last executing test programs: 4m37.945218892s ago: executing program 0 (id=466): r0 = socket(0x10, 0x803, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000080)={r1, &(0x7f0000000100), &(0x7f0000000200)=""/166}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b70800000d0000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1, 0xc, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000040)={{r5}, &(0x7f0000000280), &(0x7f0000000240)=r2}, 0x20) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r5, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001801000000082c2500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000700000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r3, 0x1, 0x32, &(0x7f00000000c0)=r6, 0x4) sendmsg$inet(r4, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) 4m37.770977811s ago: executing program 0 (id=469): setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r0 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) pwritev(r0, &(0x7f00000000c0)=[{0x0}], 0x1, 0x2, 0x2) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) 4m37.631777147s ago: executing program 0 (id=471): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0xfa, 0x0, 0xe2}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000100)='nv', 0x2) sendmmsg(r0, &(0x7f0000008d80)=[{{0x0, 0x0, &(0x7f0000003300)=[{&(0x7f0000002240)="321f349be984b668f593bf16c2f60e4b01783ed59dcd6a4105711458d2cf86696caad21a4387232f7ae8dbda478307058ab2ffec546f49907b7d4c54fe1fa76d99f5c80956c6769c810b895a00ab69f114794c1e3ee671204a47d3153305395d1e523e504927505590c078bc1a7d6e82b332bf141f662f26ad9ba4c11b87d5abbc3340ef989b3a8e666f8f82ca82aab6d33c953938b30b61c91cbc926b2a58d67d8198e458ed8f10ad8975356af9dab25f718147ae2a3e81187adaa46d247e3a8c437053bb01b855c6fb0ee0e7024fa61bd2af5aa1d918fcc93b3ffadf3a982efefa3b47727caafee6246ee147d676a5e2879e351f5ac51e6b62aaedb5cd03d16cb4f8bfaac498397b3dc22c063fbd87b2912647948430488fb45ca42096e08a6760c831b06d4582b7440f9123f3711a87b71a4a3a4614b2bf8dcdb84d985777893889120fb820ffe525acbf530869895f2caf84922e5a8aee6a0f887145b0d961bfa9c8f71788ccb8d2ee73676c2f68427b776f537afb9a8c97e055e35204ec09fd3f2c9a0b9f8b33ef0343ef22c99a7fe463550d074b626c1173f34fc49f1431460881ccd35b679f186d", 0x1ab}], 0x1}}], 0x1, 0x0) 4m36.693232301s ago: executing program 0 (id=473): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) write(r0, &(0x7f0000000100)="e80000", 0x3) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/uprobe_events\x00', 0x1, 0x0) write(r1, &(0x7f0000000180)='p:p1 ./file0:0', 0xe) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing/events/uprobes/p1/enable\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='1', 0x1) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x5, 0x12, r0, 0x0) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ptrace$cont(0x7, r3, 0x0, 0x0) wait4(r3, 0x0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mlock(&(0x7f0000400000/0xc00000)=nil, 0xc00000) mremap(&(0x7f0000bfd000/0x400000)=nil, 0x400000, 0x400000, 0x7, &(0x7f0000000000/0x400000)=nil) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(0xffffffffffffffff, 0xc018aa06, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) syz_open_procfs(0x0, &(0x7f0000000240)='net/kcm\x00') 4m36.09305835s ago: executing program 0 (id=474): r0 = socket$inet(0xa, 0x801, 0x84) listen(r0, 0xfffffffd) r1 = socket$inet(0xa, 0x801, 0x84) listen(r1, 0x8) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = socket$inet(0xa, 0x801, 0x84) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r4, &(0x7f00000001c0)="b0", 0x1, 0x40, &(0x7f0000000180)={0xa, 0x4e23, 0x7, @dev={0xfe, 0x80, '\x00', 0x1b}, 0x4}, 0x1c) listen(r3, 0xfffffffd) r5 = socket$inet(0xa, 0x801, 0x84) listen(r5, 0x1) r6 = socket$netlink(0x10, 0x3, 0x4) listen(r2, 0x8200002) syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r6) writev(r6, 0x0, 0x0) 4m34.049266056s ago: executing program 0 (id=484): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x42, 0x1ff) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/uprobe_events\x00', 0x1, 0x0) write(r1, &(0x7f0000000180)='p:p1 ./file0:0', 0xe) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing/events/uprobes/p1/enable\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='1', 0x1) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x5, 0x12, r0, 0x0) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ptrace$cont(0x7, r3, 0x0, 0x0) wait4(r3, 0x0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mlock(&(0x7f0000400000/0xc00000)=nil, 0xc00000) mremap(&(0x7f0000bfd000/0x400000)=nil, 0x400000, 0x400000, 0x7, &(0x7f0000000000/0x400000)=nil) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(0xffffffffffffffff, 0xc018aa06, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) syz_open_procfs(0x0, &(0x7f0000000240)='net/kcm\x00') 4m33.75869585s ago: executing program 32 (id=484): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x42, 0x1ff) write(r0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/uprobe_events\x00', 0x1, 0x0) write(r1, &(0x7f0000000180)='p:p1 ./file0:0', 0xe) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing/events/uprobes/p1/enable\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='1', 0x1) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x5, 0x12, r0, 0x0) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ptrace$cont(0x7, r3, 0x0, 0x0) wait4(r3, 0x0, 0x0, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mlock(&(0x7f0000400000/0xc00000)=nil, 0xc00000) mremap(&(0x7f0000bfd000/0x400000)=nil, 0x400000, 0x400000, 0x7, &(0x7f0000000000/0x400000)=nil) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x3}) ioctl$UFFDIO_WRITEPROTECT(0xffffffffffffffff, 0xc018aa06, &(0x7f0000000140)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) syz_open_procfs(0x0, &(0x7f0000000240)='net/kcm\x00') 1m55.305230454s ago: executing program 4 (id=1378): openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_mount_image$ext4(&(0x7f0000000100)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x2000c16, &(0x7f0000000680)={[{@usrquota}, {@stripe={'stripe', 0x3d, 0x2}}]}, 0xff, 0x25e, &(0x7f0000000e80)="$eJzs3U1IHGcYB/BnZndr1aXY9lIo/YBSSiuIvRV6sZcWhCJSSqEtWErppUULVulNe8olh+QYkuApFwm5xeQYvEguCYGcTOLBXAKJ5BDJIQnZsDsr+JVo3HUnZH4/WOfDd97nHWb+74g4GEBh9UXEUESUIqI/IioRkWxu8HH26WtuznUvjUXUaj/cTxrtsu3MxnG9ETEbEV9FxGKaxF/liOmFX1YfLn/32dGpyqdnFn7u7uhJNq2trny/fnrkyPnhL6evXr87ksRQVLecV/slu+wrJxHvHEaxV0RSznsE7Mfof+du1HP/bkR80sh/JdLILt6xyTcWK/HFqecde/zetfc7OVag/Wq1Sv0ZOFsDCieNiGok6UBEZOtpOjCQ/Qx/s9ST/j0x+W//nxNT43/kPVMB7VKNWPn2YteF3m35v1PK8g+8prJfSq38ODp/q76yXsp7QEBHfJAt6s///t9mPg/5h8KRfygu+Yfikn8oLvmH4pJ/KC75h4J42vxjv0275B+KS/6huA6c/xNPDm9QQEdszj8AUCy1rgO9Ndzel5CBXOQ9/wAAAAAAAAAAAAAAAAAAADvNdS+NbXza02N5zxaXT0asfZM13Vm/1Ph/xBFvNr72PEi29Jjsq8KL/fpRix206GzOb1+/dTvf+lc+zLf+zHjE7P8RMVgu77z/kub9d3Bv7/H9yu8tFnhJybbtr3/qbP3tHs/nW394OeJSff4Z3G3+SeO9xnL3+adav34t1v/nUYsdAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0DHPAgAA///B2nXP") prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) socket$netlink(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000580)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./myproc\x00', 0x1ff) 1m54.488698812s ago: executing program 4 (id=1379): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0) r1 = dup(r0) ioctl$BLKROSET(r0, 0x125d, &(0x7f0000000000)=0x1000000010) ioctl$BLKRRPART(r1, 0x125f, 0x0) r2 = semget$private(0x0, 0x6, 0x3b1) rseq(&(0x7f0000000400), 0x20, 0x0, 0x0) geteuid() semop(r2, 0x0, 0x0) inotify_init() 1m54.193488866s ago: executing program 4 (id=1385): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000480)=ANY=[@ANYBLOB="3c00000012"], 0x3c}}, 0x0) r0 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x3}}}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x0) getsockname$packet(r0, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) bpf$MAP_CREATE(0xb00000000000014, 0x0, 0x48) 1m54.005230095s ago: executing program 4 (id=1387): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) memfd_create(&(0x7f0000000280)='[\vx\'\xa5)\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\x01\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc0\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3E`\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x99\x83\xcd\b\xd1\x02R\xae\x80z8Z\xd2}\xf5\xe4\x9f5\x9b7\xaf\xb7o\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd', 0x0) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000200), 0x40280, 0x0) 1m53.209195232s ago: executing program 4 (id=1388): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x0) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, &(0x7f0000000080)={0x27, 0x0, 0x0, 0x7, 0x0, 0x6, "750538d1ee602ec4802a04ea7cdcd151bb2cd9893bc31f80718336d9bd3517076db9ad1f6a120d8be6d7f81cd81ec275000386e7d95f0669b740a5418d69d0", 0x10000000000001}, 0x60) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r2, &(0x7f0000001040)={0x27, 0x0, 0xfefffffd, 0x5, 0x0, 0xfd, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000080000200000000001900", 0x3c}, 0x60) bind$nfc_llcp(0xffffffffffffffff, &(0x7f0000000080)={0x27, 0x0, 0x0, 0xe0cba8b119564bb4, 0x0, 0x46, "750538d1ee602ec4802a04ea7cdcd151bb2cd9893bc31f80718336d9bd3517076db9ad1f6a120d8be6d7f81cd81ec275000386e7d95f0669b740a5418d69d0", 0x2d}, 0x60) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="1a0000002700090025bd"], 