0000000540), 0x1, 0x79e, &(0x7f00000007c0)="$eJzs3c9rXNUeAPDvnfxq0r6XPHjwXl0FBA2UTkyNrYKLigsRLBR0bRsm0xAzyZTMpDQhixYR3ChaXAi66dpq3bn1x1b/CxfSUjUtVlxI5E5m2kkzk07a+VHI5wM3c8695+ac75z748zcy9wA9q3x9E8m4nBEfJREjFbnJxExUEn1R5zcKnd3Yz2XTklsbr75W1Ipc2djPRd166QOVjP/j4jv34s4ktlZb2l1bWGmUMgvV/OT5cXzk6XVtaPzizNz+bn80vGp6eljJ144cbx9sf7x09qhmx+/9uxXJ/9693/XP/ghiZNxqLqsPo52GY/x6nsykL6F27za7sp6LOl1A3gk6a7Zt7WXx+EYjb5KqonhbrYMAOiUTQBgH0qMAQBgn6l9D3BnYz1Xm3r7jUR33XolIg5sxV+7vrm1pL96ze5A5TroyJ1k25WRJCLG2lD/eMSHVyKuff7N29ei2g+upQHdcOlyRJwdG995/E923LOwV8/ttnBzqPIy/sDs/Xb+gV76Nh3/vNho/Je5N/6JBuOfoQb77qN4+P6fudGGappKx38v193bdrcu/qqxvmruX5Ux30Bybr6QT49t/46IiRgYSvNTlaKNR24Tt/++3az+NP507JdOv19554u0/vT1fonMjf6h7evMzpRnHjfumluXI57qbxR/cq//kybj39Mt1vH6S+9/1mxZGn8ab23aGX9nbV6NeKZh/9/vy2TX+xMnK5vDZG2jaODrnz8daVZ/ff+nU1p/7bNAN6T9P7J7/GNJ/f2apb3X8ePV0e+aLXt4/I23/8HkrUp6sDrv4ky5vDwVMZi8sXP+sfvr1vK18mn8E0833v+3qm28/aefCc+2GH//zV+/fPT4OyuNf3ZP/b/3xPW7C33N6m+t/6crqYnqnFaOf6028HHeOwAAAAAAAAAAAAAAAAAAAAAAAABoVSYiDkWSyd5LZzLZ7NYzvP8bI5lCsVQ+cq64sjQblWdlj8VApvZTl6N1v4c6Vf09/Ep+oJA/Vp+fL+Sfj4j/RMQnQ8OVfDZXLMz2OngAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqDrY5Pn/qV+Get06AKBjDvS6AQBA1zn/A8D+s7fz/3DH2gEAdI/P/wCw/7R8/j/b2XYAAN3z4Pm/r1GhhjMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgJadPnUqnzT831nNpfvbC6spC8cLR2XxpIbu4ksvmisvns3PF4lwhn80VF7etnKlLX9p6KRSL56djaeXiZDlfKk+WVtfOLBZXlspn5hdn5vJn8gNdjQ4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAWlNaXVuYKRTyyxK7Jobb8X8Gex1F+xL98UQ0Q6JjifqjxHDvDlAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAT7h/AgAA///wSSzL") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.stat\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000040), 0x208e24b) 1m30.325466078s ago: executing program 7 (id=7384): openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x80d02, 0x0) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(0xffffffffffffffff, 0xc0305710, 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r0, 0x40505330, &(0x7f0000000040)={{}, {0x18}, 0x10003, 0x2}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r0, 0x40605346, &(0x7f0000000d00)={0x4d5, 0x2, {0x1, 0x2, 0x8, 0x2, 0xfffffffe}, 0x2}) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000180), 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x14, 0x10, 0x701, 0x0, 0x0, {0x13}}, 0x14}}, 0x4000080) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r1, 0x40505331, &(0x7f0000000540)={{}, {0x18}, 0x0, 0x6}) socket$l2tp(0x2, 0x2, 0x73) 1m19.264467068s ago: executing program 7 (id=7398): r0 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x1c1040, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000e80)='./bus\x00', 0x1c1002, 0x40) write(r2, 0x0, 0x0) sendfile(r2, r1, 0x0, 0x7fffffff) ftruncate(r0, 0x2007ffb) sendfile(r0, r0, 0x0, 0x1000000201005) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) 1m18.549393606s ago: executing program 36 (id=7398): r0 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x1c1040, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000e80)='./bus\x00', 0x1c1002, 0x40) write(r2, 0x0, 0x0) sendfile(r2, r1, 0x0, 0x7fffffff) ftruncate(r0, 0x2007ffb) sendfile(r0, r0, 0x0, 0x1000000201005) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) 48.925141618s ago: executing program 2 (id=7440): socket(0x840000000002, 0x3, 0x100) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffff9c, 0x0, 0x4) r0 = fsopen(0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) r2 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x1c1040, 0x0) bind$unix(0xffffffffffffffff, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) r4 = openat(0xffffffffffffff9c, &(0x7f0000000e80)='./bus\x00', 0x1c1002, 0x40) write(r4, &(0x7f0000004200)='t', 0x1) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x10, &(0x7f0000000340)={[{@rodir}, {@rodir}, {@iocharset={'iocharset', 0x3d, 'cp874'}}, {@shortname_lower}, {@numtail}, {@utf8}, {@numtail}, {@utf8no}, {@fat=@nocase}, {@fat=@errors_continue}, {@fat=@check_strict}, {@iocharset={'iocharset', 0x3d, 'cp863'}}, {@utf8}, {@iocharset={'iocharset', 0x3d, 'cp1250'}}, {@utf8no}, {@uni_xlate}, {@numtail}, {@fat=@nocase}, {@rodir}]}, 0x3, 0x27b, &(0x7f0000000640)="$eJzs3cFqK1UYAOB/mqRJdJEsXInQAV24Kq1P0CIVxIKgZKEutNgUpAmFFgJVMXblE/gEPo8b8QV8AC93d7u43LmkM0nTyyQlvWlT7v2+TQ//+f85/5kZ2tWc/vBB//jw5Ozo4tf/otFIYm0nduIyiXasxdjvUerfJ+VxAOCRu8yyeJrl6nno/GZGbUZlde3emwMA7sX03/9V9wIAPIyvv/n2i939/b2v0rQR0f9j0Eki/5nP7x7FT9GLbmxFK55HZBP5+LPP9/eimo6046P+cNAZVfa//7u4/u7/EVf129GKdnn9dpqbqh8OOrV4p1h/pxfdL/+KVrxXXv9JSX101uPjD6f634xW/PNjnEQvDovexvW/bafpp9mfz375bhQd1SfDQac+ySuyKw/6YAAAAAAAAAAAAAAAAAAAAAAAeKNtphPtm+fvjA/+nzM/53yg4dT5PFtpmmZJnn9dX433q1Fd5d4BAAAAAAAAAAAAAAAAAADgsTg7//n4oNfrni51MP6sv2QqXtyM1CPi7mttLFoVlaK1XhKx2Fq1qF9V3p5cWXAXzVE/3dOkGst7BMkk0pye2oh8rVGkmQ+mIq+9eiOuBuO36/ggue3hNspekiUMspLXrzKzav3VSLPYQUlyc87q6+/eqeesNWMqiYja5GbOv05tuffw4X4HAQAAAAAAAAAAAAAAAAAAueuPfksmL1bQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACswPX//19gMCyKZ+VkldGgGkVkxVsEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLfAyAAD//0MUZ+o=") syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0xd280, 0x0, 0x1, 0x0, &(0x7f00000007c0)) sendfile(r4, r3, 0x0, 0x7fffffff) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x8004) ftruncate(r2, 0x2007ffb) sendfile(r2, r2, 0x0, 0x1000000201005) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) 47.319446229s ago: executing program 2 (id=7443): r0 = socket$key(0xf, 0x3, 0x2) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=@newsa={0x15c, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0xfffffffe, 0xfffffffc, 0x8}, 0x70bd2a, 0x3504, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @lifetime_val={0x24, 0x9, {0xf, 0x40000000000081, 0x9, 0x5f}}]}, 0x15c}, 0x1, 0x0, 0x0, 0x8801}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000140)={0x40000000, 0x0, 0x0}, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') pread64(r3, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) bind$inet(0xffffffffffffffff, 0x0, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFNL_MSG_CTHELPER_NEW(0xffffffffffffffff, &(0x7f0000001240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24044090}, 0x40000) socket$nl_generic(0x10, 0x3, 0x10) openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/class/dvb/dvb0.frontend0/device/uevent\x00', 0x0, 0x0) sendmsg$key(r0, &(0x7f0000000440)={0x900, 0x0, &(0x7f0000000400)={&(0x7f0000000040)={0x2, 0xa, 0xfc, 0x0, 0x7, 0x0, 0x70bd28, 0x25dfdbfe, [@sadb_x_filter={0x5, 0x1a, @in=@empty, @in=@rand_addr=0x64010100, 0x2c, 0x30}]}, 0x38}}, 0x40408c0) 46.969535008s ago: executing program 2 (id=7445): utime(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x1, 0x9}) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000b40)={'wlan0\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_init_net_socket$rose(0xb, 0x5, 0x0) recvmsg(r4, &(0x7f00000011c0)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f00000002c0)=""/65, 0x41}, {0x0}, {&(0x7f0000000d80)=""/5, 0x5}, {&(0x7f0000000dc0)=""/172, 0xac}, {&(0x7f0000000e80)=""/245, 0xf5}, {&(0x7f0000000f80)=""/246, 0xf6}], 0x6, &(0x7f0000001100)=""/159, 0x9f}, 0x10000) 45.760326438s ago: executing program 2 (id=7446): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4, 0x0, @loopback, 0x4}, 0x1c) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000180)=0x1, 0x4) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "0000000400", "6abc00000000000000000000001000", "f0630400"}, 0x28) sendto$inet6(r0, &(0x7f0000000240), 0x0, 0x8040, 0x0, 0x0) 40.420718704s ago: executing program 2 (id=7456): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x5, 0x7, 0xb3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000884) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newqdisc={0x48, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r7, {0x6}, {}, {0xfff2, 0x1}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x2, '\x00', 0x9, 0x0, 0x3, 0xfffffffd}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x4040098}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000600)=@newqdisc={0x434, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xffffbddc, {0x0, 0x0, 0x0, r4, {0x10}, {0x6}, {0xfff2, 0x1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x408, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0xfffffffc, 0x7ff, 0xb542, 0xfffffffa, 0x0, 0x9, 0x6, 0x1, 0x6, 0x7, 0x2, 0x8, 0x5, 0x80, 0x4, 0x10001, 0x9, 0x5, 0x5, 0x6, 0xc, 0x3d4fca1b, 0x0, 0x100, 0xfffff127, 0x4, 0x4d3, 0xdfe, 0x7ff, 0xff, 0xe9, 0x80000000, 0x4, 0x2c000, 0x4, 0x7, 0x5, 0x3, 0x1, 0xfa7, 0x101, 0x1ff, 0xf, 0x80000000, 0x2, 0x7, 0x6, 0xd0ad, 0x80000001, 0x2, 0x8, 0x6, 0xa27, 0xcd4, 0x6, 0x46, 0x5, 0x10000, 0x5, 0x40, 0x2, 0x8, 0x6, 0x8, 0x4a, 0x1, 0x80000001, 0xa, 0x5, 0x8, 0x80, 0x2, 0x5, 0x6, 0x6, 0x3, 0x4f, 0xa, 0x3, 0x0, 0x4, 0x40, 0x0, 0x4, 0xff, 0x0, 0x40000000, 0x7, 0x10000, 0x9, 0x400, 0x8, 0x70, 0x2e89, 0x3, 0x800, 0x6, 0x800, 0xea9, 0x8, 0x8, 0xff, 0x4, 0x3, 0xf, 0xc, 0x4, 0x7fffffff, 0xff, 0x8, 0xfff, 0x10000, 0x6, 0x227540, 0xe5, 0x9, 0x8, 0x1, 0x3, 0xf29, 0x0, 0xf87a, 0x3, 0x5, 0x7, 0x40, 0x136, 0xb691, 0x5, 0x7, 0x4, 0x1, 0x6, 0x8, 0x7, 0x7f, 0x1, 0xe20a, 0x1, 0xfffffff6, 0x3, 0x9, 0x4, 0xf, 0xffff, 0x4, 0x5, 0x1ff, 0xffff, 0x9, 0x4, 0x2, 0x1, 0x400, 0x1, 0xb, 0x0, 0x6e14, 0x10, 0x6, 0xfffffd39, 0x1a2ed5c8, 0x2c2e, 0x4, 0xfffffe01, 0xfffffffc, 0x3, 0x74, 0x4, 0x2, 0x5, 0xffffba16, 0x7, 0x7ff, 0xff, 0x0, 0x9, 0x9, 0xc, 0x0, 0x4, 0x8001, 0x0, 0x3, 0x2, 0x8, 0x2, 0xbb, 0x1ff, 0xb, 0xfffff293, 0x3, 0x4, 0x4, 0x6, 0x80, 0x401, 0x9, 0xffffffff, 0x7f, 0x1, 0x2, 0x1000, 0x4, 0x0, 0x0, 0x9, 0x6, 0x5, 0x500, 0xf45, 0x5, 0x0, 0x1, 0xffff, 0x8, 0x8, 0x1, 0x0, 0x5, 0x7fffffff, 0x4e, 0x10000, 0x81, 0xbcbb, 0x8, 0x7cd7628d, 0x9, 0xb, 0x2d449be, 0x81, 0x1, 0x0, 0x6, 0xeae, 0x0, 0x9, 0xffffffff, 0xd1, 0x5, 0x3, 0x3ff, 0x9, 0x3, 0xc, 0x4, 0x0, 0x1, 0x1ff, 0x401, 0x0, 0xffffff94, 0x9, 0x8, 0x0, 0x9]}]}}]}, 0x434}, 0x1, 0x0, 0x0, 0xc040}, 0x880) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000100)=0x4207, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(0xffffffffffffffff, &(0x7f00000002c0)="05031400d3fc140000004788031c09102c28", 0xfdef, 0x4, &(0x7f0000000140)={0x11, 0x88a8, r8, 0x1, 0x0, 0x6, @multicast}, 0x14) 39.471465878s ago: executing program 2 (id=7458): socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) setuid(0x0) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x36, 0x36}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000540)=ANY=[@ANYBLOB="08000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000086fec4d7bab54c8f4837aa17db000000000000000000ef8e473961000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000046d18af077d36d4b1"], 0x5000) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r3, 0xc0a85320, &(0x7f0000001e00)={{0x80, 0x80}, 'port0\x00', 0x4, 0x0, 0x7ff9, 0x409, 0x4, 0x0, 0x2, 0x0, 0x1, 0x4}) 23.452469895s ago: executing program 8 (id=7489): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0xf5d1b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x6b4, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)={0x14, 0x2, 0x6, 0x201}, 0x14}, 0x1, 0x0, 0x0, 0x20044000}, 0x0) 22.271237485s ago: executing program 8 (id=7490): socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) setuid(0x0) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x36, 0x36}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r2, 0xc0a85320, &(0x7f0000001e00)={{0x80, 0x80}, 'port0\x00', 0x4, 0x0, 0x7ff9, 0x409, 0x4, 0x0, 0x2, 0x0, 0x1, 0x4}) 19.558982143s ago: executing program 4 (id=7497): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_clone(0x2000400, 0x0, 0xfffffebf, 0x0, 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) unshare(0x28000600) r3 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000140), 0x9, r3}, 0x38) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000380)={r3, &(0x7f0000001940), &(0x7f00000002c0)=""/187}, 0x20) 17.672665021s ago: executing program 4 (id=7498): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0xf5d1b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x6b4, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)={0x14, 0x2, 0x6, 0x201}, 0x14}, 0x1, 0x0, 0x0, 0x20044000}, 0x0) 17.187090703s ago: executing program 8 (id=7500): r0 = io_uring_setup(0x178e, &(0x7f0000000300)={0x0, 0x1443, 0x8, 0xfffffffe, 0xc}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x121301, 0x0) socket(0x400000000010, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket(0x2, 0x80805, 0x0) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000100)={0x28, 0x0, 0x0, @local}, 0x10) socket(0x10, 0x3, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x8000000000000001, 0x7d, 0x0, 0x800, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xfffffffffffffeff, 0x9, 0x4, 0xf, 0x80000006}, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x40000}, 0x50) write$binfmt_aout(r1, &(0x7f0000000140)=ANY=[], 0xff2e) r3 = socket$kcm(0xa, 0x5, 0x0) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000300)={'vxcan1\x00', 0x0}) bind$can_raw(r4, &(0x7f0000000000)={0x1d, r5}, 0x10) setsockopt$CAN_RAW_FILTER(r4, 0x65, 0x1, &(0x7f00000000c0)=[{{0x0, 0x0, 0x0, 0x1}, {0x2, 0x0, 0x1, 0x1}}], 0x8) bind$can_raw(r4, &(0x7f0000000080), 0x10) close_range(r0, 0xffffffffffffffff, 0x0) 16.397525414s ago: executing program 4 (id=7501): r0 = socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000100)={0xffffffffffffffff, r5, 0x3, 0x0, @val=@iter={0x0}}, 0x20) r6 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r6, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x3000c041) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x50) r8 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f00000001c0)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x27}]}, &(0x7f0000000000)='GPL\x00'}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000280)=ANY=[@ANYRES32=r7, @ANYRES32=r8, @ANYBLOB="05"], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r7, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) 12.771705335s ago: executing program 4 (id=7502): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='dctcp', 0x5) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'lo\x00'}) ioctl$VHOST_SET_MEM_TABLE(0xffffffffffffffff, 0x4008af03, &(0x7f0000000340)) ioctl$VHOST_NET_SET_BACKEND(0xffffffffffffffff, 0x4008af30, &(0x7f00000003c0)={0x1}) sendto$inet(r0, 0x0, 0x0, 0x12, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00'}) socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x10a, &(0x7f0000000f00)={@local, @multicast, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "ad6abb", 0xd4, 0x2b, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, @private2={0xfc, 0x2, '\x00', 0x81}, {[@routing={0x87, 0x6, 0x2, 0x80, 0x0, [@loopback, @dev={0xfe, 0x80, '\x00', 0xb}, @empty]}], {0x0, 0x0, 0x9c, 0x0, @wg=@initiation={0x1, 0x2, "8a2e0b0ec46fadbd18834312e9385e5b91593453652ca34faa9af7e503cdd8a4", "c7d38cffe3874f77f421060f4ddfabe88f79f6a4c06e7f495ebd67c2b83bd11c9b2b5b6508ccf912ff63750351d69e6f", "a9b67a62f584fabf70acf4e004a87a4898ab17058c5d1c20e471b1ae", {"000000000097ce50cb00", "e760555695aaf81ffd8de70c81ecf313"}}}}}}}}, 0x0) 12.59387361s ago: executing program 4 (id=7504): socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x36, 0x36}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2e, &(0x7f0000000240)={0x8, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @private1}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, &(0x7f0000000540)=ANY=[@ANYBLOB="08000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000086fec4d7bab54c8f4837aa17db000000000000000000ef8e473961000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000046d18af077d36d4b1"], 0x5000) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r4, 0xc0a85320, &(0x7f0000001e00)={{0x80, 0x80}, 'port0\x00', 0x4, 0x0, 0x7ff9, 0x409, 0x4, 0x0, 0x2, 0x0, 0x1, 0x4}) 10.931083402s ago: executing program 1 (id=7505): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_clone(0x2000400, 0x0, 0xfffffebf, 0x0, 0x0, 0x0) unshare(0x28000600) r3 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000140), 0x9, r3}, 0x38) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000380)={r3, &(0x7f0000001940), &(0x7f00000002c0)=""/187}, 0x20) 8.564350922s ago: executing program 1 (id=7506): socket(0x840000000002, 0x3, 0x100) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffff9c, 0x0, 0x4) r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) r2 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x1c1040, 0x0) bind$unix(0xffffffffffffffff, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) r4 = openat(0xffffffffffffff9c, &(0x7f0000000e80)='./bus\x00', 0x1c1002, 0x40) write(r4, &(0x7f0000004200)='t', 0x1) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x10, &(0x7f0000000340)={[{@rodir}, {@rodir}, {@iocharset={'iocharset', 0x3d, 'cp874'}}, {@shortname_lower}, {@numtail}, {@utf8}, {@numtail}, {@utf8no}, {@fat=@nocase}, {@fat=@errors_continue}, {@fat=@check_strict}, {@iocharset={'iocharset', 0x3d, 'cp863'}}, {@utf8}, {@iocharset={'iocharset', 0x3d, 'cp1250'}}, {@utf8no}, {@uni_xlate}, {@numtail}, {@fat=@nocase}, {@rodir}]}, 0x3, 0x27b, &(0x7f0000000640)="$eJzs3cFqK1UYAOB/mqRJdJEsXInQAV24Kq1P0CIVxIKgZKEutNgUpAmFFgJVMXblE/gEPo8b8QV8AC93d7u43LmkM0nTyyQlvWlT7v2+TQ//+f85/5kZ2tWc/vBB//jw5Ozo4tf/otFIYm0nduIyiXasxdjvUerfJ+VxAOCRu8yyeJrl6nno/GZGbUZlde3emwMA7sX03/9V9wIAPIyvv/n2i939/b2v0rQR0f9j0Eki/5nP7x7FT9GLbmxFK55HZBP5+LPP9/eimo6046P+cNAZVfa//7u4/u7/EVf129GKdnn9dpqbqh8OOrV4p1h/pxfdL/+KVrxXXv9JSX101uPjD6f634xW/PNjnEQvDovexvW/bafpp9mfz375bhQd1SfDQac+ySuyKw/6YAAAAAAAAAAAAAAAAAAAAAAAeKNtphPtm+fvjA/+nzM/53yg4dT5PFtpmmZJnn9dX433q1Fd5d4BAAAAAAAAAAAAAAAAAADgsTg7//n4oNfrni51MP6sv2QqXtyM1CPi7mttLFoVlaK1XhKx2Fq1qF9V3p5cWXAXzVE/3dOkGst7BMkk0pye2oh8rVGkmQ+mIq+9eiOuBuO36/ggue3hNspekiUMspLXrzKzav3VSLPYQUlyc87q6+/eqeesNWMqiYja5GbOv05tuffw4X4HAQAAAAAAAAAAAAAAAAAAueuPfksmL1bQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACswPX//19gMCyKZ+VkldGgGkVkxVsEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLfAyAAD//0MUZ+o=") syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0xd280, 0x0, 0x1, 0x0, &(0x7f00000007c0)) sendfile(r4, r3, 0x0, 0x7fffffff) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x8004) ftruncate(r2, 0x2007ffb) sendfile(r2, r2, 0x0, 0x1000000201005) open(0x0, 0x14927e, 0x0) 6.878471905s ago: executing program 1 (id=7507): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x1}, 0x10) sendmmsg$sock(r3, &(0x7f00000044c0), 0x4000000000001c0, 0x0) recvfrom(r4, &(0x7f0000000040)=""/60, 0x3c, 0x40, 0x0, 0x0) 5.857286501s ago: executing program 1 (id=7508): socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) setuid(0x0) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x36, 0x36}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2e, &(0x7f0000000240)={0x8, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @private1}}}, 0x108) 