last executing test programs: 21.076695072s ago: executing program 2 (id=1017): setuid(0xee01) r0 = io_uring_setup(0x66a5, &(0x7f0000000100)={0x0, 0xbfb7, 0x800, 0x1, 0x87}) r1 = eventfd2(0x0, 0x0) io_uring_register$IORING_REGISTER_EVENTFD(r0, 0x4, &(0x7f0000000000)=r1, 0x1) io_uring_register$IORING_REGISTER_BUFFERS2(r0, 0xf, &(0x7f0000001580)={0x1, 0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000180)=""/118, 0x76}], &(0x7f0000001540)=[0xfffffffffffffffc]}, 0x20) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r0, 0x10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001a80)=[{0x0}], 0x0, 0x1}, 0x20) 21.032656956s ago: executing program 2 (id=1018): setresuid(0xee00, 0xee00, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0) 21.032376956s ago: executing program 2 (id=1019): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x1}) r1 = socket$unix(0x1, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller1\x00', 0x0}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x1}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x30, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x88, 0x2c, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0xb, 0x7}, {0x3, 0xffff}, {0x300}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_ct={0x4c, 0x1, 0x0, 0x0, {{0x7}, {0x24, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x20000000, 0x0, 0xfffffffe}}, @TCA_CT_ACTION={0x6, 0x3, 0x19}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x88}}, 0x20000000) write(r0, &(0x7f0000000140)="000008004500001c123400004011e5c8ac141401ac14140204d204d200080008", 0x20) 20.971708118s ago: executing program 2 (id=1020): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000140)='./file0/../file0\x00', 0x0, 0x950d3, 0x0) mount$bind(&(0x7f0000000180)='./file0\x00', &(0x7f0000000040)='./file0/../file0\x00', 0x0, 0x11050ca, 0x0) 20.950880029s ago: executing program 2 (id=1021): socket$inet6_tcp(0xa, 0x1, 0x0) syz_usb_connect$uac1(0x2, 0x72, &(0x7f0000000140)={{0x12, 0x1, 0x10, 0x0, 0x0, 0x0, 0x20, 0x1a86, 0x752d, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x60, 0x3, 0x1, 0x0, 0x50, 0x81, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x0, 0xa}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x210, 0xc, 0x7, 0x77, {0x7, 0x25, 0x1, 0x0, 0x8, 0x3}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x20, 0x6, 0x2, 0xfd, {0x7, 0x25, 0x1, 0x4, 0x2, 0x687b}}}}}}}}]}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@local, @empty, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "a24b9f", 0x8, 0x11, 0x0, @remote, @local, {[], {0x0, 0x4e22, 0x8}}}}}}, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000240)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x0) truncate(&(0x7f0000000180)='./file0\x00', 0x8fff5) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x20, 0x10012, r0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x3) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r2, 0x3e8, 0xe80, 0x0, &(0x7f0000000000)="c1df07000000d30a298ee68886dd87", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 20.532541997s ago: executing program 2 (id=1027): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="630000004ec6"}) 20.525461844s ago: executing program 32 (id=1027): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="630000004ec6"}) 19.53216441s ago: executing program 1 (id=1046): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts(aes)\x00'}, 0x58) accept4$alg(r0, 0x0, 0x0, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x8, 0x4, 0x8b, 0xfffa}, 0x1d, [0x7ffe, 0xc95a, 0x1, 0x9, 0x80, 0x2, 0x3, 0x7f, 0x6, 0x4d, 0x9, 0x5f, 0x9, 0x5, 0xffff2d37, 0xfdffff01, 0x6, 0x3, 0x0, 0x6, 0x4, 0x8, 0x4, 0x3c5b, 0x1, 0x3, 0x9, 0x1, 0x1f461e2c, 0x0, 0xe660, 0x4, 0x7, 0x101, 0x7fff, 0x1, 0x80000000, 0x4, 0x3, 0xe, 0xfffffffb, 0x71, 0xfffffff8, 0x7, 0x0, 0x0, 0x4, 0x80003e, 0x8f, 0x6, 0x10000006, 0x0, 0x5, 0x4, 0x8, 0x0, 0x2, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x1, 0xffff, 0x134, 0x7ffe, 0x9, 0xfffffff3, 0x129432e6, 0xcb, 0x6, 0xd, 0x2bf, 0x6c9, 0x9, 0x6, 0x3, 0x0, 0x7, 0x5, 0x0, 0xe, 0x312, 0x74, 0xea4, 0x0, 0x3, 0x4, 0x8000, 0x3, 0x400, 0x5, 0x6, 0x7, 0xff, 0x5, 0x5, 0x5f31, 0x4, 0x0, 0x2, 0x100002, 0xa, 0x4, 0x9, 0x8, 0x800, 0x6, 0x7, 0x8002, 0x1, 0xfe000000, 0xff7f, 0x2, 0x7f, 0x9, 0x2, 0xffffffff, 0x9, 0x1, 0x7, 0x80000003, 0x9, 0x48c93690, 0x42, 0x7], [0x400, 0x4, 0x0, 0x7, 0xfffffffe, 0xfffff76b, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x83, 0x80000003, 0x200009, 0x100003e7, 0x9, 0x5, 0x3, 0x2, 0xf38, 0x7, 0x4, 0x6d01, 0x5, 0x38, 0x800003, 0x200, 0x80, 0xf, 0xd, 0x2950bfaf, 0x1000, 0xa2, 0x8, 0x53cf697b, 0x4, 0x6, 0xac8, 0x7, 0x2, 0x3, 0x81, 0xfffffffc, 0x2, 0x2, 0xffff, 0x0, 0x1a, 0x1c, 0x120000, 0x3, 0x8, 0x8aaed, 0x4, 0x65], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0x20000ce7, 0x1ff, 0x2, 0x4, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7ffe, 0x80000000, 0x200a620, 0x2, 0xc, 0x1, 0x4, 0x14c, 0x60a7, 0xe, 0x6, 0xffffffff, 0x7ff, 0x5, 0x8, 0x5, 0xee1, 0xfffff000, 0x80ffff, 0x10, 0x7f, 0x104, 0x9606, 0x4, 0x2, 0x4, 0x8006, 0x1, 0x0, 0x4, 0x8, 0x30b1d693, 0xa1f, 0x8, 0x7, 0x1, 0x6c1b, 0x2, 0x4, 0xb0b2748, 0x1, 0x1, 0x200, 0xffbf2441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) 19.422016965s ago: executing program 1 (id=1047): r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r0, &(0x7f0000000540)=""/99, 0x63) write$char_usb(r0, 0x0, 0x0) read$char_usb(r0, &(0x7f0000000780)=""/131, 0x83) 19.369150502s ago: executing program 1 (id=1050): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x2, &(0x7f0000000200)=0x0) io_submit(r1, 0x1, &(0x7f0000000040)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x80000000}]) io_submit(r1, 0x1, &(0x7f0000000140)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0x0, r0, 0x0}]) 19.241709241s ago: executing program 1 (id=1054): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000180)='./file0\x00', &(0x7f0000000040)='./file0/../file0\x00', 0x0, 0x11050ca, 0x0) 19.174656789s ago: executing program 1 (id=1055): socket$packet(0x11, 0x3, 0x300) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001f00)=ANY=[@ANYBLOB="20010000410007012cbd7000fddbdf25037c00000400c28008010180040110801400080000000000000000000000000000000001ec000f"], 0x120}, 0x1, 0x0, 0x0, 0x4c084}, 0xc000) 18.809615998s ago: executing program 1 (id=1060): syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$evdev(0x0, 0xe899, 0x48000) r0 = syz_usb_connect(0x5, 0x58, &(0x7f0000000080)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000bc0)={0x14, 0x0, &(0x7f0000000b00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c01}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000011c0)={0x24, 0x0, &(0x7f0000000a00)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001600)={0x24, 0x0, &(0x7f0000000d40)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000100)={0x40, 0x8, 0x8, "003cb3a4aa50323f"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000002280)={0x84, &(0x7f0000001e00)={0x20, 0x14, 0x4, "348b35e5"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000540)=""/99, 0x63) write$char_usb(r1, 0x0, 0x0) r2 = syz_usb_connect$uac1(0x2, 0x0, 0x0, 0x0) syz_usb_ep_read(r2, 0x3, 0x0, 0x0) read$char_usb(r1, &(0x7f0000000780)=""/131, 0x83) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB], 0x0}, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f00000005c0)={0x1c, 0x0, 0x0, 0x0}) 18.780690693s ago: executing program 33 (id=1060): syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$evdev(0x0, 0xe899, 0x48000) r0 = syz_usb_connect(0x5, 0x58, &(0x7f0000000080)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000bc0)={0x14, 0x0, &(0x7f0000000b00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c01}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000011c0)={0x24, 0x0, &(0x7f0000000a00)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001600)={0x24, 0x0, &(0x7f0000000d40)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000100)={0x40, 0x8, 0x8, "003cb3a4aa50323f"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000002280)={0x84, &(0x7f0000001e00)={0x20, 0x14, 0x4, "348b35e5"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, &(0x7f0000000540)=""/99, 0x63) write$char_usb(r1, 0x0, 0x0) r2 = syz_usb_connect$uac1(0x2, 0x0, 0x0, 0x0) syz_usb_ep_read(r2, 0x3, 0x0, 0x0) read$char_usb(r1, &(0x7f0000000780)=""/131, 0x83) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB], 0x0}, 0x0) syz_usb_control_io$printer(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, &(0x7f00000005c0)={0x1c, 0x0, 0x0, 0x0}) 18.736103242s ago: executing program 4 (id=1062): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x90) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003840)=@newqdisc={0x24, 0x2a, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffdfc, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0x3}, {0xb, 0x7}}}, 0x24}}, 0x4008000) write(r0, &(0x7f0000000000)='3', 0x4e) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x6080, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000100)='dctcp', 0x5) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={0x0, 0x0, 0x80}, 0x28) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) 18.679380724s ago: executing program 4 (id=1063): r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) r1 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VIDIOC_TRY_EXT_CTRLS(r1, 0xc0205649, &(0x7f0000000240)={0x0, 0x1, 0xffffffff, r0, 0x0, &(0x7f0000000140)={0x9a091c, 0x7, '\x00', @p_u32=0x0}}) 18.617967302s ago: executing program 4 (id=1064): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$UI_SET_LEDBIT(r0, 0x40045569, 0x1) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x11) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f00000002c0)={{0x548, 0x0, 0x896a}, 'syz0\x00', 0x1c}) ioctl$UI_DEV_CREATE(r0, 0x5501) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) 18.520365672s ago: executing program 4 (id=1065): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000140)='./file0/../file0\x00', 0x0, 0x950d3, 0x0) mount$bind(&(0x7f0000000180)='./file0\x00', &(0x7f0000000040)='./file0/../file0\x00', 0x0, 0x11050ca, 0x0) 18.481612003s ago: executing program 4 (id=1066): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) fsopen(&(0x7f0000000080)='autofs\x00', 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 18.07392147s ago: executing program 4 (id=1072): r0 = socket(0xa, 0x5, 0x0) close(0x3) r1 = socket(0x2, 0x80805, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f0000000300)=[@in6={0xa, 0x4e24, 0xffff, @private1, 0x3ff}]}, &(0x7f0000001280)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r1, &(0x7f0000000180)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x492492492492775, 0x0) getsockopt$inet_sctp_SCTP_ASCONF_SUPPORTED(r0, 0x84, 0x80, &(0x7f0000000200), &(0x7f0000000240)=0x8) 18.053180066s ago: executing program 34 (id=1072): r0 = socket(0xa, 0x5, 0x0) close(0x3) r1 = socket(0x2, 0x80805, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x1c, &(0x7f0000000300)=[@in6={0xa, 0x4e24, 0xffff, @private1, 0x3ff}]}, &(0x7f0000001280)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) sendmmsg$inet_sctp(r1, &(0x7f0000000180)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x492492492492775, 0x0) getsockopt$inet_sctp_SCTP_ASCONF_SUPPORTED(r0, 0x84, 0x80, &(0x7f0000000200), &(0x7f0000000240)=0x8) 12.326735365s ago: executing program 0 (id=1183): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000780)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x1011f, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) shutdown(r3, 0x7ffffffe) 11.409831763s ago: executing program 0 (id=1192): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) fsopen(0x0, 0x1) ioctl$sock_inet_SIOCSIFNETMASK(0xffffffffffffffff, 0x8922, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/bus/netdevsim/devices/netdevsim0/sriov_numvfs\x00', 0x1, 0x1) write$sysctl(r0, &(0x7f0000000000)='7\x00', 0x2) 11.409440787s ago: executing program 0 (id=1194): sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=[@rights={{0x10}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x10}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xb8}, 0x80) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = dup(r6) syz_ublk_setup_queues(r7, r5, 0x0, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe700, 0x800, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c87, 0x20, 0x3, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f70, 0x2, 0x2, 0x334}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x89a0, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) 10.433259525s ago: executing program 0 (id=1207): mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000140)='./file0/../file0\x00', 0x0, 0x950d3, 0x0) mount$bind(&(0x7f0000000180)='./file0\x00', &(0x7f0000000040)='./file0/../file0\x00', 0x0, 0x11050ca, 0x0) 10.380034889s ago: executing program 0 (id=1210): openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r0, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOW_IOVAS(0xffffffffffffffff, 0x3b82, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r1, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8) 10.029975307s ago: executing program 0 (id=1225): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000b40)=ANY=[@ANYBLOB="500000001000010400000000000000000000ffff", @ANYRES32=0x0, @ANYBLOB="00000000000000001c001280090001007866726d000000000c00028008000200ea"], 0x50}}, 0x0) 10.021402582s ago: executing program 35 (id=1225): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000b40)=ANY=[@ANYBLOB="500000001000010400000000000000000000ffff", @ANYRES32=0x0, @ANYBLOB="00000000000000001c001280090001007866726d000000000c00028008000200ea"], 0x50}}, 0x0) 5.251416381s ago: executing program 5 (id=1295): setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x24040084) r5 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000800)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0x4, 0xa}, {}, {0xffe0, 0xffe0}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x8}]}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) r7 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000280)=@getchain={0x24, 0x11, 0x839, 0x70bd27, 0x0, {0x0, 0x0, 0x0, 0x0, {0x4}, {}, {0xa}}}, 0x24}, 0x1, 0x0, 0x0, 0x4040091}, 0x0) 5.093698847s ago: executing program 5 (id=1303): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x2400, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0xe) r1 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000100)=0x1) ioctl$PPPIOCATTCHAN(r1, 0x40047457, 0x0) 5.02341591s ago: executing program 5 (id=1304): r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000200)={0xb, {'syz0\x00', 'syz0\x00', 'syz0\x00', 0x24, 0x3, 0x46d, 0xc082, 0x0, 0x0, "0600ff0901a10185107508950609018102090191028511750895130901810209019102c0"}}, 0x13c) write$UHID_INPUT2(r0, &(0x7f0000000340)={0xc, {0x6, "10ff00010200"}}, 0xc) 5.022315528s ago: executing program 5 (id=1307): r0 = syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000180)='./bus\x00', 0xe, &(0x7f0000000200)={[{@barrier_val={'barrier', 0x3d, 0x101}}, {@errors_remount}]}, 0x1, 0x445, &(0x7f0000000b00)="$eJzs28+PE1UcAPDvTLeLCLgr4g9+qKto3PhjlwVUDh7UaOIBExM96HGzuxCksIZdEyFEwRg8GWPi3Xj0X/CkF2M8mXjVuyEhhgvgqWbaGbYtbdktLUX6+SQD78282fe+nXnte/PaAEbWVPZPErE1Iv6MiIl6trnAVP2/q5fPLly7fHYhiWr13X+SWrkrl88uFEWL87bkmek0Iv0iid1t6l05feb4fKWydCrPz66e+Gh25fSZF46dmD+6dHTp5P5Dhw4emHv5pf0v9iXOrE1Xdn26vGfnWx988/bhr5rib4mjT6a6HXy6Wu1zdcO1rSGdjA2xIWxIKSKyy1Wu9f+JKMXaxZuINz8fauOAgapWq9UtnQ+fqwJ3sSSa87o8jIrigz6b/xZb6yDg1cENP4bu0mv1CVAW99V8qx8ZizQvU26Z3/bTVES8f+7f77ItBvMcAgCgyU/Z+Of5duO/NB5qKHdfvjY0GRH3R8T2iHggInZExIMRtbIPR8QjG6y/dZHkxvFPerGnwNYpG/+9kq9tNY//itFfTJby3LZa/OXkyLHK0r78NZmO8qYsP9eljp/f+OPrTscax3/ZltVfjAXzdlwc29R8zuL86vytxNzo0vmIXWPt4k+urwQkEbEzInb1WMexZ3/Y0+nYzePvog/rTNXvI56pX/9z0RJ/Iem+Pjl7T1SW9s0Wd8WNfvv9wjud6r+l+Psgu/73tr3/r8c/mTSu165svI4Lf33ZcU7T6/0/nrxXS4/n+z6ZX109NRcxnhyuN7px//61c4t8UT6Lf3pv+/6/PdZeid0Rkd3Ej0bEYxHxeN72JyLiyYjY2yX+X19/6sPe4x+sLP7FDV3/tcR4tO5pnygd/+XHpkonb4j/Wvfrf7CWms73rOf9bz3t6u1uBgAAgP+fNCK2RpLOXE+n6cxM/fvyOyLSyvLK6nNHlj8+uVj/jcBklNPiSddEw/PQuXxaX8+fj4j6VwuK4wfy58bfljbX8jMLy5XFYQcPI25Lh/6f+bs07NYBA+f3WjC69H8YXfo/jC79H0ZXm/6/eRjtAG6/dp//nw2hHcDt19L/LfvBCDH/h9Gl/8Po0v9hJK1sjpv/SL5rovhLPZ5+1yaifEc0Y2CJSO+IZkgMKDHc9yUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB++S8AAP///fHg0g==") syz_mount_image$vfat(&(0x7f0000000100), &(0x7f00000003c0)='./bus\x00', 0x826850, 0x0, 0x1, 0x0, &(0x7f0000000100)) unlinkat(r0, &(0x7f0000000380)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000280)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) 4.94976905s ago: executing program 5 (id=1310): r0 = socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000480)=[@in6={0xa, 0x4e20, 0x6, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0x7}]}, &(0x7f0000000080)=0x10) r2 = socket$inet_sctp(0x2, 0x1, 0x84) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) getsockopt$inet_sctp_SCTP_MAX_BURST(r2, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000040)={r3}, &(0x7f0000000100)=0x8) 4.637984244s ago: executing program 5 (id=1326): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) openat$tcp_mem(0xffffffffffffff9c, 0x0, 0x1, 0x0) r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, 0x0, 0x0) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @loopback}, 0x0, {[0x4, 0x0, 0x0, 0xfffffffc, 0x9]}}, 0x5c) 4.591568445s ago: executing program 36 (id=1326): mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) openat$tcp_mem(0xffffffffffffff9c, 0x0, 0x1, 0x0) r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, 0x0, 0x0) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @loopback}, 0x0, {[0x4, 0x0, 0x0, 0xfffffffc, 0x9]}}, 0x5c) 3.293911188s ago: executing program 8 (id=1336): mknodat$loop(0xffffffffffffff9c, 0x0, 0x1004, 0x1) openat$fuse(0xffffffffffffff9c, &(0x7f0000001180), 0x2, 0x0) read(0xffffffffffffffff, 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'hmac(sha1)\x00'}, 0x58) openat$procfs(0xffffffffffffff9c, &(0x7f0000004280)='/proc/partitions\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1279000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = accept$alg(r0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) accept(r4, 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, 0xffffffffffffffff, 0x0) 2.434371858s ago: executing program 8 (id=1341): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB], 0xc4}}, 0x20050890) syz_emit_vhci(&(0x7f0000000340)=ANY=[], 0x2d) r0 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$eventfd(r0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) setxattr$incfs_metadata(0x0, &(0x7f0000000180), 0x0, 0x0, 0x0) removexattr(0x0, 0x0) r1 = openat$udambuf(0xffffffffffffff9c, 0x0, 0x2) r2 = memfd_create(&(0x7f0000000040)=')$}\xc0\x00', 0x4) ioctl$UDMABUF_CREATE_LIST(r1, 0x40087543, &(0x7f0000000080)={0x0, 0x1, [{r2, 0x0, 0x8000, 0x1000000}]}) r3 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r3, 0xc008561c, &(0x7f0000000040)={0xf0f005, 0x5}) 1.605974004s ago: executing program 6 (id=1347): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c0001000600060008000000100007007f0000017f000001910040001400020010000c000c0003"], 