0x14}}, 0x4000080) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006100000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000980000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r5, 0x18000000000002a0, 0xe40, 0x0, &(0x7f0000000300)="d2ffdd934517f3e145f228e088a8", 0x0, 0xd5b4, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) setsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000080)={0xb, 0x24, 0x2, 0x0, 0xd, 0x2, 0x4, 0x0, 0x0, 0xb5, 0x40, 0x0, 0x8}, 0xe) shutdown(r0, 0x1) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000240)=0x10) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)={0x44, 0x42, 0x1, 0x0, 0x0, {0x3, 0x1}, [@generic="000000002600010000112233445566778899aabb0800450000140000000001170000010203040506070800000c00"]}, 0x44}}, 0x0) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f0000000600)={r6, 0x400}, 0x8) getsockopt$WPAN_WANTLQI(r3, 0x0, 0x3, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r8, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000140)={'wlan1\x00'}) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x14, &(0x7f0000001080)=ANY=[@ANYRES32=r9, @ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfe}, 0x94) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r8, 0x110, 0x5, &(0x7f0000000280)=[0x2, 0x3], 0x2) 1m51.860472726s ago: executing program 4 (id=1393): bind$inet(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a54000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a050000000008000a40ffffff78080008401000000108000c4000000005080003400000001014"], 0x7c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) bind$bt_l2cap(0xffffffffffffffff, 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) close(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r2, 0x1, 0x200000010, &(0x7f0000000000)=0x7, 0x4) sendto$unix(r1, &(0x7f0000000080)="008e", 0x2, 0xd1, 0x0, 0x0) recvmmsg(r0, &(0x7f00000055c0), 0x400023c, 0x300, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x13, &(0x7f0000000140)=0x2, 0x4) sendmsg$IPCTNL_MSG_EXP_DELETE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c000000f702010100000000000000000500ab93080004400000593228000280060003400001000006000340000500000400018008000100"], 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x4040000) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, 0x0, 0x0) 1m35.716095298s ago: executing program 33 (id=1393): bind$inet(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a54000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a050000000008000a40ffffff78080008401000000108000c4000000005080003400000001014"], 0x7c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) bind$bt_l2cap(0xffffffffffffffff, 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) close(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r2, 0x1, 0x200000010, &(0x7f0000000000)=0x7, 0x4) sendto$unix(r1, &(0x7f0000000080)="008e", 0x2, 0xd1, 0x0, 0x0) recvmmsg(r0, &(0x7f00000055c0), 0x400023c, 0x300, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x13, &(0x7f0000000140)=0x2, 0x4) sendmsg$IPCTNL_MSG_EXP_DELETE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="4c000000f702010100000000000000000500ab93080004400000593228000280060003400001000006000340000500000400018008000100"], 0x4c}, 0x1, 0x0, 0x0, 0x800}, 0x4040000) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x17, 0x0, 0x0) 7.83729351s ago: executing program 2 (id=1717): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x20, 0x11, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000ffffffff000000000000000085000000a8000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b705000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x11, &(0x7f0000000200)=ANY=[], &(0x7f0000000b00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x39, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000ed07449e00000000eb15000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x45, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r2}, 0xc) 7.651221905s ago: executing program 1 (id=1720): mkdir(&(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) ftruncate(r0, 0x200000) r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x0, 0x2) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) dup2(r1, 0x3) mkdir(&(0x7f0000000100)='./config/cluster/ocfs2\x00', 0x1ff) mkdir(&(0x7f0000000140)='./config/cluster/ocfs2/node/node0\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/cluster/ocfs2/node/node0/ipv4_address\x00', 0x1, 0x0) write(r2, 0x0, 0x0) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/cluster/ocfs2/node/node0/ipv4_port\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='7777', 0x4) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/cluster/ocfs2/node/node0/num\x00', 0x1, 0x0) close(r4) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./config/cluster/ocfs2/node/node0/local\x00', 0x1, 0x0) close(r5) mkdir(&(0x7f0000000380)='./config/cluster/ocfs2/heartbeat/hb0\x00', 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/cluster/ocfs2/heartbeat/hb0/block_bytes\x00', 0x1, 0x0) write(r6, &(0x7f0000000400)='512\n', 0x4) close(r6) openat(0xffffffffffffff9c, &(0x7f0000000440)='./config/cluster/ocfs2/heartbeat/hb0/start_block\x00', 0x1, 0x0) r7 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r7, &(0x7f0000000500), 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/cluster/ocfs2/heartbeat/hb0/dev\x00', 0x1, 0x0) write(r8, &(0x7f0000000580)='3\n', 0x2) 7.549165478s ago: executing program 5 (id=1721): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000280)=[{0x6, 0xfa, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x98, 0x130, 0x1c8, 0x2f8, 0x0, 0x98, 0x130, 0x260, 0x2f8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98, 0x0, {0x0, 0x1e01}}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x0, 0x3}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) sendmmsg$inet(r0, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000001dc0)=[{&(0x7f0000000c80)="91f8a984851bdef38491bbc4173c3c6f357d028feff84ab17c417789f9fc9b8572c98172b7319130feaab952ac4703cad04be6890ee50e997fc26e0000ea4feb931647fc5393de25000000000000000000f4922da20bf1f802970c30f03cc271337e892c99bda9475d51361f8b78938a6a68ba85987219000000eb52c9ff439180b413ec4d4fe130b41d113ce7efb5e9838379c5a554eb896f7808d5904cd8da06fd5159085c9275f49e775e92fb106c2f10442d508891e58a3f117fc203f787901de99a6a1b851ff5c8", 0xca}], 0x1}}], 0x1, 0x2090) syz_open_dev$vim2m(&(0x7f00000000c0), 0x7, 0x2) sendmsg$inet_sctp(r0, &(0x7f0000003440)={0x0, 0x0, &(0x7f0000003380)=[{&(0x7f0000002280)="d375dc9bd8d50ab625fb43aa3800296efd70ffba8fabd3d372d6171bd26fd360a5dad3afd30cadf5a779e0dc8a0822cbf0b0a19976b1f5a17e10f4837587f682e06640ceee261064064077801d70e1cb25bb4f6fe469082b7939754cdb509488ff512513370c1d6ae11685b81f", 0x6d}], 0x1, 0x0, 0x0, 0x20000001}, 0x20000000) 7.513449349s ago: executing program 2 (id=1722): sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4000040, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket(0x400000000010, 0x3, 0x0) syz_mount_image$cramfs(&(0x7f0000000100), &(0x7f0000000000)='./bus\x00', 0x80000d, &(0x7f0000000540)=ANY=[], 0xfa, 0x155, &(0x7f00000001c0)="$eJzskT9LQlEYxp/jvV41Mg0MKiiChsQwb1dsa9BIcrADhUtToCcSNEUh3LLmhj6AS0uTOERjQ9FkeSHsMzS6BUGLce4faW1/f8u953mf87zvOWd324wiDCiw2alV6w3RbIrSygHPZw/vHx5npO5THQOq9YY0l+zVUxo4lV8VGF3a8kvQA6AiNoq1SkkDkAaiADIyo+yFDts7JbWIHyflith0tOgqPp1WwnA1DdDmYPmSjraoApmQrek/wPgWWJN5s5jkfQFodbzO3PHY3ZKSdk/R6qz3uq/7g34uHlsW10Z2wbqBgpDzMln/SPTj74led2gOxhc8z82kYWwldUXXU0P+Nsil2jdQ96bPgSMGBP7kaTKjAFwxoMOArpU3enZ7c3/IFwkAnrMwwGSFBWXP9jevuu+gWJXi8byXudsmPwRBEARBEARBEATxX34DAAD//4EIV14=") r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) 7.393538092s ago: executing program 6 (id=1724): syz_usb_connect(0x0, 0x36, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket(0x10, 0x2, 0x0) write(r1, &(0x7f0000000040)="1c0000001a009b8a140000003b9b301f00"/28, 0x1c) recvmmsg(r1, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) 7.305428084s ago: executing program 1 (id=1725): bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x16, 0x16, &(0x7f0000000380)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf670000000000001507"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_ext={0x1c, 0x0, 0x0, 0x0, 0xf0f, 0x0, 0x0, 0x41100, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1313b, 0xffffffffffffffff, 0x0, 0x0, &(0x7f00000003c0), 0x10, 0x1ff}, 0x94) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110e22fff6) ioctl$TUNGETVNETLE(r0, 0x4010744d, &(0x7f0000000180)) 5.575256771s ago: executing program 2 (id=1726): openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4102}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, 0x0, 0x4800) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, &(0x7f0000000600), 0x56) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000640)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {0x0, 0x8}, {0xffff, 0xb}, {0xffe0, 0xfff0}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x5, 0x80000001, 0xdcf, 0x9, 0x5, 0x6}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x3, 0x452f, 0x4, 0x5, 0x1, 0x80000001}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r5, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 4.797236602s ago: executing program 5 (id=1728): write$tun(0xffffffffffffffff, &(0x7f0000000440)={@val={0x70}, @void, @eth={@broadcast, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x4000, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x0, 0x6558, 0x18, 0x0, @wg=@data={0x4, 0x0, 0x8ffffa888}}}}}}}, 0x3e) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000300)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_ACT={0x30, 0x3, [@m_nat={0x2c, 0x1, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x64}}, 0x0) write$tun(r0, &(0x7f0000000440)=ANY=[@ANYBLOB="000060034503003000640000ac019078ffffffff0a0101020c"], 0x34) 4.710710554s ago: executing program 1 (id=1729): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f00000000c0)='usbip-', 0x6) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) symlinkat(&(0x7f0000000380)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u\x00', 0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.0/streaming/header/h/u\x00') symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00') 4.513010289s ago: executing program 1 (id=1730): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x101042, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$INCFS_IOC_FILL_BLOCKS(0xffffffffffffffff, 0x80106720, &(0x7f0000000a00)={0x1, &(0x7f0000000980)=[{0x1, 0x0, 0x0, 0x0, 0x1}]}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0b000000080000000c0000000000008001000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00'], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0xc, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000000000000000000400000018110000", @ANYRESOCT, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00020000f8ffffffb703000008000000b7040000000000c59cada3e3fb22cf009500"/72], 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007808500000075"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'macvlan0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000780)=ANY=[@ANYBLOB="44000000100001042abd70000000000000000000", @ANYRES32=r4, @ANYBLOB="8249e900800005001c00378009000100626f6e64000000000c0002800500100006000000050027"], 0x44}, 0x1, 0x0, 0x0, 0x20000c10}, 0x4) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000140)=0x801) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_int(r7, 0x0, 0x32, &(0x7f0000000200), &(0x7f0000000040)=0x3) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=@newtaction={0x6c, 0x30, 0xffff, 0x70bd2c, 0x25dfdbfb, {}, [{0x58, 0x1, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x23, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0xaf, 0x1, 0x2e3fa6bf2c47fb38, 0x1000, 0x10}, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xff000000}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x24004040}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x1e, 0xb, &(0x7f0000000880)=ANY=[@ANYRES16], 0x0, 0x8, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, 0x24}, 0x94) r9 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=@newlink={0x64, 0x10, 0x401, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x10bc0, 0x46951}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE={0x8, 0x2, @local}, @IFLA_GENEVE_REMOTE6={0x14, 0x7, @private0={0xfc, 0x0, '\x00', 0x1}}]}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve1\x00'}]}, 0x64}}, 0x2000000) ioctl$int_in(r9, 0x5421, &(0x7f0000000440)=0x6) close(r9) ioctl$PPPIOCNEWUNIT(r6, 0xc004743e, &(0x7f0000000040)=0x1) close(r0) accept$inet(r2, 0x0, &(0x7f0000000180)) 4.49322121s ago: executing program 5 (id=1731): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000480)={0x0}, 0x1, 0x0, 0x0, 0x81}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x6101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2901, 0x0) close(r2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @link_local}) write$tun(r0, &(0x7f00000001c0)=ANY=[], 0xc2) write$tun(r0, &(0x7f00000001c0)=ANY=[], 0x16) 4.129281069s ago: executing program 6 (id=1734): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000), 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) memfd_create(&(0x7f0000000280)='[\vx\'\xa5)\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\x01\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc0\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3E`\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x99\x83\xcd\b\xd1\x02R\xae\x80z8Z\xd2}\xf5\xe4\x9f5\x9b7\xaf\xb7o\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd', 0x0) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000200), 0x40280, 0x0) 3.962234064s ago: executing program 6 (id=1735): r0 = syz_usb_connect(0x2, 0x4e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010002ff000040cd06310100010102030109023c00010100a0320904000006ff00000007050102400000070502024000000705040240000007050602400000070581034000010705880240"], &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0}) syz_usb_connect$cdc_ecm(0x4, 0x0, 0x0, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x2, &(0x7f0000000680)=@string={0x2}}]}) syz_usb_ep_write(r0, 0x88, 0xfffffffffffffebe, &(0x7f0000000580)="02c0e5db37065ae2a1e12a5d97536f0ec800ce5f58753f01a2da60238fdddfe68111cabeff08a03ebc3a5746f2c258f43bff13e494f8e527d18d984bfd8bd882952a13d60c9ed5fc0ceb3f5348c5e49ff7530ef44c8149c792f8c95ff944e5b384586e29ee432d34d71cd03b127428347545ebffe973cdbdf67c31c57df2fc6fa0d55e24c36a434d399615fe1ed5c19b87a44d6b5003c93c92") 3.937645624s ago: executing program 3 (id=1736): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x15, @loopback}, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(0xffffffffffffffff, 0x8008f513, 0x0) bpf$BPF_MAP_LOOKUP_AND_DELETE_BATCH(0x19, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x41}, 0x38) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="40000000400007012bad700000000000047c00000c00fc80080008"], 0x40}, 0x1, 0x0, 0x0, 0xc000}, 0x4040) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000200)={{0x6, @loopback, 0x15, 0x0, 'rr\x00'}, {@loopback, 0x15, 0x0, 0x1}}, 0x44) setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, 0x0, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) r3 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$bt_BT_VOICE(r3, 0x112, 0xb, 0x0, 0x0) r4 = socket$inet6(0xa, 0x80002, 0x3) connect$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_mtu(r4, 0x29, 0x17, &(0x7f0000000000)=0x5, 0x4) setsockopt$inet6_IPV6_HOPOPTS(r4, 0x29, 0x36, &(0x7f0000000040)={0x16}, 0x8) sendmmsg$inet6(r4, &(0x7f0000003e80)=[{{&(0x7f0000000440)={0xa, 0x4e21, 0x2, @mcast2}, 0x1c, 0x0, 0x0, &(0x7f0000000500)=ANY=[], 0x18}}], 0x1, 0x40) close(0xffffffffffffffff) setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x48c, &(0x7f0000000800)={0x1, 'lo\x00'}, 0x18) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x38c6) 3.554295764s ago: executing program 3 (id=1737): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600000000000000", @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r5}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x44}}, 0x0) 1.783420142s ago: executing program 2 (id=1738): sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4000040, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket(0x400000000010, 0x3, 0x0) syz_mount_image$cramfs(&(0x7f0000000100), &(0x7f0000000000)='./bus\x00', 0x80000d, &(0x7f0000000540)=ANY=[], 0xfa, 0x155, &(0x7f00000001c0)="$eJzskT9LQlEYxp/jvV41Mg0MKiiChsQwb1dsa9BIcrADhUtToCcSNEUh3LLmhj6AS0uTOERjQ9FkeSHsMzS6BUGLce4faW1/f8u953mf87zvOWd324wiDCiw2alV6w3RbIrSygHPZw/vHx5npO5THQOq9YY0l+zVUxo4lV8VGF3a8kvQA6AiNoq1SkkDkAaiADIyo+yFDts7JbWIHyflith0tOgqPp1WwnA1DdDmYPmSjraoApmQrek/wPgWWJN5s5jkfQFodbzO3PHY3ZKSdk/R6qz3uq/7g34uHlsW10Z2wbqBgpDzMln/SPTj74led2gOxhc8z82kYWwldUXXU0P+Nsil2jdQ96bPgSMGBP7kaTKjAFwxoMOArpU3enZ7c3/IFwkAnrMwwGSFBWXP9jevuu+gWJXi8byXudsmPwRBEARBEARBEATxX34DAAD//4EIV14=") r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) 1.680393785s ago: executing program 5 (id=1739): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000000)) r1 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) migrate_pages(0x0, 0x71, 0x0, 0xffffffffffffffff) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="54000000020601080000000000000000000000000c00078008000640000000000500010006000000050005000a00000005000400000000000900020073797a31000000000d000300686173683a6e65"], 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000001400)=ANY=[@ANYBLOB="0100000042000000060000000800000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32], 0x48) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYRES32=r4, @ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000200)=0xd) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000480), 0x810, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r6 = socket$nl_route(0x10, 0x3, 