2.904210186s ago: executing program 4 (id=7509): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4, 0x0, @loopback, 0x4}, 0x1c) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000180)=0x1, 0x4) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_128={{0x304}, "0000000400", "6abc00000000000000000000001000", "f0630400"}, 0x28) sendto$inet6(r0, &(0x7f0000000240), 0x0, 0x8040, 0x0, 0x0) 2.829503818s ago: executing program 1 (id=7510): socket(0x840000000002, 0x3, 0x100) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffff9c, 0x0, 0x4) r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) r2 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x1c1040, 0x0) bind$unix(0xffffffffffffffff, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) r4 = openat(0xffffffffffffff9c, &(0x7f0000000e80)='./bus\x00', 0x1c1002, 0x40) write(r4, &(0x7f0000004200)='t', 0x1) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x10, &(0x7f0000000340)={[{@rodir}, {@rodir}, {@iocharset={'iocharset', 0x3d, 'cp874'}}, {@shortname_lower}, {@numtail}, {@utf8}, {@numtail}, {@utf8no}, {@fat=@nocase}, {@fat=@errors_continue}, {@fat=@check_strict}, {@iocharset={'iocharset', 0x3d, 'cp863'}}, {@utf8}, {@iocharset={'iocharset', 0x3d, 'cp1250'}}, {@utf8no}, {@uni_xlate}, {@numtail}, {@fat=@nocase}, {@rodir}]}, 0x3, 0x27b, &(0x7f0000000640)="$eJzs3cFqK1UYAOB/mqRJdJEsXInQAV24Kq1P0CIVxIKgZKEutNgUpAmFFgJVMXblE/gEPo8b8QV8AC93d7u43LmkM0nTyyQlvWlT7v2+TQ//+f85/5kZ2tWc/vBB//jw5Ozo4tf/otFIYm0nduIyiXasxdjvUerfJ+VxAOCRu8yyeJrl6nno/GZGbUZlde3emwMA7sX03/9V9wIAPIyvv/n2i939/b2v0rQR0f9j0Eki/5nP7x7FT9GLbmxFK55HZBP5+LPP9/eimo6046P+cNAZVfa//7u4/u7/EVf129GKdnn9dpqbqh8OOrV4p1h/pxfdL/+KVrxXXv9JSX101uPjD6f634xW/PNjnEQvDovexvW/bafpp9mfz375bhQd1SfDQac+ySuyKw/6YAAAAAAAAAAAAAAAAAAAAAAAeKNtphPtm+fvjA/+nzM/53yg4dT5PFtpmmZJnn9dX433q1Fd5d4BAAAAAAAAAAAAAAAAAADgsTg7//n4oNfrni51MP6sv2QqXtyM1CPi7mttLFoVlaK1XhKx2Fq1qF9V3p5cWXAXzVE/3dOkGst7BMkk0pye2oh8rVGkmQ+mIq+9eiOuBuO36/ggue3hNspekiUMspLXrzKzav3VSLPYQUlyc87q6+/eqeesNWMqiYja5GbOv05tuffw4X4HAQAAAAAAAAAAAAAAAAAAueuPfksmL1bQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACswPX//19gMCyKZ+VkldGgGkVkxVsEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLfAyAAD//0MUZ+o=") syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0xd280, 0x0, 0x1, 0x0, &(0x7f00000007c0)) sendfile(r4, r3, 0x0, 0x7fffffff) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x8004) ftruncate(r2, 0x2007ffb) sendfile(r2, r2, 0x0, 0x1000000201005) open(0x0, 0x14927e, 0x0) 2.706884911s ago: executing program 8 (id=7511): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x104}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000040)={0x28, 0x0, 0xffffffff}, 0x10, 0x800) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r3) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc1400000011000100"], 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c0001800600010058c6000014000000110001"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, '\x00\x00'}]}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELSETELEM={0x2c, 0xe, 0xa, 0x23f, 0x0, 0x0, {0xa}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x54}, 0x1, 0x0, 0x0, 0x4000850}, 0x40000c0) bpf$PROG_LOAD(0x5, 0x0, 0x0) 1.338716516s ago: executing program 8 (id=7512): socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x36, 0x36}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2e, &(0x7f0000000240)={0x8, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @private1}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, &(0x7f0000000540)=ANY=[@ANYBLOB="08000000000000000a00000000000000ff0100000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000086fec4d7bab54c8f4837aa17db000000000000000000ef8e473961000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000046d18af077d36d4b1"], 0x5000) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r4, 0xc0a85320, &(0x7f0000001e00)={{0x80, 0x80}, 'port0\x00', 0x4, 0x0, 0x7ff9, 0x409, 0x4, 0x0, 0x2, 0x0, 0x1, 0x4}) 106.582907ms ago: executing program 8 (id=7513): socket(0x840000000002, 0x3, 0x100) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffff9c, 0x0, 0x4) r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) r2 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./bus\x00', 0x1c1040, 0x0) bind$unix(0xffffffffffffffff, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) r4 = openat(0xffffffffffffff9c, &(0x7f0000000e80)='./bus\x00', 0x1c1002, 0x40) write(r4, &(0x7f0000004200), 0x0) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f00000000c0)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x10, &(0x7f0000000340)={[{@rodir}, {@rodir}, {@iocharset={'iocharset', 0x3d, 'cp874'}}, {@shortname_lower}, {@numtail}, {@utf8}, {@numtail}, {@utf8no}, {@fat=@nocase}, {@fat=@errors_continue}, {@fat=@check_strict}, {@iocharset={'iocharset', 0x3d, 'cp863'}}, {@utf8}, {@iocharset={'iocharset', 0x3d, 'cp1250'}}, {@utf8no}, {@uni_xlate}, {@numtail}, {@fat=@nocase}, {@rodir}]}, 0x3, 0x27b, &(0x7f0000000640)="$eJzs3cFqK1UYAOB/mqRJdJEsXInQAV24Kq1P0CIVxIKgZKEutNgUpAmFFgJVMXblE/gEPo8b8QV8AC93d7u43LmkM0nTyyQlvWlT7v2+TQ//+f85/5kZ2tWc/vBB//jw5Ozo4tf/otFIYm0nduIyiXasxdjvUerfJ+VxAOCRu8yyeJrl6nno/GZGbUZlde3emwMA7sX03/9V9wIAPIyvv/n2i939/b2v0rQR0f9j0Eki/5nP7x7FT9GLbmxFK55HZBP5+LPP9/eimo6046P+cNAZVfa//7u4/u7/EVf129GKdnn9dpqbqh8OOrV4p1h/pxfdL/+KVrxXXv9JSX101uPjD6f634xW/PNjnEQvDovexvW/bafpp9mfz375bhQd1SfDQac+ySuyKw/6YAAAAAAAAAAAAAAAAAAAAAAAeKNtphPtm+fvjA/+nzM/53yg4dT5PFtpmmZJnn9dX433q1Fd5d4BAAAAAAAAAAAAAAAAAADgsTg7//n4oNfrni51MP6sv2QqXtyM1CPi7mttLFoVlaK1XhKx2Fq1qF9V3p5cWXAXzVE/3dOkGst7BMkk0pye2oh8rVGkmQ+mIq+9eiOuBuO36/ggue3hNspekiUMspLXrzKzav3VSLPYQUlyc87q6+/eqeesNWMqiYja5GbOv05tuffw4X4HAQAAAAAAAAAAAAAAAAAAueuPfksmL1bQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACswPX//19gMCyKZ+VkldGgGkVkxVsEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLfAyAAD//0MUZ+o=") syz_mount_image$vfat(&(0x7f0000000240), &(0x7f0000000280)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0xd280, 0x0, 0x1, 0x0, &(0x7f00000007c0)) sendfile(r4, r3, 0x0, 0x7fffffff) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, 0x0, 0x8004) ftruncate(r2, 0x2007ffb) sendfile(r2, r2, 0x0, 0x1000000201005) open(&(0x7f0000000180)='./bus\x00', 0x14927e, 0x0) 0s ago: executing program 1 (id=7514): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000018c0)=ANY=[@ANYBLOB="0a000000d2cf00003d36000002"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000140), 0x9, r3}, 0x38) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000380)={r3, &(0x7f0000001940), &(0x7f00000002c0)=""/187}, 0x20) kernel console output (not intermixed with test programs): 00000. [ 1167.663538][T24857] loop4: detected capacity change from 0 to 1024 [ 1167.688590][T24857] EXT4-fs: Ignoring removed nomblk_io_submit option [ 1167.713329][T24857] EXT4-fs: inline encryption not supported [ 1167.719281][T24857] EXT4-fs: Ignoring removed nomblk_io_submit option [ 1167.796408][T24857] EXT4-fs (loop4): mounted filesystem 00fc0c00-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 1167.881264][T24857] ext4 filesystem being mounted at /375/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 1170.323312][T24838] EXT4-fs error (device loop4): ext4_validate_block_bitmap:439: comm ext4lazyinit: bg 0: block 112: padding at end of block bitmap is not set [ 1172.021079][T18812] EXT4-fs (loop4): unmounting filesystem 00fc0c00-0000-0006-0000-000000000000. [ 1173.474697][T24937] loop4: detected capacity change from 0 to 128 [ 1173.499826][T24937] FAT-fs (loop4): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 1173.577329][T24937] FAT-fs (loop4): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 1173.664013][T21146] FAT-fs (loop4): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 1174.908943][T24954] netlink: 'syz.1.6164': attribute type 1 has an invalid length. [ 1174.994281][T24958] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6165'. [ 1175.007222][T24954] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1176.208058][T24971] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1176.222465][T24973] netlink: 20 bytes leftover after parsing attributes in process `syz.5.6169'. [ 1176.232615][T24973] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6169'. [ 1180.114906][T25004] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6176'. [ 1180.693870][T25010] netlink: 80 bytes leftover after parsing attributes in process `syz.5.6178'. [ 1184.201726][T25048] netlink: 80 bytes leftover after parsing attributes in process `syz.2.6188'. [ 1186.158745][T25067] loop4: detected capacity change from 0 to 512 [ 1186.372092][T25067] EXT4-fs error (device loop4): ext4_quota_enable:7140: comm syz.4.6193: Bad quota inum: 2, type: 1 [ 1186.383481][T25067] EXT4-fs warning (device loop4): ext4_enable_quotas:7188: Failed to enable quota tracking (type=1, err=-117, ino=2). Please run e2fsck to fix. [ 1186.399700][T25067] EXT4-fs (loop4): mount failed [ 1186.658457][T25079] netlink: 80 bytes leftover after parsing attributes in process `syz.1.6198'. [ 1189.039835][T25108] overlayfs: failed to resolve './file0': -2 [ 1189.312646][T25114] loop4: detected capacity change from 0 to 1024 [ 1189.347924][T25114] EXT4-fs: Ignoring removed nomblk_io_submit option [ 1189.385024][T25114] EXT4-fs: inline encryption not supported [ 1189.406114][T25114] EXT4-fs: Ignoring removed nomblk_io_submit option [ 1189.443515][T25114] EXT4-fs (loop4): mounted filesystem 00fc0c00-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 1189.462288][T25114] ext4 filesystem being mounted at /383/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 1189.761864][T25122] netlink: 80 bytes leftover after parsing attributes in process `syz.1.6210'. [ 1189.815182][T25123] netlink: 36 bytes leftover after parsing attributes in process `syz.5.6208'. [ 1189.857146][ T5787] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 1189.875286][ T5787] CPU: 0 PID: 5787 Comm: kworker/u5:7 Not tainted syzkaller #0 [ 1189.882959][ T5787] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1189.893048][ T5787] Workqueue: hci4 hci_rx_work [ 1189.897775][ T5787] Call Trace: [ 1189.901114][ T5787] [ 1189.904076][ T5787] dump_stack_lvl+0x18c/0x250 [ 1189.908798][ T5787] ? show_regs_print_info+0x20/0x20 [ 1189.914057][ T5787] ? load_image+0x420/0x420 [ 1189.918614][ T5787] sysfs_create_dir_ns+0x26e/0x2a0 [ 1189.923761][ T5787] ? __lock_acquire+0x7d80/0x7d80 [ 1189.928863][ T5787] ? sysfs_warn_dup+0xa0/0xa0 [ 1189.933584][ T5787] ? do_raw_spin_unlock+0x121/0x230 [ 1189.938836][ T5787] kobject_add_internal+0x617/0xc90 [ 1189.944091][ T5787] kobject_add+0x164/0x240 [ 1189.948559][ T5787] ? kobject_init+0x1d0/0x1d0 [ 1189.953292][ T5787] ? get_device_parent+0x366/0x390 [ 1189.958462][ T5787] device_add+0x3fa/0xc40 [ 1189.962837][ T5787] hci_conn_add_sysfs+0xd5/0x1e0 [ 1189.967822][ T5787] le_conn_complete_evt+0xe9f/0x1480 [ 1189.973160][ T5787] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1189.979454][ T5787] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1189.985130][ T5787] ? mutex_unlock+0x10/0x10 [ 1189.989674][ T5787] ? skb_pull_data+0xf0/0x1f0 [ 1189.994396][ T5787] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1190.000350][ T5787] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1190.006861][ T5787] ? hci_remote_host_features_evt+0x150/0x150 [ 1190.012982][ T5787] hci_event_packet+0x7b4/0x1280 [ 1190.017967][ T5787] ? __lock_acquire+0x7d80/0x7d80 [ 1190.023036][ T5787] ? lock_chain_count+0x20/0x20 [ 1190.027932][ T5787] ? bis_list+0x290/0x290 [ 1190.032304][ T5787] ? lockdep_hardirqs_on+0x98/0x150 [ 1190.037556][ T5787] ? hci_send_to_monitor+0xd7/0x4f0 [ 1190.042804][ T5787] hci_rx_work+0x43a/0xd60 [ 1190.047269][ T5787] ? process_scheduled_works+0x975/0x1600 [ 1190.053039][ T5787] process_scheduled_works+0xa60/0x1600 [ 1190.058657][ T5787] ? worker_attach_to_pool+0x370/0x370 [ 1190.064153][ T5787] ? assign_work+0x3cc/0x5d0 [ 1190.068788][ T5787] worker_thread+0xa5e/0xfe0 [ 1190.073435][ T5787] ? _raw_spin_unlock+0x40/0x40 [ 1190.078327][ T5787] ? __kthread_parkme+0x71/0x1c0 [ 1190.083311][ T5787] kthread+0x2fa/0x390 [ 1190.087423][ T5787] ? pr_cont_work+0x550/0x550 [ 1190.092142][ T5787] ? kthread_blkcg+0xd0/0xd0 [ 1190.096775][ T5787] ret_from_fork+0x48/0x80 [ 1190.101233][ T5787] ? kthread_blkcg+0xd0/0xd0 [ 1190.105887][ T5787] ret_from_fork_asm+0x11/0x20 [ 1190.110756][ T5787] [ 1190.122457][ T5787] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1190.136668][ T5787] Bluetooth: hci4: failed to register connection device [ 1190.298195][T18812] EXT4-fs (loop4): unmounting filesystem 00fc0c00-0000-0006-0000-000000000000. [ 1190.316569][T25111] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1192.382688][T25130] Bluetooth: hci4: command 0x0406 tx timeout [ 1193.779863][T25162] Invalid ELF header magic: != ELF [ 1194.581398][T25168] netlink: 80 bytes leftover after parsing attributes in process `syz.1.6221'. [ 1195.625017][T25179] bridge0: port 3(macvlan3) entered blocking state [ 1195.632062][T25179] bridge0: port 3(macvlan3) entered disabled state [ 1195.638775][T25179] macvlan3: entered allmulticast mode [ 1195.644791][T25179] ip6gretap0: entered allmulticast mode [ 1195.651677][T25179] macvlan3: entered promiscuous mode [ 1195.662467][T25179] bridge0: port 3(macvlan3) entered blocking state [ 1195.669209][T25179] bridge0: port 3(macvlan3) entered forwarding state [ 1197.713441][T25203] netlink: 36 bytes leftover after parsing attributes in process `syz.4.6228'. [ 1197.856693][T25185] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1198.369486][T25130] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:0' [ 1198.379729][T25130] CPU: 0 PID: 25130 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 1198.387399][T25130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1198.397480][T25130] Workqueue: hci3 hci_rx_work [ 1198.402195][T25130] Call Trace: [ 1198.405519][T25130] [ 1198.408487][T25130] dump_stack_lvl+0x18c/0x250 [ 1198.413195][T25130] ? show_regs_print_info+0x20/0x20 [ 1198.418423][T25130] ? load_image+0x420/0x420 [ 1198.422991][T25130] sysfs_create_dir_ns+0x26e/0x2a0 [ 1198.428130][T25130] ? __lock_acquire+0x7d80/0x7d80 [ 1198.433189][T25130] ? sysfs_warn_dup+0xa0/0xa0 [ 1198.437903][T25130] ? do_raw_spin_unlock+0x121/0x230 [ 1198.443144][T25130] kobject_add_internal+0x617/0xc90 [ 1198.448394][T25130] kobject_add+0x164/0x240 [ 1198.452849][T25130] ? kobject_init+0x1d0/0x1d0 [ 1198.457565][T25130] ? get_device_parent+0x366/0x390 [ 1198.462712][T25130] device_add+0x3fa/0xc40 [ 1198.467076][T25130] hci_conn_add_sysfs+0xd5/0x1e0 [ 1198.472056][T25130] le_conn_complete_evt+0xe9f/0x1480 [ 1198.477432][T25130] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1198.483728][T25130] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1198.489402][T25130] ? mutex_unlock+0x10/0x10 [ 1198.493945][T25130] ? skb_pull_data+0xf0/0x1f0 [ 1198.498675][T25130] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1198.504626][T25130] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1198.511085][T25130] ? hci_remote_host_features_evt+0x150/0x150 [ 1198.517197][T25130] hci_event_packet+0x7b4/0x1280 [ 1198.522189][T25130] ? __lock_acquire+0x7d80/0x7d80 [ 1198.527261][T25130] ? lock_chain_count+0x20/0x20 [ 1198.532165][T25130] ? bis_list+0x290/0x290 [ 1198.536587][T25130] ? lockdep_hardirqs_on+0x98/0x150 [ 1198.541842][T25130] ? hci_send_to_monitor+0xd7/0x4f0 [ 1198.547099][T25130] hci_rx_work+0x43a/0xd60 [ 1198.551576][T25130] ? process_scheduled_works+0x975/0x1600 [ 1198.557357][T25130] process_scheduled_works+0xa60/0x1600 [ 1198.562996][T25130] ? worker_attach_to_pool+0x370/0x370 [ 1198.568510][T25130] ? assign_work+0x3cc/0x5d0 [ 1198.573156][T25130] worker_thread+0xa5e/0xfe0 [ 1198.577798][T25130] ? _raw_spin_unlock+0x40/0x40 [ 1198.582717][T25130] ? __kthread_parkme+0x71/0x1c0 [ 1198.587717][T25130] kthread+0x2fa/0x390 [ 1198.591832][T25130] ? pr_cont_work+0x550/0x550 [ 1198.596540][T25130] ? kthread_blkcg+0xd0/0xd0 [ 1198.601172][T25130] ret_from_fork+0x48/0x80 [ 1198.605625][T25130] ? kthread_blkcg+0xd0/0xd0 [ 1198.610250][T25130] ret_from_fork_asm+0x11/0x20 [ 1198.615065][T25130] [ 1198.628255][T25130] kobject: kobject_add_internal failed for hci3:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1198.642449][T25130] Bluetooth: hci3: failed to register connection device [ 1199.905406][T25212] netlink: 80 bytes leftover after parsing attributes in process `syz.1.6233'. [ 1200.183883][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 1200.190302][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 1200.860445][T21168] Bluetooth: hci3: command 0x0406 tx timeout [ 1201.592863][T25242] loop4: detected capacity change from 0 to 512 [ 1201.685998][T25242] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #11: comm syz.4.6242: invalid indirect mapped block 4294967295 (level 1) [ 1201.705312][T25242] EXT4-fs (loop4): Remounting filesystem read-only [ 1201.715261][T25242] EXT4-fs (loop4): 2 truncates cleaned up [ 1201.723066][T25242] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1201.980894][T25250] netlink: 80 bytes leftover after parsing attributes in process `syz.2.6245'. [ 1202.019428][T25251] netlink: 36 bytes leftover after parsing attributes in process `syz.5.6243'. [ 1202.031181][T21168] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 1202.040856][T21168] CPU: 1 PID: 21168 Comm: kworker/u5:1 Not tainted syzkaller #0 [ 1202.048539][T21168] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1202.058619][T21168] Workqueue: hci4 hci_rx_work [ 1202.063335][T21168] Call Trace: [ 1202.066638][T21168] [ 1202.069599][T21168] dump_stack_lvl+0x18c/0x250 [ 1202.074321][T21168] ? show_regs_print_info+0x20/0x20 [ 1202.079548][T21168] ? load_image+0x420/0x420 [ 1202.084098][T21168] sysfs_create_dir_ns+0x26e/0x2a0 [ 1202.089252][T21168] ? __lock_acquire+0x7d80/0x7d80 [ 1202.094313][T21168] ? sysfs_warn_dup+0xa0/0xa0 [ 1202.099043][T21168] ? do_raw_spin_unlock+0x121/0x230 [ 1202.104286][T21168] kobject_add_internal+0x617/0xc90 [ 1202.109539][T21168] kobject_add+0x164/0x240 [ 1202.114000][T21168] ? kobject_init+0x1d0/0x1d0 [ 1202.118711][T21168] ? get_device_parent+0x366/0x390 [ 1202.123863][T21168] device_add+0x3fa/0xc40 [ 1202.128236][T21168] hci_conn_add_sysfs+0xd5/0x1e0 [ 1202.133224][T21168] le_conn_complete_evt+0xe9f/0x1480 [ 1202.138585][T21168] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1202.144876][T21168] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1202.150556][T21168] ? mutex_unlock+0x10/0x10 [ 1202.155106][T21168] ? skb_pull_data+0xf0/0x1f0 [ 1202.159825][T21168] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1202.165757][T21168] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1202.172238][T21168] ? hci_remote_host_features_evt+0x150/0x150 [ 1202.178361][T21168] hci_event_packet+0x7b4/0x1280 [ 