0x48}, 0x1, 0x0, 0x0, 0x2c048040}, 0xe840) 1.603434645s ago: executing program 6 (id=1348): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000340)='./sys/module/md_mod/parameters/new_array\x00', &(0x7f0000000500)='rpc_pipefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./sys/module/md_mod/parameters/new_array\x00', 0x1, 0x0) write(r0, &(0x7f0000000200)='md0', 0x3) openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/md0\x00', 0x2, 0x0) ioctl(0xffffffffffffffff, 0x40140921, &(0x7f0000000420)="0100000001000000010000000100000006") setns(0xc9, 0x0) pivot_root(0x0, &(0x7f0000000240)='./dev\x00') r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x80, 0x0) close(r1) r2 = socket$inet6(0xa, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_NODELAY(r2, 0x84, 0x3, 0x0, &(0x7f0000000540)) r3 = openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETOFFLOAD(r3, 0xc004743e, 0x110e22fff6) ioctl$TUNATTACHFILTER(0xffffffffffffffff, 0x401054d5, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x6}]}) ioctl$TUNGETVNETLE(r1, 0x40107446, &(0x7f0000000180)) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r4, 0x4004743d, 0x110e22fff6) write$cgroup_type(r4, &(0x7f0000000280), 0x9) setsockopt$bt_BT_CHANNEL_POLICY(r1, 0x112, 0xa, &(0x7f00000004c0)=0x1, 0x4) r5 = socket$rxrpc(0x21, 0x2, 0x2) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x4, &(0x7f00000001c0)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r5}}], 0x0, 0x9, 0x0, 0x0, 0x41000, 0x1c, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000002c0)={0x5, 0x4, 0x2a, 0x1}, 0x10, 0x0, 0x0, 0x8, &(0x7f0000000340), &(0x7f0000000380)=[{0x5, 0x5, 0x2, 0x1}, {0x2, 0x4, 0x8, 0x3}, {0x0, 0x1, 0x2, 0x2}, {0x4, 0x2, 0x10, 0x16}, {0x2, 0x5, 0xc, 0x7}, {0x1, 0x3, 0x6, 0x3}, {0x2, 0x4, 0x2, 0x9}, {0x4, 0x5, 0x1, 0x9}], 0x10, 0xfffffff9}, 0x94) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000006c0)={@cgroup, 0xffffffffffffffff, 0x1b, 0x4004, r6}, 0x20) r7 = socket$pppoe(0x18, 0x1, 0x0) ioctl$PPPIOCGCHAN(r7, 0x80047437, &(0x7f0000000040)) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r8, 0x40047438, &(0x7f0000000040)) bind$rxrpc(r5, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e20, @empty}}, 0x24) 1.533086804s ago: executing program 6 (id=1349): bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x10, 0x4, 0x4, 0x6, 0x0, 0xffffffffffffffff, 0xfffdfffd}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x4, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, [@call={0x85, 0x0, 0x0, 0x50}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) 1.428762578s ago: executing program 6 (id=1351): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x10}}, 0x10) socket$inet(0x2, 0x2, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) sched_setscheduler(0x0, 0x1, &(0x7f00000000c0)=0x7) prctl$PR_SET_MM(0x23, 0xa, &(0x7f00002d5000/0x2000)=nil) bpf$MAP_CREATE(0x100000000000000, 0x0, 0x48) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000140)='cdg', 0x3) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 1.428274337s ago: executing program 8 (id=1352): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="c40000001900674c2cbd70000000000000000000000000000000000000000000ac1eff0100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0100000000000000000000000000000000000020000000000000000000000000000000000000000000008000000000000000000000000000fcffffffffffffff0000000000000000b0ac0000000000000000000000000000000000000000000000040000000000"], 0xc4}}, 0x4c050) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=@newpolicy={0xb8, 0x13, 0x101, 0x0, 0x0, {{@in=@rand_addr=0x64010102, @in=@rand_addr=0x64010102, 0x100, 0xd, 0x400, 0x9, 0xa}, {0x2, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x0, 0x8}, {0x0, 0xfffffffffffffffe, 0x0, 0x100}, 0xfffffffe, 0x0, 0x0, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x20048000}, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) 1.318340869s ago: executing program 3 (id=1355): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x202, 0x40) write(r0, &(0x7f0000000000)='27', 0x2) mount$binderfs(&(0x7f0000000080), &(0x7f00000000c0)='./binderfs\x00', &(0x7f0000000100), 0x80, 0x0) 1.236496365s ago: executing program 3 (id=1357): r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r0, 0x89fa, &(0x7f0000000040)={'sit0\x00', 0x0}) 1.152503013s ago: executing program 3 (id=1359): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/pm_debug_messages', 0x20001, 0xca) io_setup(0x9, &(0x7f0000000100)) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000200)={'wlan0\x00'}) sendmsg$NL80211_CMD_GET_WIPHY(r0, 0x0, 0x8800) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/nfsd.export/channel\x00', 0x2, 0x0) write(r1, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, &(0x7f0000000240)) syz_mount_image$ext4(&(0x7f0000000140)='ext4\x00', &(0x7f0000000080)='./file0\x00', 0x0, &(0x7f0000000000), 0xfd, 0x4bf, &(0x7f0000000740)="$eJzs3M9vFFUcAPDvbLeF8sNWxB8gShWNKLGlBZWDBzGaeNDExAsea1uwUqhpixFCtHrAoyHxbjya+Bd40otRTyZc8W5IiOECakzWzO7MdtvuLtuy7Qr7+SS7+97s7L737by3+9687gTQtYbSuyRiR0RcjYiBSnb5DkOVh1s3Lk78dePiRBKl0jt/JuX9bt64OJHvmr9ue55ZXL691vz5C6fHZ2am5rL8yMKZD0fmz194fvrM+KmpU1Nnx44dO3pk9KUXx15oXPne1uNM63Rz7yez+/a88e7ltyZOXH7vl++SPP5lcXzU+ps2N1RnW0+eeLpdpfxP7Czf95fvk2K+tdC5CtGStEEWs650NQaiJ6oHLwbi9c87WjlgQzX/Ch2MiNKSJHus3QbcxZKWe3Ovfg/3lOyLPolYnEjnwLXz+W5w/XhlApTGfSu7VZ4pVmevvdX5bfuls60Ti39/nd5i6TxE3wYVBwAQPxyvPOZjv6XxX6FYu98r2drQYETcHxG7IuKBiNgdEQ9GxEMR8XBEPFLzmnrrPiutXCRZPf4sXFtXYC26fiji5Wxta/n4r7p2MdiT5XaW4+9NTk7PTB2OiPsi4mD0bknzo03K+PG1K19myVXjuqGa8V96S8vPx4JZPa4Vtyx/zeT4wvidxp27/lnE3mK9+JPqSkB6HPdExN796ytj+rlv9zV67vbx11Fc8XgHSt9EPFM5/ouxIv5c0nx9cmRrzEwdHslbxWq//nbp7Ublryv+NkqP/7a67b8a/2BSu147v/YyLv3+RcM5ZYvtf1m/Sdt/X7K8K308vrAwNxrRl7xZzveVP7HS7bF6v7Gl/dP4Dx6o3/93xdJf4tGISBvxYxHxeETsz+r+REQ8GREHmsT/86tPfbD++DdWGv/k7Y//+89Wj3/DRL62veqpntM/fV9+Jj9kg03iT6LO8T9aTh3MtrTy+de0pnN30poBAADg7lOIiB2RFIar6UJheLjy//K7Y1thZnZ+4dDJ2XNnJyu/ERiM3kJ+pmugej40FkezaX1+fnRsRf5Idt74q57+cn54YnZmstPBQ5fb3qD/p/7o6XTtgA3XhnU04C613v5fKpU+bXNVgE3m+x+6l/4P3atO/+9fkd+yWXUBNldN/y/kmZqJ/b9LvxMG7jWNxv9XNrkewOYz/4fupf9D99L/oStlv4QvRku/lt+gRPr503CfnojoVMUaJEqlrauvclBJTJ/byNL72viGO1ZeJWFgbe8ThTUWmtS2sa1ruEbDqkR0ugGsMfFPdrHNTSgr7Upz/Y17U+uJTn8yAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAtMd/AQAA//+FndTG") r3 = socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000fc0)=@raw={'raw\x00', 0x3c1, 0x3, 0x3a0, 0x0, 0x111, 0x4b4, 0x1c0, 0xd4feffff, 0x2d0, 0x20a, 0x278, 0x2d0, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [0x0, 0xffffff00], [], 'ipvlan0\x00', 'team_slave_0\x00', {}, {}, 0x6, 0xfe}, 0x0, 0x198, 0x1c0, 0x0, {}, [@common=@inet=@tcp={{0x30}, {[], [], 0x0, 0x0, 0x2, 0xe}}, @common=@unspec=@string={{0xc0}, {0x0, 0xfffd, 'bm\x00', "6d93eb04697dfa39de04767f46614613a407abbf4ed2e83a63b484dbb3bf6b2a850e79009e2905d2f98ba19f91f3c9faee6d3686e9bee067f4e77d9ad66238750c4100d7ee97ec7646259d90edece6e9787a97bc956c01754c34c5c9518c46178ed5f9194454980e579c80eca35a58dc47d1d5e4ff6e216c724e88c702448587", 0x28}}]}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0xffff}}}, {{@ipv6={@loopback, @mcast2, [], [], 'veth1_to_hsr\x00', 'pim6reg1\x00'}, 0x0, 0xa8, 0x110}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x400) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000000), 0x8) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a300000000040000000030a01080000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a300000000050000000060a010400000000000000000100000008000b40000000000900010073797a30000000002800048024000180090001006d65746100000000140002800800014000000012080002400000002214000000110001"], 0xd8}, 0x1, 0x0, 0x0, 0x2004c011}, 0x90) 1.129561344s ago: executing program 8 (id=1361): socketpair$nbd(0x1, 0x1, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) syz_open_dev$usbfs(0x0, 0x76, 0x103901) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x2382, @loopback}, 0x10) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000080)=@req3={0x8000, 0x200, 0x80, 0x20000, 0x0, 0x0, 0x8}, 0x1c) syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000100)='./file0\x00', 0x2a00005, &(0x7f0000000140)=ANY=[], 0x0, 0x2e6, &(0x7f00000001c0)="$eJzs3d9KG0scB/BfNJooHBLOOVelFwulpVdB7ROEYqE0ULAEaq8MVWkxIkQqtBfVO9+lj9MXaK/7ArVQSLEbdSMxNZK6/vl8QHbY2e/OzI44CrNm5e7mxurW9vryf9+iUE6iGLEXPyIiJmIyeo4LEYWYjqy9GF31AhkAYHyWllr1M6qmLrkr/CWdTr11OJmlU+f/rTXNMQAAAAAAAAAAwDWV3f9fPtr/fxBRzez/L/SOE2Pa/w8A5GvI/n9uiE6n3prt/f7Wr/kplw4BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAARMRBt1vpDvnqu/hrbt0EAMZopPX/lO/d1OX1FgAYh/71v7AXcf71HwC4ng761vpCjPL3PwBwPb1YfvWs3mgsLiVJOWJzf6e500yPaX19Pd5GO9ZiLirxM6J7LC0/edpYnEt+q8bK5m4vv7tT6jVwlJ+PSlQH5+fTfNKXb07FbLb9hajE/4PzCwPz0/HwXiZfi0p8fh1b0Y7VOMye5D/OJ8nj541T+VKszgx6YlOXODsAAAAAAAAAAAAAAAAAAADcFrXkWP/7+83JtL52Vn3mVfjz/X+Ad4/uf8nki3GnmOvQAQAAAAAAAAAAAAAAAAAA4MrYfv9ho9Vur3UUhhcelM5x8czgp1qMizV6NEl5j320QjkGVf2TOTMz/D77V2EUN6fQraTfRSPGc/qBBAAAAAAAAAAAAAAAAAAAt9jJS78R03l3BgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABycvL5/yMXXr5Jb/HHi/tbLOcyTgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODm+xUAAP//fx7hhA==") r1 = openat(0xffffffffffffff9c, 0x0, 0x40042, 0x1) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x0, 0x0, 0x0, 0x4, 0xcd, &(0x7f0000000700)=""/205, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000002c0), 0x10}, 0x94) mount$9p_fd(0x0, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000040), 0x400, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r1}}) mmap(&(0x7f0000568000/0x2000)=nil, 0x1000000, 0x0, 0x11, r0, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r1, 0xc018937c, &(0x7f0000002700)={{0x1, 0x1, 0x18}, './cgroup/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) syz_clone3(&(0x7f0000000680)={0x100a43080, 0x0, 0x0, 0x0, {0x5}, 0x0, 0x0, 0x0, 0x0}, 0x58) 626.507085ms ago: executing program 8 (id=1363): syz_usb_connect(0x0, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002e00101408d0e08060001000000010902270001010080fa0904"], 0x0) 537.950909ms ago: executing program 6 (id=1364): syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$evdev(0x0, 0xe899, 0x48000) r0 = syz_usb_connect(0x5, 0x58, &(0x7f0000000080)={{0x12, 0x1, 0x310, 0x8e, 0x3a, 0xc6, 0x20, 0x694, 0x1, 0x7813, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x2, 0xe, 0x6, 0x10, 0x3, "", [{{0x9, 0x4, 0x39, 0xd8, 0x1, 0x1a, 0xda, 0xa8, 0x8, [], [{{0x9, 0x5, 0x8, 0x10, 0x20, 0x7, 0x9, 0x80}}]}}, {{0x9, 0x4, 0xe4, 0x5, 0x3, 0xb9, 0x56, 0xda, 0x2, [], [{{0x9, 0x5, 0x8, 0x0, 0x400, 0x1, 0x12, 0xfc}}, {{0x9, 0x5, 0xb, 0x0, 0x20, 0x7, 0x3, 0x9a, [@generic={0x7, 0x5, "d15b89f26d"}]}}, {{0x9, 0x5, 0x9, 0x3, 0x40, 0x7a, 0xa, 0x84}}]}}]}}]}}, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r0, &(0x7f0000000bc0)={0x14, 0x0, &(0x7f0000000b00)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1c01}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000011c0)={0x24, 0x0, &(0x7f0000000a00)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000001600)={0x24, 0x0, &(0x7f0000000d40)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000100)={0x40, 0x8, 0x8, "003cb3a4aa50323f"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000002280)={0x84, &(0x7f0000001e00)={0x20, 0x14, 0x4, "348b35e5"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) read$char_usb(0xffffffffffffffff, &(0x7f0000000540)=""/99, 0x63) write$char_usb(0xffffffffffffffff, 0x0, 0x0) 449.384013ms ago: executing program 7 (id=1366): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETOFFLOAD(r0, 0x400454d0, 0x4) 422.403502ms ago: executing program 9 (id=1327): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x2400, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0xe) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047457, 0x0) 395.033422ms ago: executing program 7 (id=1367): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pnp/drivers/serial\x00', 0x0, 0x0) r1 = openat(r0, &(0x7f0000000140)='unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000180)='00:02', 0x5) r2 = openat(r0, &(0x7f0000000480)='bind\x00', 0x1, 0x0) write(r2, &(0x7f00000004c0)='00:02', 0x5) 394.649648ms ago: executing program 9 (id=1368): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00000002c0)=@filter={'filter\x00', 0xe, 0x4, 0x2b0, 0xffffffff, 0x0, 0x98, 0x0, 0xffffffff, 0xffffffff, 0x218, 0x218, 0x218, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x0, 0x6, 0x1}, {0x3, 0x3, 0x3}}}}, {{@ip={@multicast1, @dev={0xac, 0x14, 0x14, 0x39}, 0xffffff00, 0xff, 'geneve1\x00', 'pimreg0\x00', {0xff}, {0xff}, 0x33, 0x1, 0x44}, 0x0, 0xc0, 0xe8, 0x0, {}, [@common=@addrtype={{0x30}, {0x462, 0x219, 0x1}}, @common=@socket0={{0x20}}]}, @REJECT={0x28}}, {{@ip={@loopback, @multicast1, 0xff, 0x0, 'dummy0\x00', 'macsec0\x00', {}, {0xff}, 0x60878ae06965b9fe, 0x1, 0x8}, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0xf}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x310) 329.86435ms ago: executing program 7 (id=1369): socket$packet(0x11, 0x2, 0x300) r0 = syz_ublk_setup_io_uring(0xd, &(0x7f0000000400)={0x0, 0x30b5, 0x400, 0x2, 0x154}, &(0x7f0000000040)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x4, 0xa22, 0x0, 0x0, 0x1000, 0x2, 0x0, 0x0, 0xe0}}}, &(0x7f0000000480)=0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = dup(r5) syz_ublk_setup_queues(r6, r4, &(0x7f0000000180)={0x0, 0x20fb87, 0x800, 0x1, 0x32c}, &(0x7f0000000800)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x2f41, 0x300, 0x1006, 0x200015a, 0x0, r0}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xffffed7d, 0x40000, 0x10001, 0x146}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x88de, 0x8, 0x0, 0xffffffff}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x0, 0x4000, 0x2, 0xba}}], 0x1, &(0x7f0000000340)={0x2e, 0x14, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x700, 0x0, {}, 0x1f, 0x0, '\x00', {0xfff9, 0x5c0, 0x0, 0x0}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, 0x0, 0x0, 0x0, 0xffffffffffffff4f, 0x0, 0x0, 0x7}, 0x94) 329.599314ms ago: executing program 9 (id=1370): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="c40000001900674c2cbd70000000000000000000000000000000000000000000ac1eff0100000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0100000000000000000000000000000000000020000000000000000000000000000000000000000000008000000000000000000000000000fcffffffffffffff0000000000000000b0ac0000000000000000000000000000000000000000000000040000000000"], 0xc4}}, 0x4c050) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=@newpolicy={0xb8, 0x13, 0x101, 0x0, 0x0, {{@in=@rand_addr=0x64010102, @in=@rand_addr=0x64010102, 0x100, 0xd, 0x400, 0x9, 0xa}, {0x2, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x0, 0x8}, {0x0, 0xfffffffffffffffe, 0x0, 0x100}, 0xfffffffe, 0x0, 0x0, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x20048000}, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003082f00fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) 179.12247ms ago: executing program 3 (id=1371): setns(0xc9, 0x0) syz_emit_ethernet(0x2e, &(0x7f0000000000)=ANY=[@ANYBLOB="0180c200"], 0x0) socket$packet(0x11, 0x3, 0x300) r0 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendmsg$802154_raw(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)="e9", 0x2f}, 0x1, 0x0, 0x0, 0x810}, 0x24004014) 161.403914ms ago: executing program 7 (id=1372): mount$binderfs(&(0x7f0000000080), &(0x7f00000000c0)='./binderfs\x00', &(0x7f0000000100), 0x80, 0x0) 130.364648ms ago: executing program 7 (id=1373): r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000100)={'wlan0\x00'}) 61.845056ms ago: executing program 3 (id=1374): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x24000000) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000340)="23000000010007", 0x7) 61.681333ms ago: executing program 3 (id=1375): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty, 0x3}, 0x1c) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) r2 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f00000006c0)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x0, 0x0, 0x16}, @ipv4=@udp={{0x6, 0x4, 0x3, 0x1b, 0x28, 0x66, 0x0, 0x40, 0x11, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x16}, {[@generic={0x7, 0x3, "aa"}]}}, {0x4e24, 0x4e20, 0x10, 0x0, @gue={{0x2, 0x0, 0x1, 0xa, 0x100, @val=0x80}}}}}, 0x36) 61.593021ms ago: executing program 7 (id=1376): r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) read(r0, &(0x7f0000000080)=""/220, 0xdc) connect$bt_rfcomm(r0, &(0x7f0000000040)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x3}, 0x11) shutdown(r0, 0x1) move_pages(0x0, 0x0, 0x0, &(0x7f0000001180), 0x0, 0x0) 61.48539ms ago: executing program 8 (id=1377): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x400c8c1}, 0x20) sendmsg$nl_route_sched(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff2}, {0x7, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0xc, 0x2, [@TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x6}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r4 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r4, &(0x7f00000005c0)="bad386dd", 0x4, 0x840, &(0x7f00000001c0)={0x11, 0x8100, r3, 0x1, 0xd8, 0x6, @multicast}, 0x14) 0s ago: executing program 6 (id=1378): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000100), 0x2400, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000080)=0xe) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047457, 0x0) kernel console output (not intermixed with test programs): 0x704/0xb20 [ 40.481891][ T5751] alloc_inode+0x9c/0x198 [ 40.481901][ T5751] new_inode+0x20/0x50 [ 40.481912][ T5751] mqueue_get_inode+0x40/0x93c [ 40.481924][ T5751] mqueue_fill_super+0x110/0x1a8 [ 40.481936][ T5751] vfs_get_super+0xb8/0x148 [ 40.481946][ T5751] get_tree_nodev+0x2c/0x3c [ 40.481956][ T5751] mqueue_get_tree+0xac/0xe8 [ 40.481968][ T5751] vfs_get_tree+0x90/0x28c [ 40.481977][ T5751] fc_mount+0x24/0xac [ 40.481987][ T5751] fc_mount_longterm+0x20/0x74 [ 40.481996][ T5751] mq_init_ns+0x3c8/0x638 [ 40.482008][ T5751] copy_ipcs+0x3c8/0x63c [ 40.482020][ T5751] create_new_namespaces+0x1a8/0x50c [ 40.482031][ T5751] unshare_nsproxy_namespaces+0x120/0x170 [ 40.482042][ T5751] ksys_unshare+0x438/0x6cc [ 40.482051][ T5751] __arm64_sys_unshare+0x40/0x54 [ 40.482060][ T5751] invoke_syscall+0x98/0x244 [ 40.482072][ T5751] el0_svc_common+0xec/0x23c [ 40.482084][ T5751] do_el0_svc+0x4c/0x5c [ 40.482095][ T5751] el0_svc+0x60/0x1d8 [ 40.482107][ T5751] el0t_64_sync_handler+0x44/0x104 [ 40.482119][ T5751] el0t_64_sync+0x198/0x19c [ 40.599514][ T5759] netlink: 'syz.2.314': attribute type 25 has an invalid length. [ 40.855206][ T5783] ip6gre1: entered promiscuous mode [ 40.855228][ T5783] ip6gre1: entered allmulticast mode [ 41.063972][ T5789] tipc: Started in network mode [ 41.063990][ T5789] tipc: Node identity 0010000000000000002, cluster identity 4711 [ 41.087923][ T5791] tipc: Enabling of bearer rejected, failed to enable media [ 41.118106][ T5799] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 41.118638][ T5799] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 41.182649][ T5803] loop9: detected capacity change from 0 to 16384 [ 41.258455][ T5808] syzkaller0: entered promiscuous mode [ 41.258472][ T5808] syzkaller0: entered allmulticast mode [ 41.402371][ T5787] syz.2.320 (5787): drop_caches: 2 [ 41.499877][ T5836] tipc: Enabling of bearer rejected, failed to enable media [ 41.586149][ T5851] syzkaller1: tun_chr_ioctl cmd 1074025684 [ 41.946857][ T4718] Bluetooth: hci5: command 0x1003 tx timeout [ 41.946916][ T50] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 42.197232][ T5941] tipc: Enabling of bearer rejected, failed to enable media [ 42.405366][ T5958] overlayfs: missing 'lowerdir' [ 42.411751][ T5957] FAULT_INJECTION: forcing a failure. [ 42.411751][ T5957] name failslab, interval 1, probability 0, space 0, times 0 [ 42.411770][ T5957] CPU: 1 UID: 0 PID: 5957 Comm: syz.4.373 Not tainted syzkaller #0 PREEMPT [ 42.411780][ T5957] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 42.411785][ T5957] Call trace: [ 42.411788][ T5957] show_stack+0x2c/0x3c (C) [ 42.411807][ T5957] __dump_stack+0x30/0x40 [ 42.411820][ T5957] dump_stack_lvl+0xd8/0x12c [ 42.411831][ T5957] dump_stack+0x1c/0x28 [ 42.411842][ T5957] should_fail_ex+0x418/0x58c [ 42.411855][ T5957] should_failslab+0xc4/0x120 [ 42.411868][ T5957] __kmalloc_noprof+0x108/0x6c8 [ 42.411877][ T5957] tomoyo_realpath_from_path+0xbc/0x4dc [ 42.411890][ T5957] tomoyo_path_number_perm+0x1f0/0x500 [ 42.411900][ T5957] tomoyo_file_ioctl+0x2c/0x3c [ 42.411911][ T5957] security_file_ioctl+0xdc/0x2b0 [ 42.411921][ T5957] __arm64_sys_ioctl+0xb0/0x1cc [ 42.411934][ T5957] invoke_syscall+0x98/0x244 [ 42.411946][ T5957] el0_svc_common+0xec/0x23c [ 42.411958][ T5957] do_el0_svc+0x4c/0x5c [ 42.411969][ T5957] el0_svc+0x60/0x1d8 [ 42.411981][ T5957] el0t_64_sync_handler+0x44/0x104 [ 42.411992][ T5957] el0t_64_sync+0x198/0x19c [ 42.412003][ T5957] ERROR: Out of memory at tomoyo_realpath_from_path. [ 42.422559][ T5957] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input7 [ 42.458044][ T5960] loop3: detected capacity change from 0 to 4096 [ 42.468116][ T5960] EXT4-fs (loop3): invalid first ino: 0 [ 42.507646][ T50] Bluetooth: hci0: command 0x040f tx timeout [ 42.518269][ T4801] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 42.611136][ T5974] tipc: Enabling of bearer rejected, failed to enable media [ 42.678206][ T4801] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 42.679759][ T4801] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 42.679774][ T4801] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 42.679785][ T4801] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 42.679794][ T4801] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 42.679811][ T4801] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 42.681253][ T4801] usb 1-1: config 0 descriptor?? [ 42.698994][ T5988] binder: 5987:5988 ioctl 4018620d 0 returned -22 [ 42.725485][ T4720] binder: undelivered death notification, 0000000000000000 [ 42.785191][ T6001] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 42.786001][ T6001] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 42.812663][ T6005] loop2: detected capacity change from 0 to 1024 [ 42.825106][ T6008] tipc: Enabling of bearer rejected, failed to enable media [ 42.834591][ T6005] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 42.859842][ T4717] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 42.886322][ T6015] FAULT_INJECTION: forcing a failure. [ 42.886322][ T6015] name failslab, interval 1, probability 0, space 0, times 0 [ 42.886343][ T6015] CPU: 0 UID: 0 PID: 6015 Comm: syz.4.398 Not tainted syzkaller #0 PREEMPT [ 42.886353][ T6015] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 42.886358][ T6015] Call trace: [ 42.886361][ T6015] show_stack+0x2c/0x3c (C) [ 42.886380][ T6015] __dump_stack+0x30/0x40 [ 42.886392][ T6015] dump_stack_lvl+0xd8/0x12c [ 42.886404][ T6015] dump_stack+0x1c/0x28 [ 42.886418][ T6015] should_fail_ex+0x418/0x58c [ 42.886431][ T6015] should_failslab+0xc4/0x120 [ 42.886444][ T6015] __kmalloc_noprof+0x108/0x6c8 [ 42.886453][ T6015] tomoyo_realpath_from_path+0xbc/0x4dc [ 42.886466][ T6015] tomoyo_path_number_perm+0x1f0/0x500 [ 42.886476][ T6015] tomoyo_file_ioctl+0x2c/0x3c [ 42.886487][ T6015] security_file_ioctl+0xdc/0x2b0 [ 42.886498][ T6015] __arm64_sys_ioctl+0xb0/0x1cc [ 42.886510][ T6015] invoke_syscall+0x98/0x244 [ 42.886523][ T6015] el0_svc_common+0xec/0x23c [ 42.886534][ T6015] do_el0_svc+0x4c/0x5c [ 42.886545][ T6015] el0_svc+0x60/0x1d8 [ 42.886558][ T6015] el0t_64_sync_handler+0x44/0x104 [ 42.886569][ T6015] el0t_64_sync+0x198/0x19c [ 42.895953][ T6015] ERROR: Out of memory at tomoyo_realpath_from_path. [ 43.287770][ T4801] usbhid 1-1:0.0: can't add hid device: -71 [ 43.287927][ T4801] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 43.300268][ T4801] usb 1-1: USB disconnect, device number 3 [ 43.338042][ T6031] new mount options do not match the existing superblock, will be ignored [ 43.799351][ T6033] __nla_validate_parse: 6 callbacks suppressed [ 43.799365][ T6033] netlink: 4 bytes leftover after parsing attributes in process `syz.1.406'. [ 43.827949][ T6039] FAULT_INJECTION: forcing a failure. [ 43.827949][ T6039] name failslab, interval 1, probability 0, space 0, times 0 [ 43.827970][ T6039] CPU: 0 UID: 0 PID: 6039 Comm: syz.2.409 Not tainted syzkaller #0 PREEMPT [ 43.827980][ T6039] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 43.827986][ T6039] Call trace: [ 43.827989][ T6039] show_stack+0x2c/0x3c (C) [ 43.828008][ T6039] __dump_stack+0x30/0x40 [ 43.828021][ T6039] dump_stack_lvl+0xd8/0x12c [ 43.828032][ T6039] dump_stack+0x1c/0x28 [ 43.828043][ T6039] should_fail_ex+0x418/0x58c [ 43.828056][ T6039] should_failslab+0xc4/0x120 [ 43.828069][ T6039] __kmalloc_noprof+0x108/0x6c8 [ 43.828078][ T6039] tomoyo_realpath_from_path+0xbc/0x4dc [ 43.828090][ T6039] tomoyo_path_number_perm+0x1f0/0x500 [ 43.828100][ T6039] tomoyo_file_ioctl+0x2c/0x3c [ 43.828112][ T6039] security_file_ioctl+0xdc/0x2b0 [ 43.828122][ T6039] __arm64_sys_ioctl+0xb0/0x1cc [ 43.828134][ T6039] invoke_syscall+0x98/0x244 [ 43.828146][ T6039] el0_svc_common+0xec/0x23c [ 43.828158][ T6039] do_el0_svc+0x4c/0x5c [ 43.828169][ T6039] el0_svc+0x60/0x1d8 [ 43.828181][ T6039] el0t_64_sync_handler+0x44/0x104 [ 43.828199][ T6039] el0t_64_sync+0x198/0x19c [ 43.828210][ T6039] ERROR: Out of memory at tomoyo_realpath_from_path. [ 43.891924][ T6050] loop3: detected capacity change from 0 to 1024 [ 43.895422][ T6047] tipc: Enabling of bearer rejected, failed to enable media [ 43.943155][ T6050] Quota error (device loop3): find_tree_dqentry: Cycle in quota tree detected: block 4 index 0 [ 43.943238][ T6050] Quota error (device loop3): qtree_read_dquot: Can't read quota structure for id 0 [ 43.943251][ T6050] EXT4-fs error (device loop3): ext4_acquire_dquot:7069: comm syz.3.412: Failed to acquire dquot type 0 [ 43.943321][ T6050] loop3: lost filesystem error report for type 5 error -5 [ 43.946645][ C1] EXT4-fs (loop3): error count since last fsck: 1 [ 43.946657][ C1] EXT4-fs (loop3): initial error at time 43: ext4_acquire_dquot:7069 [ 43.946669][ C1] EXT4-fs (loop3): last error at time 43: ext4_acquire_dquot:7069 [ 43.956141][ T6050] EXT4-fs (loop3): 1 truncate cleaned up [ 43.959125][ T6050] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 43.980709][ T6050] Quota error (device loop3): find_tree_dqentry: Cycle in quota tree detected: block 4 index 0 [ 43.980771][ T6050] Quota error (device loop3): qtree_read_dquot: Can't read quota structure for id 0 [ 43.980782][ T6050] EXT4-fs error (device loop3): ext4_acquire_dquot:7069: comm syz.3.412: Failed to acquire dquot type 0 [ 44.008096][ T4707] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 44.011502][ T6063] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 44.031635][ T6063] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 44.045273][ T6065] vivid-000: ================= START STATUS ================= [ 44.045299][ T6065] vivid-000: Generate PTS: true [ 44.045313][ T6065] vivid-000: Generate SCR: true [ 44.045325][ T6065] tpg source WxH: 320x240 (Y'CbCr) [ 44.045331][ T6065] tpg field: 1 [ 44.045335][ T6065] tpg crop: (0,0)/320x240 [ 44.045342][ T6065] tpg compose: (0,0)/320x240 [ 44.045348][ T6065] tpg colorspace: 8 [ 44.045351][ T6065] tpg transfer function: 0/0 [ 44.045356][ T6065] tpg Y'CbCr encoding: 0/0 [ 44.045360][ T6065] tpg quantization: 0/0 [ 44.045364][ T6065] tpg RGB range: 0/2 [ 44.045368][ T6065] vivid-000: ================== END STATUS ================== [ 44.117777][ T6067] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 44.119680][ T6067] infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 [ 44.265047][ T6081] FAULT_INJECTION: forcing a failure. [ 44.265047][ T6081] name failslab, interval 1, probability 0, space 0, times 0 [ 44.265069][ T6081] CPU: 0 UID: 0 PID: 6081 Comm: syz.3.422 Not tainted syzkaller #0 PREEMPT [ 44.265080][ T6081] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 44.265086][ T6081] Call trace: [ 44.265090][ T6081] show_stack+0x2c/0x3c (C) [ 44.265108][ T6081] __dump_stack+0x30/0x40 [ 44.265122][ T6081] dump_stack_lvl+0xd8/0x12c [ 44.265133][ T6081] dump_stack+0x1c/0x28 [ 44.265145][ T6081] should_fail_ex+0x418/0x58c [ 44.265159][ T6081] should_failslab+0xc4/0x120 [ 44.265172][ T6081] __kmalloc_noprof+0x108/0x6c8 [ 44.265181][ T6081] tomoyo_realpath_from_path+0xbc/0x4dc [ 44.265200][ T6081] tomoyo_path_number_perm+0x1f0/0x500 [ 44.265210][ T6081] tomoyo_file_ioctl+0x2c/0x3c [ 44.265222][ T6081] security_file_ioctl+0xdc/0x2b0 [ 44.265232][ T6081] __arm64_sys_ioctl+0xb0/0x1cc [ 44.265245][ T6081] invoke_syscall+0x98/0x244 [ 44.265257][ T6081] el0_svc_common+0xec/0x23c [ 44.265269][ T6081] do_el0_svc+0x4c/0x5c [ 44.265280][ T6081] el0_svc+0x60/0x1d8 [ 44.265292][ T6081] el0t_64_sync_handler+0x44/0x104 [ 44.265303][ T6081] el0t_64_sync+0x198/0x19c [ 44.265313][ T6081] ERROR: Out of memory at tomoyo_realpath_from_path. [ 44.315034][ T6085] netlink: 4 bytes leftover after parsing attributes in process `syz.3.424'. [ 44.366668][ T4801] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 44.505791][ T6092] tipc: Enabling of bearer rejected, failed to enable media [ 44.527442][ T4801] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 44.537562][ T4801] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 44.537576][ T4801] usb 1-1: Product: syz [ 44.537583][ T4801] usb 1-1: Manufacturer: syz [ 44.537590][ T4801] usb 1-1: SerialNumber: syz [ 44.553484][ T6096] 0: reclassify loop, rule prio 0, protocol 03 [ 44.784081][ T6112] netlink: 4 bytes leftover after parsing attributes in process `syz.3.436'. [ 44.891375][ T6126] loop3: detected capacity change from 0 to 8 [ 44.896057][ T6126] squashfs: SQUASHFS error: Xattrs in filesystem, these will be ignored [ 44.896066][ T6126] unable to read xattr id index table [ 44.903525][ T6126] SQUASHFS error: Unable to read inode 0x127 [ 44.913587][ T6126] netlink: 36 bytes leftover after parsing attributes in process `syz.3.442'. [ 44.947113][ T4801] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 44.947139][ T4801] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 45.041843][ T6143] loop3: detected capacity change from 0 to 512 [ 45.061271][ T6143] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 45.063401][ T6145] netlink: 4 bytes leftover after parsing attributes in process `syz.2.451'. [ 45.099968][ T4707] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 45.189964][ T6164] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.190170][ T6164] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.395731][ T6164] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 45.396248][ T6164] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 45.690075][ T6185] netlink: 4 bytes leftover after parsing attributes in process `syz.4.465'. [ 45.833508][ T6204] ip_tables: iptables: counters copy to user failed while replacing table [ 46.356661][ T4801] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000040. ret = -EPIPE [ 46.357553][ T4801] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001000. ret = -EPIPE [ 46.357799][ T4801] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 46.357823][ T4801] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 46.358407][ T4801] lan78xx 1-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 46.387298][ T4801] lan78xx 1-1:1.0: probe with driver lan78xx failed with error -71 [ 46.390500][ T4801] usb 1-1: USB disconnect, device number 4 [ 46.397534][ C0] vxcan0: j1939_tp_rxtimer: 0x00000000b36fa25e: rx timeout, send abort [ 46.398055][ C0] vxcan0: j1939_xtp_rx_abort_one: 0x00000000b36fa25e: 0x0f000: (3) A timeout occurred and this is the connection abort to close the session. [ 46.863902][ T6248] FAULT_INJECTION: forcing a failure. [ 46.863902][ T6248] name failslab, interval 1, probability 0, space 0, times 0 [ 46.863922][ T6248] CPU: 1 UID: 0 PID: 6248 Comm: syz.4.479 Not tainted syzkaller #0 PREEMPT [ 46.863932][ T6248] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 46.863938][ T6248] Call trace: [ 46.863941][ T6248] show_stack+0x2c/0x3c (C) [ 46.863960][ T6248] __dump_stack+0x30/0x40 [ 46.863973][ T6248] dump_stack_lvl+0xd8/0x12c [ 46.863984][ T6248] dump_stack+0x1c/0x28 [ 46.863995][ T6248] should_fail_ex+0x418/0x58c [ 46.864007][ T6248] should_failslab+0xc4/0x120 [ 46.864020][ T6248] kmem_cache_alloc_lru_noprof+0x98/0x5d8 [ 46.864029][ T6248] shmem_alloc_inode+0x2c/0x48 [ 46.864042][ T6248] alloc_inode+0x68/0x198 [ 46.864058][ T6248] new_inode+0x20/0x50 [ 46.864069][ T6248] shmem_get_inode+0xac/0x788 [ 46.864081][ T6248] shmem_mknod+0x140/0x2f8 [ 46.864088][ T6248] shmem_create+0x40/0x54 [ 46.864096][ T6248] lookup_open+0xafc/0x1180 [ 46.864106][ T6248] path_openat+0x50c/0x18f0 [ 46.864115][ T6248] do_file_open+0x1c8/0x2e8 [ 46.864125][ T6248] do_sys_openat2+0x114/0x1e8 [ 46.864137][ T6248] do_sys_open+0xb0/0xe0 [ 46.864147][ T6248] __arm64_sys_openat+0xa8/0xc4 [ 46.864159][ T6248] invoke_syscall+0x98/0x244 [ 46.864171][ T6248] el0_svc_common+0xec/0x23c [ 46.864182][ T6248] do_el0_svc+0x4c/0x5c [ 46.864193][ T6248] el0_svc+0x60/0x1d8 [ 46.864212][ T6248] el0t_64_sync_handler+0x44/0x104 [ 46.864223][ T6248] el0t_64_sync+0x198/0x19c [ 47.427563][ T865] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 47.576709][ T865] usb 1-1: Using ep0 maxpacket: 32 [ 47.577104][ T865] usb 1-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 47.577877][ T865] usb 1-1: config index 0 descriptor too short (expected 19, got 18) [ 47.577892][ T865] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 47.577902][ T865] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 47.579453][ T865] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 47.579466][ T865] usb 1-1: Product: syz [ 47.579474][ T865] usb 1-1: Manufacturer: syz [ 47.579480][ T865] usb 1-1: SerialNumber: syz [ 47.582946][ T865] usb 1-1: config 0 descriptor?? [ 47.871915][ T1090] usb 1-1: USB disconnect, device number 5 [ 48.373979][ T6291] netlink: 4 bytes leftover after parsing attributes in process `syz.2.498'. [ 48.588324][ T6317] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 48.590914][ T6317] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 48.854848][ T50] Bluetooth: min 6 > max 0 [ 49.156772][ T4888] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 49.248842][ T6387] netlink: 4 bytes leftover after parsing attributes in process `syz.3.525'. [ 49.297923][ T6389] syz_tun: entered allmulticast mode [ 49.298727][ T6389] syz_tun: left allmulticast mode [ 49.306961][ T4888] usb 1-1: Using ep0 maxpacket: 8 [ 49.310920][ T4888] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 49.311585][ T4888] usb 1-1: config index 0 descriptor too short (expected 74, got 45) [ 49.311602][ T4888] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 1536, setting to 1024 [ 49.311613][ T4888] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 49.311623][ T4888] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 49.311632][ T4888] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 49.311647][ T4888] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 49.394161][ T6397] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 49.394349][ T6397] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 49.519778][ T6358] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 49.520080][ T6358] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 49.543520][ T4888] usb 1-1: GET_CAPABILITIES returned 0 [ 49.543545][ T4888] usbtmc 1-1:16.0: can't read capabilities [ 49.632967][ T6417] bond0: option slaves: interface +b does not exist! [ 49.748254][ T6358] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 49.748434][ T6358] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 49.753050][ T6358] usbtmc 1-1:16.0: usbtmc488_ioctl_trigger returned -71 [ 49.754242][ T1090] usb 1-1: USB disconnect, device number 6 [ 49.870957][ T6455] loop1: detected capacity change from 0 to 512 [ 49.900768][ T6455] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 49.902879][ T6455] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 49.903039][ T6455] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 50.041482][ T6476] FAULT_INJECTION: forcing a failure. [ 50.041482][ T6476] name failslab, interval 1, probability 0, space 0, times 0 [ 50.041503][ T6476] CPU: 0 UID: 0 PID: 6476 Comm: syz.3.549 Not tainted syzkaller #0 PREEMPT [ 50.041514][ T6476] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 50.041519][ T6476] Call trace: [ 50.041522][ T6476] show_stack+0x2c/0x3c (C) [ 50.041540][ T6476] __dump_stack+0x30/0x40 [ 50.041553][ T6476] dump_stack_lvl+0xd8/0x12c [ 50.041564][ T6476] dump_stack+0x1c/0x28 [ 50.041575][ T6476] should_fail_ex+0x418/0x58c [ 50.041588][ T6476] should_failslab+0xc4/0x120 [ 50.041601][ T6476] __kmalloc_noprof+0x108/0x6c8 [ 50.041609][ T6476] __register_sysctl_table+0x70/0xb4c [ 50.041623][ T6476] register_pidns_sysctls+0xec/0x1d0 [ 50.041635][ T6476] copy_pid_ns+0x53c/0x918 [ 50.041645][ T6476] create_new_namespaces+0x21c/0x50c [ 50.041655][ T6476] unshare_nsproxy_namespaces+0x120/0x170 [ 50.041665][ T6476] ksys_unshare+0x438/0x6cc [ 50.041674][ T6476] __arm64_sys_unshare+0x40/0x54 [ 50.041683][ T6476] invoke_syscall+0x98/0x244 [ 50.041695][ T6476] el0_svc_common+0xec/0x23c [ 50.041707][ T6476] do_el0_svc+0x4c/0x5c [ 50.041718][ T6476] el0_svc+0x60/0x1d8 [ 50.041730][ T6476] el0t_64_sync_handler+0x44/0x104 [ 50.041741][ T6476] el0t_64_sync+0x198/0x19c [ 50.088897][ T6482] netlink: 20 bytes leftover after parsing attributes in process `syz.3.552'. [ 50.364875][ T6512] FAULT_INJECTION: forcing a failure. [ 50.364875][ T6512] name failslab, interval 1, probability 0, space 0, times 0 [ 50.364896][ T6512] CPU: 0 UID: 0 PID: 6512 Comm: syz.0.563 Not tainted syzkaller #0 PREEMPT [ 50.364907][ T6512] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 50.364913][ T6512] Call trace: [ 50.364915][ T6512] show_stack+0x2c/0x3c (C) [ 50.364935][ T6512] __dump_stack+0x30/0x40 [ 50.364949][ T6512] dump_stack_lvl+0xd8/0x12c [ 50.364961][ T6512] dump_stack+0x1c/0x28 [ 50.364972][ T6512] should_fail_ex+0x418/0x58c [ 50.364985][ T6512] should_failslab+0xc4/0x120 [ 50.364999][ T6512] __kmalloc_node_track_caller_noprof+0x108/0x6e0 [ 50.365009][ T6512] kmemdup_noprof+0x44/0x8c [ 50.365018][ T6512] register_pidns_sysctls+0x50/0x1d0 [ 50.365031][ T6512] copy_pid_ns+0x53c/0x918 [ 50.365041][ T6512] create_new_namespaces+0x21c/0x50c [ 50.365051][ T6512] unshare_nsproxy_namespaces+0x120/0x170 [ 50.365061][ T6512] ksys_unshare+0x438/0x6cc [ 50.365071][ T6512] __arm64_sys_unshare+0x40/0x54 [ 50.365080][ T6512] invoke_syscall+0x98/0x244 [ 50.365092][ T6512] el0_svc_common+0xec/0x23c [ 50.365103][ T6512] do_el0_svc+0x4c/0x5c [ 50.365115][ T6512] el0_svc+0x60/0x1d8 [ 50.365127][ T6512] el0t_64_sync_handler+0x44/0x104 [ 50.365139][ T6512] el0t_64_sync+0x198/0x19c [ 50.433769][ T4708] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 50.783319][ T6534] syz_tun: entered allmulticast mode [ 50.783558][ T6534] syz_tun: left allmulticast mode [ 50.906686][ T50] Bluetooth: hci4: command tx timeout [ 51.013177][ T6571] ip6gre1: entered promiscuous mode [ 51.013201][ T6571] ip6gre1: entered allmulticast mode [ 51.048997][ T6573] syz_tun: entered allmulticast mode [ 51.049289][ T6573] syz_tun: left allmulticast mode [ 51.054131][ T6575] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 51.054335][ T6575] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 51.432668][ T6598] FAULT_INJECTION: forcing a failure. [ 51.432668][ T6598] name failslab, interval 1, probability 0, space 0, times 0 [ 51.432689][ T6598] CPU: 0 UID: 0 PID: 6598 Comm: syz.2.595 Not tainted syzkaller #0 PREEMPT [ 51.432699][ T6598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 51.432705][ T6598] Call trace: [ 51.432708][ T6598] show_stack+0x2c/0x3c (C) [ 51.432728][ T6598] __dump_stack+0x30/0x40 [ 51.432740][ T6598] dump_stack_lvl+0xd8/0x12c [ 51.432751][ T6598] dump_stack+0x1c/0x28 [ 51.432762][ T6598] should_fail_ex+0x418/0x58c [ 51.432775][ T6598] should_failslab+0xc4/0x120 [ 51.432788][ T6598] __kmalloc_cache_noprof+0x94/0x5fc [ 51.432798][ T6598] cuse_channel_open+0x1bc/0x6c0 [ 51.432807][ T6598] misc_open+0x2dc/0x338 [ 51.432820][ T6598] chrdev_open+0x398/0x3e8 [ 51.432830][ T6598] do_dentry_open+0x5c4/0xfbc [ 51.432841][ T6598] vfs_open+0x44/0x2dc [ 51.432852][ T6598] path_openat+0x1084/0x18f0 [ 51.432862][ T6598] do_file_open+0x1c8/0x2e8 [ 51.432872][ T6598] do_sys_openat2+0x114/0x1e8 [ 51.432883][ T6598] do_sys_open+0xb0/0xe0 [ 51.432894][ T6598] __arm64_sys_openat+0xa8/0xc4 [ 51.432905][ T6598] invoke_syscall+0x98/0x244 [ 51.432917][ T6598] el0_svc_common+0xec/0x23c [ 51.432928][ T6598] do_el0_svc+0x4c/0x5c [ 51.432939][ T6598] el0_svc+0x60/0x1d8 [ 51.432952][ T6598] el0t_64_sync_handler+0x44/0x104 [ 51.432963][ T6598] el0t_64_sync+0x198/0x19c [ 51.477112][ T6602] loop2: detected capacity change from 0 to 512 [ 51.501945][ T6602] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 51.523768][ T93] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1317: group 0, block bitmap and bg descriptor inconsistent: 96 vs 65376 free clusters [ 51.525036][ T93] EXT4-fs (loop2): Delayed block allocation failed for inode 15 at logical offset 65537 with max blocks 1 with error 28 [ 51.525052][ T93] EXT4-fs (loop2): This should not happen!! Data will be lost [ 51.525052][ T93] [ 51.525059][ T93] EXT4-fs (loop2): Total free blocks count 0 [ 51.525065][ T93] EXT4-fs (loop2): Free/Dirty block details [ 51.525074][ T93] EXT4-fs (loop2): free_blocks=65280 [ 51.525085][ T93] EXT4-fs (loop2): dirty_blocks=1 [ 51.525090][ T93] EXT4-fs (loop2): Block reservation details [ 51.525096][ T93] EXT4-fs (loop2): i_reserved_data_blocks=1 [ 51.547004][ T4717] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 51.639622][ T6609] loop2: detected capacity change from 0 to 1024 [ 51.668903][ T6612] loop1: detected capacity change from 0 to 1024 [ 51.719145][ T6612] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 52.075031][ T4708] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 52.529400][ T6636] syzkaller0: entered promiscuous mode [ 52.529417][ T6636] syzkaller0: entered allmulticast mode [ 52.563347][ T6641] bridge0: port 3(vxlan0) entered blocking state [ 52.563389][ T6641] bridge0: port 3(vxlan0) entered disabled state [ 52.563461][ T6641] vxlan0: entered allmulticast mode [ 52.567819][ T6641] vxlan0: entered promiscuous mode [ 52.724860][ T6659] loop1: detected capacity change from 0 to 1024 [ 52.739120][ T6659] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 52.834167][ T4708] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 52.936338][ T6675] 0: reclassify loop, rule prio 0, protocol 03 [ 52.940078][ T6673] syz_tun: entered allmulticast mode [ 52.959270][ T6668] netlink: 4 bytes leftover after parsing attributes in process `syz.2.619'. [ 53.457926][ T6714] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci4/hci4:200/input9 [ 53.790264][ T6725] netlink: 4 bytes leftover after parsing attributes in process `syz.2.639'. [ 53.849418][ T6738] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 53.852039][ T50] Bluetooth: min 6 > max 0 [ 53.857953][ T6738] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 53.980385][ T6750] loop1: detected capacity change from 0 to 1024 [ 54.014268][ T6750] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 54.042381][ T4708] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 54.681948][ T12] IPVS: starting estimator thread 0... [ 54.768138][ T6787] IPVS: using max 53 ests per chain, 127200 per kthread [ 54.782360][ T6794] syzkaller0: entered promiscuous mode [ 54.782377][ T6794] syzkaller0: entered allmulticast mode [ 54.875400][ T6806] The dccp option matching is deprecated and scheduled to be removed in 2027. [ 54.875400][ T6806] Please contact the netfilter-devel mailing list or update your nftables rules. [ 54.902366][ T6808] syz_tun: entered allmulticast mode [ 54.910614][ T6808] syz_tun: left allmulticast mode [ 54.996393][ T6816] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 55.104174][ T6826] netlink: set zone limit has 8 unknown bytes [ 55.253011][ T6835] syzkaller0: entered promiscuous mode [ 55.253033][ T6835] syzkaller0: entered allmulticast mode [ 55.347724][ T6854] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 55.347904][ T6854] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 55.390913][ T6856] syzkaller0: entered promiscuous mode [ 55.390930][ T6856] syzkaller0: entered allmulticast mode [ 55.464746][ T6868] loop4: detected capacity change from 0 to 1024 [ 55.497483][ T6868] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 55.505894][ T4715] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 55.629576][ T865] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 55.769804][ T6904] syz_tun: entered allmulticast mode [ 55.770097][ T6904] syz_tun: left allmulticast mode [ 55.789302][ T865] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 55.789973][ T865] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 55.789986][ T865] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 55.789997][ T865] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 55.790006][ T865] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 55.790022][ T865] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 55.791216][ T865] usb 1-1: config 0 descriptor?? [ 55.829316][ T6909] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 55.834205][ T6909] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 55.842693][ T6906] syzkaller0: entered promiscuous mode [ 55.842708][ T6906] syzkaller0: entered allmulticast mode [ 55.866826][ T50] Bluetooth: hci2: command tx timeout [ 55.930935][ T40] Bluetooth: hci5: Frame reassembly failed (-84) [ 56.217768][ T865] plantronics 0003:047F:FFFF.0003: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 56.555701][ T6942] syzkaller0: entered promiscuous mode [ 56.555719][ T6942] syzkaller0: entered allmulticast mode [ 56.605316][ T6944] syz_tun: left allmulticast mode [ 56.630964][ T6946] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 56.743268][ T6948] netlink: 4 bytes leftover after parsing attributes in process `syz.4.712'. [ 56.876255][ T6974] netlink: 'syz.4.718': attribute type 19 has an invalid length. [ 56.876275][ T6974] netlink: 28 bytes leftover after parsing attributes in process `syz.4.718'. [ 57.019745][ T6985] syzkaller0: entered promiscuous mode [ 57.019764][ T6985] syzkaller0: entered allmulticast mode [ 57.304811][ T4469] usb 1-1: USB disconnect, device number 7 [ 57.350557][ T6998] loop2: detected capacity change from 0 to 2048 [ 57.363406][ T6998] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 57.603277][ T7017] xt_CT: You must specify a L4 protocol and not use inversions on it [ 57.811692][ T7025] syzkaller0: entered promiscuous mode [ 57.811708][ T7025] syzkaller0: entered allmulticast mode [ 57.926250][ T7046] fuse: Bad value for 'fd' [ 57.946987][ T4718] Bluetooth: hci5: command 0x1003 tx timeout [ 57.947059][ T50] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 58.007775][ T7059] syzkaller0: entered promiscuous mode [ 58.007792][ T7059] syzkaller0: entered allmulticast mode [ 58.170540][ T7065] netlink: 4 bytes leftover after parsing attributes in process `syz.0.736'. [ 58.225605][ T4717] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 58.291227][ T7098] syzkaller1: entered promiscuous mode [ 58.291246][ T7098] syzkaller1: entered allmulticast mode [ 58.396249][ T7115] syzkaller0: entered promiscuous mode [ 58.396267][ T7115] syzkaller0: entered allmulticast mode [ 58.460983][ T4720] logitech-hidpp-device 0003:046D:C082.0004: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 58.504714][ T7132] fido_id[7132]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 58.576380][ T7146] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 58.576557][ T7146] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 58.650655][ T7135] netlink: 4 bytes leftover after parsing attributes in process `syz.3.754'. [ 58.812098][ T7179] syzkaller1: entered promiscuous mode [ 58.812115][ T7179] syzkaller1: entered allmulticast mode [ 58.848133][ T7191] netlink: 20 bytes leftover after parsing attributes in process `syz.2.767'. [ 58.986340][ T7203] netlink: 4 bytes leftover after parsing attributes in process `syz.3.769'. [ 59.014413][ T7222] FAULT_INJECTION: forcing a failure. [ 59.014413][ T7222] name failslab, interval 1, probability 0, space 0, times 0 [ 59.014438][ T7222] CPU: 1 UID: 0 PID: 7222 Comm: syz.0.775 Not tainted syzkaller #0 PREEMPT [ 59.014450][ T7222] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 59.014455][ T7222] Call trace: [ 59.014458][ T7222] show_stack+0x2c/0x3c (C) [ 59.014478][ T7222] __dump_stack+0x30/0x40 [ 59.014491][ T7222] dump_stack_lvl+0xd8/0x12c [ 59.014502][ T7222] dump_stack+0x1c/0x28 [ 59.014513][ T7222] should_fail_ex+0x418/0x58c [ 59.014526][ T7222] should_failslab+0xc4/0x120 [ 59.014540][ T7222] kmem_cache_alloc_noprof+0x94/0x5d4 [ 59.014549][ T7222] __kernfs_new_node+0xf0/0x7d8 [ 59.014560][ T7222] kernfs_new_node+0xe8/0x130 [ 59.014570][ T7222] kernfs_create_dir_ns+0x58/0x138 [ 59.014581][ T7222] sysfs_create_dir_ns+0x120/0x1f4 [ 59.014593][ T7222] kobject_add_internal+0x290/0x6f0 [ 59.014603][ T7222] kobject_add_varg+0x9c/0xe8 [ 59.014616][ T7222] kobject_add+0x110/0x1c8 [ 59.014628][ T7222] device_add+0x394/0x9e0 [ 59.014638][ T7222] wakeup_source_sysfs_add+0x1b4/0x2a4 [ 59.014651][ T7222] wakeup_source_register+0x158/0x2fc [ 59.014662][ T7222] ep_create_wakeup_source+0xf4/0x240 [ 59.014675][ T7222] ep_insert+0xab8/0x12d4 [ 59.014685][ T7222] do_epoll_ctl_file+0xa0c/0xbd4 [ 59.014697][ T7222] do_epoll_ctl+0xa0/0x140 [ 59.014708][ T7222] __arm64_sys_epoll_ctl+0x164/0x1b8 [ 59.014720][ T7222] invoke_syscall+0x98/0x244 [ 59.014732][ T7222] el0_svc_common+0xec/0x23c [ 59.014744][ T7222] do_el0_svc+0x4c/0x5c [ 59.014755][ T7222] el0_svc+0x60/0x1d8 [ 59.014766][ T7222] el0t_64_sync_handler+0x44/0x104 [ 59.014778][ T7222] el0t_64_sync+0x198/0x19c [ 59.014794][ T7222] kobject: kobject_add_internal failed for wakeup11 (error: -12 parent: wakeup) [ 59.119642][ T7238] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 59.119806][ T7238] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 59.175032][ T7240] syzkaller0: entered promiscuous mode [ 59.175049][ T7240] syzkaller0: entered allmulticast mode [ 59.272401][ T7242] netlink: 4 bytes leftover after parsing attributes in process `syz.3.785'. [ 59.317967][ T4720] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 59.321000][ T7256] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 59.321173][ T7256] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 59.344591][ T7258] 9p: Bad value for 'rfdno' [ 59.401825][ T7264] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 59.402027][ T7264] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 59.425579][ T7266] netlink: zone id is out of range [ 59.425681][ T7266] netlink: get zone limit has 8 unknown bytes [ 59.467465][ T4720] usb 1-1: Using ep0 maxpacket: 32 [ 59.468438][ T4720] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 59.469127][ T4720] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 59.469142][ T4720] usb 1-1: config 0 has no interface number 0 [ 59.469155][ T4720] usb 1-1: config 0 interface 184 has no altsetting 0 [ 59.470447][ T4720] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 59.470458][ T4720] usb 1-1: Product: syz [ 59.470464][ T4720] usb 1-1: Manufacturer: syz [ 59.470470][ T4720] usb 1-1: SerialNumber: syz [ 59.471789][ T4720] usb 1-1: config 0 descriptor?? [ 59.536028][ T7270] loop2: detected capacity change from 0 to 1024 [ 59.562894][ T7270] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 59.575115][ T4717] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 59.594146][ T7274] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 59.594404][ T7274] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 59.642394][ T7276] netlink: 4 bytes leftover after parsing attributes in process `syz.4.798'. [ 59.763598][ T7284] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 59.763835][ T7284] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 59.876508][ T4720] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 59.876532][ T4720] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 59.876542][ T4720] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_bind [ 59.877440][ T4720] smsc75xx 1-1:0.184: probe with driver smsc75xx failed with error -71 [ 59.881918][ T4720] usb 1-1: USB disconnect, device number 8 [ 59.960323][ T7300] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 59.960503][ T7300] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 60.073824][ T7317] loop3: detected capacity change from 0 to 256 [ 60.253898][ T7346] No control pipe specified [ 60.300400][ T7352] syzkaller0: entered promiscuous mode [ 60.300417][ T7352] syzkaller0: entered allmulticast mode [ 60.402687][ T7360] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 60.403303][ T7360] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 60.521968][ T7370] netlink: 4 bytes leftover after parsing attributes in process `syz.0.828'. [ 60.863368][ T7412] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 60.863545][ T7412] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 60.988741][ T7426] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 60.988909][ T7426] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 61.025931][ T7428] netlink: 4 bytes leftover after parsing attributes in process `syz.2.845'. [ 61.187957][ T7447] syz_tun: entered allmulticast mode [ 61.188322][ T7447] syz_tun: left allmulticast mode [ 61.217317][ T4720] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 61.376881][ T4720] usb 1-1: Using ep0 maxpacket: 32 [ 61.561166][ T4720] usb 1-1: unable to get BOS descriptor or descriptor too short [ 61.561203][ T4720] usb 1-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 61.561877][ T4720] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 61.561891][ T4720] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 61.561900][ T4720] usb 1-1: config 14 has no interface number 0 [ 61.561908][ T4720] usb 1-1: config 14 has no interface number 1 [ 61.561922][ T4720] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 61.561932][ T4720] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 61.561941][ T4720] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 61.561951][ T4720] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 61.561962][ T4720] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 61.561972][ T4720] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 61.561982][ T4720] usb 1-1: config 14 interface 57 has no altsetting 0 [ 61.561989][ T4720] usb 1-1: config 14 interface 228 has no altsetting 0 [ 61.564237][ T4720] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 61.564249][ T4720] usb 1-1: Product: syz [ 61.564255][ T4720] usb 1-1: Manufacturer: syz [ 61.564261][ T4720] usb 1-1: SerialNumber: syz [ 61.659804][ T7477] loop3: detected capacity change from 0 to 2048 [ 61.680389][ T7477] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 61.744710][ T7488] tipc: Enabling of bearer rejected, failed to enable media [ 61.774810][ T7491] syzkaller0: entered promiscuous mode [ 61.774844][ T7491] syzkaller0: entered allmulticast mode [ 61.990925][ T7493] xt_CT: You must specify a L4 protocol and not use inversions on it [ 62.107267][ T4720] legousbtower 1-1:14.57: interrupt endpoints not found [ 62.120051][ T4888] logitech-hidpp-device 0003:046D:C082.0005: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 62.132449][ T7496] syzkaller0: entered promiscuous mode [ 62.132466][ T7496] syzkaller0: entered allmulticast mode [ 62.139368][ T7496] tipc: Started in network mode [ 62.139386][ T7496] tipc: Node identity c6a9eabbcab7, cluster identity 4711 [ 62.141222][ T7496] tipc: Enabled bearer , priority 0 [ 62.154875][ T7496] tipc: Resetting bearer [ 62.158635][ T7495] tipc: Resetting bearer [ 62.173201][ T7495] tipc: Disabling bearer [ 62.180955][ T7500] fido_id[7500]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 62.191305][ T7504] syz_tun: entered allmulticast mode [ 62.194632][ T7504] syz_tun: left allmulticast mode [ 62.485871][ T7514] warning: `syz.4.878' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 62.550740][ T7520] autofs: Unknown parameter './file0' [ 62.552165][ T4707] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 62.578035][ T7522] FAULT_INJECTION: forcing a failure. [ 62.578035][ T7522] name failslab, interval 1, probability 0, space 0, times 0 [ 62.578055][ T7522] CPU: 1 UID: 0 PID: 7522 Comm: syz.3.882 Not tainted syzkaller #0 PREEMPT [ 62.578065][ T7522] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 62.578071][ T7522] Call trace: [ 62.578074][ T7522] show_stack+0x2c/0x3c (C) [ 62.578093][ T7522] __dump_stack+0x30/0x40 [ 62.578105][ T7522] dump_stack_lvl+0xd8/0x12c [ 62.578116][ T7522] dump_stack+0x1c/0x28 [ 62.578127][ T7522] should_fail_ex+0x418/0x58c [ 62.578141][ T7522] should_failslab+0xc4/0x120 [ 62.578154][ T7522] kmem_cache_alloc_lru_noprof+0x98/0x5d8 [ 62.578163][ T7522] __d_alloc+0x50/0x600 [ 62.578173][ T7522] d_alloc_parallel+0xc4/0xf2c [ 62.578182][ T7522] __lookup_slow+0x90/0x2b4 [ 62.578191][ T7522] lookup_slow+0x60/0x84 [ 62.578207][ T7522] link_path_walk+0xb0c/0x1584 [ 62.578218][ T7522] path_openat+0x160/0x18f0 [ 62.578229][ T7522] do_file_open+0x1c8/0x2e8 [ 62.578239][ T7522] do_sys_openat2+0x114/0x1e8 [ 62.578251][ T7522] do_sys_open+0xb0/0xe0 [ 62.578262][ T7522] __arm64_sys_openat+0xa8/0xc4 [ 62.578273][ T7522] invoke_syscall+0x98/0x244 [ 62.578286][ T7522] el0_svc_common+0xec/0x23c [ 62.578297][ T7522] do_el0_svc+0x4c/0x5c [ 62.578308][ T7522] el0_svc+0x60/0x1d8 [ 62.578320][ T7522] el0t_64_sync_handler+0x44/0x104 [ 62.578331][ T7522] el0t_64_sync+0x198/0x19c [ 62.622256][ T7524] syzkaller0: entered promiscuous mode [ 62.622285][ T7524] syzkaller0: entered allmulticast mode [ 62.623040][ T7526] tipc: Enabling of bearer rejected, failed to enable media [ 62.649652][ T7530] syz_tun: entered allmulticast mode [ 62.650149][ T7530] syz_tun: left allmulticast mode [ 62.675696][ T4720] legousbtower 1-1:14.228: LEGO USB Tower firmware version is 170.80 build 16178 [ 62.679712][ T4720] legousbtower 1-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 62.747261][ T7545] autofs: Unknown parameter './file0' [ 62.756888][ T7546] __nla_validate_parse: 1 callbacks suppressed [ 62.756899][ T7546] netlink: 4 bytes leftover after parsing attributes in process `syz.2.893'. [ 62.842396][ T7554] netlink: 252 bytes leftover after parsing attributes in process `syz.2.898'. [ 62.842413][ T7554] FAULT_INJECTION: forcing a failure. [ 62.842413][ T7554] name failslab, interval 1, probability 0, space 0, times 0 [ 62.842428][ T7554] CPU: 0 UID: 0 PID: 7554 Comm: syz.2.898 Not tainted syzkaller #0 PREEMPT [ 62.842439][ T7554] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 62.842444][ T7554] Call trace: [ 62.842447][ T7554] show_stack+0x2c/0x3c (C) [ 62.842468][ T7554] __dump_stack+0x30/0x40 [ 62.842480][ T7554] dump_stack_lvl+0xd8/0x12c [ 62.842492][ T7554] dump_stack+0x1c/0x28 [ 62.842503][ T7554] should_fail_ex+0x418/0x58c [ 62.842516][ T7554] should_failslab+0xc4/0x120 [ 62.842530][ T7554] __kmalloc_cache_noprof+0x94/0x5fc [ 62.842539][ T7554] nf_tables_newtable+0x460/0x10f4 [ 62.842549][ T7554] nfnetlink_rcv+0xc8c/0x16ec [ 62.842557][ T7554] netlink_unicast+0x600/0x7f8 [ 62.842568][ T7554] netlink_sendmsg+0x648/0x948 [ 62.842579][ T7554] __sock_sendmsg+0xc8/0x17c [ 62.842589][ T7554] ____sys_sendmsg+0x3d0/0x6c8 [ 62.842600][ T7554] ___sys_sendmsg+0x198/0x224 [ 62.842611][ T7554] __sys_sendmsg+0x158/0x204 [ 62.842621][ T7554] __arm64_sys_sendmsg+0x88/0x9c [ 62.842632][ T7554] invoke_syscall+0x98/0x244 [ 62.842644][ T7554] el0_svc_common+0xec/0x23c [ 62.842656][ T7554] do_el0_svc+0x4c/0x5c [ 62.842667][ T7554] el0_svc+0x60/0x1d8 [ 62.842679][ T7554] el0t_64_sync_handler+0x44/0x104 [ 62.842691][ T7554] el0t_64_sync+0x198/0x19c [ 62.850663][ T7556] tipc: Enabling of bearer rejected, failed to enable media [ 63.137662][ T7560] syzkaller0: entered promiscuous mode [ 63.137679][ T7560] syzkaller0: entered allmulticast mode [ 63.712771][ T4888] usb 1-1: USB disconnect, device number 9 [ 63.717226][ T4888] legousbtower 1-1:14.228: LEGO USB Tower #-160 now disconnected [ 63.759056][ T7578] autofs: Bad value for 'fd' [ 63.777939][ T7583] syz_tun: entered allmulticast mode [ 63.778384][ T7583] syz_tun: left allmulticast mode [ 63.798087][ T7585] netlink: 4 bytes leftover after parsing attributes in process `syz.1.912'. [ 63.856184][ T7593] loop2: detected capacity change from 0 to 1024 [ 63.859618][ T7593] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 63.862288][ T7593] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 64.123850][ T4717] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 64.152046][ T7601] syzkaller0: entered promiscuous mode [ 64.152064][ T7601] syzkaller0: entered allmulticast mode [ 64.152813][ T7604] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 64.153797][ T7604] sch_tbf: burst 10 is lower than device lo mtu (65550) ! [ 64.217299][ T7611] tipc: Enabling of bearer rejected, failed to enable media [ 64.224937][ T7613] syz_tun: entered allmulticast mode [ 64.225461][ T7613] syz_tun: left allmulticast mode [ 64.290319][ T7621] fuse: Bad value for 'group_id' [ 64.290334][ T7621] fuse: Bad value for 'group_id' [ 64.333451][ T7626] loop4: detected capacity change from 0 to 1024 [ 64.349422][ T7626] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 64.363139][ T7626] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1317: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 64.367332][ T7626] EXT4-fs (loop4): Remounting filesystem read-only [ 64.384246][ T4715] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 64.426527][ T7642] autofs: Bad value for 'fd' [ 64.469511][ T7645] syzkaller0: entered promiscuous mode [ 64.469531][ T7645] syzkaller0: entered allmulticast mode [ 64.484270][ T7648] tipc: Enabling of bearer rejected, failed to enable media [ 64.509363][ T1593] ieee802154 phy0 wpan0: encryption failed: -22 [ 64.509402][ T1593] ieee802154 phy1 wpan1: encryption failed: -22 [ 64.524015][ T26] cfg80211: failed to load regulatory.db [ 64.617826][ T7662] netlink: 32 bytes leftover after parsing attributes in process `syz.1.943'. [ 64.649628][ T7665] netlink: 88 bytes leftover after parsing attributes in process `syz.1.944'. [ 64.676451][ T7667] ima: policy update failed [ 64.677536][ T30] audit: type=1807 audit(64.640:2): UNKNOWN=? res=0 [ 64.677558][ T30] audit: type=1802 audit(64.640:3): pid=7670 uid=0 auid=4294967295 ses=4294967295 subj=_ op=update_policy cause=invalid-policy comm="syz.3.945" res=0 errno=0 [ 64.677579][ T30] audit: type=1802 audit(64.640:4): pid=7667 uid=0 auid=4294967295 ses=4294967295 subj=_ op=policy_update cause=failed comm="syz.3.945" res=0 errno=0 [ 65.283973][ T7712] syzkaller0: entered promiscuous mode [ 65.283994][ T7712] syzkaller0: entered allmulticast mode [ 65.955645][ T7718] syz_tun: entered allmulticast mode [ 65.960264][ T7725] syz_tun: left allmulticast mode [ 65.979096][ T7729] netlink: 20 bytes leftover after parsing attributes in process `syz.4.965'. [ 65.979123][ T7729] netlink: set zone limit has 8 unknown bytes [ 66.022175][ T7733] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 66.022354][ T7733] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 66.152632][ T7750] syz_tun: entered allmulticast mode [ 66.157026][ T7750] syz_tun: left allmulticast mode [ 66.197135][ T7759] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 66.197325][ T7759] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 66.223316][ T7761] syz.1.981 (7761): drop_caches: 2 [ 66.301317][ T7775] loop4: detected capacity change from 0 to 2048 [ 66.323909][ T7775] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 66.325695][ T7775] EXT4-fs error (device loop4): ext4_lookup:1779: inode #2: comm syz.4.988: bad inode number: 12 [ 66.326492][ T7775] EXT4-fs (loop4): Remounting filesystem read-only [ 66.338912][ T4715] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 66.376773][ T4888] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 66.400738][ T7789] loop4: detected capacity change from 0 to 512 [ 66.470418][ T7795] netlink: 104 bytes leftover after parsing attributes in process `syz.4.996'. [ 66.524226][ T7803] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 66.524412][ T7803] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 66.536729][ T4888] usb 1-1: Using ep0 maxpacket: 32 [ 66.546177][ T4888] usb 1-1: unable to get BOS descriptor or descriptor too short [ 66.546209][ T4888] usb 1-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 66.548308][ T4888] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 66.548323][ T4888] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 66.548332][ T4888] usb 1-1: config 14 has no interface number 0 [ 66.548339][ T4888] usb 1-1: config 14 has no interface number 1 [ 66.548354][ T4888] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 66.548363][ T4888] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 66.548373][ T4888] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 66.548383][ T4888] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 66.548394][ T4888] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 66.548404][ T4888] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 66.548414][ T4888] usb 1-1: config 14 interface 57 has no altsetting 0 [ 66.548421][ T4888] usb 1-1: config 14 interface 228 has no altsetting 0 [ 66.562286][ T4888] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 66.562304][ T4888] usb 1-1: Product: syz [ 66.562312][ T4888] usb 1-1: Manufacturer: syz [ 66.562319][ T4888] usb 1-1: SerialNumber: syz [ 66.577534][ T7809] autofs: Unknown parameter '0x0000000000000000' [ 66.725317][ T7823] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1007'. [ 66.753518][ T40] IPVS: starting estimator thread 0... [ 66.836716][ T7824] IPVS: using max 58 ests per chain, 139200 per kthread [ 66.868512][ T7828] syzkaller0: entered promiscuous mode [ 66.868530][ T7828] syzkaller0: entered allmulticast mode [ 66.982306][ T4888] legousbtower 1-1:14.57: interrupt endpoints not found [ 67.051513][ T7831] team0: Port device vxlan0 added [ 67.067905][ T93] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 67.068530][ T40] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 67.068553][ T40] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 67.068569][ T40] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 67.085156][ T7833] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 67.085337][ T7833] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 67.383356][ T4888] legousbtower 1-1:14.228: LEGO USB Tower firmware version is 170.80 build 16178 [ 67.384043][ T4888] legousbtower 1-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 68.296534][ T26] usb 1-1: USB disconnect, device number 10 [ 68.306236][ T26] legousbtower 1-1:14.228: LEGO USB Tower #-160 now disconnected [ 68.777361][ T7858] i2c i2c-0: new_device: Can't parse I2C address [ 68.793778][ T7860] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1023'. [ 68.978079][ T3270] IPVS: starting estimator thread 0... [ 69.002504][ T4718] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 69.004307][ T4718] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 69.004964][ T4718] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 69.005847][ T4718] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 69.013732][ T4718] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 69.077470][ T7880] IPVS: using max 44 ests per chain, 105600 per kthread [ 69.167542][ T7881] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.167611][ T7881] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.167664][ T7881] bridge_slave_0: entered allmulticast mode [ 69.168068][ T7881] bridge_slave_0: entered promiscuous mode [ 69.175051][ T7881] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.175102][ T7881] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.175153][ T7881] bridge_slave_1: entered allmulticast mode [ 69.175581][ T7881] bridge_slave_1: entered promiscuous mode [ 69.191514][ T7881] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 69.192341][ T7881] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 69.202649][ T7881] team0: Port device team_slave_0 added [ 69.203366][ T7881] team0: Port device team_slave_1 added [ 69.211882][ T7881] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 69.211892][ T7881] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.211906][ T7881] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 69.212854][ T7881] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 69.212862][ T7881] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 69.212878][ T7881] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 69.241829][ T7881] hsr_slave_0: entered promiscuous mode [ 69.242115][ T7881] hsr_slave_1: entered promiscuous mode [ 69.242308][ T7881] debugfs: 'hsr0' already exists in 'hsr' [ 69.242322][ T7881] Cannot create hsr debugfs directory [ 69.600096][ T7811] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 69.603487][ T7881] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 69.617167][ T7881] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 69.617539][ T7881] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 69.625699][ T7881] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 69.633717][ T7881] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 69.645261][ T7881] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 69.645605][ T7881] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 69.662781][ T7881] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 69.680493][ T7881] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.680524][ T7881] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.680598][ T7881] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.680627][ T7881] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.723924][ T7881] 8021q: adding VLAN 0 to HW filter on device bond0 [ 69.731137][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 69.732604][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 69.752614][ T7881] 8021q: adding VLAN 0 to HW filter on device team0 [ 69.768895][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 69.768924][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 69.769264][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 69.769283][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 69.796151][ T7927] syz_tun: entered allmulticast mode [ 69.810379][ T7927] syz_tun: left allmulticast mode [ 69.813127][ T7936] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 69.814074][ T7936] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 69.828579][ T7931] loop4: detected capacity change from 0 to 512 [ 69.986054][ T7881] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 70.039424][ T7949] UHID_CREATE from different security context by process 491 (syz.4.1044), this is not allowed. [ 70.071543][ T7972] syzkaller1: entered promiscuous mode [ 70.071560][ T7972] syzkaller1: entered allmulticast mode [ 70.124468][ T7981] netlink: 'syz.4.1049': attribute type 25 has an invalid length. [ 70.140920][ T7881] veth0_vlan: entered promiscuous mode [ 70.144991][ T7881] veth1_vlan: entered promiscuous mode [ 70.163661][ T7881] veth0_macvtap: entered promiscuous mode [ 70.165159][ T7881] veth1_macvtap: entered promiscuous mode [ 70.172433][ T7881] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 70.174676][ T7881] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 70.216857][ T3367] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.224025][ T1162] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.224040][ T1162] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.253320][ T3367] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.253375][ T3367] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 70.253385][ T3367] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 70.253571][ T3367] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.282680][ T7996] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1053'. [ 70.329049][ T1162] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 70.340857][ T8003] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 70.341033][ T8003] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 70.610581][ T8003] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 70.611190][ T8003] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 70.641326][ T8012] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 70.641505][ T8012] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 70.747509][ T4718] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 70.748635][ T4718] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 70.748988][ T4718] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 70.750226][ T4718] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 70.752501][ T4718] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 70.771391][ T8019] FAULT_INJECTION: forcing a failure. [ 70.771391][ T8019] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 70.771410][ T8019] CPU: 1 UID: 0 PID: 8019 Comm: syz.4.1062 Not tainted syzkaller #0 PREEMPT [ 70.771420][ T8019] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 70.771426][ T8019] Call trace: [ 70.771429][ T8019] show_stack+0x2c/0x3c (C) [ 70.771448][ T8019] __dump_stack+0x30/0x40 [ 70.771461][ T8019] dump_stack_lvl+0xd8/0x12c [ 70.771472][ T8019] dump_stack+0x1c/0x28 [ 70.771483][ T8019] should_fail_ex+0x418/0x58c [ 70.771497][ T8019] should_fail+0x14/0x24 [ 70.771508][ T8019] should_fail_usercopy+0x20/0x30 [ 70.771520][ T8019] copy_from_sockptr_offset+0x84/0x1e8 [ 70.771533][ T8019] do_tcp_setsockopt+0x364/0x1a48 [ 70.771543][ T8019] tcp_setsockopt+0x68/0xe8 [ 70.771553][ T8019] sock_common_setsockopt+0xb0/0xcc [ 70.771564][ T8019] do_sock_setsockopt+0x1f0/0x330 [ 70.771576][ T8019] __sys_setsockopt+0x104/0x170 [ 70.771586][ T8019] __arm64_sys_setsockopt+0xc8/0xe4 [ 70.771597][ T8019] invoke_syscall+0x98/0x244 [ 70.771610][ T8019] el0_svc_common+0xec/0x23c [ 70.771622][ T8019] do_el0_svc+0x4c/0x5c [ 70.771633][ T8019] el0_svc+0x60/0x1d8 [ 70.771645][ T8019] el0t_64_sync_handler+0x44/0x104 [ 70.771657][ T8019] el0t_64_sync+0x198/0x19c [ 70.839068][ T8030] input: syz0 as /devices/virtual/input/input11 [ 70.843578][ T8012] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 70.843771][ T8012] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 70.906773][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 70.935569][ T8015] bridge0: port 1(bridge_slave_0) entered blocking state [ 70.935651][ T8015] bridge0: port 1(bridge_slave_0) entered disabled state [ 70.935741][ T8015] bridge_slave_0: entered allmulticast mode [ 70.936160][ T8015] bridge_slave_0: entered promiscuous mode [ 70.944773][ T8015] bridge0: port 2(bridge_slave_1) entered blocking state [ 70.944823][ T8015] bridge0: port 2(bridge_slave_1) entered disabled state [ 70.944938][ T8015] bridge_slave_1: entered allmulticast mode [ 70.945351][ T8015] bridge_slave_1: entered promiscuous mode [ 70.968311][ T8015] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 70.973996][ T8015] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 70.986296][ T8015] team0: Port device team_slave_0 added [ 70.995364][ T8015] team0: Port device team_slave_1 added [ 71.007069][ T8015] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 71.007082][ T8015] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.007096][ T8015] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 71.007691][ T8015] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 71.007699][ T8015] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 71.007714][ T8015] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 71.036301][ T8015] hsr_slave_0: entered promiscuous mode [ 71.039037][ T8015] hsr_slave_1: entered promiscuous mode [ 71.039262][ T8015] debugfs: 'hsr0' already exists in 'hsr' [ 71.039274][ T8015] Cannot create hsr debugfs directory [ 71.083676][ T50] Bluetooth: hci4: command tx timeout [ 71.108245][ T8015] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 71.109583][ T8015] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 71.109943][ T8015] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 71.110782][ T8015] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 