0x0) read$FUSE(r5, &(0x7f0000002100)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r5, &(0x7f00000083c0)="4e5350994ebf71ce3049a58c5d050078bf16b0757a4c27b455e2a547739587dd3380b5df8f40a0696c5bd6cdb672cffe4d870c5c90ca92095b9ebf3e92fe31d8cd74275d857d34a74f7eecc7fac15e2f148d4e9d47bb45b858bbf078999970d180f28d7b2cefd92635d45a563d9229c9fd770efdc0848e52fa5efd9ada5c94a1ba94b4b7c7507f8b0819bb20910f9f50a83a010abbe126dd9f6a7b84eab6b0d5ce78d2ade77a5f7e4e997df1d03ffab4b4c945d803e4457909013127a98769c938c237f37263bc509a42bc56ff2dbf80e847e2c407009eef94f18e1e59069d62298fdbadae007ffbdf403c5049a4530ac0abecceb5608da02754c9a575af52c0b7e41226e2d642a814861c4310c935bcbae413516dde2132652b39c7aa0218a6ce65dabb4494965209ce879ba7e7e59039db5c1d36d6a7f86d72dd59954fd6f46124a2506b245a0db11aa89d2feb312a6596ea2fecaa7b6021f37a255f628da7ff6b6c36b514d3b6be34e505f9dac6acfb888198004699fb350ac93431533554658c4957df36703591638d6488bc03dd8290a75ebb367a481a50e79a46b04d005649cabd79e5c6326c066bc2b6fc5febb87ef66d832ef31a16c2a450a0b990fb549a5d810c928d1a81fa1dc795db2607ac7d46cb5716b68acdeb00987e429fe6a394632c83b43336e7b51d9cfdb50e83d8c6ba1784d9f74c16b476e048e65e7ac0af683b347d7377ac1795422e00e5bd8da9b313af83abb3348861116de7a99959169b7dff9f7d9b7a6d107f2e76670a6214a419bf8298f80eb570fa29264ba57a383c5ec5836ce33104ecaf1aec76e311280a1d2c8bd7abff3a5a242e6a637f7db63038ef5d78aca9c680d72b60da4dbeb0e1e683ddc82898647c589a81b8f92db06711d8a0af05560cd77fa7005283db71e8da21713fccd450822062b994d152aaed2cdcf0dec9c60617e15ba4df628da4e71279bf9d1eee5c7f055c27cddfdd45f9225d5d5529ef7119e2e3c9838e7362971e069be487797e949b24297de19c61340d1cd7a2bfa3880b91a71e934720a59e1e0ea992d2a1633a0852ad8addfcab73a291e35745e694a6471f429b124305886c1f79f67c78de3f3ec998c91e7fc59d26766cd446f6f0de603f2c6892e13cdaa37d9e8e118d098b6986ccd991993ec152193e7d77394b05b99e7d310c506707f1be52249438fba9615f6dad2ec7244fedf36e34ec311b7d6bee64271d6491079e161190ded7e28e2ada4307a9b2986c267b1a30d2f720ff23408011f1d589ce9ee77f981c7833656ccf7df5b3a87ec253ff7c7ef1e67ceeb10c93e3fa683cdadad65850ffbc402b7744e94cdecef9db9d264c755c53d36278df23d4c9685fdefa69f7588a33b8a64b35191ee81abcb9765577d175cb06e31c582807ff7243bfef44961fbc0f8a235242f51ee991ea621803d4dcfed90d26f004b299425bf219f6d185fe6e088ae44601b03defada18794feac93787696a5d419f09f769bc590f43d2df6a131f6895da2de120c2644685e57b1d476c6aba5881e954fb2575356452b118b942cb02b4ea0fcf8f1bbb9a23b6e32c9d0accd3dd861452a3ad77b38fe709e216974932deb5397fd8033ff0e073d93ac0b4be762bca0424d69bd57b22ba914133f87671a29498b268c2911e793215463ca2164e38059456107dcb29beedfd6277e2b41a11d1c6f1361b19875c9384f04f9c53c1856d71f360a8fafe05f7aef750ec0cf2bfcfa971c017ad071b69a18fdaf970b384d4c889cfa5a0397dbe89543a5c6302645d6edf959aa60709ce0225fe6c3266c7ef62157ac8e78fddcd8a1f2ca5b58128218d19276885515775326aeeee0006cc810843eb05144bf8e2fe3340cf60b32cafd96d23cd7d0d3adcbdfec9a2a3d88307c362633b1c5637608ea8476d900b3f836a9734bc5862ef52983577128d3f74b903b0e3bf64326c1b564ae42aeeb0c07702b63a9ff74a2af6b45e5185a53f36c17bc29dfbc0ea28ca5cca43a15d751e9887ad3e6a87faacb6a278c4c8a8d21b9a77b9776f33102a6e645e99cc5cbc543ed0674282c2b9f8e5d14c2599aa9ac8f81438c77f2b9368bdac82edcdc5366f39adec9e9a3fbd55b79abc16d2ebff26b7d0c88f18b486e5836333575e3fc7808cb423b44781c57965767862922b4ff32d9bae76296843a46f430211c27ef9db168430026a5691623284dfd459dbdd1f1a6ec9bfad666507e6eacb1e2a7866da2e12e6d596d0bbb150500590013d9288af20596447f97bf1744eb9cfb244d8fca269b1fb71e14de664be4e95d83fff1d7abcfebcf3e78c1c66d28f260fb0c19f9fbcd2abbdd7dd7246e49dc25d954bf25f810a2ff6f9069dfdc62e7170fe3b0964b2ac95024256dfa3e7a426be5bb5f707fd82c2b3afec5d5dcf5bbb8fcb6dbc1b59f6c5330966c70d8b016956903a4278817414ba3652a102d7e7e37ecc79400267fc3bf7601c0731f87d479c33f100735e748874155267f708cea49d549e93cf7a398b20373dc90ad9afd56d9c77cd24e2c4a18f7130b366c7fe5b26bc4d11ca1ed1b98fa0b4d7396f82ae6593f4575d19f4d8fd586c991129e5cbe15c8bacc89c3ee15ca471dea966b5c48ede0d3ba2a7e28c75c04e6a4aa49a61f4e391ffe78eb5e40a5ef349f3aa4d15f2291cc86ec7e47ae301bf0b6083dae44b695820a893d46732553ef15ed1c16d28268d52a7e3a7e7c009d0c0708a356d3310c1ebcbcca4d7acf433e34bfc9fc115498142dcc725e7a16879c75e4c2f01c6c98b39619f3248bf530e6ee593467e38cf4026cfdc4db6296560000d587f3c580750b1453ecc141c0461495551297d88ae034acbd4f5e80ce198e6640c4c1e9501529988109cef006eb2090a6fcd974d7f60290b78f1a8ce3051ac2d69636c3219f0a6ad8c254764396a1684b2fd9805b1853525f2e640e513197283cc4d4073ac033e0539a88f08aabe1423cd40b8a7e073437d812b57a5d39a0531dcbe13f4466e89efc66c2a1e4b39a3e0b3073c9d44e6cf9b85f4df5c4e03628d05bc0f94ec04234c9eca4ed17463f190406834b02888728f625371cda75d15ec19efebd59f00ab659eb94eb88bcb2110862a369ad599610c1530fcc118f5b82205bc5215fe3623ac8ec297d8ff4eee75ace20731c5d505e6605c26203b7f754164c9463f0a6eefe3a2880b8e06e7bc66bb2adcc1a3f9b0325f5ec31d12a25f1f73c2aa6bb3a7680d786a082a63b13cce1822fa6a4b085a871ae3409eecbc1fd8661b5d52bb2b8b72f23e24a225075f272ed2ba0c6c5c693811a0ef8db6da7cfe7c966c647f0187ad223eedb1012a5b7af103e98464ac768c79b21ca45b12a52cf261dfed367442cda71c4b8ee39c94ded1b22ba06c13836cb467ebab4efea07bdf1e3de8da56a0ee6d4f848011253cc21fac10700003513d3167b7a73e0d752b861c49814bc5410ebe53a0264f76068c91ee6ec9e2daa343482b2f0f06e605c5aaf81f2a3cd570efc2094b4bc452f9526f1bbe7b22b694fb8109a5a987fabf6250912d6099e67da9cac79e8b6f2cce4702d1f17cbc5d06c38b8a48155ec758369c185ded839fb58cd736fbb74105fe5baf44e7e3ed06843f23601b60a43b1f88fd29e9b3f58479f9b95392a39d5ba1a31ee4441ca2d1fb57c0a8678a07a724b7a65b2ab16d1da197f435bce3ef003fce27fa2f0a67c9dd6c930a4bcf59e79e57b010000006fe34972958c28b56642d14ea89bf4d7d6f7fcbcf4fd92bd08fc9fe424de4359112b11f81fbdc1505658363697713ff6e1f8ca3c4be34a79993a9091f6017cda6c7489ae5c07062555231427c3eb42a049f42d22a060983b044a7d34ab5d2b5386cca79af72396a48aad6b8dcd7855410fc6106e4a165994f26efff1e7ea0aa8f560333b5dfdb2a0d899b0fda955155f90c75effd3c9535d88508e836feb7807d57b2a57cca42d3d08fe7de60d2a33376f49bdacdd3f814bd0927f417f15ad62a10b302f46dc53a26fd997f3af46bbf990b6ada45ef83ce13029d167c65134e7b82b59ddfdc367e61c40defd2732ccebb1d4000f6c742df964e1fb390c255d2b1dfc745c6ab34af8096b5b67aa179e3f341854f7a69f7bf47664c832037ec7a78f8e27209e3f20f833fb6e8c0fc4a40920a5ad2b0618982ff72540009d5db82f0f5bcaed2a27f35d1e50eaa0cf8e48c7a2d43c25d0264db750a7f33b44a4bfaae576cf9ee7594ed204513899566564ed8bbc97ed18b1d8868f926a5c70ac06fbac1eade46792186be7bf8ffa3301239edd093449b7d77192782b5111c14169d2b4a1b3443ad62e4abdf11aac6a5b89a5b20ab0ad0abd949b9d64582c67ffce018e7e46de4091fcc77a65b971fc67c8d9cbf0c341ca764b1056ee5014d9865059616a525a1d46ae2fad159afe86dd1df9b8246411827e19535ca0aa9f83050b06e70aa2737f27e93d584a9cef878a642e9361efaa5d20bd8da901fa2e064656f686d3b3ea31d1d850ae9196b7764548f5c6450a32a717e09b6b7e75d43fbbda76e43a24f186d5578933f408bfa28e0435cde525fb91e71d92d704cc5a9b5e3db7aaec46d2b1f8dcb3f921f69bd7397c96a1e132c39c8f1656cea4365c779abf76199cb5b6aada022edec5c901cdafa2e7f3765af9c8b20cb1a6785085fcb0dc901367b89051bdfdc6b68c5215fd04e2b3c7e1c454a4d21132953b25c50995af0f7159a5a8d0a1621f4808f126a5bd40ddc79fed90f49925ee367a57a05c070fbe39fe2c213e7c1724a907ecfa69efe6e021c06a262471a4377f3c9809e9fee4f375e27c31b6afbb2151da86b7cab63c7b4fa4b77fb30172b9d0d78b1c0535ec0639c4910b5eeecbb5b8b5c8aa74c140e7ad347812e36db3097a7ff85c09ab2c0020202307f50efefcdb497b9c060ca68c4be54a9165b4cebc6b2e2e14e5ffb9213142418faedcdf26fd326b7672399e71cfffe3ed712ced5317c254f9199ee10c24c802d102bd8749513d3145201ca4e01bc7c8bbcf430afa541ec5665f86dfb143be648521bb0f2b029018201444787f644f8c88b79e754e6ea9c797babdaec72a9680abadf3a41684cdd57c2b6e833acc0846be5aa927f1b1b36562d2acb9ecfb758455230d050daec6748ba280a5edc86d48e3f8af0f8f4ffb18ae3cd3c19a82d504a4fd52bb62289ae8026572a497fe268f87ef4b4b5886aa07eeb698b7cbf99683f710afc9ed1f8a488883ce0eb8f7fd055b82a9fe21a409caa231c41ba151008e9658919c611e157d7f3926a5e4248532a6860e615b9c86e9fea212128d96ed58c9b84ef22706071eb69f492e4d8321ed9faf6c6a8928f86172bdc930244583ea15be497d9ce4ae79cb3e6293a8512ffaa9e8e358f3c7c7117001fb92891a40b84f9126cc3def5cde84f463bbac9668b9f56c3e4ee72fceebb47e52fc226bab213d8193516e7064459fd1365350a95c5a1c3ac44a73bbba2a4c17ebe49dd781bff1995cd706b77bb533117594ad63566f4c0730beab85ff4c713b7f10b95480fe99a0f676c5770e85509e4e60f198148115f0a3ce6028516a946178d1acacf7767f6be7277891369eff67762aa58f928d48b7231e44d899cea8289003349117a53d61bc27b207fdc91c9db61e677d1e1a1bc6a1b6e8564130b335233db4b5de8d62324e6d0ccb2b08c2ff922324eb8c506711142d4b8d7a21223ef0a3d534fdb0de58be95cd827152f71bdd0a82766b62b4c87536f0b7e7df343c4263187da887de6e65d11d0360e2376c1d71c367ae85edeed8f767d24c644b1a9b455ded1dc3cc224f99936a6ee66931c45e5e3db2427719ab2d5cd9c20d9bb0ec004b69bccb00649f3d8e34a3572c257de114b9f027d76bc7db9007175cc03b9e2061b6b3fe7409e009b5371544e56fe438cbd361e5b11efbf2d79d1c250a1e73ca8c601c4f4d1e3761290950421c48c7daa45965e472f5ef3c4b8597444dc5dc01cd25358055b5000617f3e7291da3413e3f0853b1271366612405c35ff1b785b984d921b518425628a533a29ab65d3c11f44c6daa86f8b6457ebb9419274c481aa6f3fa4547641670aff58b9cc62c0993d49a509f02dee755ee5f1fd2710c995c43a91c4f873afa1bbdff14427cba2641052a8f361ecbc72e8a6cf587e83f8bd3110c95fb080edc77a6d43cd58c447b0e02261e4109500c6458dce70acb17aa8f9dc1d15b94a61354164031b5d563c25d0246fc45e6401cefceb501e1468903e5d677759dbe3f24bd48ce55ff8b8f26529fb3b2d669202a1e8a498984b449b4830a0126b18f0e78182c9ce78fe0c448c0e27845b926cfde28fa85e156fa98fefaeb19ed1247c9643b447b4342c97cba5ca94ef1c555d5b49aa70e6aad45bfb557f15e8fdb2d6e3d10d8338a13fe3f187751985b37a5bb10b750f79e36fc2e2ee9bdecc3ed156e202ed7b45a94809d77edaa398042fc6a825a4848c334c557303d24eb3f8e01be06995ceb283c70272b00da61c3381628f0e372fe2fcc779ff7daf7e4b7f2686c39d3fab674b8867b62b0bf9d5cfd0c1d3b270521f55f147de75142ffd7fc9ac7e5dae7ca2fdf26a9222d060823852409dd040cfd1f66f218c6dbdaaacddab34b123af22f97384d64fac64d84fd638c96378c8f9532a11927d48440bc777ff8b8b9be88f930f3b579a713c0bc449dca3a3bd5f2efa98240ccc594299e44451dc60c6c5c9edd0d7b777912b3dc40c57e0ea5f4425cd7047e686c7304f04ba9f7b5de6ad2bd524f1d29f8802a524441fa286015adf4589431710aa4d76de8a956dc1d39c0a13abb7fc309d24222d036e204ab6bb46ef8a7595d9e4512e0b9d5f8fd719a4e3072e1d806967045789c67a1681f2a9f1f4b19f4f5e1afdafc17db7a6d5196161499e62ab4b0ec27648f3eeb1fb2b78f8ecf9b05cf9509a3b9e2a361238deb1c91bdbc8b1d11bbeb939fd9da811cd439069da0ecc00665d72357aac01f259a0325409b201859cc0569e0eba67a7a9ca7e8b78078