1202.183344][T21168] ? __lock_acquire+0x7d80/0x7d80 [ 1202.188403][T21168] ? lock_chain_count+0x20/0x20 [ 1202.193305][T21168] ? bis_list+0x290/0x290 [ 1202.197709][T21168] ? lockdep_hardirqs_on+0x98/0x150 [ 1202.202949][T21168] ? hci_send_to_monitor+0xd7/0x4f0 [ 1202.208184][T21168] hci_rx_work+0x43a/0xd60 [ 1202.212639][T21168] ? process_scheduled_works+0x975/0x1600 [ 1202.218401][T21168] process_scheduled_works+0xa60/0x1600 [ 1202.224017][T21168] ? worker_attach_to_pool+0x370/0x370 [ 1202.229521][T21168] ? assign_work+0x3cc/0x5d0 [ 1202.234155][T21168] worker_thread+0xa5e/0xfe0 [ 1202.238830][T21168] kthread+0x2fa/0x390 [ 1202.242936][T21168] ? pr_cont_work+0x550/0x550 [ 1202.247662][T21168] ? kthread_blkcg+0xd0/0xd0 [ 1202.252332][T21168] ret_from_fork+0x48/0x80 [ 1202.256816][T21168] ? kthread_blkcg+0xd0/0xd0 [ 1202.261445][T21168] ret_from_fork_asm+0x11/0x20 [ 1202.266268][T21168] [ 1202.277550][T25234] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1202.290110][T21168] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1202.304268][T21168] Bluetooth: hci4: failed to register connection device [ 1202.613510][T18812] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1204.233642][T25281] netlink: 80 bytes leftover after parsing attributes in process `syz.4.6254'. [ 1204.732632][T25130] Bluetooth: hci4: command 0x0406 tx timeout [ 1205.170984][T25302] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6260'. [ 1206.193689][T25314] netlink: 80 bytes leftover after parsing attributes in process `syz.1.6263'. [ 1207.631178][T25335] netlink: 36 bytes leftover after parsing attributes in process `syz.5.6264'. [ 1207.644105][T25130] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 1207.653750][T25130] CPU: 0 PID: 25130 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 1207.661421][T25130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1207.671498][T25130] Workqueue: hci4 hci_rx_work [ 1207.676218][T25130] Call Trace: [ 1207.679526][T25130] [ 1207.682487][T25130] dump_stack_lvl+0x18c/0x250 [ 1207.687201][T25130] ? show_regs_print_info+0x20/0x20 [ 1207.692442][T25130] ? load_image+0x420/0x420 [ 1207.697049][T25130] sysfs_create_dir_ns+0x26e/0x2a0 [ 1207.702200][T25130] ? __lock_acquire+0x7d80/0x7d80 [ 1207.707282][T25130] ? sysfs_warn_dup+0xa0/0xa0 [ 1207.711986][T25130] ? do_raw_spin_unlock+0x121/0x230 [ 1207.717218][T25130] kobject_add_internal+0x617/0xc90 [ 1207.722457][T25130] kobject_add+0x164/0x240 [ 1207.726918][T25130] ? kobject_init+0x1d0/0x1d0 [ 1207.731640][T25130] ? get_device_parent+0x366/0x390 [ 1207.736790][T25130] device_add+0x3fa/0xc40 [ 1207.741159][T25130] hci_conn_add_sysfs+0xd5/0x1e0 [ 1207.746131][T25130] le_conn_complete_evt+0xe9f/0x1480 [ 1207.751473][T25130] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1207.757790][T25130] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1207.763465][T25130] ? mutex_unlock+0x10/0x10 [ 1207.768005][T25130] ? skb_pull_data+0xf0/0x1f0 [ 1207.772717][T25130] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1207.778644][T25130] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1207.785100][T25130] ? hci_remote_host_features_evt+0x150/0x150 [ 1207.791273][T25130] hci_event_packet+0x7b4/0x1280 [ 1207.796260][T25130] ? __lock_acquire+0x7d80/0x7d80 [ 1207.801325][T25130] ? lock_chain_count+0x20/0x20 [ 1207.806228][T25130] ? bis_list+0x290/0x290 [ 1207.810632][T25130] ? lockdep_hardirqs_on+0x98/0x150 [ 1207.815894][T25130] ? hci_send_to_monitor+0xd7/0x4f0 [ 1207.821144][T25130] hci_rx_work+0x43a/0xd60 [ 1207.825602][T25130] ? process_scheduled_works+0x975/0x1600 [ 1207.831364][T25130] process_scheduled_works+0xa60/0x1600 [ 1207.837001][T25130] ? worker_attach_to_pool+0x370/0x370 [ 1207.842512][T25130] ? assign_work+0x3cc/0x5d0 [ 1207.847143][T25130] worker_thread+0xa5e/0xfe0 [ 1207.851778][T25130] ? _raw_spin_unlock+0x40/0x40 [ 1207.856692][T25130] ? __kthread_parkme+0x71/0x1c0 [ 1207.861687][T25130] kthread+0x2fa/0x390 [ 1207.865857][T25130] ? pr_cont_work+0x550/0x550 [ 1207.870577][T25130] ? kthread_blkcg+0xd0/0xd0 [ 1207.875200][T25130] ret_from_fork+0x48/0x80 [ 1207.879649][T25130] ? kthread_blkcg+0xd0/0xd0 [ 1207.884269][T25130] ret_from_fork_asm+0x11/0x20 [ 1207.889099][T25130] [ 1207.898304][T25310] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1207.909091][T25130] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1207.923337][T25130] Bluetooth: hci4: failed to register connection device [ 1208.334886][T25338] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6269'. [ 1210.103505][T21168] Bluetooth: hci4: command 0x0406 tx timeout [ 1210.987949][T25356] netlink: 80 bytes leftover after parsing attributes in process `syz.4.6275'. [ 1212.602541][T25368] loop4: detected capacity change from 0 to 512 [ 1213.182562][T25368] EXT4-fs error (device loop4): ext4_quota_enable:7140: comm syz.4.6277: Bad quota inum: 2, type: 1 [ 1213.195536][T25368] EXT4-fs warning (device loop4): ext4_enable_quotas:7188: Failed to enable quota tracking (type=1, err=-117, ino=2). Please run e2fsck to fix. [ 1213.211448][T25368] EXT4-fs (loop4): mount failed [ 1216.357677][T25400] netlink: 36 bytes leftover after parsing attributes in process `syz.5.6284'. [ 1216.436726][T21168] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:0' [ 1216.446136][T21168] CPU: 0 PID: 21168 Comm: kworker/u5:1 Not tainted syzkaller #0 [ 1216.453801][T21168] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1216.463896][T21168] Workqueue: hci4 hci_rx_work [ 1216.468629][T21168] Call Trace: [ 1216.471939][T21168] [ 1216.474897][T21168] dump_stack_lvl+0x18c/0x250 [ 1216.479613][T21168] ? show_regs_print_info+0x20/0x20 [ 1216.484838][T21168] ? load_image+0x420/0x420 [ 1216.489376][T21168] sysfs_create_dir_ns+0x26e/0x2a0 [ 1216.494511][T21168] ? __lock_acquire+0x7d80/0x7d80 [ 1216.499560][T21168] ? sysfs_warn_dup+0xa0/0xa0 [ 1216.504258][T21168] ? do_raw_spin_unlock+0x121/0x230 [ 1216.509511][T21168] kobject_add_internal+0x617/0xc90 [ 1216.514751][T21168] kobject_add+0x164/0x240 [ 1216.519211][T21168] ? kobject_init+0x1d0/0x1d0 [ 1216.523924][T21168] ? get_device_parent+0x366/0x390 [ 1216.529054][T21168] device_add+0x3fa/0xc40 [ 1216.533423][T21168] hci_conn_add_sysfs+0xd5/0x1e0 [ 1216.538385][T21168] le_conn_complete_evt+0xe9f/0x1480 [ 1216.543692][T21168] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1216.549957][T21168] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1216.555618][T21168] ? mutex_unlock+0x10/0x10 [ 1216.560150][T21168] ? skb_pull_data+0xf0/0x1f0 [ 1216.564855][T21168] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1216.570765][T21168] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1216.577199][T21168] ? hci_remote_host_features_evt+0x150/0x150 [ 1216.583291][T21168] hci_event_packet+0x7b4/0x1280 [ 1216.588278][T21168] ? __lock_acquire+0x7d80/0x7d80 [ 1216.593345][T21168] ? lock_chain_count+0x20/0x20 [ 1216.598208][T21168] ? bis_list+0x290/0x290 [ 1216.602561][T21168] ? lockdep_hardirqs_on+0x98/0x150 [ 1216.607783][T21168] ? hci_send_to_monitor+0xd7/0x4f0 [ 1216.613006][T21168] hci_rx_work+0x43a/0xd60 [ 1216.617458][T21168] ? process_scheduled_works+0x975/0x1600 [ 1216.623206][T21168] process_scheduled_works+0xa60/0x1600 [ 1216.628803][T21168] ? worker_attach_to_pool+0x370/0x370 [ 1216.634281][T21168] ? assign_work+0x3cc/0x5d0 [ 1216.638900][T21168] worker_thread+0xa5e/0xfe0 [ 1216.643538][T21168] kthread+0x2fa/0x390 [ 1216.647624][T21168] ? pr_cont_work+0x550/0x550 [ 1216.652317][T21168] ? kthread_blkcg+0xd0/0xd0 [ 1216.656922][T21168] ret_from_fork+0x48/0x80 [ 1216.661354][T21168] ? kthread_blkcg+0xd0/0xd0 [ 1216.665957][T21168] ret_from_fork_asm+0x11/0x20 [ 1216.670752][T21168] [ 1216.778707][T21168] kobject: kobject_add_internal failed for hci4:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1216.800107][T21168] Bluetooth: hci4: failed to register connection device [ 1217.276876][T25394] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1219.039554][T25130] Bluetooth: hci4: command 0x0406 tx timeout [ 1227.745802][T25479] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6303'. [ 1227.762699][T25130] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci5/hci5:0' [ 1227.772769][T25130] CPU: 0 PID: 25130 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 1227.780448][T25130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1227.790544][T25130] Workqueue: hci5 hci_rx_work [ 1227.795281][T25130] Call Trace: [ 1227.798593][T25130] [ 1227.801564][T25130] dump_stack_lvl+0x18c/0x250 [ 1227.806304][T25130] ? show_regs_print_info+0x20/0x20 [ 1227.811538][T25130] ? load_image+0x420/0x420 [ 1227.816121][T25130] sysfs_create_dir_ns+0x26e/0x2a0 [ 1227.821274][T25130] ? __lock_acquire+0x7d80/0x7d80 [ 1227.826346][T25130] ? sysfs_warn_dup+0xa0/0xa0 [ 1227.831059][T25130] ? do_raw_spin_unlock+0x121/0x230 [ 1227.836315][T25130] kobject_add_internal+0x617/0xc90 [ 1227.841585][T25130] kobject_add+0x164/0x240 [ 1227.846054][T25130] ? kobject_init+0x1d0/0x1d0 [ 1227.850790][T25130] ? get_device_parent+0x366/0x390 [ 1227.855943][T25130] device_add+0x3fa/0xc40 [ 1227.860308][T25130] hci_conn_add_sysfs+0xd5/0x1e0 [ 1227.865306][T25130] le_conn_complete_evt+0xe9f/0x1480 [ 1227.870659][T25130] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1227.876965][T25130] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1227.882642][T25130] ? mutex_unlock+0x10/0x10 [ 1227.887182][T25130] ? skb_pull_data+0xf0/0x1f0 [ 1227.891904][T25130] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1227.897848][T25130] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1227.904304][T25130] ? hci_remote_host_features_evt+0x150/0x150 [ 1227.910411][T25130] hci_event_packet+0x7b4/0x1280 [ 1227.915437][T25130] ? __lock_acquire+0x7d80/0x7d80 [ 1227.920510][T25130] ? lock_chain_count+0x20/0x20 [ 1227.925511][T25130] ? bis_list+0x290/0x290 [ 1227.929882][T25130] ? lockdep_hardirqs_on+0x98/0x150 [ 1227.935125][T25130] ? hci_send_to_monitor+0xd7/0x4f0 [ 1227.940365][T25130] hci_rx_work+0x43a/0xd60 [ 1227.944823][T25130] ? process_scheduled_works+0x975/0x1600 [ 1227.950587][T25130] process_scheduled_works+0xa60/0x1600 [ 1227.956236][T25130] ? worker_attach_to_pool+0x370/0x370 [ 1227.961740][T25130] ? assign_work+0x3cc/0x5d0 [ 1227.966378][T25130] worker_thread+0xa5e/0xfe0 [ 1227.971021][T25130] ? _raw_spin_unlock+0x40/0x40 [ 1227.975926][T25130] ? __kthread_parkme+0x71/0x1c0 [ 1227.980908][T25130] kthread+0x2fa/0x390 [ 1227.985006][T25130] ? pr_cont_work+0x550/0x550 [ 1227.989732][T25130] ? kthread_blkcg+0xd0/0xd0 [ 1227.994358][T25130] ret_from_fork+0x48/0x80 [ 1227.998824][T25130] ? kthread_blkcg+0xd0/0xd0 [ 1228.003493][T25130] ret_from_fork_asm+0x11/0x20 [ 1228.008327][T25130] [ 1228.041155][T25130] kobject: kobject_add_internal failed for hci5:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1228.055349][T25130] Bluetooth: hci5: failed to register connection device [ 1228.174529][T25475] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1230.543439][T25130] Bluetooth: hci5: command 0x0406 tx timeout [ 1231.177089][T25494] loop4: detected capacity change from 0 to 4096 [ 1232.100009][T25426] I/O error, dev loop4, sector 3968 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1235.109287][T25528] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6315'. [ 1235.133603][T25130] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:0' [ 1235.142999][T25130] CPU: 0 PID: 25130 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 1235.150667][T25130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1235.160755][T25130] Workqueue: hci0 hci_rx_work [ 1235.165478][T25130] Call Trace: [ 1235.168782][T25130] [ 1235.171748][T25130] dump_stack_lvl+0x18c/0x250 [ 1235.176468][T25130] ? show_regs_print_info+0x20/0x20 [ 1235.181708][T25130] ? load_image+0x420/0x420 [ 1235.186271][T25130] sysfs_create_dir_ns+0x26e/0x2a0 [ 1235.191478][T25130] ? __lock_acquire+0x7d80/0x7d80 [ 1235.196563][T25130] ? sysfs_warn_dup+0xa0/0xa0 [ 1235.201294][T25130] ? do_raw_spin_unlock+0x121/0x230 [ 1235.206533][T25130] kobject_add_internal+0x617/0xc90 [ 1235.211809][T25130] kobject_add+0x164/0x240 [ 1235.216264][T25130] ? kobject_init+0x1d0/0x1d0 [ 1235.220972][T25130] ? get_device_parent+0x366/0x390 [ 1235.226136][T25130] device_add+0x3fa/0xc40 [ 1235.230489][T25130] hci_conn_add_sysfs+0xd5/0x1e0 [ 1235.235475][T25130] le_conn_complete_evt+0xe9f/0x1480 [ 1235.240791][T25130] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1235.247054][T25130] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1235.252723][T25130] ? mutex_unlock+0x10/0x10 [ 1235.257257][T25130] ? skb_pull_data+0xf0/0x1f0 [ 1235.262010][T25130] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1235.267970][T25130] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1235.274453][T25130] ? hci_remote_host_features_evt+0x150/0x150 [ 1235.280548][T25130] hci_event_packet+0x7b4/0x1280 [ 1235.285520][T25130] ? __lock_acquire+0x7d80/0x7d80 [ 1235.290602][T25130] ? lock_chain_count+0x20/0x20 [ 1235.295478][T25130] ? bis_list+0x290/0x290 [ 1235.299839][T25130] ? lockdep_hardirqs_on+0x98/0x150 [ 1235.305067][T25130] ? hci_send_to_monitor+0xd7/0x4f0 [ 1235.310746][T25130] hci_rx_work+0x43a/0xd60 [ 1235.315209][T25130] ? process_scheduled_works+0x975/0x1600 [ 1235.320965][T25130] process_scheduled_works+0xa60/0x1600 [ 1235.326565][T25130] ? worker_attach_to_pool+0x370/0x370 [ 1235.332055][T25130] ? assign_work+0x3cc/0x5d0 [ 1235.336681][T25130] worker_thread+0xa5e/0xfe0 [ 1235.341308][T25130] ? _raw_spin_unlock+0x40/0x40 [ 1235.346208][T25130] ? __kthread_parkme+0x71/0x1c0 [ 1235.351179][T25130] kthread+0x2fa/0x390 [ 1235.355265][T25130] ? pr_cont_work+0x550/0x550 [ 1235.359987][T25130] ? kthread_blkcg+0xd0/0xd0 [ 1235.364593][T25130] ret_from_fork+0x48/0x80 [ 1235.369036][T25130] ? kthread_blkcg+0xd0/0xd0 [ 1235.373651][T25130] ret_from_fork_asm+0x11/0x20 [ 1235.378460][T25130] [ 1235.382450][T25130] kobject: kobject_add_internal failed for hci0:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1235.396672][T25130] Bluetooth: hci0: failed to register connection device [ 1235.631657][T25519] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1237.775520][T25130] Bluetooth: hci0: command 0x0401 tx timeout [ 1240.572561][T25573] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6330'. [ 1240.607228][T25573] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 1242.563428][T25588] netlink: 36 bytes leftover after parsing attributes in process `syz.2.6335'. [ 1242.574919][T25587] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1242.585626][T25130] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci5/hci5:0' [ 1242.595377][T25130] CPU: 0 PID: 25130 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 1242.603110][T25130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1242.613308][T25130] Workqueue: hci5 hci_rx_work [ 1242.618040][T25130] Call Trace: [ 1242.621366][T25130] [ 1242.624333][T25130] dump_stack_lvl+0x18c/0x250 [ 1242.629056][T25130] ? show_regs_print_info+0x20/0x20 [ 1242.634302][T25130] ? load_image+0x420/0x420 [ 1242.638888][T25130] sysfs_create_dir_ns+0x26e/0x2a0 [ 1242.644062][T25130] ? __lock_acquire+0x7d80/0x7d80 [ 1242.649224][T25130] ? sysfs_warn_dup+0xa0/0xa0 [ 1242.653948][T25130] ? do_raw_spin_unlock+0x121/0x230 [ 1242.659200][T25130] kobject_add_internal+0x617/0xc90 [ 1242.664456][T25130] kobject_add+0x164/0x240 [ 1242.668927][T25130] ? kobject_init+0x1d0/0x1d0 [ 1242.673666][T25130] ? get_device_parent+0x366/0x390 [ 1242.678865][T25130] device_add+0x3fa/0xc40 [ 1242.683261][T25130] hci_conn_add_sysfs+0xd5/0x1e0 [ 1242.688257][T25130] le_conn_complete_evt+0xe9f/0x1480 [ 1242.693598][T25130] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1242.699892][T25130] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1242.705581][T25130] ? mutex_unlock+0x10/0x10 [ 1242.710147][T25130] ? skb_pull_data+0xf0/0x1f0 [ 1242.714871][T25130] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1242.720829][T25130] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1242.727315][T25130] ? hci_remote_host_features_evt+0x150/0x150 [ 1242.733430][T25130] hci_event_packet+0x7b4/0x1280 [ 1242.738417][T25130] ? __lock_acquire+0x7d80/0x7d80 [ 1242.743743][T25130] ? lock_chain_count+0x20/0x20 [ 1242.748643][T25130] ? bis_list+0x290/0x290 [ 1242.753039][T25130] ? lockdep_hardirqs_on+0x98/0x150 [ 1242.758313][T25130] ? hci_send_to_monitor+0xd7/0x4f0 [ 1242.763566][T25130] hci_rx_work+0x43a/0xd60 [ 1242.768030][T25130] ? process_scheduled_works+0x975/0x1600 [ 1242.773828][T25130] process_scheduled_works+0xa60/0x1600 [ 1242.779466][T25130] ? worker_attach_to_pool+0x370/0x370 [ 1242.784978][T25130] ? assign_work+0x3cc/0x5d0 [ 1242.789635][T25130] worker_thread+0xa5e/0xfe0 [ 1242.794285][T25130] ? _raw_spin_unlock+0x40/0x40 [ 1242.799185][T25130] ? __kthread_parkme+0x71/0x1c0 [ 1242.804170][T25130] kthread+0x2fa/0x390 [ 1242.808278][T25130] ? pr_cont_work+0x550/0x550 [ 1242.813022][T25130] ? kthread_blkcg+0xd0/0xd0 [ 1242.817662][T25130] ret_from_fork+0x48/0x80 [ 1242.822152][T25130] ? kthread_blkcg+0xd0/0xd0 [ 1242.826799][T25130] ret_from_fork_asm+0x11/0x20 [ 1242.831642][T25130] [ 1242.840123][T25130] kobject: kobject_add_internal failed for hci5:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1242.855241][T25130] Bluetooth: hci5: failed to register connection device [ 1244.393821][T25620] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6348'. [ 1245.144753][T25130] Bluetooth: hci5: command 0x0406 tx timeout [ 1247.000245][T25640] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6354'. [ 1260.070640][ T5844] IPVS: starting estimator thread 0... [ 1260.272044][T25746] IPVS: using max 20 ests per chain, 48000 per kthread [ 1265.683206][T25786] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6398'. [ 1267.130191][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 1267.136668][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 1269.425156][T25811] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6406'. [ 1272.742220][T25839] netlink: 'syz.4.6415': attribute type 1 has an invalid length. [ 1277.114745][T25885] vlan2: entered promiscuous mode [ 1277.146920][T25885] vlan2: entered allmulticast mode [ 1277.152121][T25885] hsr_slave_1: entered allmulticast mode [ 1284.315853][T25935] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 1284.330391][T25935] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 1292.936549][T26012] macvlan2: left promiscuous mode [ 1292.941755][T26012] bond2: left promiscuous mode [ 1293.793080][T26021] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1306.637287][T26123] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6498'. [ 1307.109353][T26129] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1311.417419][T26155] netlink: 12 bytes leftover after parsing attributes in process `syz.5.6507'. [ 