71.111112][ T8015] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 71.111958][ T8015] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 71.112291][ T8015] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 71.113099][ T8015] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 71.153086][ T8015] 8021q: adding VLAN 0 to HW filter on device bond0 [ 71.159647][ T8015] 8021q: adding VLAN 0 to HW filter on device team0 [ 71.164356][ T1162] bridge0: port 1(bridge_slave_0) entered blocking state [ 71.164380][ T1162] bridge0: port 1(bridge_slave_0) entered forwarding state [ 71.164895][ T1162] bridge0: port 2(bridge_slave_1) entered blocking state [ 71.164913][ T1162] bridge0: port 2(bridge_slave_1) entered forwarding state [ 71.276292][ T8015] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 71.339437][ T8015] veth0_vlan: entered promiscuous mode [ 71.341633][ T8015] veth1_vlan: entered promiscuous mode [ 71.353457][ T8015] veth0_macvtap: entered promiscuous mode [ 71.354975][ T8015] veth1_macvtap: entered promiscuous mode [ 71.362859][ T8015] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 71.365108][ T8015] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 71.406949][ T865] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 71.411918][ T1162] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 71.428261][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.428279][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.443473][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.443490][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.447314][ T3367] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.447522][ T3367] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.447829][ T3367] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.447902][ T3367] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 71.474357][ T4718] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 71.475152][ T4718] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 71.475510][ T4718] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 71.475917][ T4718] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 71.476232][ T4718] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 71.492421][ T1162] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 71.522535][ T1162] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 71.566769][ T865] usb 1-1: Using ep0 maxpacket: 32 [ 71.579564][ T865] usb 1-1: unable to get BOS descriptor or descriptor too short [ 71.579593][ T865] usb 1-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 71.580269][ T865] usb 1-1: config 14 has an invalid interface number: 57 but max is 1 [ 71.580278][ T865] usb 1-1: config 14 has an invalid interface number: 228 but max is 1 [ 71.580287][ T865] usb 1-1: config 14 has no interface number 0 [ 71.580293][ T865] usb 1-1: config 14 has no interface number 1 [ 71.580307][ T865] usb 1-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 71.580317][ T865] usb 1-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 71.580326][ T865] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 71.580336][ T865] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 71.580347][ T865] usb 1-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 71.580357][ T865] usb 1-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 71.580367][ T865] usb 1-1: config 14 interface 57 has no altsetting 0 [ 71.580374][ T865] usb 1-1: config 14 interface 228 has no altsetting 0 [ 71.583150][ T865] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 71.583161][ T865] usb 1-1: Product: syz [ 71.583168][ T865] usb 1-1: Manufacturer: syz [ 71.583174][ T865] usb 1-1: SerialNumber: syz [ 71.634526][ T1162] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 71.658502][ T8092] netlink: 'syz.6.1077': attribute type 6 has an invalid length. [ 71.767466][ T1162] bridge_slave_1: left allmulticast mode [ 71.767494][ T1162] bridge_slave_1: left promiscuous mode [ 71.768286][ T1162] bridge0: port 2(bridge_slave_1) entered disabled state [ 71.782193][ T1162] bridge_slave_0: left allmulticast mode [ 71.782213][ T1162] bridge_slave_0: left promiscuous mode [ 71.782299][ T1162] bridge0: port 1(bridge_slave_0) entered disabled state [ 71.825312][ T8113] loop3: detected capacity change from 0 to 512 [ 71.834789][ T8113] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 71.847369][ T8113] EXT4-fs error (device loop3): ext4_validate_block_bitmap:436: comm syz.3.1084: bg 0: block 4: invalid block bitmap [ 71.847391][ T8113] loop3: lost filesystem error report for type 5 error -117 [ 71.848391][ T8113] EXT4-fs error (device loop3) in ext4_mb_clear_bb:6680: Corrupt filesystem [ 71.848406][ T8113] loop3: lost filesystem error report for type 5 error -117 [ 71.849048][ T8113] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #11: comm syz.3.1084: invalid indirect mapped block 1 (level 1) [ 71.849124][ T8113] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 71.851785][ T8113] EXT4-fs (loop3): 1 truncate cleaned up [ 71.852687][ T8113] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 71.984286][ T1162] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 71.993488][ T1162] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 72.014501][ T865] legousbtower 1-1:14.57: interrupt endpoints not found [ 72.053926][ T8131] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 72.241854][ T1162] bond0 (unregistering): Released all slaves [ 72.283232][ T4398] 8021q: adding VLAN 0 to HW filter on device eth0 [ 72.445514][ T8073] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.445757][ T8073] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.445898][ T865] legousbtower 1-1:14.228: LEGO USB Tower firmware version is 170.80 build 16178 [ 72.456340][ T8073] bridge_slave_0: entered allmulticast mode [ 72.459936][ T8073] bridge_slave_0: entered promiscuous mode [ 72.460481][ T865] legousbtower 1-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 72.465676][ T8073] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.465698][ T8073] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.465751][ T8073] bridge_slave_1: entered allmulticast mode [ 72.475309][ T8073] bridge_slave_1: entered promiscuous mode [ 72.547436][ T8073] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.548459][ T8073] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.585978][ T8180] loop6: detected capacity change from 0 to 512 [ 72.607111][ T8180] EXT4-fs error (device loop6): ext4_orphan_get:1403: inode #15: comm syz.6.1100: inode has both inline data and extents flags [ 72.607136][ T8180] loop6: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 72.611973][ T8180] EXT4-fs error (device loop6): ext4_orphan_get:1408: comm syz.6.1100: couldn't read orphan inode 15 (err -117) [ 72.611999][ T8180] loop6: lost filesystem error report for type 5 error -117 [ 72.614051][ T8180] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 72.614813][ T8073] team0: Port device team_slave_0 added [ 72.615555][ T8073] team0: Port device team_slave_1 added [ 72.660850][ T8015] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 72.679363][ T1162] hsr_slave_0: left promiscuous mode [ 72.686791][ T1162] hsr_slave_1: left promiscuous mode [ 72.697089][ T1162] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 72.697115][ T1162] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 72.700566][ T1162] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 72.700579][ T1162] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 72.708755][ T1162] veth1_macvtap: left promiscuous mode [ 72.708797][ T1162] veth0_macvtap: left promiscuous mode [ 72.708864][ T1162] veth1_vlan: left promiscuous mode [ 72.708904][ T1162] veth0_vlan: left promiscuous mode [ 72.723698][ T4707] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 72.826966][ T4718] Bluetooth: hci0: command tx timeout [ 72.831554][ T1162] team0 (unregistering): Port device team_slave_1 removed [ 72.835400][ T1162] team0 (unregistering): Port device team_slave_0 removed [ 72.883806][ T8073] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 72.883819][ T8073] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 72.883833][ T8073] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 72.884468][ T8073] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 72.884475][ T8073] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 72.884488][ T8073] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 72.911270][ T4398] 8021q: adding VLAN 0 to HW filter on device eth2 [ 72.930971][ T8073] hsr_slave_0: entered promiscuous mode [ 72.931281][ T8073] hsr_slave_1: entered promiscuous mode [ 72.978848][ T8204] netlink: 'syz.5.1104': attribute type 25 has an invalid length. [ 73.011559][ T8210] loop3: detected capacity change from 0 to 512 [ 73.036389][ T8073] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 73.042582][ T8210] EXT4-fs: Ignoring removed nobh option [ 73.045610][ T8073] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 73.046220][ T8073] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 73.058239][ T8073] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 73.058609][ T8073] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 73.060467][ T8210] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 73.060778][ T8073] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 73.061081][ T8073] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 73.072052][ T8210] EXT4-fs (loop3): 1 truncate cleaned up [ 73.075323][ T8210] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 73.156736][ T4718] Bluetooth: hci4: command tx timeout [ 73.157548][ T8073] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 73.186628][ T8073] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.186664][ T8073] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.186740][ T8073] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.186768][ T8073] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.187598][ T8235] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 73.187766][ T8235] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 73.192357][ T4398] 8021q: adding VLAN 0 to HW filter on device eth1 [ 73.420823][ T3367] bridge0: port 1(bridge_slave_0) entered disabled state [ 73.421574][ T3367] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.434404][ T8109] usb 1-1: USB disconnect, device number 11 [ 73.437879][ T8235] usb 1-1: LEGO USB Tower reset control request failed [ 73.442133][ T8237] usb 1-1: LEGO USB Tower reset control request failed [ 73.450862][ T8109] legousbtower 1-1:14.228: LEGO USB Tower #-160 now disconnected [ 73.463642][ T8073] 8021q: adding VLAN 0 to HW filter on device bond0 [ 73.486317][ T8073] 8021q: adding VLAN 0 to HW filter on device team0 [ 73.503585][ T1162] bridge0: port 1(bridge_slave_0) entered blocking state [ 73.503614][ T1162] bridge0: port 1(bridge_slave_0) entered forwarding state [ 73.504574][ T1162] bridge0: port 2(bridge_slave_1) entered blocking state [ 73.504601][ T1162] bridge0: port 2(bridge_slave_1) entered forwarding state [ 73.510557][ T8073] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 73.510572][ T8073] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 73.548232][ T4718] Bluetooth: hci3: command tx timeout [ 73.639863][ T8073] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 73.677759][ T4398] 8021q: adding VLAN 0 to HW filter on device eth3 [ 73.743714][ T8073] veth0_vlan: entered promiscuous mode [ 73.750502][ T8073] veth1_vlan: entered promiscuous mode [ 73.752626][ T8287] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(3) [ 73.752644][ T8287] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 73.753527][ T8287] vhci_hcd vhci_hcd.0: Device attached [ 73.762431][ T8288] vhci_hcd: connection closed [ 73.764700][ T12] vhci_hcd vhci_hcd.6: stop threads [ 73.764940][ T12] vhci_hcd vhci_hcd.6: release socket [ 73.765405][ T12] vhci_hcd vhci_hcd.6: disconnect device [ 73.770228][ T8073] veth0_macvtap: entered promiscuous mode [ 73.771706][ T8073] veth1_macvtap: entered promiscuous mode [ 73.775764][ T8073] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 73.779573][ T8073] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 73.815638][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.815656][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.831489][ T1162] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.831502][ T1162] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.846926][ T1162] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.846956][ T1162] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.846971][ T1162] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.846986][ T1162] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 73.863846][ T4707] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 73.931299][ T8300] FAULT_INJECTION: forcing a failure. [ 73.931299][ T8300] name failslab, interval 1, probability 0, space 0, times 0 [ 73.931319][ T8300] CPU: 0 UID: 0 PID: 8300 Comm: syz.7.1117 Not tainted syzkaller #0 PREEMPT [ 73.931331][ T8300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 73.931337][ T8300] Call trace: [ 73.931340][ T8300] show_stack+0x2c/0x3c (C) [ 73.931358][ T8300] __dump_stack+0x30/0x40 [ 73.931371][ T8300] dump_stack_lvl+0xd8/0x12c [ 73.931382][ T8300] dump_stack+0x1c/0x28 [ 73.931393][ T8300] should_fail_ex+0x418/0x58c [ 73.931406][ T8300] should_failslab+0xc4/0x120 [ 73.931419][ T8300] __kmalloc_noprof+0x108/0x6c8 [ 73.931428][ T8300] tomoyo_realpath_from_path+0xbc/0x4dc [ 73.931441][ T8300] tomoyo_path_number_perm+0x1f0/0x500 [ 73.931451][ T8300] tomoyo_file_ioctl+0x2c/0x3c [ 73.931462][ T8300] security_file_ioctl+0xdc/0x2b0 [ 73.931472][ T8300] __arm64_sys_ioctl+0xb0/0x1cc [ 73.931485][ T8300] invoke_syscall+0x98/0x244 [ 73.931497][ T8300] el0_svc_common+0xec/0x23c [ 73.931509][ T8300] do_el0_svc+0x4c/0x5c [ 73.931520][ T8300] el0_svc+0x60/0x1d8 [ 73.931532][ T8300] el0t_64_sync_handler+0x44/0x104 [ 73.931543][ T8300] el0t_64_sync+0x198/0x19c [ 73.931553][ T8300] ERROR: Out of memory at tomoyo_realpath_from_path. [ 73.931848][ T8300] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 73.932029][ T8300] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 74.029225][ T8312] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 74.029405][ T8312] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 74.198009][ T8320] netlink: 104 bytes leftover after parsing attributes in process `syz.5.1127'. [ 74.629312][ T8337] syzkaller1: entered promiscuous mode [ 74.629328][ T8337] syzkaller1: entered allmulticast mode [ 74.629927][ T8336] syzkaller1: entered promiscuous mode [ 74.629941][ T8336] syzkaller1: entered allmulticast mode [ 74.631754][ T8336] 0: reclassify loop, rule prio 0, protocol 03 [ 74.659658][ T8339] syz_tun: entered allmulticast mode [ 74.659976][ T8339] syz_tun: left allmulticast mode [ 74.867955][ T30] audit: type=1326 audit(74.830:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8364 comm="syz.3.1143" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa2778868 code=0x7ffc0000 [ 74.868134][ T30] audit: type=1326 audit(74.840:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8364 comm="syz.3.1143" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa2778868 code=0x7ffc0000 [ 74.869135][ T30] audit: type=1326 audit(74.840:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8364 comm="syz.3.1143" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=56 compat=0 ip=0xffffa2778868 code=0x7ffc0000 [ 74.869153][ T30] audit: type=1326 audit(74.840:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8364 comm="syz.3.1143" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa2778868 code=0x7ffc0000 [ 74.869167][ T30] audit: type=1326 audit(74.840:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8364 comm="syz.3.1143" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa2778868 code=0x7ffc0000 [ 74.869886][ T30] audit: type=1326 audit(74.840:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8364 comm="syz.3.1143" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=155 compat=0 ip=0xffffa2778868 code=0x7ffc0000 [ 74.869903][ T30] audit: type=1326 audit(74.840:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8364 comm="syz.3.1143" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa2778868 code=0x7ffc0000 [ 74.869918][ T30] audit: type=1326 audit(74.840:12): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8364 comm="syz.3.1143" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa2778868 code=0x7ffc0000 [ 74.870024][ T30] audit: type=1326 audit(74.840:13): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8364 comm="syz.3.1143" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=434 compat=0 ip=0xffffa2778868 code=0x7ffc0000 [ 74.870174][ T30] audit: type=1326 audit(74.840:14): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8364 comm="syz.3.1143" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffffa2778868 code=0x7ffc0000 [ 74.911347][ T4718] Bluetooth: hci0: command tx timeout [ 75.057447][ T8373] syz_tun: entered allmulticast mode [ 75.058224][ T8374] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 75.058401][ T8374] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 75.060014][ T8373] syz_tun: left allmulticast mode [ 75.226302][ T8376] loop5: detected capacity change from 0 to 128 [ 75.226843][ T4718] Bluetooth: hci4: command tx timeout [ 75.249641][ T8376] netlink: 208 bytes leftover after parsing attributes in process `syz.5.1148'. [ 75.249755][ T8376] netlink: 'syz.5.1148': attribute type 1 has an invalid length. [ 75.506766][ T4888] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 75.580887][ T8396] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1157'. [ 75.638620][ T4718] Bluetooth: hci3: command tx timeout [ 75.669885][ T4888] usb 1-1: Using ep0 maxpacket: 32 [ 75.670603][ T4888] usb 1-1: New USB device found, idVendor=046d, idProduct=c24f, bcdDevice= 0.00 [ 75.671298][ T4888] usb 1-1: config 0 interface 0 altsetting 8 endpoint 0x81 has an invalid bInterval 189, changing to 11 [ 75.671312][ T4888] usb 1-1: config 0 interface 0 altsetting 8 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 75.671323][ T4888] usb 1-1: config 0 interface 0 has no altsetting 0 [ 75.671336][ T4888] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 75.673310][ T4888] usb 1-1: config 0 descriptor?? [ 75.976192][ T8405] syz_tun: entered allmulticast mode [ 75.978219][ T8405] syz_tun: left allmulticast mode [ 76.021494][ T8414] netlink: 48 bytes leftover after parsing attributes in process `syz.6.1165'. [ 76.054163][ T8417] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 76.054385][ T8417] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 76.137158][ T8421] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1168'. [ 76.137489][ T8421] netlink: 96 bytes leftover after parsing attributes in process `syz.3.1168'. [ 76.137502][ T8421] netlink: 96 bytes leftover after parsing attributes in process `syz.3.1168'. [ 76.137510][ T8421] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1168'. [ 76.146102][ T4888] logitech 0003:046D:C24F.0006: unknown main item tag 0x2 [ 76.146116][ T4888] logitech 0003:046D:C24F.0006: unknown main item tag 0x0 [ 76.146126][ T4888] logitech 0003:046D:C24F.0006: unknown main item tag 0x0 [ 76.146135][ T4888] logitech 0003:046D:C24F.0006: unknown main item tag 0x0 [ 76.146144][ T4888] logitech 0003:046D:C24F.0006: unknown main item tag 0x0 [ 76.146153][ T4888] logitech 0003:046D:C24F.0006: unknown main item tag 0x0 [ 76.146161][ T4888] logitech 0003:046D:C24F.0006: unknown main item tag 0x0 [ 76.146170][ T4888] logitech 0003:046D:C24F.0006: unknown main item tag 0x0 [ 76.146178][ T4888] logitech 0003:046D:C24F.0006: unknown main item tag 0x0 [ 76.146187][ T4888] logitech 0003:046D:C24F.0006: unknown main item tag 0x0 [ 76.146209][ T4888] logitech 0003:046D:C24F.0006: unbalanced collection at end of report description [ 76.146572][ T4888] logitech 0003:046D:C24F.0006: parse failed [ 76.164786][ T4888] logitech 0003:046D:C24F.0006: probe with driver logitech failed with error -22 [ 76.168399][ T4720] logitech-hidpp-device 0003:046D:C082.0007: unbalanced collection at end of report description [ 76.168565][ T4720] logitech-hidpp-device 0003:046D:C082.0007: hidpp_probe:parse failed [ 76.168587][ T4720] logitech-hidpp-device 0003:046D:C082.0007: probe with driver logitech-hidpp-device failed with error -22 [ 76.194781][ T8425] syzkaller0: entered promiscuous mode [ 76.194799][ T8425] syzkaller0: entered allmulticast mode [ 76.295802][ T8429] loop7: detected capacity change from 0 to 512 [ 76.306145][ T8429] EXT4-fs error (device loop7): ext4_validate_block_bitmap:436: comm syz.7.1172: bg 0: block 4: invalid block bitmap [ 76.306173][ T8429] loop7: lost filesystem error report for type 5 error -117 [ 76.306650][ C0] EXT4-fs (loop7): error count since last fsck: 1 [ 76.306667][ C0] EXT4-fs (loop7): initial error at time 76: ext4_validate_block_bitmap:436 [ 76.306681][ C0] EXT4-fs (loop7): last error at time 76: ext4_validate_block_bitmap:436 [ 76.312958][ T8429] EXT4-fs error (device loop7) in ext4_mb_clear_bb:6680: Corrupt filesystem [ 76.312975][ T8429] loop7: lost filesystem error report for type 5 error -117 [ 76.313327][ T8429] EXT4-fs error (device loop7): ext4_free_branches:1023: inode #11: comm syz.7.1172: invalid indirect mapped block 1 (level 1) [ 76.313348][ T8429] loop7: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 76.313926][ T8429] EXT4-fs (loop7): 1 truncate cleaned up [ 76.314393][ T8429] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 76.357546][ T4888] usb 1-1: USB disconnect, device number 12 [ 76.506911][ T8433] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 76.945110][ T8444] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 76.945294][ T8444] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 77.059347][ T8446] netlink: 'syz.3.1178': attribute type 25 has an invalid length. [ 77.091857][ T4808] logitech-hidpp-device 0003:046D:C082.0008: unbalanced collection at end of report description [ 77.092007][ T4808] logitech-hidpp-device 0003:046D:C082.0008: hidpp_probe:parse failed [ 77.092027][ T4808] logitech-hidpp-device 0003:046D:C082.0008: probe with driver logitech-hidpp-device failed with error -22 [ 77.507696][ T4718] Bluetooth: hci4: command tx timeout [ 77.514259][ T8073] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 77.550647][ T8463] misc userio: No port type given on /dev/userio [ 77.643029][ T8465] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1186'. [ 77.667197][ T8470] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 77.667384][ T8470] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 77.706901][ T4718] Bluetooth: hci3: command tx timeout [ 77.774771][ T8485] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1190'. [ 77.846272][ T8492] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 77.846530][ T8492] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 78.430903][ T8514] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 78.432046][ T8514] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 79.152393][ T8561] syzkaller0: entered promiscuous mode [ 79.152411][ T8561] syzkaller0: entered allmulticast mode [ 79.214366][ T8569] __nla_validate_parse: 1 callbacks suppressed [ 79.214438][ T8569] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1214'. [ 79.321820][ T8585] tipc: Started in network mode [ 79.321843][ T8585] tipc: Node identity aaaaaaaaaaaa, cluster identity 4711 [ 79.321933][ T8585] tipc: Enabled bearer , priority 0 [ 79.390750][ T8601] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 79.390956][ T8601] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 79.392189][ T13] IPVS: starting estimator thread 0... [ 79.469587][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 79.479592][ T8603] IPVS: using max 61 ests per chain, 146400 per kthread [ 79.508959][ T50] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 79.509784][ T50] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 79.510156][ T50] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 79.510483][ T50] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 79.510686][ T50] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 79.551404][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 79.565499][ T8618] syzkaller0: entered promiscuous mode [ 79.565517][ T8618] syzkaller0: entered allmulticast mode [ 79.618993][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 79.644661][ T8625] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1229'. [ 79.676801][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 79.712687][ T8632] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 79.713244][ T8632] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 79.740953][ T8610] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.741020][ T8610] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.741074][ T8610] bridge_slave_0: entered allmulticast mode [ 79.741590][ T8610] bridge_slave_0: entered promiscuous mode [ 79.743257][ T8610] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.743308][ T8610] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.743366][ T8610] bridge_slave_1: entered allmulticast mode [ 79.743821][ T8610] bridge_slave_1: entered promiscuous mode [ 79.751314][ T8610] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.752361][ T8610] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.760408][ T8610] team0: Port device team_slave_0 added [ 79.761742][ T8610] team0: Port device team_slave_1 added [ 79.772671][ T8610] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.772684][ T8610] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.772697][ T8610] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.777398][ T8610] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.777410][ T8610] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 79.777425][ T8610] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.795296][ T8610] hsr_slave_0: entered promiscuous mode [ 79.795651][ T8610] hsr_slave_1: entered promiscuous mode [ 79.795835][ T8610] debugfs: 'hsr0' already exists in 'hsr' [ 79.795846][ T8610] Cannot create hsr debugfs directory [ 79.797042][ T4718] Bluetooth: hci3: command tx timeout [ 79.830634][ T13] bridge_slave_1: left allmulticast mode [ 79.830657][ T13] bridge_slave_1: left promiscuous mode [ 79.830736][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.831905][ T13] bridge_slave_0: left allmulticast mode [ 79.831915][ T13] bridge_slave_0: left promiscuous mode [ 79.831974][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.927143][ T8648] loop3: detected capacity change from 0 to 1024 [ 79.936273][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 79.942940][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 79.949347][ T8648] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 79.952312][ T13] bond0 (unregistering): Released all slaves [ 79.996170][ T13] tipc: Left network mode [ 79.999927][ T4707] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 80.038506][ T4398] 8021q: adding VLAN 0 to HW filter on device eth4 [ 80.061662][ T8660] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 80.061850][ T8660] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 80.082499][ T8610] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 80.083967][ T8610] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 80.084281][ T8610] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 80.085031][ T8610] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 80.085306][ T8610] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 80.086162][ T8610] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 80.097985][ T8610] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 80.098961][ T8610] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 80.441398][ T8677] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 80.442429][ T8677] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 80.445093][ T4801] tipc: Node number set to 43690 [ 80.454159][ T13] hsr_slave_0: left promiscuous mode [ 80.454428][ T13] hsr_slave_1: left promiscuous mode [ 80.454713][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 80.454723][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 80.455036][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 80.455046][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 80.467780][ T13] veth1_macvtap: left promiscuous mode [ 80.467811][ T13] veth0_macvtap: left promiscuous mode [ 80.467893][ T13] veth1_vlan: left promiscuous mode [ 80.467927][ T13] veth0_vlan: left promiscuous mode [ 80.651714][ T13] team0 (unregistering): Port device team_slave_1 removed [ 80.655609][ T13] team0 (unregistering): Port device team_slave_0 removed [ 80.723161][ T4398] 8021q: adding VLAN 0 to HW filter on device eth5 [ 81.049292][ T8610] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.072998][ T8610] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.090967][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.091000][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.099756][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.099783][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.239047][ T13] IPVS: stop unused estimator thread 0... [ 81.479978][ T8610] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 81.546782][ T4718] Bluetooth: hci2: command tx timeout [ 81.551786][ T4398] 8021q: adding VLAN 0 to HW filter on device eth7 [ 81.654126][ T8610] veth0_vlan: entered promiscuous mode [ 81.662934][ T8610] veth1_vlan: entered promiscuous mode [ 81.695047][ T8755] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 81.695234][ T8755] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 81.696112][ T8610] veth0_macvtap: entered promiscuous mode [ 81.703025][ T8610] veth1_macvtap: entered promiscuous mode [ 81.712701][ T8610] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.713661][ T8610] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.767254][ T3270] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.767490][ T3270] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.767732][ T3270] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.767756][ T3270] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.793783][ T3270] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.793799][ T3270] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.807432][ T8762] fuse: Unknown parameter 'group_id00000000000000000000' [ 81.822281][ T51] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.822293][ T51] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.520920][ T8760] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 82.521091][ T8760] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 82.600207][ T8784] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 82.601209][ T8784] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 82.646046][ T4398] 8021q: adding VLAN 0 to HW filter on device eth6 [ 82.762750][ T8796] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 82.786340][ T8798] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1260'. [ 82.857641][ T3270] sl0: header compression turned on [ 82.959633][ T8821] mmap: syz.5.1269 (8821) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 83.396064][ T8840] FAULT_INJECTION: forcing a failure. [ 83.396064][ T8840] name fail_futex, interval 1, probability 0, space 0, times 1 [ 83.396085][ T8840] CPU: 0 UID: 0 PID: 8840 Comm: syz.5.1272 Not tainted syzkaller #0 PREEMPT [ 83.396096][ T8840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 83.396101][ T8840] Call trace: [ 83.396104][ T8840] show_stack+0x2c/0x3c (C) [ 83.396123][ T8840] __dump_stack+0x30/0x40 [ 83.396138][ T8840] dump_stack_lvl+0xd8/0x12c [ 83.396150][ T8840] dump_stack+0x1c/0x28 [ 83.396161][ T8840] should_fail_ex+0x418/0x58c [ 83.396174][ T8840] should_fail+0x14/0x24 [ 83.396191][ T8840] get_futex_key+0x1ec/0x12b0 [ 83.396202][ T8840] futex_wake+0x10c/0x594 [ 83.396213][ T8840] do_futex+0x2c4/0x378 [ 83.396223][ T8840] __arm64_sys_futex+0x2e4/0x418 [ 83.396234][ T8840] invoke_syscall+0x98/0x244 [ 83.396246][ T8840] el0_svc_common+0xec/0x23c [ 83.396257][ T8840] do_el0_svc+0x4c/0x5c [ 83.396268][ T8840] el0_svc+0x60/0x1d8 [ 83.396280][ T8840] el0t_64_sync_handler+0x44/0x104 [ 83.396291][ T8840] el0t_64_sync+0x198/0x19c [ 83.496142][ T8845] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1273'. [ 83.630303][ T4718] Bluetooth: hci2: command tx timeout [ 83.890510][ T8864] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1280'. [ 83.894403][ T40] sl0: header compression turned on [ 83.929233][ T8871] logitech-hidpp-device 0003:046D:C082.0009: received hid++ report of bad size (6) [ 83.934581][ T4720] logitech-hidpp-device 0003:046D:C082.0009: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 83.965893][ T8875] fido_id[8875]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 84.019131][ T8884] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 84.019343][ T8884] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 84.034715][ T8889] fuse: Bad value for 'fd' [ 84.071560][ T8896] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 84.071751][ T8896] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 84.149064][ T8910] loop5: detected capacity change from 0 to 1024 [ 84.154153][ T10] logitech-hidpp-device 0003:046D:C082.000A: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 84.165024][ T8910] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 84.182636][ T8910] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1317: group 0, block bitmap and bg descriptor inconsistent: 25 vs 1305 free clusters [ 84.183645][ T8910] EXT4-fs (loop5): Remounting filesystem read-only [ 84.233775][ T7881] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 84.238614][ T8917] fido_id[8917]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 84.282866][ T8928] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1296'. [ 84.313278][ T8929] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1295'. [ 84.399844][ T8951] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 84.400025][ T8951] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 84.401616][ T8950] Bluetooth: MGMT ver 1.23 [ 84.439563][ T8958] logitech-hidpp-device 0003:046D:C082.000B: received hid++ report of bad size (6) [ 84.441421][ T4808] logitech-hidpp-device 0003:046D:C082.000B: hidraw0: USB HID v0.00 Device [syz0] on syz0 [ 84.472667][ T8960] fido_id[8960]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 84.474913][ T8963] netlink: zone id is out of range [ 84.474965][ T8963] netlink: get zone limit has 8 unknown bytes [ 84.476473][ T8965] loop5: detected capacity change from 0 to 512 [ 84.493658][ T8965] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 84.499258][ T8965] EXT4-fs (loop5): 1 truncate cleaned up [ 84.499702][ T8965] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 84.511701][ T8965] EXT4-fs error (device loop5): ext4_generic_delete_entry:2675: inode #2: block 13: comm syz.5.1307: bad entry in directory: rec_len is smaller than minimal - offset=24, inode=11, rec_len=8, size=1024 fake=0 [ 84.512237][ T8965] EXT4-fs (loop5): Remounting filesystem read-only [ 84.513016][ T8965] overlayfs: failed to create directory ./bus/work (errno: 30); mounting read-only [ 84.513114][ T8965] overlayfs: failed to set uuid (/file0, err=-30); falling back to uuid=null. [ 84.787441][ T7881] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 84.850070][ T9015] loop7: detected capacity change from 0 to 512 [ 84.851286][ T12] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 84.862221][ T9015] EXT4-fs (loop7): Test dummy encryption mode enabled [ 84.862244][ T9015] EXT4-fs (loop7): encrypted files will use data=ordered instead of data journaling mode [ 84.883288][ T9015] EXT4-fs error (device loop7): ext4_orphan_get:1429: comm syz.7.1325: bad orphan inode 131083 [ 84.883316][ T9015] loop7: lost filesystem error report for type 5 error -117 [ 84.883971][ T9015] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 84.922472][ T8073] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 84.978074][ T50] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 84.979084][ T50] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 84.979460][ T50] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 84.980194][ T50] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 84.980517][ T50] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 85.001762][ T9024] loop3: detected capacity change from 0 to 512 [ 85.001847][ T12] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.024596][ T9024] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=8856c01c, mo2=0002] [ 85.024710][ T9024] EXT4-fs (loop3): orphan cleanup on readonly fs [ 85.025525][ T9024] EXT4-fs warning (device loop3): ext4_enable_quotas:7304: Failed to enable quota tracking (type=2, err=-22, ino=15). Please run e2fsck to fix. [ 85.027116][ T9024] EXT4-fs (loop3): Cannot turn on quotas: error -22 [ 85.027866][ T9024] EXT4-fs error (device loop3): ext4_ext_check_inode:521: inode #13: comm syz.3.1329: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 0(0) [ 85.027895][ T9024] loop3: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 85.028785][ T9024] EXT4-fs error (device loop3): ext4_orphan_get:1408: comm syz.3.1329: couldn't read orphan inode 13 (err -117) [ 85.028807][ T9024] loop3: lost filesystem error report for type 5 error -117 [ 85.029400][ T9024] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 85.129884][ T9041] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 85.130067][ T9041] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 85.210852][ T9045] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1329'. [ 85.406137][ T12] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.504826][ T12] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.574279][ T9014] loop6: detected capacity change from 0 to 1024 [ 85.576216][ T9014] EXT4-fs: Ignoring removed nomblk_io_submit option [ 85.608341][ T9014] EXT4-fs (loop6): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none. [ 85.611699][ T9014] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0006-0000-000000000000. [ 85.706742][ T4718] Bluetooth: hci2: command tx timeout [ 85.751837][ T12] bridge_slave_1: left allmulticast mode [ 85.751857][ T12] bridge_slave_1: left promiscuous mode [ 85.751926][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.752955][ T12] bridge_slave_0: left allmulticast mode [ 85.752965][ T12] bridge_slave_0: left promiscuous mode [ 85.753022][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.774114][ T9067] FAULT_INJECTION: forcing a failure. [ 85.774114][ T9067] name failslab, interval 1, probability 0, space 0, times 0 [ 85.774138][ T9067] CPU: 1 UID: 0 PID: 9067 Comm: syz.8.1333 Not tainted syzkaller #0 PREEMPT [ 85.774151][ T9067] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 85.774157][ T9067] Call trace: [ 85.774160][ T9067] show_stack+0x2c/0x3c (C) [ 85.774179][ T9067] __dump_stack+0x30/0x40 [ 85.774194][ T9067] dump_stack_lvl+0xd8/0x12c [ 85.774216][ T9067] dump_stack+0x1c/0x28 [ 85.774227][ T9067] should_fail_ex+0x418/0x58c [ 85.774243][ T9067] should_failslab+0xc4/0x120 [ 85.774257][ T9067] __kmalloc_cache_noprof+0x94/0x5fc [ 85.774268][ T9067] __genradix_ptr_alloc+0x180/0x49c [ 85.774281][ T9067] proc_map_files_readdir+0x42c/0x880 [ 85.774293][ T9067] iterate_dir+0x290/0x458 [ 85.774306][ T9067] __arm64_sys_getdents64+0x124/0x310 [ 85.774314][ T9067] invoke_syscall+0x98/0x244 [ 85.774327][ T9067] el0_svc_common+0xec/0x23c [ 85.774338][ T9067] do_el0_svc+0x4c/0x5c [ 85.774349][ T9067] el0_svc+0x60/0x1d8 [ 85.774362][ T9067] el0t_64_sync_handler+0x44/0x104 [ 85.774373][ T9067] el0t_64_sync+0x198/0x19c [ 86.104610][ T4707] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 86.186267][ T9077] loop6: detected capacity change from 0 to 512 [ 86.208982][ T9077] EXT4-fs error (device loop6): ext4_orphan_get:1403: inode #15: comm syz.6.1337: inode has both inline data and extents flags [ 86.209004][ T9077] loop6: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117 [ 86.209102][ T9077] EXT4-fs error (device loop6): ext4_orphan_get:1408: comm syz.6.1337: couldn't read orphan inode 15 (err -117) [ 86.209115][ T9077] loop6: lost filesystem error report for type 5 error -117 [ 86.216833][ C0] EXT4-fs (loop6): error count since last fsck: 2 [ 86.216844][ C0] EXT4-fs (loop6): initial error at time 86: ext4_orphan_get:1403: inode 15 [ 86.216859][ C0] EXT4-fs (loop6): last error at time 86: ext4_orphan_get:1408 [ 86.229407][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 86.250758][ T9077] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 86.291408][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 86.300297][ T8015] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 86.317771][ T12] bond0 (unregistering): Released all slaves [ 86.331504][ T9027] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.332411][ T9027] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.332492][ T9027] bridge_slave_0: entered allmulticast mode [ 86.332994][ T9027] bridge_slave_0: entered promiscuous mode [ 86.343060][ T9027] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.343091][ T9027] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.343167][ T9027] bridge_slave_1: entered allmulticast mode [ 86.353209][ T9027] bridge_slave_1: entered promiscuous mode [ 86.653801][ T9027] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.665723][ T9027] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.039087][ T9027] team0: Port device team_slave_0 added [ 87.041127][ T9027] team0: Port device team_slave_1 added [ 87.057877][ T9027] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.057890][ T9027] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.057905][ T9027] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.058413][ T9027] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.058420][ T9027] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.058432][ T9027] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.067348][ T4718] Bluetooth: hci4: command tx timeout [ 87.084714][ T9027] hsr_slave_0: entered promiscuous mode [ 87.086034][ T9027] hsr_slave_1: entered promiscuous mode [ 87.090260][ T9027] debugfs: 'hsr0' already exists in 'hsr' [ 87.090274][ T9027] Cannot create hsr debugfs directory [ 87.143965][ T9106] loop3: detected capacity change from 0 to 2048 [ 87.168582][ T9106] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 87.182077][ T12] hsr_slave_0: left promiscuous mode [ 87.182463][ T12] hsr_slave_1: left promiscuous mode [ 87.183431][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 87.183444][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 87.184460][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 87.184472][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 87.257083][ T12] veth1_macvtap: left promiscuous mode [ 87.257117][ T12] veth0_macvtap: left promiscuous mode [ 87.257166][ T12] veth1_vlan: left promiscuous mode [ 87.257311][ T12] veth0_vlan: left promiscuous mode [ 87.798110][ T4718] Bluetooth: hci2: command tx timeout [ 87.859206][ T9130] netlink: zone id is out of range [ 87.859222][ T9130] netlink: zone id is out of range [ 87.883949][ T12] team0 (unregistering): Port device team_slave_1 removed [ 87.893014][ T12] team0 (unregistering): Port device team_slave_0 removed [ 87.934051][ T9134] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 87.970113][ T4398] 8021q: adding VLAN 0 to HW filter on device eth8 [ 88.008691][ T4707] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 88.030727][ T9027] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 88.072281][ T9027] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 88.072620][ T9027] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 88.085044][ T9027] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 88.085769][ T9027] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 88.093476][ T9027] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 88.093941][ T9027] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 88.094157][ T9144] netlink: 12 bytes leftover after parsing attributes in process `syz.8.1352'. [ 88.102537][ T9027] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 88.201647][ T9160] FAULT_INJECTION: forcing a failure. [ 88.201647][ T9160] name failslab, interval 1, probability 0, space 0, times 0 [ 88.201669][ T9160] CPU: 1 UID: 0 PID: 9160 Comm: syz.3.1355 Not tainted syzkaller #0 PREEMPT [ 88.201680][ T9160] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 88.201685][ T9160] Call trace: [ 88.201688][ T9160] show_stack+0x2c/0x3c (C) [ 88.201709][ T9160] __dump_stack+0x30/0x40 [ 88.201724][ T9160] dump_stack_lvl+0xd8/0x12c [ 88.201735][ T9160] dump_stack+0x1c/0x28 [ 88.201746][ T9160] should_fail_ex+0x418/0x58c [ 88.201760][ T9160] should_failslab+0xc4/0x120 [ 88.201773][ T9160] kmem_cache_alloc_lru_noprof+0x98/0x5d8 [ 88.201782][ T9160] __d_alloc+0x50/0x600 [ 88.201791][ T9160] d_make_root+0x48/0x90 [ 88.201800][ T9160] binderfs_fill_super+0x4e4/0xda0 [ 88.201812][ T9160] vfs_get_super+0xb8/0x148 [ 88.201822][ T9160] get_tree_nodev+0x2c/0x3c [ 88.201831][ T9160] binderfs_fs_context_get_tree+0x28/0x38 [ 88.201842][ T9160] vfs_get_tree+0x90/0x28c [ 88.201851][ T9160] fc_mount+0x24/0xac [ 88.201862][ T9027] 8021q: adding VLAN 0 to HW filter on device bond0 [ 88.201861][ T9160] do_new_mount+0x2a4/0x538 [ 88.201872][ T9160] path_mount+0x5f0/0xa88 [ 88.201883][ T9160] do_mount+0xe8/0x148 [ 88.201893][ T9160] __arm64_sys_mount+0x33c/0x388 [ 88.201904][ T9160] invoke_syscall+0x98/0x244 [ 88.201917][ T9160] el0_svc_common+0xec/0x23c [ 88.201928][ T9160] do_el0_svc+0x4c/0x5c [ 88.201939][ T9160] el0_svc+0x60/0x1d8 [ 88.201951][ T9160] el0t_64_sync_handler+0x44/0x104 [ 88.201963][ T9160] el0t_64_sync+0x198/0x19c [ 88.230948][ T9164] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(4) [ 88.230963][ T9164] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 88.231666][ T9164] vhci_hcd vhci_hcd.0: Device attached [ 88.232084][ T9165] vhci_hcd: connection closed [ 88.232387][ T1198] vhci_hcd vhci_hcd.0: stop threads [ 88.232402][ T1198] vhci_hcd vhci_hcd.0: release socket [ 88.232416][ T1198] vhci_hcd vhci_hcd.0: disconnect device [ 88.245229][ T9027] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.247138][ T1198] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.247168][ T1198] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.272719][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 88.272735][ T30] audit: type=1326 audit(88.240:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9167 comm="syz.7.1358" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff88178868 code=0x7ffc0000 [ 88.272760][ T30] audit: type=1326 audit(88.240:21): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9167 comm="syz.7.1358" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff88178868 code=0x7ffc0000 [ 88.272776][ T30] audit: type=1326 audit(88.240:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9167 comm="syz.7.1358" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff88178868 code=0x7ffc0000 [ 88.272791][ T30] audit: type=1326 audit(88.240:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9167 comm="syz.7.1358" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff88178868 code=0x7ffc0000 [ 88.272805][ T30] audit: type=1326 audit(88.240:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9167 comm="syz.7.1358" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=146 compat=0 ip=0xffff88178868 code=0x7ffc0000 [ 88.272820][ T30] audit: type=1326 audit(88.240:25): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=_ pid=9167 comm="syz.7.1358" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff88178868 code=0x7ffc0000 [ 88.272835][ T30] audit: type=1326 audit(88.240:26): auid=4294967295 uid=60929 gid=0 ses=4294967295 subj=_ pid=9167 comm="syz.7.1358" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=98 compat=0 ip=0xffff88178868 code=0x7ffc0000 [ 88.272850][ T30] audit: type=1326 audit(88.240:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9167 comm="syz.7.1358" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=436 compat=0 ip=0xffff88178868 code=0x7ffc0000 [ 88.272865][ T30] audit: type=1326 audit(88.240:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9167 comm="syz.7.1358" exe="/root/ci-upstream-gce-arm64/syz-executor" sig=0 arch=c00000b7 syscall=94 compat=0 ip=0xffff88178868 code=0x7ffc0000 [ 88.277026][ T12] IPVS: stop unused estimator thread 0... [ 88.279278][ T40] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.279313][ T40] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.392144][ T9182] loop3: detected capacity change from 0 to 512 [ 88.405986][ T9182] EXT4-fs error (device loop3): ext4_validate_block_bitmap:436: comm syz.3.1359: bg 0: block 4: invalid block bitmap [ 88.406015][ T9182] loop3: lost filesystem error report for type 5 error -117 [ 88.406430][ T9182] EXT4-fs error (device loop3) in ext4_mb_clear_bb:6680: Corrupt filesystem [ 88.406447][ T9182] loop3: lost filesystem error report for type 5 error -117 [ 88.406622][ C0] EXT4-fs (loop3): error count since last fsck: 2 [ 88.406637][ C0] EXT4-fs (loop3): initial error at time 88: ext4_validate_block_bitmap:436 [ 88.406649][ C0] EXT4-fs (loop3): last error at time 88: ext4_mb_clear_bb:6680 [ 88.407860][ T9182] EXT4-fs error (device loop3): ext4_free_branches:1023: inode #11: comm syz.3.1359: invalid indirect mapped block 1 (level 1) [ 88.407881][ T9182] loop3: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117 [ 88.408192][ T9182] EXT4-fs (loop3): 1 truncate cleaned up [ 88.408726][ T9182] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 88.413345][ T9183] loop8: detected capacity change from 0 to 512 [ 88.442261][ T9183] FAT-fs (loop8): bogus logical sector size 256 [ 88.442282][ T9183] FAT-fs (loop8): Can't find a valid FAT filesystem [ 88.489324][ T9183] 9p: Bad value for 'rfdno' [ 88.588100][ T9199] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 88.806345][ T9027] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.874947][ T9221] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 88.875127][ T9221] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 88.919740][ T9027] veth0_vlan: entered promiscuous mode [ 88.922296][ T9027] veth1_vlan: entered promiscuous mode [ 88.923024][ T9225] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 88.923221][ T9225] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 88.949883][ T9027] veth0_macvtap: entered promiscuous mode [ 88.951229][ T9027] veth1_macvtap: entered promiscuous mode [ 88.955750][ T9027] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.964397][ T9027] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.968322][ T1162] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.968408][ T1162] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.987233][ T1162] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.987374][ T1162] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 89.009522][ T40] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.009532][ T40] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.026017][ T40] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.026033][ T40] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.110831][ T9248] x_tables: duplicate underflow at hook 2 [ 89.156876][ T4718] Bluetooth: hci4: command tx timeout [ 89.168203][ T9260] netlink: 12 bytes leftover after parsing attributes in process `syz.9.1370'. [ 89.194762][ T4398] 8021q: adding VLAN 0 to HW filter on device eth9 [ 89.311018][ T4707] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 89.392736][ T4398] 8021q: adding VLAN 0 to HW filter on device eth10 [ 89.399630][ T9286] Bluetooth: MGMT ver 1.23 [ 89.432759][ T9288] syzkaller1: entered promiscuous mode [ 89.432776][ T9288] syzkaller1: entered allmulticast mode [ 89.446420][ T9294] syzkaller0: entered promiscuous mode [ 89.446435][ T9294] syzkaller0: entered allmulticast mode [ 89.483447][ T9300] [ 89.483942][ T9300] ====================================================== [ 89.485405][ T9300] WARNING: possible circular locking dependency detected [ 89.486733][ T9300] syzkaller #0 Not tainted [ 89.487666][ T9300] ------------------------------------------------------ [ 89.489167][ T9300] syz.7.1376/9300 is trying to acquire lock: [ 89.490412][ T9300] ffff0000f21ec0b8 (&hdev->lock){+.+.}-{4:4}, at: l2cap_chan_connect+0x84/0xe94 [ 89.492427][ T9300] [ 89.492427][ T9300] but task is already holding lock: [ 89.493928][ T9300] ffff800089ef1660 (rfcomm_mutex){+.+.}-{4:4}, at: rfcomm_dlc_open+0xa4/0x8b0 [ 89.495766][ T9300] [ 89.495766][ T9300] which lock already depends on the new lock. [ 89.495766][ T9300] [ 89.497854][ T9300] [ 89.497854][ T9300] the existing dependency chain (in reverse order) is: [ 89.499737][ T9300] [ 89.499737][ T9300] -> #2 (rfcomm_mutex){+.+.}-{4:4}: [ 89.501288][ T9300] __mutex_lock+0x164/0x1078 [ 89.502366][ T9300] mutex_lock_nested+0x24/0x30 [ 89.503421][ T9300] rfcomm_security_cfm+0x54/0x4c8 [ 89.504555][ T9300] hci_encrypt_cfm+0x30c/0x44c [ 89.505623][ T9300] hci_encrypt_change_evt+0x54c/0xb48 [ 89.506839][ T9300] hci_event_packet+0x4e0/0x9c8 [ 89.507926][ T9300] hci_rx_work+0x2f4/0xd78 [ 89.508916][ T9300] process_scheduled_works+0x91c/0x1250 [ 89.510154][ T9300] worker_thread+0x798/0xbd0 [ 89.511186][ T9300] kthread+0x304/0x3d4 [ 89.512127][ T9300] ret_from_fork+0x10/0x20 [ 89.513123][ T9300] [ 89.513123][ T9300] -> #1 (hci_cb_list_lock){+.+.}-{4:4}: [ 89.514693][ T9300] __mutex_lock+0x164/0x1078 [ 89.515723][ T9300] mutex_lock_nested+0x24/0x30 [ 89.516760][ T9300] hci_remote_features_evt+0x284/0x5e0 [ 89.517922][ T9300] hci_event_packet+0x4e0/0x9c8 [ 89.518972][ T9300] hci_rx_work+0x2f4/0xd78 [ 89.519974][ T9300] process_scheduled_works+0x91c/0x1250 [ 89.521167][ T9300] worker_thread+0x798/0xbd0 [ 89.522146][ T9300] kthread+0x304/0x3d4 [ 89.523015][ T9300] ret_from_fork+0x10/0x20 [ 89.523945][ T9300] [ 89.523945][ T9300] -> #0 (&hdev->lock){+.+.}-{4:4}: [ 89.525365][ T9300] __lock_acquire+0x1660/0x2b08 [ 89.526415][ T9300] lock_acquire+0x13c/0x320 [ 89.527416][ T9300] __mutex_lock+0x164/0x1078 [ 89.528434][ T9300] mutex_lock_nested+0x24/0x30 [ 89.529490][ T9300] l2cap_chan_connect+0x84/0xe94 [ 89.530548][ T9300] l2cap_sock_connect+0x44c/0x654 [ 89.531632][ T9300] kernel_connect+0x12c/0x1a0 [ 89.532684][ T9300] rfcomm_dlc_open+0x574/0x8b0 [ 89.533771][ T9300] rfcomm_sock_connect+0x278/0x598 [ 89.534908][ T9300] __sys_connect_file+0x13c/0x184 [ 89.536050][ T9300] __sys_connect+0x114/0x194 [ 89.537117][ T9300] __arm64_sys_connect+0x84/0x9c [ 89.538309][ T9300] invoke_syscall+0x98/0x244 [ 89.539402][ T9300] el0_svc_common+0xec/0x23c [ 89.540508][ T9300] do_el0_svc+0x4c/0x5c [ 89.541520][ T9300] el0_svc+0x60/0x1d8 [ 89.542456][ T9300] el0t_64_sync_handler+0x44/0x104 [ 89.543628][ T9300] el0t_64_sync+0x198/0x19c [ 89.544624][ T9300] [ 89.544624][ T9300] other info that might help us debug this: [ 89.544624][ T9300] [ 89.546607][ T9300] Chain exists of: [ 89.546607][ T9300] &hdev->lock --> hci_cb_list_lock --> rfcomm_mutex [ 89.546607][ T9300] [ 89.549099][ T9300] Possible unsafe locking scenario: [ 89.549099][ T9300] [ 89.550597][ T9300] CPU0 CPU1 [ 89.551718][ T9300] ---- ---- [ 89.552852][ T9300] lock(rfcomm_mutex); [ 89.553781][ T9300] lock(hci_cb_list_lock); [ 89.555346][ T9300] lock(rfcomm_mutex); [ 89.556838][ T9300] lock(&hdev->lock); [ 89.557749][ T9300] [ 89.557749][ T9300] *** DEADLOCK *** [ 89.557749][ T9300] [ 89.559563][ T9300] locks held by syz.7.1376/9300: 1, last CPU#1: [ 89.560939][ T9300] #0: ffff800089ef1660 (rfcomm_mutex){+.+.}-{4:4}, at: rfcomm_dlc_open+0xa4/0x8b0 [ 89.562909][ T9300] [ 89.562909][ T9300] stack backtrace: [ 89.564150][ T9300] CPU: 1 UID: 0 PID: 9300 Comm: syz.7.1376 Not tainted syzkaller #0 PREEMPT [ 89.565853][ T9300] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026 [ 89.567945][ T9300] Call trace: [ 89.568556][ T9300] show_stack+0x2c/0x3c (C) [ 89.569442][ T9300] __dump_stack+0x30/0x40 [ 89.570300][ T9300] dump_stack_lvl+0xd8/0x12c [ 89.571188][ T9300] dump_stack+0x1c/0x28 [ 89.572016][ T9300] print_circular_bug+0x328/0x330 [ 89.572975][ T9300] check_noncircular+0x158/0x174 [ 89.573989][ T9300] __lock_acquire+0x1660/0x2b08 [ 89.574928][ T9300] lock_acquire+0x13c/0x320 [ 89.575826][ T9300] __mutex_lock+0x164/0x1078 [ 89.576757][ T9300] mutex_lock_nested+0x24/0x30 [ 89.577624][ T9300] l2cap_chan_connect+0x84/0xe94 [ 89.578628][ T9300] l2cap_sock_connect+0x44c/0x654 [ 89.579630][ T9300] kernel_connect+0x12c/0x1a0 [ 89.580535][ T9300] rfcomm_dlc_open+0x574/0x8b0 [ 89.581463][ T9300] rfcomm_sock_connect+0x278/0x598 [ 89.582475][ T9300] __sys_connect_file+0x13c/0x184 [ 89.583501][ T9300] __sys_connect+0x114/0x194 [ 89.584429][ T9300] __arm64_sys_connect+0x84/0x9c [ 89.585469][ T9300] invoke_syscall+0x98/0x244 [ 89.586444][ T9300] el0_svc_common+0xec/0x23c [ 89.587428][ T9300] do_el0_svc+0x4c/0x5c [ 89.588327][ T9300] el0_svc+0x60/0x1d8 [ 89.589157][ T9300] el0t_64_sync_handler+0x44/0x104 [ 89.590232][ T9300] el0t_64_sync+0x198/0x19c [ 89.610508][ T4398] 8021q: adding VLAN 0 to HW filter on device eth11 [ 91.236651][ T4718] Bluetooth: hci4: command tx timeout [ 93.316924][ T4718] Bluetooth: hci4: command tx timeout