d9370bd3e37f0571680ede60cb6bbfe69435d6ab5efd80cf051d119a7004fc0b600844d49218d844de8f521524a47ee50229c7da25e42a8639b5db225e7f23967f5d4f8a297aff04a3cbedc2985b6393a5ba0b26b6c7b4ca22d369b35b410799d1ad02825104d34f73408db1948438597931ed1c1c260e78340517bfa2f734537dbdf5ec303518ff4640efe7f7b1c2f46ba8b9ddb7a18d5e87ced554c9d6de78f85d293349590c6c32483534bc968b24a28eb54b9515589d6dd8eb51a5ad0b4d896ce92250397cbc404323fcdf0ee47ed634e0c58213bc5b35a72b21a098e11b79c061430dc817c1e0c79a5b6ed3b002979933f1b83a17f250b1bd5c4958df4d75531ca03efbda89f6a92fe08c23ad9014ff562a7f3dcde578d6825b9847b5df04dbca4f2aa52d8e0f4cf8183ce121e39b50358a9796acde0372a8ff97769874a80ab997cd889145aad4888c06963c2f5b82f53a748a6729fbc79d35c06d84e05c62e44ff78040e56ebfc6efcf0d8b49337d5a17c4041f0d5a8b616244d585a162b69db073accd9071d12df5b326a43b834bbffc2f2a60deafcbddf1c6438a1769d6fb09fbe1990e89da12164ef237f326edb5be64bb64b143a030de8a99b3c5e543c871cb581e2be090a92134aa587701f864907cadd7c1ce20fcf8f5dc7f7ecd06a6c19d89a92ca0ad4393c208b80bba990c7a3702a9c79bddde75d5db244719ac32191b6ceb041ab541fb47680a97dc0422b8a50d91e32cb08cd341b0b099aca5bd12b69d4f89d10b755b351a6489180b786a3bebac926532a4a2d85b07bce6c090d1aaaff079e36d5394a612f1351b90c13a0fa6bf9d188d548dfe6fa51a9026edb52009c03ed45ac51d05c58a957bcc67e05a588985ba00d79f33ae9cdd5f5721d9fdc72ee6e880708be87e8a60c3c035c146f2091d1b9a4c2cfa56f292fe1ba62290d4e56c05669291bbe917f3cac51802a2cc8e9c90dadfe666c233c5a5bb71ee17deec51ce60c73f57bf9ecb84873afcc44815131810c6c1217bea485ef9aa2785e859b25315ef8aa3a274982786e45d622ae831fb76010d69a181b069e4cc55d4436edb10d1119b0c6000c6d5cff7c72f740a59dc0507e7a952b69403c62673f122c9d1264fac6ce2262e86cd8d6a402672f88530fc2d16f31736dd497a4e853253ac8d5aff8d1376895e9f5519b2490cc2a2412ba0c99cec855f668837310035e92fb646486de1b0acffb91ae7516df3eeef381456b55e65baa58e71461c928687e699d2b21814805591382e95e1b970aaa53259917f070281f2336b7d570249d838b3f1a32753c336864e15f4561badf8fee034a29c52ff3fca7456ae140f83e3b2fd5b57c9aef3f20c664200d235f236ec47dd2fc20b14dc6000812237aea992d987e5460679e8c5b76d931ef6d951e6c7087e3106b6ce2db9de6f228fdf3ffc38710c0e8d5000a195a79d1fa2301038f5b27c40b09c34c025e5099d40c2204ea0eae985263c9101cab88d6857a320c9e497f22348a24861a5fb8d734e08cad09f9933748ff01eab22f17756f58688dc1b486a397563ee9ad0784b8833cdb5f7c6bcf76d9c1105f71c3c6aabefd70dc6cd5c66d31caf916145ac5ed7fa070b4277c0448ab1eb78c943be9aeab0587d321a4bcb7754f070881178f8be668b686124899fac252519f4b60ec42db766a908755040463125c26850177402a977246d36d23afac0a11889d54640bd8f6f670d686cfd33f6fc5d90cf6cbd63d9d0fd201dd4c74dbbab899f3c23c0b7e37ea0b2aff421327200d0da58b5893a4186ae3652cc6e11c2c2a0e52184a3872532acce98c94cebf4f31333663a620f0dba0ffd89c3124380075bd28caa6d449a050b3661b8fbaf4747b77c4928b1378fdc8c7a7b38ade1aeec44bdfacc8271d0b132b2029b0f3582f9919f5c8cd543abc9caf6b82b197cd482c3ef61a64743506342bf50a3c1ff544563bb8b2002911ee1fad698f4ac133ffed5bfe81239c918207a03c7a8bd71a0a502aea78d38e970e3ab2abf754b598acb79cf276792aa08724d0ba24f2a694912ab795b3f45f52dec50d9bfbc99ae27e1d2c2216afec6709d6513a64b29ef58255bbe18478c5d4f15f74ea63a1e15487752eec8fd019f1d4a7aa25277664754bd2d7cd3a7a018b92c56d965a1974885363757286da9e055ef7fac17876f0a64c1026a597733b897a9155ecbf420159ae8e5209aa83a3544fff1fb4566f2d54f95e3bbd30dcca5f24397e4bd47ff01292f0d6fe9dd47a810e0c25382fa69b4987d1afd9b69ef125110ad6b240eaa9c85829a2646f9ab7874bc02bfa8346cc9190943e9d46b44880670b1e2aa3a29e83be5472d7418885a353faade6e8b18f4b588607bbb758588d1e2f11a9dfa1c4d61be50249f1ee32e6ff8c0c7722aaec1bc79654a4772efc578bd6a14c79abcc77a4e09c8b6c6ea35cd3ab31e35268fb55db843176f8042f8ce7be0ddd4ead6dbdad0ef9e7cb2323db5cc48119a72b27306b8ff6366c0bc682a85ab9e2cf2238b6d6eb2e38a97d5577e6334cb2aa6e7c86e489e876f9d7053577a5cb57f52812fab7c4bd7b19a34c228ffb67dcac9281612f778b58c580c140542200fd00cb3ad81d93420df93c5af2493f646d8de797102fa0a650b2c7638623b823ff11444fdde453570f99f9099b60061a908b83383ba8b82bb78edd074dccf9342afdf8d11a6129ba6ea7030f3629056264f1736c2b926171b6dc7e1fa455a473de656390495f3b6ad2f9f46f35eacb075628ff739ef78f28ba683448068c7f18fb63f28ba7dbbb78999100dde0a94e8b8570817c7114c13e139ceb333782b29b84a5b19497fa785915c7680dd7f972cb59ba22161f60886e5cb3c3e808726cbf96bc4da78914eee565c6d9d18e70d22cf8c0244cf3cf488c3550eaa400bc0f26d64e0f1bc8d0301a841d954073a641f3ef883d81f4d5db8e9df708e64e640b38df7295f7fe573863653086bae5507c880ab7fdb7a6c5ce77027ffa7395233d3ce536d77ae6c2e9c8ffb6fee78a3bcb3b5f888bd595caa3a5586948776b950a89cde4db8247ffff27491c882b430afdd60e7a22324f6635a9aa7139f3e624c6d9ece60f7f8153b2080cf0544fbf8e1c436503766e670b902604ab521e11aa5a65cedd64cfaf898ac5f55c08c87693c323517bcb0d99c28f5e072d4f6540c7ead70138d47c1a67fd72bd6ef5613af33a0af311c3d0a631ca2a2dfbe35d1021eb610e40b9be128683235a788b5a4cacf99babee382458d59e8aa1dd7bba7e09dd30c055a3df8ed721a1778b2c6ed587a403566325cd19962edd7831caa44a6b716517bad502130e7cf6a5ce5288dc84c0170f622ae0b1e1166a9c2c0771d91df9f9dd82ae210469602ce38964746c1c1d04321aae7d464eb801dbea7ec39505457e778208774d72673626c998b002c46a9b4b1e390d9344f0c1043a2100b35196bce42d40caa0ea9a486bf8526fd1f0f0d362c2cac463ea7377a20b54b9435442ca529fc00da4fd7e27c4eaf14215a06857b54254c26346956fd7fe215a5ce57ec38cedf50a3c759e563a4fd87494f00e7bd9b44f3b7e99c6ef67187056a21d2fe1ac9d24125b1947eb293189fdc448b591af4d9b8eb091d6bbb5e50fae79d000044e282bb2ab6c63cc9562b151c214e45015354e62be63e1881238b907f7bdb791ff44a4e03fa29dbd26db2f49d0f4729b7cd9ba69a65b0b493466d35d09b3f590c67c31660d95e2ab4af2c9f1df91f04ce5a57dde2d75206b42e3423126774d76593c2f713ae279d7092506b513fd5b38f0f52d3fafd7141dfd4a0de1063754dba865faf8dc0f6be9d90ef21ec86a275533f6ad4b4e360dc775413f29eab8b3daac6279b9abfe163ea2f183e09ed91ef67fbb090875109288a182cfdcc46d90678efe5edceda6518335e678438cac4bb47d376f3f0e12aa55301735d7f42653c073d6a4a37b2e17d332dc1be6b50918c007b14886307cc39250e81efecd63d24067a49994572725a9df1760caac13a28f5255556b27ec245e93969b85cdec7cd1c2d2a433d3f9572b93054a7ce8adff81bc1d30884d5fc4791e251bd907e37af5bec74235c3e2f804e4e0450b715289942b7859ad207bafcfec1b586dc15e7911fe6d20aa3d02fcd47e9956780e300d7c53c17dfa15754deb4c20efebc7270bda0fa6b37fc88c6be4250cac38c1b8186b364482026ab52d65d3a691903fccc39772277011bfaa421adba76bed9731077be00000000d40f36bbd2a839c67dc4b862c968491b877d4fd13fc90f8da57a29121e12f78e85af765cd66e72ba513593fe1cdf20019985b065d828707d8e509c6834eab188deea5c9ee97955f4b07d37b6fc7beed73be94887d423a349f35bb8782bc654ceaec870d97f061bda02ae73f6d575f81e0b6326eae6c1b3085cc584686120e12dd9ad8ce44036bec8a189f900", 0x2000, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)={0x90, 0x0, 0x4000000000000, {0x0, 0x1fffffffe, 0x8, 0x6, 0x8, 0xc, {0x1, 0x8010001, 0xf36, 0x40d, 0x6, 0x0, 0xed1, 0x2, 0x5, 0xc000, 0x7ff, r8, r9, 0x3f5, 0x20000002}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_INIT(r5, &(0x7f0000000180)={0x50, 0x0, r7, {0x7, 0x26, 0x5, 0xffffffffc4e10885, 0x0, 0xfffc, 0x6, 0x5d2186cc, 0x0, 0x0, 0x1, 0x10001}}, 0x50) syz_fuse_handle_req(r5, &(0x7f0000004380)="a6c574dd37ad5a06633d06f193c5b957758b45f2f4212a3ce6abbfded4461de98c0780332e9d3bfa72a53a1565605c551d53a1a3df7a15704f14493a1022fbcf144fe898338e9d3ea15101d7e179a6bfc093e7fb9ce3bb0854c64264cf2b2baeee72f52658949c8262186aa1582f932c471e68d5cfabd57f6abc46aa8052b942bac756f03e4a14f3ee3cc55d2aeec21d08ae0cd7a67ba70814ce161c6b7718e96055c1494f55f10673316179e99ce409c9cc18b80a020ea99be8bd3415d4420a9a4c74c9d16b8c6b58517f1380c44b8cee0d164eee6bfadada764eeac74f4c867b5e184dc0918d587bfc577836e9668f0fd44674f1310a910df2dc6e2342d47fbeb890b30d7183595996daa2e6f21fc1541ce0ed0686f2ca5536bfbc851a1ab1575502a19cbd990e954f12e9b7a0985d93c1ca66b268d4bdcdf7c75c17faa6d9b03c9f88fe6d31aaef35d2dc65bc74279983b0c6646475b83c1e01b6c8872d115aa72ae06a18e6d4120f551d2c35fae118d490c50867bf3f6cd2f950f22d6b0c7577e04697bee47b85c6144e2ecf45c4fd93ac1b51e44f98e38f9e9b93c3eb9160404d3a60f808836a8668604ffd8b317f91fd4dae384386c01f5fdebfa643907b5a07ad1423cb0d4a9a68aae6d2b5a912ba0b0789735e73d9a8ed8ae42c92f67f5c3a40e7df5575dd5e033f3bbfc443cfdde1685d9d5c05e8e9469bf7f546398a36cac008bc36520d0e08a4cee2a48ad2ab819524c9e2145f0d9d474acdb028b9cb8248a4d9df5bf6a1bfeea458fedbc039815ffe375cae1fb9be988916c20387318cde61c36b17eea13c176bb106d292728537032cdd79d7c8d48038a6b71aec0d61e774be6ad9f64210957c82dea29ca0991e019455cd7fd2ee2a64491e87e89807be62436132e5a6e75eb14f83885f161bc0c1ad2f3390cf0125712a9f5a14e62be0a9ef23f1eae46680143a83ab24483be91e1c015d4aadeb378c7aab79a474b755e14bbba59f2ac1b80d53d38baee42fd758e9a336ca9044e9fca0146f7168aa4a519e674daf9e061778a74a9ba48c34e1bc8ee86943f37b6fb653a82598902630bd4fa3cf374a622f38dcfe1006a3eed5c31766d13bcb431d7911ed3fd747755300b0343b65de201e0b95599f36cf1971b39fb3bad2448b863df0df7a3ad88741f08b90d7ab7632f481f0a6d1d8cea57d106b54790acb105f5a4030c48a232592a887863710b16abb7357670b36ccfa676d6689bf10b6ff95af963336f89f4136dc9ba2ea1c92bba5cafca6b248b2ffba2737012f29ac03ff59572833c4ff9e1a2ef2571e6962ab67e1e55138ddc4ac90441fa75f0feb9b2e07424bde534f28a50205f1136d9fca176d875bc44e3439c0bda08a2777987bb4e6795f48038f2ac7963d6528fddedf73b8416412031e84fb2ea1374adc4e3999db6339aadbf1c795dac51153f0ac54ca6d418427b696ded56900d663ef962822d67b6c7a6a0d5002f88e24b06ca47529f02ebbfffae34efec65f230de35368054a9d8bd9fc710f005008149019d683c7450234ae571b40e5de4c9178c1f1122aeac8293008a28ead3946bd6287126fdf42fecb03700cb9495b8a9be544aef8b489238020d7b9149f404dc17f61cfa4a3eeae72f46f79fe3f6d384ac2a4db2a45bc8c002ee4d491607e924fefd165c46fb15f2abba54a36a2460b6c2ee63de3e30e98ff3d453fab204eaef89ea21f8117b0e5e5e87eed6e2a3a58d270e65cc92f618b0e445d55f29c031fd36fce5ff62d036902