1314.046685][T26162] bond20: option lacp_rate: invalid value (4) [ 1314.072405][T26162] bond20 (unregistering): Released all slaves [ 1319.597589][T26205] netlink: 68 bytes leftover after parsing attributes in process `syz.5.6523'. [ 1324.626319][T26218] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6528'. [ 1330.192661][ T27] audit: type=1326 audit(1785837069.726:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26265 comm="syz.4.6541" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f18e4d9e019 code=0x7ffc0000 [ 1330.325360][ T27] audit: type=1326 audit(1785837069.726:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26265 comm="syz.4.6541" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f18e4d9e019 code=0x7ffc0000 [ 1330.519185][ T27] audit: type=1326 audit(1785837069.726:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26265 comm="syz.4.6541" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f18e4d9e019 code=0x7ffc0000 [ 1330.548579][ T27] audit: type=1326 audit(1785837069.726:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26265 comm="syz.4.6541" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f18e4d9e019 code=0x7ffc0000 [ 1330.637755][T26274] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 1331.305700][ T27] audit: type=1326 audit(1785837069.726:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26265 comm="syz.4.6541" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f18e4d9e019 code=0x7ffc0000 [ 1331.330787][ T27] audit: type=1326 audit(1785837069.726:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26265 comm="syz.4.6541" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f18e4d9e019 code=0x7ffc0000 [ 1331.368895][ T27] audit: type=1326 audit(1785837069.726:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26265 comm="syz.4.6541" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f18e4d9e019 code=0x7ffc0000 [ 1331.393434][ T27] audit: type=1326 audit(1785837069.726:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26265 comm="syz.4.6541" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f18e4d9e019 code=0x7ffc0000 [ 1331.442731][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 1331.449211][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 1331.476130][ T27] audit: type=1326 audit(1785837069.726:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26265 comm="syz.4.6541" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f18e4d9e019 code=0x7ffc0000 [ 1331.505589][ T27] audit: type=1326 audit(1785837069.726:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=26265 comm="syz.4.6541" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=131 compat=0 ip=0x7f18e4d9e019 code=0x7ffc0000 [ 1331.657474][T26277] 9pnet_fd: Insufficient options for proto=fd [ 1333.900852][T26302] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6553'. [ 1333.911340][T26302] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6553'. [ 1333.930253][T26302] netlink: 'syz.2.6553': attribute type 19 has an invalid length. [ 1333.952048][T26302] netlink: 'syz.2.6553': attribute type 20 has an invalid length. [ 1333.991494][T26302] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1334.001186][T26302] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1334.010139][T26302] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1334.019088][T26302] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1339.735333][T26366] overlayfs: failed to clone lowerpath [ 1344.412715][T26424] netlink: 592 bytes leftover after parsing attributes in process `syz.5.6584'. [ 1347.160752][T26441] overlayfs: failed to clone upperpath [ 1347.288239][T26442] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1348.240173][T26444] netlink: 68 bytes leftover after parsing attributes in process `syz.2.6588'. [ 1351.053883][T26455] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6592'. [ 1355.445262][T26502] netlink: 68 bytes leftover after parsing attributes in process `syz.2.6605'. [ 1362.008082][T26561] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6622'. [ 1362.038024][T26561] netlink: 20 bytes leftover after parsing attributes in process `syz.5.6622'. [ 1364.522345][T26586] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6631'. [ 1368.231518][T26611] netlink: 36 bytes leftover after parsing attributes in process `syz.1.6635'. [ 1368.243920][T25130] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:0' [ 1368.253521][T25130] CPU: 0 PID: 25130 Comm: kworker/u5:0 Not tainted syzkaller #0 [ 1368.261206][T25130] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1368.271307][T25130] Workqueue: hci0 hci_rx_work [ 1368.276044][T25130] Call Trace: [ 1368.279363][T25130] [ 1368.282330][T25130] dump_stack_lvl+0x18c/0x250 [ 1368.287081][T25130] ? show_regs_print_info+0x20/0x20 [ 1368.292320][T25130] ? load_image+0x420/0x420 [ 1368.296911][T25130] sysfs_create_dir_ns+0x26e/0x2a0 [ 1368.302066][T25130] ? __lock_acquire+0x7d80/0x7d80 [ 1368.307137][T25130] ? sysfs_warn_dup+0xa0/0xa0 [ 1368.311894][T25130] ? do_raw_spin_unlock+0x121/0x230 [ 1368.317153][T25130] kobject_add_internal+0x617/0xc90 [ 1368.322416][T25130] kobject_add+0x164/0x240 [ 1368.326897][T25130] ? kobject_init+0x1d0/0x1d0 [ 1368.331636][T25130] ? get_device_parent+0x366/0x390 [ 1368.336796][T25130] device_add+0x3fa/0xc40 [ 1368.341171][T25130] hci_conn_add_sysfs+0xd5/0x1e0 [ 1368.346182][T25130] le_conn_complete_evt+0xe9f/0x1480 [ 1368.351526][T25130] ? hci_le_big_info_adv_report_evt+0x910/0x910 [ 1368.357835][T25130] ? __mutex_unlock_slowpath+0x1b4/0x6c0 [ 1368.363532][T25130] ? mutex_unlock+0x10/0x10 [ 1368.368085][T25130] ? skb_pull_data+0xf0/0x1f0 [ 1368.372807][T25130] hci_le_enh_conn_complete_evt+0x189/0x460 [ 1368.378753][T25130] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 1368.385230][T25130] ? hci_remote_host_features_evt+0x150/0x150 [ 1368.391345][T25130] hci_event_packet+0x7b4/0x1280 [ 1368.396321][T25130] ? __lock_acquire+0x7d80/0x7d80 [ 1368.401393][T25130] ? lock_chain_count+0x20/0x20 [ 1368.406285][T25130] ? bis_list+0x290/0x290 [ 1368.410655][T25130] ? lockdep_hardirqs_on+0x98/0x150 [ 1368.415908][T25130] ? hci_send_to_monitor+0xd7/0x4f0 [ 1368.421160][T25130] hci_rx_work+0x43a/0xd60 [ 1368.425637][T25130] ? process_scheduled_works+0x975/0x1600 [ 1368.431414][T25130] process_scheduled_works+0xa60/0x1600 [ 1368.437025][T25130] ? worker_attach_to_pool+0x370/0x370 [ 1368.442525][T25130] ? assign_work+0x3cc/0x5d0 [ 1368.447157][T25130] worker_thread+0xa5e/0xfe0 [ 1368.451797][T25130] ? _raw_spin_unlock+0x40/0x40 [ 1368.456687][T25130] ? __kthread_parkme+0x71/0x1c0 [ 1368.461667][T25130] kthread+0x2fa/0x390 [ 1368.465774][T25130] ? pr_cont_work+0x550/0x550 [ 1368.470499][T25130] ? kthread_blkcg+0xd0/0xd0 [ 1368.475129][T25130] ret_from_fork+0x48/0x80 [ 1368.479590][T25130] ? kthread_blkcg+0xd0/0xd0 [ 1368.484215][T25130] ret_from_fork_asm+0x11/0x20 [ 1368.489048][T25130] [ 1368.497150][T26602] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1368.508264][T25130] kobject: kobject_add_internal failed for hci0:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 1368.522455][T25130] Bluetooth: hci0: failed to register connection device [ 1369.340055][T26620] o2cb: This node has not been configured. [ 1369.347172][T26620] o2cb: Cluster check failed. Fix errors before retrying. [ 1369.354464][T26620] (syz.4.6640,26620,0):user_dlm_register:674 ERROR: status = -22 [ 1369.362301][T26620] (syz.4.6640,26620,0):dlmfs_mkdir:438 ERROR: Error -22 could not register domain "file2" [ 1369.458455][T26622] overlayfs: failed to clone upperpath [ 1369.746833][T26624] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6641'. [ 1369.786439][T26624] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6641'. [ 1370.923840][T25130] Bluetooth: hci0: command 0x0401 tx timeout [ 1376.429798][T26684] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6657'. [ 1382.079267][T26715] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6667'. [ 1384.246826][T26733] netlink: 'syz.4.6672': attribute type 1 has an invalid length. [ 1384.361453][T26733] bond20: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 1384.395784][T26733] netlink: 28 bytes leftover after parsing attributes in process `syz.4.6672'. [ 1384.426444][T26733] 8021q: adding VLAN 0 to HW filter on device bond20 [ 1384.696259][T26740] netlink: 64 bytes leftover after parsing attributes in process `syz.5.6674'. [ 1387.018406][T26754] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6679'. [ 1390.125281][T26783] overlayfs: failed to clone upperpath [ 1396.574464][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 1396.581041][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 1400.230478][T26838] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6701'. [ 1400.241192][T26838] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6701'. [ 1403.081574][T25130] Bluetooth: hci4: unexpected event for opcode 0x0000 [ 1403.545614][T26868] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6713'. [ 1403.612777][T26870] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6712'. [ 1403.641101][T26870] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6712'. [ 1407.094822][T26900] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6723'. [ 1407.123703][T26900] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6723'. [ 1407.479789][T25130] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 1407.489774][T25130] Bluetooth: hci4: Injecting HCI hardware error event [ 1407.500407][T25130] Bluetooth: hci4: hardware error 0x00 [ 1410.042874][T25130] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 1410.731226][T26936] netlink: 'syz.1.6734': attribute type 29 has an invalid length. [ 1410.753454][T26936] netlink: 'syz.1.6734': attribute type 29 has an invalid length. [ 1410.767100][T26936] netlink: 'syz.1.6734': attribute type 29 has an invalid length. [ 1421.131260][T27014] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1425.387854][T27054] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1425.547608][T27059] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6768'. [ 1425.561714][T27059] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6768'. [ 1429.570043][T21168] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1429.582510][T21168] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1429.590867][T21168] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1429.601952][T21168] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1429.611072][T21168] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 1429.618654][T21168] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1430.113413][T27096] chnl_net:caif_netlink_parms(): no params data found [ 1430.328906][T27096] bridge0: port 1(bridge_slave_0) entered blocking state [ 1430.348723][T27096] bridge0: port 1(bridge_slave_0) entered disabled state [ 1430.370981][T27096] bridge_slave_0: entered allmulticast mode [ 1430.398397][T27096] bridge_slave_0: entered promiscuous mode [ 1430.423366][T27096] bridge0: port 2(bridge_slave_1) entered blocking state [ 1430.445412][T27096] bridge0: port 2(bridge_slave_1) entered disabled state [ 1430.466569][T27096] bridge_slave_1: entered allmulticast mode [ 1430.488590][T27096] bridge_slave_1: entered promiscuous mode [ 1430.562810][T27096] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1430.576373][T27096] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1430.646447][T27096] team0: Port device team_slave_0 added [ 1432.007335][T21168] Bluetooth: hci2: command tx timeout [ 1432.020103][T27096] team0: Port device team_slave_1 added [ 1432.149278][T27096] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1432.393519][T27096] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1432.488922][T27096] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1432.501832][T27096] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1432.508834][T27096] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1432.535208][T27096] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1433.078069][T27096] hsr_slave_0: entered promiscuous mode [ 1433.129589][T27096] hsr_slave_1: entered promiscuous mode [ 1433.870413][T27127] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6787'. [ 1433.910813][T27127] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6787'. [ 1434.284346][T21168] Bluetooth: hci2: command tx timeout [ 1434.337877][T27096] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1434.379771][T27096] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1434.437238][T27096] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1434.474860][T27096] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1434.675173][T27096] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1434.721883][T27096] 8021q: adding VLAN 0 to HW filter on device team0 [ 1434.746988][T24524] bridge0: port 1(bridge_slave_0) entered blocking state [ 1434.754294][T24524] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1434.790964][T24524] bridge0: port 2(bridge_slave_1) entered blocking state [ 1434.798219][T24524] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1435.227046][T27096] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1436.896159][T21168] Bluetooth: hci2: command tx timeout [ 1437.670394][T27096] veth0_vlan: entered promiscuous mode [ 1437.791030][T27096] veth1_vlan: entered promiscuous mode [ 1437.949708][T27096] veth0_macvtap: entered promiscuous mode [ 1437.970662][T27096] veth1_macvtap: entered promiscuous mode [ 1437.998353][T27096] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1438.017645][T27096] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1438.088117][T27096] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1438.417407][T27096] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1438.462255][T27096] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1438.473801][T27096] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1438.484432][T27170] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6796'. [ 1438.498188][T27170] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6796'. [ 1438.516258][T27096] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1438.535871][T27096] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1438.557856][T27096] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1438.581632][T27096] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1438.853122][ T2977] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1438.884323][ T2977] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1438.935228][T24524] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1438.974733][T24524] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1439.106277][T21168] Bluetooth: hci2: command tx timeout [ 1439.474065][T27185] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1446.100937][T27216] netlink: 'syz.1.6808': attribute type 29 has an invalid length. [ 1446.156227][T27216] netlink: 'syz.1.6808': attribute type 29 has an invalid length. [ 1446.202444][T27219] netlink: 'syz.1.6808': attribute type 29 has an invalid length. [ 1446.463511][T27224] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1451.739751][T27279] loop5: detected capacity change from 0 to 4096 [ 1451.778505][T27279] ntfs3: loop5: Different NTFS sector size (4096) and media sector size (512). [ 1454.186571][T27315] 0x000000000007-0x000000020000 : "" [ 1454.230349][T27315] ftl_cs: FTL header corrupt! [ 1460.941577][T21168] Bluetooth: hci0: command 0x0401 tx timeout [ 1461.260903][T27388] loop5: detected capacity change from 0 to 1024 [ 1461.300201][T27388] EXT4-fs: Ignoring removed nomblk_io_submit option [ 1461.396813][T27388] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1462.302110][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 1462.308614][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 1465.114157][T27419] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6876'. [ 1465.356753][T27096] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1470.222156][T27472] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6894'. [ 1470.231614][T27472] netlink: 24 bytes leftover after parsing attributes in process `syz.5.6894'. [ 1470.910863][T27482] loop5: detected capacity change from 0 to 128 [ 1470.918415][T27482] FAT-fs (loop5): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 1470.981333][T27482] FAT-fs (loop5): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 1471.012313][ T2962] FAT-fs (loop5): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 1472.672497][T27491] loop5: detected capacity change from 0 to 512 [ 1472.695300][T27491] EXT4-fs (loop5): Test dummy encryption mode enabled [ 1472.874396][T27491] EXT4-fs error (device loop5): ext4_orphan_get:1404: inode #15: comm syz.5.6900: inode has both inline data and extents flags [ 1473.273643][T27491] EXT4-fs error (device loop5): ext4_orphan_get:1409: comm syz.5.6900: couldn't read orphan inode 15 (err -117) [ 1473.307082][T27491] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1480.379919][ T27] kauditd_printk_skb: 320 callbacks suppressed [ 1480.380020][ T27] audit: type=1326 audit(1785837211.313:352): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27551 comm="syz.2.6915" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcd4f39e019 code=0x7ffc0000 [ 1480.516365][ T27] audit: type=1326 audit(1785837211.313:353): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27551 comm="syz.2.6915" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcd4f39e019 code=0x7ffc0000 [ 1480.625245][ T27] audit: type=1326 audit(1785837211.313:354): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27551 comm="syz.2.6915" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcd4f39e019 code=0x7ffc0000 [ 1480.677192][ T27] audit: type=1326 audit(1785837211.313:355): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27551 comm="syz.2.6915" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcd4f39e019 code=0x7ffc0000 [ 1480.701607][ T27] audit: type=1326 audit(1785837211.322:356): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27551 comm="syz.2.6915" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fcd4f35e84e code=0x7ffc0000 [ 1480.741490][ T27] audit: type=1326 audit(1785837211.322:357): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27551 comm="syz.2.6915" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcd4f39e019 code=0x7ffc0000 [ 1480.771686][ T27] audit: type=1326 audit(1785837211.322:358): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27551 comm="syz.2.6915" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcd4f39e019 code=0x7ffc0000 [ 1480.801952][ T27] audit: type=1326 audit(1785837211.322:359): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27551 comm="syz.2.6915" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcd4f39e019 code=0x7ffc0000 [ 1480.858628][ T27] audit: type=1326 audit(1785837211.322:360): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27551 comm="syz.2.6915" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7fcd4f39e019 code=0x7ffc0000 [ 1480.883200][ T27] audit: type=1326 audit(1785837211.322:361): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27551 comm="syz.2.6915" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcd4f39e019 code=0x7ffc0000 [ 1481.238934][T27566] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6920'. [ 1481.258947][T27566] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6920'. [ 1481.277525][T27566] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6920'. [ 1485.160185][T27096] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1485.496251][T27596] loop5: detected capacity change from 0 to 1024 [ 1488.112136][T27621] loop5: detected capacity change from 0 to 512 [ 1488.121537][T27621] EXT4-fs (loop5): Test dummy encryption mode enabled [ 1488.144547][T27621] EXT4-fs error (device loop5): ext4_orphan_get:1404: inode #15: comm syz.5.6936: inode has both inline data and extents flags [ 1488.168788][T27621] EXT4-fs error (device loop5): ext4_orphan_get:1409: comm syz.5.6936: couldn't read orphan inode 15 (err -117) [ 1488.216311][T27621] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1488.713665][T27096] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1489.062495][T27633] IPVS: Error connecting to the multicast addr [ 1494.546586][T27680] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6953'. [ 1494.556249][T27680] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6953'. [ 1494.565487][T27680] netlink: 'syz.1.6953': attribute type 19 has an invalid length. [ 1494.573567][T27680] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6953'. [ 1494.651730][T27680] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1494.660705][T27680] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1494.670926][T27680] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1494.680169][T27680] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1495.661223][T27694] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6954'. [ 1495.681926][T27695] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6955'. [ 1496.335316][T27703] overlayfs: failed to clone upperpath [ 1497.403186][T27724] netlink: 'syz.1.6965': attribute type 1 has an invalid length. [ 1497.435074][T27724] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1497.443177][T27724] IPv6: NLM_F_CREATE should be set when creating new route [ 1503.627428][T27754] loop5: detected capacity change from 0 to 1024 [ 1503.660468][T27754] EXT4-fs: Ignoring removed nomblk_io_submit option [ 1503.869841][T27754] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1504.540669][T27760] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6976'. [ 1505.150940][T27096] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1511.116935][T27817] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1511.130059][T27817] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1511.139191][T27817] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1511.147473][T27817] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1511.161422][T27817] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 1511.169679][T27817] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1512.459298][T27816] chnl_net:caif_netlink_parms(): no params data found [ 1512.565825][T27816] bridge0: port 1(bridge_slave_0) entered blocking state [ 1512.573219][T27816] bridge0: port 1(bridge_slave_0) entered disabled state [ 1512.580435][T27816] bridge_slave_0: entered allmulticast mode [ 1512.588636][T27816] bridge_slave_0: entered promiscuous mode [ 1512.600236][T27816] bridge0: port 2(bridge_slave_1) entered blocking state [ 1512.607808][T27816] bridge0: port 2(bridge_slave_1) entered disabled state [ 1512.615369][T27816] bridge_slave_1: entered allmulticast mode [ 1512.622879][T27816] bridge_slave_1: entered promiscuous mode [ 1512.664409][T27816] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1512.680910][T27816] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1512.762138][T27816] team0: Port device team_slave_0 added [ 1512.802019][T27816] team0: Port device team_slave_1 added [ 1512.863675][T27816] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1512.885775][T27816] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1512.936946][T27816] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1512.957170][T27816] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1512.983114][T27816] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1513.048065][T27816] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1513.201171][T27816] hsr_slave_0: entered promiscuous mode [ 1513.229162][T27816] hsr_slave_1: entered promiscuous mode [ 1513.245679][T27816] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1513.296515][T27816] Cannot create hsr debugfs directory [ 1513.474435][T27817] Bluetooth: hci4: command tx timeout [ 1515.125871][T27850] netlink: 148 bytes leftover after parsing attributes in process `syz.1.6998'. [ 1515.415945][T27850] netlink: 148 bytes leftover after parsing attributes in process `syz.1.6998'. [ 1515.744236][T21168] Bluetooth: hci4: command tx timeout [ 1517.000923][ T34] bond1: (slave ip6gretap1): Releasing active interface [ 1517.597703][T27883] loop5: detected capacity change from 0 to 512 [ 1517.619592][T27883] EXT4-fs (loop5): Test dummy encryption mode enabled [ 1517.657819][T27883] EXT4-fs error (device loop5): ext4_orphan_get:1404: inode #15: comm syz.5.7006: inode has both inline data and extents flags [ 1517.705125][T27883] EXT4-fs error (device loop5): ext4_orphan_get:1409: comm syz.5.7006: couldn't read orphan inode 15 (err -117) [ 1517.741978][T21168] Bluetooth: hci4: command tx timeout [ 1517.784285][T27883] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1518.851279][T27096] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1519.104164][T27902] loop5: detected capacity change from 0 to 2048 [ 1519.153498][T27816] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1519.228773][ T34] erspan0 (unregistering): left promiscuous mode [ 1519.266143][T27816] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1519.285582][T27902] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1519.319651][T27816] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1519.343063][T27816] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1519.388196][ T34] gretap0 (unregistering): left promiscuous mode [ 1522.082747][T21168] Bluetooth: hci4: command tx timeout [ 1522.093826][T27886] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 1522.260961][T27909] EXT4-fs (loop5): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 3 with error 28 [ 1522.273538][T27909] EXT4-fs (loop5): This should not happen!! Data will be lost [ 1522.273538][T27909] [ 1522.283278][T27909] EXT4-fs (loop5): Total free blocks count 0 [ 1522.289281][T27909] EXT4-fs (loop5): Free/Dirty block details [ 1522.295210][T27909] EXT4-fs (loop5): free_blocks=2415919504 [ 1522.301351][T27909] EXT4-fs (loop5): dirty_blocks=43264 [ 1522.306776][T27909] EXT4-fs (loop5): Block reservation details [ 1522.312766][T27909] EXT4-fs (loop5): i_reserved_data_blocks=2485 [ 1522.373009][T15059] EXT4-fs (loop5): Delayed block allocation failed for inode 18 at logical offset 4 with max blocks 2048 with error 28 [ 1522.417699][ T34] bond15: (slave gretap1): Releasing active interface [ 1522.883259][T27816] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1523.154831][T27816] 8021q: adding VLAN 0 to HW filter on device team0 [ 1523.392245][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 1523.399523][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1523.477818][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 1523.485045][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1524.877112][ T34] hsr_slave_0: left promiscuous mode [ 1525.127063][ T34] hsr_slave_1: left promiscuous mode [ 1525.184927][ T34] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1525.364611][ T34] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1525.981543][ T34] bridge_slave_1: left promiscuous mode [ 1526.001982][ T34] bridge0: port 2(bridge_slave_1) entered disabled state [ 1526.058297][ T34] bridge_slave_0: left allmulticast mode [ 1526.064014][ T34] bridge_slave_0: left promiscuous mode [ 1526.094706][ T34] bridge0: port 1(bridge_slave_0) entered disabled state [ 1526.361944][ T34] bond2: left allmulticast mode [ 1527.114788][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 1527.121340][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 1527.625632][ T34] bond20 (unregistering): (slave veth0_to_bond): Releasing active interface [ 1527.646600][ T34] bond20 (unregistering): Released all slaves [ 1528.669967][ T34] bond19 (unregistering): Released all slaves [ 1528.902368][ T34] bond18 (unregistering): Released all slaves [ 1529.115143][T27096] EXT4-fs: 31 callbacks suppressed [ 1529.115164][T27096] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1529.167342][ T34] bond17 (unregistering): Released all slaves [ 1529.495050][ T34] bond16 (unregistering): Released all slaves [ 1529.669271][ T34] bond15 (unregistering): Released all slaves [ 1529.827577][ T34] bond14 (unregistering): Released all slaves [ 1529.985453][ T34] bond13 (unregistering): Released all slaves [ 1530.204091][ T34] bond12 (unregistering): Released all slaves [ 1530.475228][ T34] bond11 (unregistering): Released all slaves [ 1531.277346][ T34] bond10 (unregistering): Released all slaves [ 1531.533350][ T34] bond9 (unregistering): Released all slaves [ 1531.765500][ T34] bond8 (unregistering): Released all slaves [ 1532.084037][ T34] bond7 (unregistering): Released all slaves [ 1532.305797][ T34] bond6 (unregistering): Released all slaves [ 1532.534924][ T34] bond5 (unregistering): Released all slaves [ 1532.743473][ T34] bond4 (unregistering): Released all slaves [ 1532.911995][T27980] loop5: detected capacity change from 0 to 128 [ 1532.922429][T27980] FAT-fs (loop5): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 1533.038352][T27980] FAT-fs (loop5): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 1533.098421][T15059] FAT-fs (loop5): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 1533.829961][ T34] bond3 (unregistering): Released all slaves [ 1533.893696][ T34] team0 (unregistering): Port device macvlan2 removed [ 1534.166896][ T34] bond2 (unregistering): Released all slaves [ 1534.418257][ T34] bond1 (unregistering): Released all slaves [ 1535.021947][T27985] loop5: detected capacity change from 0 to 512 [ 1535.050263][T27985] EXT4-fs (loop5): Test dummy encryption mode enabled [ 1535.093656][T27985] EXT4-fs error (device loop5): ext4_orphan_get:1404: inode #15: comm syz.5.7025: inode has both inline data and extents flags [ 1535.117467][T27985] EXT4-fs error (device loop5): ext4_orphan_get:1409: comm syz.5.7025: couldn't read orphan inode 15 (err -117) [ 1535.132778][T27985] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1535.614946][ T34] team0 (unregistering): Port device team_slave_1 removed [ 1535.671294][ T34] team0 (unregistering): Port device team_slave_0 removed [ 1535.727790][ T34] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1535.738911][ T34] bond_slave_1 (unregistering): left allmulticast mode [ 1535.795159][ T34] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1535.806416][ T34] bond_slave_0 (unregistering): left allmulticast mode [ 1536.030782][T27096] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1536.311064][T27991] kvm: kvm [27990]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x2a000000292c [ 1536.330018][T27991] kvm: kvm [27990]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0xc90000004900 [ 1536.574517][ T34] bond0 (unregistering): Released all slaves [ 1537.113169][T27816] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1537.636966][T28013] netlink: 8 bytes leftover after parsing attributes in process `syz.5.7031'. [ 1537.659158][T28013] netlink: 4 bytes leftover after parsing attributes in process `syz.5.7031'. [ 1537.669556][T28013] netlink: 'syz.5.7031': attribute type 19 has an invalid length. [ 1537.709084][T28013] netdevsim netdevsim5 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1537.718268][T28013] netdevsim netdevsim5 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1537.727365][T28013] netdevsim netdevsim5 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1537.736108][T28013] netdevsim netdevsim5 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1537.806583][ T34] IPVS: stop unused estimator thread 0... [ 1538.430457][T27816] veth0_vlan: entered promiscuous mode [ 1538.454986][T27816] veth1_vlan: entered promiscuous mode [ 1538.537908][T27816] veth0_macvtap: entered promiscuous mode [ 1538.557066][T27816] veth1_macvtap: entered promiscuous mode [ 1538.579629][T27816] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1538.590476][T27816] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1538.600882][T27816] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1538.612846][T27816] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1538.635584][T27816] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1538.982510][T27816] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1539.172357][T27816] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1539.340929][T27816] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1539.369686][T27816] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1539.428164][T27816] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1539.472026][T27816] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1539.496456][T27816] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1539.541127][T27816] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1539.560776][T27816] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1539.729227][T24524] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1539.750064][T24524] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1539.814290][ T34] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1539.830778][ T34] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1540.148454][T28045] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7041'. [ 1540.177903][T28045] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7041'. [ 1544.718782][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 1545.022707][T28076] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7051'. [ 1545.061350][T28076] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7051'. [ 1548.099994][T28099] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1550.527361][T28136] loop4: detected capacity change from 0 to 4096 [ 1550.581707][T28136] ext4: Unknown parameter 'fsname' [ 1551.273765][T28137] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1551.763177][T28136] can0: slcan on ttyS3. [ 1552.080750][T28135] can0 (unregistered): slcan off ttyS3. [ 1552.672080][T21173] IPVS: starting estimator thread 0... [ 1552.992374][T28166] IPVS: using max 18 ests per chain, 43200 per kthread [ 1554.289046][T28171] netlink: 148 bytes leftover after parsing attributes in process `syz.2.7075'. [ 1556.701014][T28171] netlink: 148 bytes leftover after parsing attributes in process `syz.2.7075'. [ 1558.567768][T28196] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1558.579883][T28196] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1558.588655][T28196] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1558.598882][T28196] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1558.607767][T28196] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 1558.615264][T28196] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1559.186887][T28194] chnl_net:caif_netlink_parms(): no params data found [ 1560.348062][T28213] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1560.596924][T28196] Bluetooth: hci2: command 0x0406 tx timeout [ 1560.675958][T27817] Bluetooth: hci3: command tx timeout [ 1560.894443][T28194] bridge0: port 1(bridge_slave_0) entered blocking state [ 1560.917422][T28194] bridge0: port 1(bridge_slave_0) entered disabled state [ 1560.937088][T28194] bridge_slave_0: entered allmulticast mode [ 1560.961645][T28194] bridge_slave_0: entered promiscuous mode [ 1560.979903][T28194] bridge0: port 2(bridge_slave_1) entered blocking state [ 1560.998717][T28194] bridge0: port 2(bridge_slave_1) entered disabled state [ 1561.008755][T28194] bridge_slave_1: entered allmulticast mode [ 1561.030425][T28194] bridge_slave_1: entered promiscuous mode [ 1561.154464][T28194] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1561.392719][T28194] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1562.020730][T28194] team0: Port device team_slave_0 added [ 1562.031928][T28194] team0: Port device team_slave_1 added [ 1562.099129][T28194] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1562.106148][T28194] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1562.175113][T28194] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1562.200810][T28194] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1562.218131][T28194] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1562.274450][T28194] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1562.407153][T28194] hsr_slave_0: entered promiscuous mode [ 1562.425257][T28194] hsr_slave_1: entered promiscuous mode [ 1562.440349][T28194] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1562.449743][T28194] Cannot create hsr debugfs directory [ 1562.759989][T21168] Bluetooth: hci3: command tx timeout [ 1563.519959][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 1565.670051][T28251] loop4: detected capacity change from 0 to 1024 [ 1565.769179][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 1566.530740][T21168] Bluetooth: hci3: command tx timeout [ 1566.647129][T28251] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1566.675936][T28194] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1566.687108][T28194] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1566.723838][T28194] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1566.756081][T28194] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1566.906676][T27816] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1567.149595][T28194] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1567.200703][T28194] 8021q: adding VLAN 0 to HW filter on device team0 [ 1567.327419][ T34] bridge0: port 1(bridge_slave_0) entered blocking state [ 1567.334708][ T34] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1567.370900][ T34] bridge0: port 2(bridge_slave_1) entered blocking state [ 1567.378149][ T34] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1567.451804][T28259] overlayfs: missing 'lowerdir' [ 1567.505555][T28258] ubi0: attaching