bf5f1e4feb74c571f5f8fe03519d579c78f82efe2dea5192222f42ce4ed35f0f5df316dbe5b1db225b00dbe4e04518bb289c6eecbf2025a6758eb04f3675a9061b5e9ae5a9ec9bc5ee41b08d71c9059d2c68a42da09d2eacd3ace96be1ad943830663052cb8e3872588394453a1aee28cc3f7e4cfe34821cc8c323204a06e9d82fd4f67751c49f17f92dcb30e8f02f3ea24be55fbafa90c501c365cc0349e2c3b6f0f02ac83ff40793c4ed56e294ce28accdf6bbefcbfd0ff538d7cfab35635ed8fc8951a1ccd30b59bbe2c51eafe223b4dfcbdcde2acc437de051f9563b76a4360940a71986d86e0854a2b530ade41bdd87c0234ac5dd42ee03a102932b083e57f65c1019d4054efc1cd25f4f852b9cc6befd387ddecce4da58a466e536ee8f7a3ca5be424c92b1a20eca71d5901f3d62ac1bbcdeeaa2ef90fbcaf35168a1dc0a5cd52ea960ab4c1d0e0a6535afd5f209aa89617be651c4c2cd212445b32e17a04aeca05b42d4788921e5834744e63f13222dc52c90a08b6204d85fb27c9f15de631d53b5ff0ae50b5feb46f7c67363423d24f970e0e950839da3f42016ac2f38859ae4261a1e9da9552b6a17a1d5bcbf27fff17ad05384206948b49ce4c87c80c80edb9a3b5d76d1e64b01ba735f93667b8b378be78935936c2ac1071d7abb977cf01edfe7664858cfd8f846a4de20d98a56860091820f9fe7ca2de7be202b36222b88bd8eac23f41f62e14110afafe64210f4a07f894bfbcb183b87747e362cd5b9e8c50df1453053c18fe121bb7507bc501a46f736bd13d5ecc4fa54dd77e53a604f7232c8331b1b7c0537689fb1945128f975d6405747bcc0d172c19d4fa610cf481a8aacd5f7a7cbef3456a65443322afd137708b3fc8b3ee9b8a4cb38c7b14d4fdd74daa58074bcaf22bca1cc8ec2dd22cde60ba5d892342a14be25b4d897ddb23b8154c6f24a93c00c17acd90522ef7acb80b343ac08b4af83ce8a0c95bbfe140c0f1c572639f4079607a34b8f675cf3ddfc2bff83635f9d13b2375c1d317920530fc72fc774edf8dc4f653d72876c1ae61edc6edb1cbc2edbda7207cca6811175cb8f9205d8be99d81d217e0433ac7d298962b87db00128fff1f3d264c50dedd3ca4bccc8db1c1191c3ea226d351560024be65f4e85f577bf8f06d6528f7c73640cd579ac1677ee58255c1bcedc9670684737173037eddc55bc943b78524f617653a324319f6026b6a9b02cc9e3b58e8b661d5d7805723cc5c476e3b7f04ee7dbfe1af744f756313a2146a84224877cf93d1f27c28e7e21e4d29193d6384c3e9eb337cf67a5b45970c7ec3d5523847d0e7d56cc4f132f160851feeced284fb5a75c203fa6b1e01362ff6da0ebf8d852c90b1a026386253afe5c7a078ecd8c5663bee57b83200653bd2a5e6695a3cc5d466d2e65d81da058107d2422fc99875e95b772608e456471cbbfa2ee8795b45cacb1290563eb23bf534c7db5e47fbee4081013974ce9dac3301d6cd966255e22243c90fc55f4b421940c7e819e5d54f44869943e2f267e3b1b9eafdf61a9157c04e71b756076445ead7851923efa6454ff156b2c3793192fec046b7b7e8947efe0009e9ef049dae89b34dfdc0183cc7a9c7cac4eb13994535e803a7d9f070b95df12bb2ecc30bb518517982be2a274faaec1713a423f020089848326e5fe32c115de0b7f8c2876271a0d17924d246c9e08bb534d741b03646daea5411f1825632caf101ccae49a99b82e3735513947b6c6a4b09b76203547f79f2809c96bef593c6e64bd0eb84b1b11e3f136fe725607df9b3420af6cdead70bc572a44ec1453de49fa1f6843f5e74055cc37aa86a9c06cc8094f3f58f3bac7f7980c1d41729ce1331096fbab86ee7568798a0be045b132ec6c587143ed9071f949f0090b783a1324d76f5aec5559168da67c85e3bb8a48937a214d1f101d7ccff655c5eb778ddd61cde8dc39bb1920e0d7cf418b761ab92bcc677a0c5b6cab85574c1216e3cec682dbfad3a7b053e365578c0c1c7a70a1b48b6744441f1476e13366087913dd41e6d9a272301be9721dc0fc78355fa914b8033c1eec4f2cd0cb39e17603b2f7052619cb52e658c928e3925c326d00016146a754142115d4bafed77a5ad8b541f4e5cb732af4411a1a8833ff4215aa8e0d743ecc63c311bbe3fd21335a82f0648535688434df83e6fe6ea8455294a2bcafff88a0d0485657e7adf5b73083d873cc87ca6cd56593f11642fe27d9a998d55ac7af93b702fe4418d3ce0f2dd73d8c1f60524575119bfe0d961c468a906a0df2868465b5bf5d2018b97c2e11393f673b7199dd0c71df6469f984dbd484cf809ef1f919d1b7fcec368cb93ef49fae9b564a28225c2e2eef782a07f6aa660b2c385ac00a2151e3ccf29344b93621987f57bd29ecde89a2cc8dc87471606cce12f2ac1210358b5f08eddd983e86c02440a9b357f386f8d4ea61b0a73b64427e4e73b174ca05e63ab749626132643d02df141c757485cf729bec5229b91dced3640366200eb3beaacb9e9daf19fe74d7c06c18f3caf4d9ea2cc8fa906f58c620f91fd883dc9f3743f094a4b0c85d78f7ce6cc01c53856be10e861fe347f077399e187d22418c0aad8a913f4cc892c903d544be85be4b031d1028f70acd8184de1c28538001b153bf0bbb65c160339fe34856eca5eda8aaa79d76e4f126b4bbfaac2f44c0d936002ba75b0205a21c4720b0b3ae87f5c458a57254b017c51e3a51e087c3a29a654abe9fe9c21a100122a11f500fca1bf676aaf959980fca9cf1ace013d1de770ceea61e9c831d3a5dd8faab74bf95ee49f1a580e8c4add9cafddade6c761bd100e1658070b8fdba52481144d14fab4771b63a1e1ca1ef6d4edeada494a084bab8a5e4e97d1fb9313330ab144adc08933fcfa71ce95e9a274e5d1deb79705512b74306bbf702db06720abd251f38a4d6c3f8006cd42701e2355e7a5815131530749a409c0d5d993d20a6b82d84e4f14c36ce24c713c53e8edd3d571049838ae8815cbe000e492b645072e8635290d7b4e13439bd7964aa14f5d55b9347df8d7635ff028f4b6c9c21a98d2fc733fab1953ec9f142e95a29df4cb41d7b7863423ff7c39cbe4623bf449d5bc77040d90817ac0048cc360509a5a16c3094a6d57580db5497c3b3d5c62104dc58e851acafebe9eb531018215ff2bf2d58999d6ed966a646dddb0ca203a27978983128949878002ed1ddaa77aea7215e74499f9159cc9955822db1615a258fe65e0561be8c62435b7271b1f2911a9e01439ec15cec3e1f9fd795fa829c20e8729ec79fd064db0a8c2e676b9f3e3f49f05931d79303a9bdfeb04acf35596520383d8e758a889a00e7362cee3717b70cf30abb93a5f2a40ae099c265c2df3c02b4fdc4293d4e7fc26c8887fb9eb9832b716b083cd56d77ec2525ce622a2c088ceda4c753643212e2170e89ae2eb48d99e22c4844553b3ea0eb5383813522bca850896239fd228d4215d4c5b550f041c87b78efc4c1dbb96a6b0c03ab83c7ad4484b487804bc21d2b82f10da8a4fc7bddfe88882d1285e5eb1592ae121dc37b39e0de0c4825639ebf4cb8328c236721ddcb5820f4ca2efdc2bfcebaa0c588b0cac27dc5586aad5043434edcc6c02bf7173cc771d73f369951e97a0ef5cf2deff299adb75e564b3630c41fc059a75c661dc2510a3dbaa265bd700c9e20685991875a352a8083db7560f81cccecbfa3a744cedcd22efa444140e4d1b44ca8694ae7b80854989c393173b2fd8320ffea2d9a20a076357e5005c3c827808ad6a52b8de9968a41e0ac3170ed92f9f5630c62660746badb6894a6ad22b31be6486cd433520fb12c35a2720cc4b26749c0c4fff90060d3e5c4e5a3ea0116e20fe0b540b3b1dfca809b76bdeda4288667dc0b5b12a017fc660ec2f81d2e123c7a44c5a5080cc6bb82dea8c4afdc577c083bfc1030575b566f8a645b625b0afe554c68047ca43b99f9fce1dafe0b8c04c0a96b291cfb57239acdea88a4da0702b28de12fd36f24191e872a1f84a4f9922f54c1ec1c4b334a2637bdf17c0ea02c625d49d5dfb6f3799fd533a2948f4eb715ce107beffca4d4bcda4f74cae225cd2d47e5328ea2d43e90bb5d889cb25582a6dec2074c2a56c9b085da58d04b47f705bd20d2a038e74047995a5a91f130931fc916ee1ce71a6e1e448a692f2038612e4ec92d9aa496bb456303948ee34fa252fdff78c73d0ea3561edaad53a687172928fcc6b4f7c489113444a71073891181c863e1b11fb91ba0ed1362e313738bb094e59848b6686b609820a40f2bb7c06b2ed25f8834550a11be1d48af0260d8b22af8a560b9b995539118a7703621bf4f458d317ff594ff5ad5b54c460b0fbefb26e6afaed183d76f5deb150a96e8afa6ae08bf2e5cf7512ba46d153417530bb0f3d0fbccfa577b6f89d67c3d35402c50ca7e26a037d6e743ced3f562624aee7c9e7edb3e6dc1fc3e692b93b819bfec8e593efc6e5614ab7dc754ae7116c14b52d3cdb5a1fae2b420fcbb0a1df00ba19f61243e94f14324fbe9ff18cb9e9050fc795a9e4951119bf1fab9ea614cec2421d1f60dfb7776c5b689a443785f979c4abc48e730d091a63f8f504e605029a817135597e7556dfa086139077037f313e827f4f1ca48aafafc4c1f8350750c68eebdf64b9f8e7043d3f53fcdc7c3479d09d70305b197e68140b430290d6169a998762af1a6c18d9f5a383503a9861930a0058641e35ebf149bd092a3f16e91779b0782f850c6ceeae5325609431cd363f46c5411ccf4187a30d3681cf28b945b47ac0300522750c706d4e438d848339578b8cefbcbdcd0d0e325a9d201ee670a98e7c79bd695915bca29f1d06ec01b71797088126b936f3233a7e6d9536aa9f09f13bfea01d44508ecdded3819bd1c6efee93703f4886be2fa2e8c93a71955a61f0cf44a9aed26cd75416e83cd87191a6c060484b0cfb50780131141f6cee23e7a0dc395118699422b1ae82199a7482e6637e5f6d0cf95b59463bccbf9a1cb13ddff1510d9e4b6c83f87b54ea388d73bb7b8ea91ef354ab5a7d789ceb116659a9b094fca42bf3b3ca01a6183d0947993d1953ddfe86b4b9ed39ee0457632989bf804e638609c7a5f02ae3375b664f9420b809fcaafb8312f8306d76635fadd3e92c6cbdc4621ff29384d1c171f526446863f5264ba0bbda4591f7c556ef90883db06ea4df05fdc2ba59972efdd10ac63317e97756c596c01b9b63efc66576fc220822fb66e63e49bd6a0bd1af1a67659e36f0f8ce4594fb592c2592b6d59ea6c387c10d83bcb6fafb0ce23eef6f108d1449ee732b75bea6536a1d4279d8c73a873ab0273dbc47b33ced5c18358b719341148c3658ff43bb93ee7240511a549e7908a767ae713f3909f937b876989f2c78d379d5f62ea7fa8c2f872179b90adf80caec5e60965fa003f4c1b022d49b2b056e3f0809ad4667accf069c2d4f93d90a6272c2434566553ff0da6507d6a4680c2ecf6b0810a9777ab213283ebc2cde80001cb3e591ffc0524c2d49e297c98e71595cc7d742ca23fde6976297988fcfdbdb131f82547aa17dc8f2225db8829a8886147cdacaf7478fb383c645d6f87486ab377e83b3b4352330fbf82193aba642e7494fbaa86dd146f3fbcafa68502be06e76f62b43520568977fa3274a1ee63250778dbb50c9b53d559a025dd5dfca0b90c39bec748b7b48f277142e7b8feed18fcbd6d064af6aedbb4af14ed01a8b947d132c439d5fc28972b1f3dc32d1347d0c78d6b0253f5eebe2c2623a0be2f11d48281384c89b8f5e9317c3f9eb5ab19fe113376b5be6d7b13518e11d10f882dbd1a78020634169294b51202691c28a3c78c1dfcf4c90cf9b6bcd89ff2487e237fd8fdcf9438d3d7fe6170d50bc2fe85a0ea92bb74a4d5a4dcae9186b48f1733f165600e3daf69425a40ed47bdf21cce93fa901a6370e67eb5bdd59857742322ad6e9aa86a260f76262faef3c957b293c80a7e26a06d6ac6590a75f47df7784c2bfa51da1ca9b016628b56db020bcb88fd584b2a6e71d97a7505cc692b7c24ca690f54683b913741ed48487e358ac12d1f5082a618344a716bce24d899577a1f6f48b22bd0ebe6cd4f98cfa0bb645a8c28575d171d898a8feaf0578d97ad9a4cc4e0a0c8367202a5bce21a1c14a99073afbcb5399336efee97bd5819cc125d1fc401840e3a31f23b51d5d4e6c9ea449975817f08f742ee5479b9ba24a7b203b82d3e060510e85aab8c32434229e4100b5b1c3760b914e095d071790b65b9bb0a3466d19b206fa415f0f8b0bed0673f6e17e2e5fae3a42a3633c302c140fb82c2f5c01fc470c9c3e68b5c0d52039ef4e50fa31e1bb2019ebb9858b299b69740b2949449d8469d728f892da89e7115de8ee1f777c507bfe98e80d9b4d064fe0889392e5170711988b609972aa8f15525ad2bb1dc0117af0933792aaca6eebdd22ce19639bee25c877d802a503d1354bba99403435db2aeff550c0b477625bd22617398b9124d3edf1306e522cb2f8610bf533cbc55d4d1c5d7ff5d07f87a11494980e97a7