mtd0 [ 1567.513794][T28258] ubi0: scanning is finished [ 1567.518459][T28258] ubi0: empty MTD device detected [ 1567.571043][T28258] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1567.578703][T28258] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1567.586074][T28258] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1567.593448][T28258] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 1567.600975][T28258] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1567.607994][T28258] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1567.616064][T28258] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 4126893263 [ 1567.626074][T28194] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1567.626086][T28258] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1567.682419][T28260] ubi0: background thread "ubi_bgt0d" started, PID 28260 [ 1567.709413][T28194] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1568.765284][T27817] Bluetooth: hci3: command tx timeout [ 1569.133231][T28275] loop4: detected capacity change from 0 to 128 [ 1569.173374][T28275] EXT4-fs: Ignoring removed orlov option [ 1569.246854][T28275] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 1569.302637][T28278] netlink: 148 bytes leftover after parsing attributes in process `syz.2.7095'. [ 1569.306564][T28275] ext4 filesystem being mounted at /16/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1569.327002][T28194] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1569.423688][T27817] Bluetooth: hci0: unexpected event for opcode 0x2041 [ 1569.455716][T28278] netlink: 148 bytes leftover after parsing attributes in process `syz.2.7095'. [ 1569.641684][T27816] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 1571.269639][T28194] veth0_vlan: entered promiscuous mode [ 1571.299005][T28194] veth1_vlan: entered promiscuous mode [ 1572.090840][T28194] veth0_macvtap: entered promiscuous mode [ 1572.160025][T28194] veth1_macvtap: entered promiscuous mode [ 1572.278086][T28194] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1572.320525][T28194] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1572.351384][T28194] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1572.361967][T28194] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1572.384304][T28194] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1572.546156][T28194] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1572.560102][T28194] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1572.668845][T28194] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1572.726101][T28194] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1572.750773][T28194] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1572.773116][T28194] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1572.794036][T28194] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1572.819542][T28194] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1572.819652][T28316] netlink: 68 bytes leftover after parsing attributes in process `syz.2.7103'. [ 1572.859763][T28194] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1572.893558][T28194] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1572.944744][T28194] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1572.975288][T28194] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1572.998557][T28194] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1573.137444][T28318] netlink: 148 bytes leftover after parsing attributes in process `syz.2.7104'. [ 1573.190382][T21937] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1573.234974][T21937] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1573.328547][T21937] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1573.351680][T21937] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1573.374495][T28318] netlink: 148 bytes leftover after parsing attributes in process `syz.2.7104'. [ 1573.591735][T28328] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1575.784188][T28359] netlink: 148 bytes leftover after parsing attributes in process `syz.2.7114'. [ 1576.451773][T28359] netlink: 148 bytes leftover after parsing attributes in process `syz.2.7114'. [ 1576.520137][T27817] Bluetooth: hci0: unexpected event for opcode 0x2041 [ 1576.618243][T27817] Bluetooth: hci5: unexpected event for opcode 0x2041 [ 1576.878630][T28372] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1577.657381][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 1577.852074][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 1578.863699][T28390] netlink: 148 bytes leftover after parsing attributes in process `syz.2.7125'. [ 1580.415264][T28388] loop4: detected capacity change from 0 to 1024 [ 1580.514428][T28388] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1580.916167][T27816] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1581.507883][T28415] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1581.762598][T28416] loop4: detected capacity change from 0 to 2048 [ 1582.332681][T28416] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1584.670756][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 1584.851600][T28431] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 1584.866737][T28431] EXT4-fs (loop4): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 3 with error 28 [ 1584.968650][T28431] EXT4-fs (loop4): This should not happen!! Data will be lost [ 1584.968650][T28431] [ 1584.978620][T28431] EXT4-fs (loop4): Total free blocks count 0 [ 1584.984625][T28431] EXT4-fs (loop4): Free/Dirty block details [ 1584.990605][T28431] EXT4-fs (loop4): free_blocks=2415919504 [ 1585.065676][T28431] EXT4-fs (loop4): dirty_blocks=42672 [ 1585.071242][T28431] EXT4-fs (loop4): Block reservation details [ 1585.077551][T28431] EXT4-fs (loop4): i_reserved_data_blocks=2421 [ 1586.107041][T28434] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7135'. [ 1586.144741][T28434] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7135'. [ 1586.319240][T27816] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1586.908485][T28453] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1588.299350][T28465] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7145'. [ 1588.334601][T28465] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7145'. [ 1590.575662][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 1590.798238][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 1591.907093][T28503] loop4: detected capacity change from 0 to 256 [ 1591.919563][T28500] netlink: 8 bytes leftover after parsing attributes in process `syz.6.7157'. [ 1591.936039][T28500] netlink: 24 bytes leftover after parsing attributes in process `syz.6.7157'. [ 1593.006499][T28510] FAT-fs (loop4): error, fat_free_clusters: deleting FAT entry beyond EOF [ 1595.436692][T28538] loop4: detected capacity change from 0 to 64 [ 1595.675368][T28540] netlink: 8 bytes leftover after parsing attributes in process `syz.6.7170'. [ 1595.694476][T28540] netlink: 24 bytes leftover after parsing attributes in process `syz.6.7170'. [ 1597.864878][T28561] pim6reg: entered allmulticast mode [ 1598.884248][T28574] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7181'. [ 1598.895244][T28574] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7181'. [ 1598.950180][T28432] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 1599.163381][T28432] usb 1-1: Dual-Role OTG device on HNP port [ 1599.208139][T28432] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 6.06 [ 1599.344094][T28432] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1599.811073][T28432] cdc_acm 1-1:1.0: ttyACM0: USB ACM device [ 1599.885186][T28432] usb 1-1: Quirk or no altest; falling back to MIDI 1.0 [ 1604.623794][T28607] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7190'. [ 1604.632778][T28607] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7190'. [ 1605.578292][T28612] loop4: detected capacity change from 0 to 2048 [ 1605.728746][T28612] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1606.724737][ T0] NOHZ tick-stop error: local softirq work is pending, handler #42!!! [ 1608.140635][T28621] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 1608.156234][T28621] EXT4-fs (loop4): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 3 with error 28 [ 1608.168437][T28621] EXT4-fs (loop4): This should not happen!! Data will be lost [ 1608.168437][T28621] [ 1608.178107][T28621] EXT4-fs (loop4): Total free blocks count 0 [ 1608.184100][T28621] EXT4-fs (loop4): Free/Dirty block details [ 1608.190298][T28621] EXT4-fs (loop4): free_blocks=2415919504 [ 1608.196029][T28621] EXT4-fs (loop4): dirty_blocks=42800 [ 1608.201469][T28621] EXT4-fs (loop4): Block reservation details [ 1608.207483][T28621] EXT4-fs (loop4): i_reserved_data_blocks=2422 [ 1608.337886][ T2924] EXT4-fs (loop4): Delayed block allocation failed for inode 18 at logical offset 4 with max blocks 2048 with error 28 [ 1608.683139][T27817] Bluetooth: hci5: unexpected event for opcode 0x2041 [ 1609.102944][T28639] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7201'. [ 1609.122410][T28639] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7201'. [ 1610.053759][T28648] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7203'. [ 1610.122619][T28648] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7203'. [ 1610.461789][T28648] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7203'. [ 1611.726944][T27816] EXT4-fs: 31 callbacks suppressed [ 1611.726963][T27816] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1616.758129][T28679] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7210'. [ 1616.810683][T28679] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7210'. [ 1618.139433][T28677] orangefs_mount: mount request failed with -4 [ 1618.424236][T21168] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1618.436019][T21168] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1618.473175][T21168] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1618.485540][T21168] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1618.495085][T21168] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 1618.503552][T21168] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1619.470194][T28690] chnl_net:caif_netlink_parms(): no params data found [ 1619.678531][T28690] bridge0: port 1(bridge_slave_0) entered blocking state [ 1619.700504][T28690] bridge0: port 1(bridge_slave_0) entered disabled state [ 1619.727381][T28690] bridge_slave_0: entered allmulticast mode [ 1619.752614][T28690] bridge_slave_0: entered promiscuous mode [ 1619.789162][T28690] bridge0: port 2(bridge_slave_1) entered blocking state [ 1619.819414][T28690] bridge0: port 2(bridge_slave_1) entered disabled state [ 1619.839307][T28690] bridge_slave_1: entered allmulticast mode [ 1619.848619][T28690] bridge_slave_1: entered promiscuous mode [ 1619.911374][T28690] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1619.946861][T28690] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1620.042313][T28690] team0: Port device team_slave_0 added [ 1620.052469][T28690] team0: Port device team_slave_1 added [ 1620.133601][T28690] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1620.159147][T28690] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1620.188248][T28690] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1620.219077][T28690] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1620.231780][T28690] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1620.272777][T28690] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1620.328270][T28717] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7219'. [ 1620.339926][T28717] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7219'. [ 1621.112747][T27817] Bluetooth: hci6: command tx timeout [ 1621.209318][T28690] hsr_slave_0: entered promiscuous mode [ 1621.234044][T28690] hsr_slave_1: entered promiscuous mode [ 1621.245601][T28690] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1621.258663][T28690] Cannot create hsr debugfs directory [ 1622.944965][T28690] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 1622.973677][T28690] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 1623.010963][T28690] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 1623.041196][T28690] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 1623.159055][T28752] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7229'. [ 1623.197459][T28752] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7229'. [ 1623.353619][T27817] Bluetooth: hci6: command tx timeout [ 1624.020490][T28690] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1624.220752][T28690] 8021q: adding VLAN 0 to HW filter on device team0 [ 1624.279109][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 1624.286348][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1625.436517][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 1625.443789][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1625.604940][T27817] Bluetooth: hci6: command tx timeout [ 1626.339903][T28784] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7237'. [ 1626.360688][T28784] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7237'. [ 1626.402338][T28690] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1627.911479][T27817] Bluetooth: hci6: command tx timeout [ 1629.277039][T28816] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7247'. [ 1629.285993][T28816] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7247'. [ 1629.564622][T28690] veth0_vlan: entered promiscuous mode [ 1629.590917][T28690] veth1_vlan: entered promiscuous mode [ 1630.576925][T28690] veth0_macvtap: entered promiscuous mode [ 1630.588287][T28690] veth1_macvtap: entered promiscuous mode [ 1630.733545][T28690] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1630.772059][T28690] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1630.782299][T28690] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1630.792849][T28690] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1630.803919][T28690] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1630.818098][T28690] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1630.828521][T28690] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1630.854846][T28690] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1630.906073][T28690] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1630.924965][T28690] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1630.935954][T28690] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1630.946262][T28690] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1630.958367][T28690] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1630.969873][T28690] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1630.981921][T28690] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1631.010065][T28690] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1631.033334][T28690] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1631.393083][T28690] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1631.405043][T28690] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1631.418066][T28690] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1631.427052][T28690] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1631.436101][T28690] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1631.569667][ T34] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1631.626913][ T34] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1631.676266][ T34] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1631.689400][ T34] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1631.841596][T28847] netlink: 8 bytes leftover after parsing attributes in process `syz.4.7256'. [ 1631.876929][T28847] netlink: 24 bytes leftover after parsing attributes in process `syz.4.7256'. [ 1634.755022][T28885] netlink: 8 bytes leftover after parsing attributes in process `syz.7.7267'. [ 1634.779480][T28885] netlink: 24 bytes leftover after parsing attributes in process `syz.7.7267'. [ 1634.808964][T27817] Bluetooth: hci5: unexpected event for opcode 0x2041 [ 1638.964460][T28919] netlink: 8 bytes leftover after parsing attributes in process `syz.2.7278'. [ 1638.992929][T28919] netlink: 24 bytes leftover after parsing attributes in process `syz.2.7278'. [ 1639.102830][T27817] Bluetooth: hci0: unexpected event for opcode 0x2041 [ 1641.166246][T28953] netlink: 8 bytes leftover after parsing attributes in process `syz.7.7289'. [ 1641.175469][T28953] netlink: 24 bytes leftover after parsing attributes in process `syz.7.7289'. [ 1642.788716][T21168] Bluetooth: hci4: command 0x0406 tx timeout [ 1644.169177][T28988] netlink: 8 bytes leftover after parsing attributes in process `syz.7.7298'. [ 1644.178501][T28988] netlink: 24 bytes leftover after parsing attributes in process `syz.7.7298'. [ 1644.303956][T27817] Bluetooth: hci5: unexpected event for opcode 0x2041 [ 1648.444052][T29016] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1648.468782][T29016] netlink: 72 bytes leftover after parsing attributes in process `syz.1.7306'. [ 1649.462418][T29026] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7309'. [ 1649.579397][T29026] netlink: 24 bytes leftover after parsing attributes in process `syz.1.7309'. [ 1652.066966][T17495] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 1653.074376][T17495] usb 8-1: Using ep0 maxpacket: 16 [ 1653.093886][T17495] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1653.111010][T17495] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1653.148018][T17495] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1653.157973][T17495] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1653.169413][T17495] usb 8-1: Product: syz [ 1653.177951][T17495] usb 8-1: Manufacturer: syz [ 1653.190382][T17495] usb 8-1: SerialNumber: syz [ 1653.761530][T21173] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 1653.922253][T17495] usb 8-1: 0:2 : does not exist [ 1653.939976][T17495] usb 8-1: 5:0: failed to get current value for ch 0 (-22) [ 1653.972474][T17495] usb 8-1: USB disconnect, device number 2 [ 1653.995024][T21173] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1654.004163][T21173] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1654.062721][T29068] udevd[29068]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb8/8-1/8-1:1.0/sound/card5/controlC5/../uevent} for writing: No such file or directory [ 1654.093577][T21173] usb 5-1: config 0 descriptor?? [ 1654.129483][T29070] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7325'. [ 1654.900690][T21173] [drm] Initialized udl 0.0.1 20120220 for 5-1:0.0 on minor 2 [ 1654.910864][T21173] [drm] Initialized udl on minor 2 [ 1655.351048][T21173] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 1 failed err ffffffb9 [ 1655.571097][T21173] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 1655.611391][T28432] udl 