c824beb7e16090040d2cbff761b826e8b5831dfcdf000eac2e771a48c6ba846b9ddf36a858099f77d51bbfad480bba9095905d618d7b355e40159f5e48ddd5583ea720ac9c74cb118c011d3ba1c67dc865a8eeab8667e0a81ce5894fd888fe4ec2ff936bfeb45c66cde689e4a4f13bd138e7dc27aa263fb009b81c274bd0d73b35385d99d1d082ebe5cb41de09d274fbd7c1c414f3d1ab45d2e8949cff34106b574710144cf6d2072c380cc9c83ca48b5e057973e73df30821c1478d21bc55a462727263062271d76fea1509b365fbdd92b4c23e088f61fce348ba0e7a3e5de600762c462e063e74981f14520babfc3278326b95419d24f4e4853507acea8a5f7e70c13b31f47dc3d823b3f699a029093b1ccbc564c3be29a974cea6fbecdae3f763fff2e65bfa1a52742fdcde3c9c0644267825576d7268e2bec08bfb52083df7b5bab93fbf2cf6a8d91cda5a04216e8b9d961a28720667d2a1d3098bba17517b74cc93b8e3b65d36c12f10a7e0898db2e1e4daf78a6696e1ee221cb885519cdfbe9284face6a525e4ac8d1d91f46d2dc8331ba90e9613947718bf51476ec3702c21313248edd984c46df760b2d83ce9599fa73508d12f606d4643c25ca38fb97fa43d229a8131332011fa87763ae10d48c5e2be8914c1d40d3e53e52f803804769edbac0e309590e4131982de1baae61ff0f1443b95344c488a7a7f4e0b3034400bddc2ec447a40a36d017b2caba9bda7f03f8cddcceecafa556820ffd3c072ef394a3d809d78f5ef53f57f72012b60ee76940b3aad36c76249a371669ddb0da3227b893b99a355143cab5cfc717658b14133aaf002ea497bd7db4d8f1bbf9934a55777ab886038492a934b1a2a2cce48971ab93c78fe4d45109e5db3c5c276cf99a3cd497023bb2a19b6a186325f72d2d202ff0201caa67ed9901afae678579fd3fce2f5bfaed4a54bd2dbb824f51dfe17d998b0526fa8dc596a80f097c46ce38f5e927ace3d0dc90b9092d619b71e36421fe0869681cdb5e385b794e9ed34932163ffc6b8d21e882b1ff00c7f3db420b8ee19c7c38ec3192de30dc3e5d01f572134c1b25b08f7cd1526fe4a97c1108cd84950a11dc697551b401c4186f2d1e4cd21a2b4fa43ec6c4af09f80bdadebbf121ad2339f6bac808f3a9964516132c3b3d8756f22f7b7b8a8695d3029c45e335c77945b8ae7eca964b77a04a1695d65c4f453f1cd3f6d85ba40764f02007165f1fba3b28d23f88534995119c869a20d48c67f79dd1d259042dd8226732905de52ee1aa570ff4fa732d86cc20a11dace7d65fdf1d26b58384b7f315d11cf3231007584025c3dd9f2d5e38d7c2e3bad6ac85267d31625dbbbce63e9898872f38a303fd638e43c5cefebd719e8efe6b2075f91cbc62cbb6579420016ac0216b667aecb7195da4c4a36477c665fcfef6ad551ea3606a1475230118d95e600cf2abeff563d92e1bc753d10d782a1d95140b5cafae4d2d350e7a84fa3b65723943a97c68cabb776ce502abf2f1f1fb8c1248a9bbf2903c9304fbf9a1219b40f378123b5f8130ba36f3f423327b869605d056a101f64d8d6ca8b59aae0e325ae5e114ea550d11fdf983ac2eedb404a10929eabaf2f7c402b82124c7bb30b5344295818a253012dafa47f6f34b4431f0180cc2859db29b349c6138b538fd4de3863c21c01285600dc1ce73013990e4c1daa03d78878200c639586038620fdb7a9fc844485818edfd2636aec5a2b16af4bff428d2dfe89475ca06776a68d5e4b4761b985095e94cd91d33a3f0a5dfbfc255ab5896491c03044aff1950823358b54edee81afea9b88764a24ac9b917e2cab6cb2ba1c91d10bd0ef8681cea3ad9c59f78882d4aa807a53a106ca2d0738a04457275cfac653638a94577c4ab03c9e5d6de1dc78b487ec918c4a7ca2a8d6ff852e8fa25776aa6f139a3c54693271502b71eaddb461c1819f6d20a79ac7226a177f42df6f4705cc62cc0484b28e5cfdf7fc52b0c582621bacd703a28714175db576ec0bf017c32424675d28d992e46de460b3289fee37b49b356f7842cd94764795c887115419234049a2a2708ae82efb8f10f5d22c2bae2f5c1abb9cd839c6214b0acc0b04fb6cfdf7f3adcadc5189d850dd957c47a4f946ac479a4e124f695d222f37ea07506638e90b86bf3bbb0ccb578bb6fee8941d6e1da1c77996a064c60157b6d417beb1ad5205f210851a079f9ef6e3faf3cab5482cdf7159e78b9d820cfee714a070ad35b91b49cb43b43bb7fbbfd5276b5c2eb0d4ca9ff9b10f0b8ec74233c7aebb2933e4bd5b0a388ed6ceafed8ef995098c2b88d74d2cebd44ba26c27b5d8983394d286156f4b501e45fe5217096b1bfe7b9bb3f6c3b4d2ad15bf1c86ed70ee852c4cfb979eb4a0c826953799a2030322669364aa905092fb45cbeacac44703c70d7e278f1a5926f242d459e36dd8e374f9bb7a0c907db1d4f8c1993ac0244f6d563041a8956ea82b7eef7a63ac200d32ab107d6728610efc530aa5783771a5fbedbf5a379b2923f088cd203e315f41072d83201a1f1fce87d8b7cf2f142e1ff5f8b2f52028e8764e49604b46dc3763f79015183f601e26346606e22c24e1833b2755afa285feb833d3ff3b910846a96e028070f925a6c640d9956c852367e89ca0dda26ad3c22f3c63f87c49f21e62363273579059ec88643943816a0a20caa0d97bb10aa5f1da882d422beefc5f59128636d851427783f1639d25af11d0bf7e8810f2304074f0710b82a1f8fea2f7da16b896783a468aa04e5524d9f118ae733501cfb913c3c2e327b7b5c87e250884667a9fcf29e27c9009c2173853b5ddafd7c6bfffbe1edaaecbf5134aff42876a192e34e32faa8605e1f5dc8553c3e43156126da540ba467be0b3bece1826a85a96232fd37a68bd9a381e96a74f857965477725c28aa908fc8367c7c4024059cd2454cdb0bd00213d70946b1751e133cff48809c6093c6fb00db7e477a86c857c81d39d49f1974d2191f52f737c0f9710a6eb8bf6b86161930b312123840cfc060abd7f69e36a6393036550321d09dc13e484794aa0de078f03d8396464feeb7fe8055b23638d7d780a394013039dd006484051211c862bbfa85e5cfbd77d2ced2f5ddb9229f183fcffd2c5d5bfac00", 0x2000, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0xa0, 0x0, 0x7, {{0x1000000000000002, 0x4, 0x5, 0x5, 0xfffffff8, 0x8003, {0x1000000002, 0x1, 0x5, 0x40000003, 0x2, 0x5, 0xfffffffb, 0x8, 0xfd55, 0x8000, 0x5, r8, 0x0, 0x1, 0xfffffdff}}}}, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f00000013c0)='./file0/file0\x00', 0x60a41, 0xb3836f6d7a15f29) close_range(r5, r6, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="44000000090601020000000000000000000000000900020073797a310000000005000100070000001c0007801800018014000240"], 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) 1.679808975s ago: executing program 3 (id=1740): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f00000000c0)='usbip-', 0x6) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/configs/c.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./config/usb_gadget/g1/functions/uvc.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.0/streaming/uncompressed/u/720p\x00', 0x1ff) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) symlinkat(&(0x7f00000005c0)='./config/usb_gadget/g1/functions/uvc.0/control/header/h\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./config/usb_gadget/g1/functions/uvc.0/control/class/fs/h\x00') 1.538475539s ago: executing program 2 (id=1741): write$tun(0xffffffffffffffff, &(0x7f0000000440)={@val={0x70}, @void, @eth={@broadcast, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x2c, 0x0, 0x4000, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x0, 0x6558, 0x18, 0x0, @wg=@data={0x4, 0x0, 0x8ffffa888}}}}}}}, 0x3e) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) r3 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) sendmsg$nl_route_sched(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newqdisc={0x30, 0x24, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000300)=@newtfilter={0x8c, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1}, {0x0, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x5c, 0x2, [@TCA_BASIC_ACT={0x58, 0x3, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0x0, 0x7, 0x6}, @empty, @private=0xa010101, 0xff000000}}]}, {0x4}, {0xc}, {0xc}}}]}]}}]}, 0x8c}}, 0x0) write$tun(r0, 0x0, 0x34) 1.49221208s ago: executing program 1 (id=1742): setsockopt$RXRPC_MIN_SECURITY_LEVEL(0xffffffffffffffff, 0x110, 0x4, &(0x7f0000000140)=0x2, 0x4) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000100), 0x0) close(0xffffffffffffffff) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x4e22, 0x0, @empty}, 0x1c) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_CREATE(0x0, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x10) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) sendmsg$nl_route_sched_retired(r2, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_INTERFACE(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000900)={&(0x7f0000000840)={0x1c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}}, 0x1c}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x4) writev(r5, 0x0, 0x0) connect$rxrpc(0xffffffffffffffff, &(0x7f0000000200)=@in6={0x21, 0x3, 0x2, 0x1c, {0xa, 0x4e22, 0x5, @rand_addr=' \x01\x00', 0xd8a}}, 0x24) connect$rxrpc(0xffffffffffffffff, &(0x7f0000000000)=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @mcast1}}, 0x24) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000002080)={&(0x7f0000000f40)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x6, [@union={0x3, 0x0, 0x0, 0x5, 0x1, 0x3}]}, {0x0, [0x30, 0x5f, 0x61, 0x5f]}}, 0x0, 0x2a, 0x0, 0x1, 0xfffffffc}, 0x28) 642.014123ms ago: executing program 3 (id=1743): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x20, 0x11, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000ffffffff000000000000000085000000a8000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b705000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x11, &(0x7f0000000200)=ANY=[], &(0x7f0000000b00)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x39, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000ed07449e00000000eb15000018010000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000396f7b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002400000095"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x45, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a8"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r2}, 0xc) 573.234225ms ago: executing program 6 (id=1744): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='pids.events\x00', 0x275a, 0x0) fcntl$setownex(r0, 0xf, &(0x7f0000000100)={0x2, 0xffffffffffffffff}) 493.301567ms ago: executing program 6 (id=1745): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) memfd_create(0x0, 0x0) openat$dsp1(0xffffffffffffff9c, &(0x7f0000000200), 0x40280, 0x0) 387.90201ms ago: executing program 3 (id=1746): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) socketpair(0x1e, 0x1, 