5-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1655.636765][T21173] usb 5-1: USB disconnect, device number 25 [ 1655.644461][T28432] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 1657.067245][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 1657.076580][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 1658.691529][T29112] loop4: detected capacity change from 0 to 2048 [ 1658.813200][T29112] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1661.515146][T29121] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 1661.530711][T29121] EXT4-fs (loop4): Delayed block allocation failed for inode 19 at logical offset 0 with max blocks 3 with error 28 [ 1661.542993][T29121] EXT4-fs (loop4): This should not happen!! Data will be lost [ 1661.542993][T29121] [ 1661.552704][T29121] EXT4-fs (loop4): Total free blocks count 0 [ 1661.558763][T29121] EXT4-fs (loop4): Free/Dirty block details [ 1661.564667][T29121] EXT4-fs (loop4): free_blocks=2415919504 [ 1661.570430][T29121] EXT4-fs (loop4): dirty_blocks=33008 [ 1661.575808][T29121] EXT4-fs (loop4): Block reservation details [ 1661.581838][T29121] EXT4-fs (loop4): i_reserved_data_blocks=2063 [ 1663.378554][T29127] netlink: 'syz.7.7339': attribute type 10 has an invalid length. [ 1663.386463][T29127] netlink: 40 bytes leftover after parsing attributes in process `syz.7.7339'. [ 1663.395526][T29127] bridge0: port 3(dummy0) entered blocking state [ 1663.402036][T29127] bridge0: port 3(dummy0) entered disabled state [ 1663.409212][T29127] dummy0: entered allmulticast mode [ 1663.415609][T29127] dummy0: entered promiscuous mode [ 1663.421270][T29127] bridge0: port 3(dummy0) entered blocking state [ 1663.427688][T29127] bridge0: port 3(dummy0) entered forwarding state [ 1665.467850][ T27] kauditd_printk_skb: 77 callbacks suppressed [ 1665.467868][ T27] audit: type=1804 audit(1785837386.900:439): pid=29157 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.7.7349" name="bus" dev="ramfs" ino=85135 res=1 errno=0 [ 1665.688750][T29161] loop7: detected capacity change from 0 to 256 [ 1665.774098][T29163] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1669.400022][T27816] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1670.051940][T29193] 9pnet_fd: Insufficient options for proto=fd [ 1670.442732][T29198] loop7: detected capacity change from 0 to 128 [ 1670.450671][T29198] EXT4-fs: Ignoring removed orlov option [ 1670.547514][T29198] EXT4-fs (loop7): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 1670.726463][T29198] ext4 filesystem being mounted at /30/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1671.860010][T28690] EXT4-fs (loop7): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 1677.192135][T29245] loop4: detected capacity change from 0 to 128 [ 1677.228358][T29245] EXT4-fs: Ignoring removed orlov option [ 1677.301739][T29245] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 1677.371229][T29245] ext4 filesystem being mounted at /80/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1677.657137][T27816] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 1678.228899][T29252] loop7: detected capacity change from 0 to 256 [ 1678.279957][ T27] audit: type=1804 audit(1785837398.680:440): pid=29252 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.7.7377" name="bus" dev="ramfs" ino=84844 res=1 errno=0 [ 1680.742794][T29268] loop7: detected capacity change from 0 to 2048 [ 1681.077361][T29268] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1682.216346][T29280] loop4: detected capacity change from 0 to 128 [ 1682.271296][T29280] EXT4-fs: Ignoring removed orlov option [ 1682.308063][T29280] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 1682.322663][T28690] EXT4-fs error (device loop7): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 1682.369940][T29280] ext4 filesystem being mounted at /84/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1683.773120][ T12] EXT4-fs (loop7): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 3 with error 28 [ 1683.818027][ T12] EXT4-fs (loop7): This should not happen!! Data will be lost [ 1683.818027][ T12] [ 1683.855826][ T12] EXT4-fs (loop7): Total free blocks count 0 [ 1683.880720][ T12] EXT4-fs (loop7): Free/Dirty block details [ 1683.886779][ T12] EXT4-fs (loop7): free_blocks=2415919520 [ 1683.920787][ T12] EXT4-fs (loop7): dirty_blocks=9552 [ 1683.966336][ T12] EXT4-fs (loop7): Block reservation details [ 1683.972410][ T12] EXT4-fs (loop7): i_reserved_data_blocks=85 [ 1684.494861][ T12] EXT4-fs (loop7): Delayed block allocation failed for inode 18 at logical offset 4 with max blocks 1640 with error 28 [ 1684.582521][T27816] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 1688.224534][T27817] Bluetooth: hci4: unexpected event for opcode 0x2041 [ 1688.468152][T29317] loop4: detected capacity change from 0 to 2048 [ 1689.208602][T29317] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1692.096734][T29326] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1244: group 0, block bitmap and bg descriptor inconsistent: 0 vs 150994969 free clusters [ 1692.112069][T29326] EXT4-fs (loop4): Delayed block allocation failed for inode 18 at logical offset 0 with max blocks 3 with error 28 [ 1692.124342][T29326] EXT4-fs (loop4): This should not happen!! Data will be lost [ 1692.124342][T29326] [ 1692.134656][T29326] EXT4-fs (loop4): Total free blocks count 0 [ 1692.140643][T29326] EXT4-fs (loop4): Free/Dirty block details [ 1692.146657][T29326] EXT4-fs (loop4): free_blocks=2415919504 [ 1692.152393][T29326] EXT4-fs (loop4): dirty_blocks=46928 [ 1692.157822][T29326] EXT4-fs (loop4): Block reservation details [ 1692.163903][T29326] EXT4-fs (loop4): i_reserved_data_blocks=2421 [ 1692.205871][ T2977] EXT4-fs: 15 callbacks suppressed [ 1692.205885][ T2977] EXT4-fs (loop7): Delayed block allocation failed for inode 18 at logical offset 3694 with max blocks 2048 with error 28 [ 1692.285618][ T2977] EXT4-fs (loop7): This should not happen!! Data will be lost [ 1692.285618][ T2977] [ 1692.295356][ T2977] EXT4-fs (loop7): Total free blocks count 0 [ 1692.372405][ T2977] EXT4-fs (loop7): Free/Dirty block details [ 1692.378410][ T2977] EXT4-fs (loop7): free_blocks=2415919520 [ 1692.422242][ T2977] EXT4-fs (loop7): dirty_blocks=2304 [ 1692.433191][ T2977] EXT4-fs (loop7): Block reservation details [ 1692.455115][ T2977] EXT4-fs (loop7): i_reserved_data_blocks=144 [ 1692.476058][ T34] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1692.834663][ T2977] EXT4-fs (loop7): Delayed block allocation failed for inode 18 at logical offset 5744 with max blocks 222 with error 28 [ 1692.923170][ T2977] EXT4-fs (loop7): This should not happen!! Data will be lost [ 1692.923170][ T2977] [ 1692.955651][ T34] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1693.170151][T21168] Bluetooth: hci3: command 0x0406 tx timeout [ 1693.322035][ T12] EXT4-fs (loop4): Delayed block allocation failed for inode 18 at logical offset 4 with max blocks 2048 with error 28 [ 1693.433019][ T34] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1693.588571][ T34] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1694.170734][T27817] Bluetooth: hci0: unexpected event for opcode 0x2041 [ 1696.275362][T28196] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1696.293667][T28196] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1696.325655][T28196] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1696.335710][T28196] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1696.343672][T28196] Bluetooth: hci6: unexpected cc 0x0c25 length: 249 > 3 [ 1696.358028][T28196] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1697.478441][ T34] hsr_slave_0: left promiscuous mode [ 1697.526343][ T34] hsr_slave_1: left promiscuous mode [ 1697.579390][ T34] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1697.604837][ T34] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1697.639967][ T34] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1697.662124][ T34] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1698.719441][T28196] Bluetooth: hci6: command tx timeout [ 1698.731116][ T34] dummy0: left allmulticast mode [ 1698.736133][ T34] dummy0: left promiscuous mode [ 1698.936247][ T34] bridge0: port 3(dummy0) entered disabled state [ 1698.972629][ T34] bridge_slave_1: left allmulticast mode [ 1698.978365][ T34] bridge_slave_1: left promiscuous mode [ 1699.033897][ T34] bridge0: port 2(bridge_slave_1) entered disabled state [ 1699.183911][ T34] bridge_slave_0: left allmulticast mode [ 1699.212649][ T34] bridge_slave_0: left promiscuous mode [ 1699.228569][ T34] bridge0: port 1(bridge_slave_0) entered disabled state [ 1699.638670][ T34] veth1_macvtap: left promiscuous mode [ 1699.651057][ T34] veth0_macvtap: left promiscuous mode [ 1699.656841][ T34] veth1_vlan: left promiscuous mode [ 1699.702061][ T34] veth0_vlan: left promiscuous mode [ 1700.916498][T28196] Bluetooth: hci6: command tx timeout [ 1701.880542][T27816] EXT4-fs: 31 callbacks suppressed [ 1701.880561][T27816] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1702.130211][ T27] audit: type=1804 audit(1785837420.754:441): pid=29410 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.7397" name="bus" dev="ramfs" ino=86084 res=1 errno=0 [ 1702.161240][T29410] loop4: detected capacity change from 0 to 256 [ 1702.206260][ T27] audit: type=1804 audit(1785837420.754:442): pid=29410 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.7397" name="bus" dev="ramfs" ino=86084 res=1 errno=0 [ 1702.930202][ T34] team0 (unregistering): Port device team_slave_1 removed [ 1703.071338][ T34] team0 (unregistering): Port device team_slave_0 removed [ 1703.162026][T28196] Bluetooth: hci6: command tx timeout [ 1703.248903][T28196] Bluetooth: hci4: unexpected event for opcode 0x2041 [ 1703.291127][ T34] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1703.881902][ T34] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1705.413670][T28196] Bluetooth: hci6: command tx timeout [ 1705.772852][ T34] bond0 (unregistering): Released all slaves [ 1706.184247][T29431] loop4: detected capacity change from 0 to 128 [ 1706.217740][T29431] EXT4-fs: Ignoring removed orlov option [ 1706.260819][T29364] chnl_net:caif_netlink_parms(): no params data found [ 1706.385013][T29431] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 1706.466204][T29431] ext4 filesystem being mounted at /94/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1706.910452][T29364] bridge0: port 1(bridge_slave_0) entered blocking state [ 1706.917753][T29364] bridge0: port 1(bridge_slave_0) entered disabled state [ 1706.929454][T29364] bridge_slave_0: entered allmulticast mode [ 1706.937775][T29364] bridge_slave_0: entered promiscuous mode [ 1706.948112][T29364] bridge0: port 2(bridge_slave_1) entered blocking state [ 1706.956975][T27816] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 1707.021491][T29364] bridge0: port 2(bridge_slave_1) entered disabled state [ 1707.070307][T29364] bridge_slave_1: entered allmulticast mode [ 1707.099662][T29364] bridge_slave_1: entered promiscuous mode [ 1708.126629][T29364] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1708.187575][T29364] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1708.238473][T29364] team0: Port device team_slave_0 added [ 1708.248458][T29364] team0: Port device team_slave_1 added [ 1708.356156][T29364] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1708.379764][T29364] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1708.459184][T28196] Bluetooth: hci5: unexpected event for opcode 0x2041 [ 1708.491808][T29364] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1708.577643][T29364] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1708.584684][T29364] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1708.698377][T29364] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1709.120331][T29364] hsr_slave_0: entered promiscuous mode [ 1709.349797][T29364] hsr_slave_1: entered promiscuous mode [ 1710.894717][T29364] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1710.906147][T29364] Cannot create hsr debugfs directory [ 1712.075803][T29364] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 1712.151489][T28196] Bluetooth: hci5: unexpected event for opcode 0x2041 [ 1712.195278][T29364] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 1713.036857][T29364] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 1713.105616][T29364] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 1713.454727][T29364] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1713.494813][T29364] 8021q: adding VLAN 0 to HW filter on device team0 [ 1713.543722][ T2962] bridge0: port 1(bridge_slave_0) entered blocking state [ 1713.550998][ T2962] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1713.576280][ T2962] bridge0: port 2(bridge_slave_1) entered blocking state [ 1713.583556][ T2962] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1714.140515][ T27] audit: type=1804 audit(1785837431.832:443): pid=29526 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.7428" name="bus" dev="ramfs" ino=86434 res=1 errno=0 [ 1714.232710][ T27] audit: type=1804 audit(1785837431.841:444): pid=29526 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.7428" name="bus" dev="ramfs" ino=86434 res=1 errno=0 [ 1714.562936][T29364] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1716.187622][T28196] Bluetooth: hci5: unexpected event for opcode 0x2041 [ 1716.889497][T29364] veth0_vlan: entered promiscuous mode [ 1716.963596][T29364] veth1_vlan: entered promiscuous mode [ 1717.053555][T29364] veth0_macvtap: entered promiscuous mode [ 1717.104882][T29364] veth1_macvtap: entered promiscuous mode [ 1717.168622][T29364] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1717.220141][T29364] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1717.230038][T29364] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1717.286721][T29364] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1717.303512][T29364] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1717.317186][T29364] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1717.342132][T29364] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1717.362233][T29364] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1717.643497][T29364] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1717.856166][T29364] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1717.951860][T29364] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1718.091727][T29364] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1718.201331][T29364] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1718.313362][T29364] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1718.404359][T29364] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1718.492161][T29364] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1718.578899][T29364] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1718.704590][T29364] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1718.716672][T29364] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1718.726101][T29364] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1718.734936][T29364] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1718.744423][T29364] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1720.694717][T15059] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1720.984877][T15059] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1721.411236][ T34] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1721.463357][ T34] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1722.143983][ T27] audit: type=1804 audit(1785837439.227:445): pid=29594 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.7437" name="bus" dev="ramfs" ino=86671 res=1 errno=0 [ 1722.568685][T28196] Bluetooth: hci5: unexpected event for opcode 0x2041 [ 1722.757178][T29604] loop8: detected capacity change from 0 to 1024 [ 1723.396359][T29604] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1723.543639][ T1292] ieee802154 phy0 wpan0: encryption failed: -22 [ 1723.557955][ T1292] ieee802154 phy1 wpan1: encryption failed: -22 [ 1723.699945][T29364] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1724.139134][ T27] audit: type=1804 audit(1785837441.212:446): pid=29616 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.8.7439" name="bus" dev="ramfs" ino=86697 res=1 errno=0 [ 1724.204834][T29616] loop8: detected capacity change from 0 to 256 [ 1724.380116][ T27] audit: type=1804 audit(1785837441.243:447): pid=29616 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.7439" name="bus" dev="ramfs" ino=86697 res=1 errno=0 [ 1724.462614][T29407] I/O error, dev loop8, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1727.500815][ T27] audit: type=1804 audit(1785837444.534:448): pid=29662 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.7448" name="bus" dev="ramfs" ino=86745 res=1 errno=0 [ 1727.525773][T29662] loop4: detected capacity change from 0 to 256 [ 1727.668352][ T27] audit: type=1804 audit(1785837444.534:449): pid=29662 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.7448" name="bus" dev="ramfs" ino=86745 res=1 errno=0 [ 1727.798180][T29407] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 1730.027188][T29693] loop4: detected capacity change from 0 to 256 [ 1732.157757][T28018] svc: failed to register nfsdv3 RPC service (errno 512). [ 1732.175508][T28018] svc: failed to register nfsaclv3 RPC service (errno 512). [ 1732.672950][ T27] audit: type=1804 audit(1785837449.417:450): pid=29718 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.7457" name="bus" dev="ramfs" ino=86828 res=1 errno=0 [ 1732.752834][T29718] loop4: detected capacity change from 0 to 256 [ 1732.827233][ T27] audit: type=1804 audit(1785837449.454:451): pid=29718 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.7457" name="bus" dev="ramfs" ino=86828 res=1 errno=0 [ 1736.043580][T27817] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 1736.054154][T27817] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 1736.064237][T27817] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 1736.090810][T27817] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 1736.102372][T27817] Bluetooth: hci7: unexpected cc 0x0c25 length: 249 > 3 [ 1736.112003][T27817] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 1736.810541][T29756] chnl_net:caif_netlink_parms(): no params data found [ 1737.315231][ T49] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1737.736449][ T49] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1737.805465][T29756] bridge0: port 1(bridge_slave_0) entered blocking state [ 1737.834885][T29756] bridge0: port 1(bridge_slave_0) entered disabled state [ 1737.862608][T29756] bridge_slave_0: entered allmulticast mode [ 1737.870389][T29756] bridge_slave_0: entered promiscuous mode [ 1737.885303][T29756] bridge0: port 2(bridge_slave_1) entered blocking state [ 1737.892637][T29756] bridge0: port 2(bridge_slave_1) entered disabled state [ 1737.900097][T29756] bridge_slave_1: entered allmulticast mode [ 1737.908698][T29756] bridge_slave_1: entered promiscuous mode [ 1738.042329][T29756] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1738.126478][T29756] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1738.157207][ T49] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1738.347645][T27817] Bluetooth: hci7: command tx timeout [ 1739.060545][ T49] netdevsim netdevsim2 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1739.789695][T29756] team0: Port device team_slave_0 added [ 1739.826867][T29756] team0: Port device team_slave_1 added [ 1739.908768][T29756] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1739.927063][T29756] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1740.202345][T29756] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1740.244513][T29756] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1740.252347][T29756] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1740.297817][T29756] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1740.573709][T28196] Bluetooth: hci7: command tx timeout [ 1742.826410][T28196] Bluetooth: hci7: command tx timeout [ 1744.298492][T29756] hsr_slave_0: entered promiscuous mode [ 1744.371105][T29756] hsr_slave_1: entered promiscuous mode [ 1744.414321][T29756] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1744.452693][T29756] Cannot create hsr debugfs directory [ 1745.077232][T28196] Bluetooth: hci7: command tx timeout [ 1747.427108][ T27] audit: type=1804 audit(1785837463.069:452): pid=29849 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.7482" name="bus" dev="ramfs" ino=88163 res=1 errno=0 [ 1747.464771][T29849] loop4: detected capacity change from 0 to 256 [ 1747.534539][ T27] audit: type=1804 audit(1785837463.069:453): pid=29849 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.7482" name="bus" dev="ramfs" ino=88163 res=1 errno=0 [ 1747.800780][ T27] audit: type=1804 audit(1785837463.420:454): pid=29860 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.8.7483" name="bus" dev="ramfs" ino=87136 res=1 errno=0 [ 1747.892866][T29860] loop8: detected capacity change from 0 to 256 [ 1747.925238][ T27] audit: type=1804 audit(1785837463.439:455): pid=29860 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.7483" name="bus" dev="ramfs" ino=87136 res=1 errno=0 [ 1748.653256][ T27] audit: type=1804 audit(1785837464.214:456): pid=29874 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.8.7487" name="bus" dev="ramfs" ino=87152 res=1 errno=0 [ 1748.680191][T29874] loop8: detected capacity change from 0 to 256 [ 1748.717226][ T27] audit: type=1804 audit(1785837464.233:457): pid=29874 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.7487" name="bus" dev="ramfs" ino=87152 res=1 errno=0 [ 1749.032452][ T27] audit: type=1804 audit(1785837464.556:458): pid=29884 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.7488" name="bus" dev="ramfs" ino=88264 res=1 errno=0 [ 1749.060882][T29884] loop4: detected capacity change from 0 to 256 [ 1749.094634][ T27] audit: type=1804 audit(1785837464.584:459): pid=29884 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.7488" name="bus" dev="ramfs" ino=88264 res=1 errno=0 [ 1751.967403][ T27] audit: type=1804 audit(1785837467.243:460): pid=29908 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.7492" name="bus" dev="ramfs" ino=88447 res=1 errno=0 [ 1752.055470][ T27] audit: type=1804 audit(1785837467.252:461): pid=29908 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.7492" name="bus" dev="ramfs" ino=88447 res=1 errno=0 [ 1752.144571][T29756] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1752.185283][T29756] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1752.214361][T29756] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1752.343151][ T49] hsr_slave_0: left promiscuous mode [ 1752.376445][ T49] hsr_slave_1: left promiscuous mode [ 1752.427694][ T49] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1752.441814][ T49] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1752.466790][ T49] bridge_slave_1: left promiscuous mode [ 1752.473219][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 1752.500201][ T49] bridge_slave_0: left allmulticast mode [ 1752.506232][ T49] bridge_slave_0: left promiscuous mode [ 1752.512018][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 1756.819502][ T49] bond12 (unregistering): Released all slaves [ 1758.600360][ T49] bond11 (unregistering): Released all slaves [ 1759.604540][ T49] bond10 (unregistering): Released all slaves [ 1760.755041][ T49] bond9 (unregistering): Released all slaves [ 1761.460790][ T49] bond8 (unregistering): Released all slaves [ 1763.428794][ T49] bond7 (unregistering): Released all slaves [ 1764.204917][ T27] audit: type=1804 audit(1785837478.552:462): pid=29979 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.7506" name="bus" dev="ramfs" ino=88476 res=1 errno=0 [ 1764.290924][ T27] audit: type=1804 audit(1785837478.589:463): pid=29979 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.7506" name="bus" dev="ramfs" ino=88476 res=1 errno=0 [ 1764.976126][ T49] bond6 (unregistering): Released all slaves [ 1765.616281][ T49] bond5 (unregistering): Released all slaves [ 1765.995768][ T49] bond4 (unregistering): Released all slaves [ 1766.330361][ T49] bond3 (unregistering): Released all slaves [ 1766.649267][ T49] bond2 (unregistering): Released all slaves [ 1767.052026][ T49] bond1 (unregistering): Released all slaves [ 1768.348277][ T49] team0 (unregistering): Port device team_slave_1 removed [ 1768.443541][ T49] team0 (unregistering): Port device team_slave_0 removed [ 1768.532832][ T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1768.625013][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1769.311927][ T49] bond0 (unregistering): Released all slaves [ 1769.465408][T29756] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1769.880947][ T27] audit: type=1804 audit(1785837483.814:464): pid=29995 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.7510" name="bus" dev="ramfs" ino=88513 res=1 errno=0 [ 1770.011070][ T27] audit: type=1804 audit(1785837483.842:465): pid=29995 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.7510" name="bus" dev="ramfs" ino=88513 res=1 errno=0 [ 1770.170552][T29756] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1770.253242][T29756] 8021q: adding VLAN 0 to HW filter on device team0 [ 1770.355370][ T2962] bridge0: port 1(bridge_slave_0) entered blocking state [ 1770.362715][ T2962] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1770.393142][ T2962] bridge0: port 2(bridge_slave_1) entered blocking state [ 1770.400442][ T2962] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1772.620663][ T27] audit: type=1804 audit(1785837486.325:466): pid=30023 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.8.7513" name="bus" dev="ramfs" ino=87466 res=1 errno=0 [ 1772.674243][T30023] loop8: detected capacity change from 0 to 256 [ 1772.739842][ T27] audit: type=1804 audit(1785837486.344:467): pid=30023 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.7513" name="bus" dev="ramfs" ino=87466 res=1 errno=0 [ 1772.774901][ T49] IPVS: stop unused estimator thread 0... [ 1772.807358][T29756] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1772.978704][ T29] INFO: task syz.6.7173:28551 blocked for more than 143 seconds. [ 1772.986527][ T29] Not tainted syzkaller #0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1773.111295][ T29] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1773.153432][ T29] task:syz.6.7173 state:D stack:27528 pid:28551 ppid:28194 flags:0x00004004 [ 1773.209148][ T29] Call Trace: [ 1773.221464][ T29] [ 1773.263302][ T29] __schedule+0x15ae/0x4660 [ 1773.338941][ T29] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1773.381021][ T29] ? asan.module_dtor+0x20/0x20 [ 1773.400262][ T29] ? __mutex_lock+0x66e/0xc80 [ 1773.428041][ T29] ? __mutex_trylock_common+0x8a/0x270 [ 1773.449700][ T29] ? trace_raw_output_contention_end+0xd0/0xd0 [ 1773.543821][ T29] schedule+0xbd/0x170 [ 1773.548030][ T29] schedule_preempt_disabled+0x13/0x20 [ 1773.595502][ T29] __mutex_lock+0x673/0xc80 [ 1773.600122][ T29] ? verify_lock_unused+0x140/0x140 [ 1773.605399][ T29] ? __mutex_lock+0x4d2/0xc80 [ 1773.638616][ T29] ? nfsd4_write_time+0xae/0x740 [ 1773.662007][ T29] ? mutex_lock_nested+0x20/0x20 [ 1773.669662][ T29] nfsd4_write_time+0xae/0x740 [ 1773.703572][ T29] ? svc_get+0x80/0x80 [ 1773.714466][ T29] ? net_generic+0x1e/0x240 [ 1773.719066][ T29] ? net_generic+0x1e/0x240 [ 1773.723624][ T29] ? net_generic+0x1f4/0x240 [ 1773.779618][ T29] ? write_gracetime+0x8d/0xb0 [ 1773.784511][ T29] nfsctl_transaction_write+0x10c/0x150 [ 1773.822844][ T29] ? nfsctl_transaction_read+0x1b0/0x1b0 [ 1773.828595][ T29] vfs_write+0x299/0x9a0 [ 1773.869307][ T29] ? file_end_write+0x250/0x250 [ 1773.874306][ T29] ? __fget_files+0x28/0x460 [ 1773.907443][ T29] ? __fget_files+0x3fc/0x460 [ 1773.912825][ T29] ? __fdget_pos+0x2a3/0x330 [ 1773.917497][ T29] ? ksys_write+0x74/0x260 [ 1773.952674][ T29] ksys_write+0x151/0x260 [ 1773.957135][ T29] ? __ia32_sys_read+0x90/0x90 [ 1773.985195][ T29] ? lockdep_hardirqs_on+0x98/0x150 [ 1773.990601][ T29] do_syscall_64+0x55/0xb0 [ 1774.039449][ T29] ? clear_bhb_loop+0x40/0x90 [ 1774.044241][ T29] ? clear_bhb_loop+0x40/0x90 [ 1774.048984][ T29] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1774.093756][ T29] RIP: 0033:0x7f3369b9e019 [ 1774.098234][ T29] RSP: 002b:00007f336aadb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1774.173792][ T29] RAX: ffffffffffffffda RBX: 00007f3369e25fa0 RCX: 00007f3369b9e019 [ 1774.183370][ T29] RDX: 0000000000000003 RSI: 0000200000000470 RDI: 0000000000000003 [ 1774.226146][ T29] RBP: 00007f3369c3500c R08: 0000000000000000 R09: 0000000000000000 [ 1774.251638][ T29] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1774.281184][ T29] R13: 00007f3369e26038 R14: 00007f3369e25fa0 R15: 00007ffe6a5bf5c8 [ 1774.304374][ T29] [ 1774.338034][ T29] [ 1774.338034][ T29] Showing all locks held in the system: [ 1774.367426][ T29] 1 lock held by khungtaskd/29: [ 1774.372365][ T29] #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 [ 1774.418596][ T29] 3 locks held by kworker/u4:3/49: [ 1774.423829][ T29] #0: ffff88801a25d138 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 1774.483571][ T29] #1: ffffc90000b9fd00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 1774.546644][ T29] #2: ffffffff8d137640 (rcu_state.barrier_mutex){+.+.}-{3:3}, at: rcu_barrier+0x4c/0x530 [ 1774.602607][ T29] 2 locks held by getty/5535: [ 1774.607380][ T29] #0: ffff888031b520a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1774.635757][ T29] #1: ffffc9000325e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 [ 1774.675874][ T29] 3 locks held by kworker/1:4/5844: [ 1774.700479][ T29] #0: ffff8880b8e3c298 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x9c/0x130 [ 1774.732687][ T29] #1: ffff8880b8f28a00 (psi_seq){-.-.}-{0:0}, at: __schedule+0x21d3/0x4660 [ 1774.754294][ T29] #2: ffff8880b8f295d8 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x123/0x270 [ 1774.763748][ T29] 2 locks held by kworker/1:5/6525: [ 1774.819235][ T29] #0: ffff888017c72d38 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 1774.862517][ T29] #1: ffffc9000fd4fd00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 1774.895358][ T29] 3 locks held by syz.5.7033/28018: [ 1774.900655][ T29] #0: ffff888069fea0c8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 [ 1774.928174][ T29] #1: ffff88802faec418 (sb_writers#32){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 [ 1774.937327][ T29] #2: ffffffff8d3e1728 (nfsd_mutex){+.+.}-{3:3}, at: nfsd_svc+0x65/0xab0 [ 1775.014520][ T29] 3 locks held by kworker/1:1/28296: [ 1775.019913][ T29] #0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 1775.077716][ T29] #1: ffffc9000336fd00 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 1775.137531][ T29] #2: ffffffff8d137778 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x306/0x880 [ 1775.186432][ T29] 2 locks held by kworker/0:2/28432: [ 1775.193236][ T29] #0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 [ 1775.241727][ T29] #1: ffff8880b8e28a00 (psi_seq){-.-.}-{0:0}, at: __schedule+0x21d3/0x4660 [ 1775.250584][ T29] 3 locks held by syz.6.7173/28551: [ 1775.285002][ T29] #0: ffff88804e564ac8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 [ 1775.294370][ T29] #1: ffff8880612a4418 (sb_writers#32){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 [ 1775.317454][ T29] #2: ffffffff8d3e1728 (nfsd_mutex){+.+.}-{3:3}, at: nfsd4_write_time+0xae/0x740 [ 1775.366027][ T29] 4 locks held by syz-executor/29756: [ 1775.371516][ T29] #0: ffff88804fc30e70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x212/0x500 [ 1775.403425][ T29] #1: ffff88804fc300b8 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x552/0x1130 [ 1775.447575][ T29] #2: ffffffff8e543f48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0x99/0x220 [ 1775.479603][ T29] #3: ffff8880636e6338 (&conn->lock#2){+.+.}-{3:3}, at: l2cap_conn_del+0x7b/0x630 [ 1775.508385][ T29] 3 locks held by syz.8.7513/30022: [ 1775.515171][ T29] #0: ffff88803b704e70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x212/0x500 [ 1775.532528][ T29] #1: ffff88803b7040b8 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x552/0x1130 [ 1775.566781][ T29] #2: ffffffff8e543f48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0x99/0x220 [ 1775.609937][ T29] 1 lock held by rm/30044: [ 1775.614567][ T29] [ 1775.616938][ T29] ============================================= [ 1775.616938][ T29] [ 1775.693488][ T29] NMI backtrace for cpu 0 [ 1775.697903][ T29] CPU: 0 PID: 29 Comm: khungtaskd Not tainted syzkaller #0 [ 1775.705129][ T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1775.715227][ T29] Call Trace: [ 1775.718548][ T29] [ 1775.721512][ T29] dump_stack_lvl+0x18c/0x250 [ 1775.726223][ T29] ? __wake_up_klogd+0xd9/0x100 [ 1775.731106][ T29] ? show_regs_print_info+0x20/0x20 [ 1775.736363][ T29] ? load_image+0x420/0x420 [ 1775.740920][ T29] nmi_cpu_backtrace+0x3a6/0x3e0 [ 1775.745901][ T29] ? nmi_trigger_cpumask_backtrace+0x2f0/0x2f0 [ 1775.752112][ T29] ? load_image+0x420/0x420 [ 1775.756666][ T29] ? wq_watchdog_touch+0xef/0x170 [ 1775.761750][ T29] ? arch_trigger_cpumask_backtrace+0x10/0x10 [ 1775.767878][ T29] nmi_trigger_cpumask_backtrace+0x17a/0x2f0 [ 1775.773902][ T29] watchdog+0xf59/0xfa0 [ 1775.778133][ T29] ? watchdog+0x1e1/0xfa0 [ 1775.782506][ T29] kthread+0x2fa/0x390 [ 1775.786611][ T29] ? hungtask_pm_notify+0x50/0x50 [ 1775.791674][ T29] ? kthread_blkcg+0xd0/0xd0 [ 1775.796295][ T29] ret_from_fork+0x48/0x80 [ 1775.800740][ T29] ? kthread_blkcg+0xd0/0xd0 [ 1775.805369][ T29] ret_from_fork_asm+0x11/0x20 [ 1775.810183][ T29] [ 1775.814341][ T29] Sending NMI from CPU 0 to CPUs 1: [ 1775.819733][ C1] NMI backtrace for cpu 1 [ 1775.819744][ C1] CPU: 1 PID: 6654 Comm: kworker/1:6 Not tainted syzkaller #0 [ 1775.819761][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1775.819773][ C1] Workqueue: events_power_efficient wg_ratelimiter_gc_entries [ 1775.819832][ C1] RIP: 0010:kasan_check_range+0x12/0x290 [ 1775.819857][ C1] Code: 0f 0b b8 ea ff ff ff c3 0f 0b b8 ea ff ff ff c3 cc cc cc cc cc cc cc cc 66 0f 1f 00 b0 01 48 85 f6 0f 84 b4 01 00 00 55 41 57 <41> 56 41 55 41 54 53 4c 8d 04 37 49 39 f8 0f 82 13 02 00 00 49 89 [ 1775.819936][ C1] RSP: 0018:ffffc900038e7788 EFLAGS: 00000002 [ 1775.819950][ C1] RAX: 0000000000000001 RBX: 000000000000070e RCX: ffffffff81689802 [ 1775.819962][ C1] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff911eb5e0 [ 1775.819973][ C1] RBP: ffffc900038e79e8 R08: dffffc0000000000 R09: 1ffffffff223d6bc [ 1775.819986][ C1] R10: dffffc0000000000 R11: fffffbfff223d6bd R12: 0000000000000000 [ 1775.819997][ C1] R13: ffff888074503c00 R14: ffffffff90baee50 R15: ffff888074504750 [ 1775.820011][ C1] FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 1775.820025][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1775.820036][ C1] CR2: 00007fa945be2286 CR3: 000000000cf32000 CR4: 00000000003506e0 [ 1775.820051][ C1] Call Trace: [ 1775.820059][ C1] [ 1775.820066][ C1] __lock_acquire+0xd92/0x7d80 [ 1775.820100][ C1] ? verify_lock_unused+0x140/0x140 [ 1775.820123][ C1] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1775.820145][ C1] ? asan.module_dtor+0x20/0x20 [ 1775.820165][ C1] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1775.820189][ C1] lock_acquire+0x19e/0x420 [ 1775.820207][ C1] ? wg_ratelimiter_gc_entries+0x5d/0x450 [ 1775.820232][ C1] ? read_lock_is_recursive+0x20/0x20 [ 1775.820252][ C1] ? __lock_acquire+0x7d80/0x7d80 [ 1775.820271][ C1] ? __rwlock_init+0x150/0x150 [ 1775.820297][ C1] _raw_spin_lock+0x2e/0x40 [ 1775.820322][ C1] ? wg_ratelimiter_gc_entries+0x5d/0x450 [ 1775.820341][ C1] wg_ratelimiter_gc_entries+0x5d/0x450 [ 1775.820362][ C1] ? process_scheduled_works+0x975/0x1600 [ 1775.820386][ C1] process_scheduled_works+0xa60/0x1600 [ 1775.820420][ C1] ? worker_attach_to_pool+0x370/0x370 [ 1775.820446][ C1] ? assign_work+0x3cc/0x5d0 [ 1775.820469][ C1] worker_thread+0xa5e/0xfe0 [ 1775.820496][ C1] ? _raw_spin_unlock+0x40/0x40 [ 1775.820520][ C1] ? __kthread_parkme+0x71/0x1c0 [ 1775.820541][ C1] kthread+0x2fa/0x390 [ 1775.820557][ C1] ? pr_cont_work+0x550/0x550 [ 1775.820578][ C1] ? kthread_blkcg+0xd0/0xd0 [ 1775.820595][ C1] ret_from_fork+0x48/0x80 [ 1775.820616][ C1] ? kthread_blkcg+0xd0/0xd0 [ 1775.820633][ C1] ret_from_fork_asm+0x11/0x20 [ 1775.820663][ C1] [ 1776.141036][ T29] Kernel panic - not syncing: hung_task: blocked tasks [ 1776.147972][ T29] CPU: 1 PID: 29 Comm: khungtaskd Not tainted syzkaller #0 [ 1776.155177][ T29] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1776.165261][ T29] Call Trace: [ 1776.168563][ T29] [ 1776.171520][ T29] dump_stack_lvl+0x18c/0x250 [ 1776.176219][ T29] ? show_regs_print_info+0x20/0x20 [ 1776.181427][ T29] ? load_image+0x420/0x420 [ 1776.185953][ T29] panic+0x2ca/0x720 [ 1776.189880][ T29] ? bpf_jit_dump+0xd0/0xd0 [ 1776.194441][ T29] ? __irq_work_queue_local+0x13a/0x3b0 [ 1776.200034][ T29] ? preempt_schedule_thunk+0x1a/0x30 [ 1776.205422][ T29] ? nmi_trigger_cpumask_backtrace+0x2a4/0x2f0 [ 1776.211612][ T29] watchdog+0xf98/0xfa0 [ 1776.215789][ T29] ? watchdog+0x1e1/0xfa0 [ 1776.220177][ T29] kthread+0x2fa/0x390 [ 1776.224282][ T29] ? hungtask_pm_notify+0x50/0x50 [ 1776.229358][ T29] ? kthread_blkcg+0xd0/0xd0 [ 1776.233970][ T29] ret_from_fork+0x48/0x80 [ 1776.238425][ T29] ? kthread_blkcg+0xd0/0xd0 [ 1776.243026][ T29] ret_from_fork_asm+0x11/0x20 [ 1776.247812][ T29] [ 1776.251432][ T29] Kernel Offset: disabled [ 1776.255780][ T29] Rebooting in 86400 seconds..