0x0, &(0x7f0000000080)={0x0, 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000000400000900000001"], 0x48) socket$packet(0x11, 0x2, 0x300) socket$packet(0x11, 0x3, 0x300) socket$inet6(0xa, 0x80002, 0x0) r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) sendmsg$inet6(r0, &(0x7f0000000880)={&(0x7f0000000080)={0xa, 0x4e21, 0x2, @private2, 0x49}, 0x1c, &(0x7f0000000100)=[{&(0x7f0000000040)="8000e8beec9dbc13", 0x8}], 0x1, &(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES32=r0], 0x30}, 0x4004000) 366.49346ms ago: executing program 5 (id=1747): r0 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x2d, &(0x7f0000000300)=0x5, 0x4) 261.997653ms ago: executing program 2 (id=1748): r0 = socket$inet6(0xa, 0x3, 0x2) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e27, 0x6, @empty}, 0x1c) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) bind$inet6(r0, 0x0, 0x0) 100.209217ms ago: executing program 3 (id=1749): openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4102}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, 0x0, 0x4800) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = socket$kcm(0x11, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r3, 0x107, 0xf, &(0x7f0000000600), 0x56) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000640)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r7, {0x0, 0x8}, {0xffff, 0xb}, {0xffe0, 0xfff0}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x5, 0x80000001, 0xdcf, 0x9, 0x5, 0x6}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x3, 0x452f, 0x4, 0x5, 0x1, 0x80000001}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40000b0}, 0x4890) sendmsg$kcm(r3, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r5, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200590214120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1}, 0x0) 92.502838ms ago: executing program 6 (id=1750): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000480)={0x0}, 0x1, 0x0, 0x0, 0x81}, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x20702, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0xca58c30f81b6079f}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x6101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2901, 0x0) close(r2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @link_local}) write$tun(r0, &(0x7f00000001c0)=ANY=[], 0xc2) write$tun(r0, &(0x7f00000001c0)=ANY=[], 0x16) 906.51µs ago: executing program 5 (id=1751): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600000000000000", @ANYRES32=r2, @ANYBLOB="01000000000000001c0012000c000100626f6e6400"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$ifreq_SIOCGIFINDEX_team(r6, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r5}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x44}}, 0x0) 0s ago: executing program 1 (id=1752): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x101042, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$INCFS_IOC_FILL_BLOCKS(0xffffffffffffffff, 0x80106720, &(0x7f0000000a00)={0x1, &(0x7f0000000980)=[{0x1, 0x0, 0x0, 0x0, 0x1}]}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="0b000000080000000c0000000000008001000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00'], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x5, 0xc, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000000000000000000000400000018110000", @ANYRESOCT, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00020000f8ffffffb703000008000000b7040000000000c59cada3e3fb22cf009500"/72], 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007808500000075"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f03, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'macvlan0\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000780)=ANY=[@ANYBLOB="44000000100001042abd70000000000000000000", @ANYRES32=r4, @ANYBLOB="8249e900800005001c00378009000100626f6e64000000000c0002800500100006000000050027"], 0x44}, 0x1, 0x0, 0x0, 0x20000c10}, 0x4) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000140)=0x801) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_int(r7, 0x0, 0x32, &(0x7f0000000200), &(0x7f0000000040)=0x3) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=@newtaction={0x6c, 0x30, 0xffff, 0x70bd2c, 0x25dfdbfb, {}, [{0x58, 0x1, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x23, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0xaf, 0x1, 0x2e3fa6bf2c47fb38, 0x1000, 0x10}, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xff000000}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x24004040}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000740)={0x1e, 0xb, &(0x7f0000000880)=ANY=[@ANYRES16], 0x0, 0x8, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, 0x24}, 0x94) r9 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=@newlink={0x64, 0x10, 0x401, 0x70bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x10bc0, 0x46951}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE={0x8, 0x2, @local}, @IFLA_GENEVE_REMOTE6={0x14, 0x7, @private0={0xfc, 0x0, '\x00', 0x1}}]}}}, @IFLA_IFNAME={0x14, 0x3, 'geneve1\x00'}]}, 0x64}}, 0x2000000) ioctl$int_in(r9, 0x5421, &(0x7f0000000440)=0x6) close(r9) ioctl$PPPIOCNEWUNIT(r6, 0xc004743e, &(0x7f0000000040)=0x1) close(r0) accept$inet(r2, 0x0, &(0x7f0000000180)) kernel console output (not intermixed with test programs): T7385] team0 (unregistering): Port device team_slave_1 removed [ 217.523938][ T7385] device bond1 left promiscuous mode [ 217.590734][ T7385] team0 (unregistering): Port device macvlan2 removed [ 217.671143][ T7385] team0 (unregistering): Port device bond0 removed [ 217.770751][ T7405] netlink: 'syz.5.924': attribute type 1 has an invalid length. [ 217.781408][ T7405] netlink: 'syz.5.924': attribute type 2 has an invalid length. [ 217.843474][ T7405] netlink: 36 bytes leftover after parsing attributes in process `syz.5.924'. [ 217.901433][ T7405] netlink: 36 bytes leftover after parsing attributes in process `syz.5.924'. [ 217.922159][ T7405] netlink: 31 bytes leftover after parsing attributes in process `syz.5.924'. [ 218.044914][ T7415] loop2: detected capacity change from 0 to 128 [ 218.160482][ T7415] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 218.252181][ T7426] loop4: detected capacity change from 0 to 1024 [ 218.262938][ T7426] EXT4-fs: Ignoring removed bh option [ 218.289584][ T7415] ext4 filesystem being mounted at /190/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 218.408536][ T7426] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 219.089741][ T4285] EXT4-fs (loop2): unmounting filesystem. [ 219.124419][ T4275] EXT4-fs (loop4): unmounting filesystem. [ 219.309640][ T7442] netlink: 12 bytes leftover after parsing attributes in process `syz.1.934'. [ 219.394658][ T7442] 8021q: adding VLAN 0 to HW filter on device bond2 [ 219.618294][ T7454] usb usb7: check_ctrlrecip: process 7454 (syz.2.933) requesting ep 01 but needs 81 [ 220.780889][ T7472] netlink: 'syz.2.942': attribute type 1 has an invalid length. [ 220.797252][ T7472] netlink: 'syz.2.942': attribute type 2 has an invalid length. [ 220.872189][ T7472] netlink: 36 bytes leftover after parsing attributes in process `syz.2.942'. [ 220.966385][ T7472] netlink: 36 bytes leftover after parsing attributes in process `syz.2.942'. [ 220.973438][ T7477] loop5: detected capacity change from 0 to 1024 [ 220.985979][ T7477] EXT4-fs: Ignoring removed bh option [ 221.133884][ T7472] netlink: 31 bytes leftover after parsing attributes in process `syz.2.942'. [ 221.155662][ T7477] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 221.181258][ T7479] loop1: detected capacity change from 0 to 128 [ 222.322708][ T7479] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 222.334390][ T5781] EXT4-fs (loop5): unmounting filesystem. [ 222.379479][ T7479] ext4 filesystem being mounted at /199/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 222.640505][ T4276] EXT4-fs (loop1): unmounting filesystem. [ 222.876268][ T7501] netlink: 12 bytes leftover after parsing attributes in process `syz.1.948'. [ 222.975605][ T7501] 8021q: adding VLAN 0 to HW filter on device bond3 [ 223.067465][ T7508] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 223.577152][ T7528] netlink: 'syz.2.957': attribute type 1 has an invalid length. [ 223.589124][ T7528] netlink: 'syz.2.957': attribute type 2 has an invalid length. [ 223.711901][ T7535] loop1: detected capacity change from 0 to 1024 [ 223.723409][ T7535] EXT4-fs: Ignoring removed bh option [ 223.819005][ T7535] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 223.820244][ T7528] netlink: 36 bytes leftover after parsing attributes in process `syz.2.957'. [ 224.097250][ T7528] netlink: 36 bytes leftover after parsing attributes in process `syz.2.957'. [ 224.109027][ T7528] netlink: 31 bytes leftover after parsing attributes in process `syz.2.957'. [ 224.172899][ T4276] EXT4-fs (loop1): unmounting filesystem. [ 224.354192][ T7545] loop1: detected capacity change from 0 to 128 [ 224.406680][ T7546] kAFS: No cell specified [ 224.507523][ T7545] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 224.531888][ T7545] ext4 filesystem being mounted at /203/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 224.725369][ T4276] EXT4-fs (loop1): unmounting filesystem. [ 224.727006][ T7555] device syzkaller0 entered promiscuous mode [ 224.990779][ T7565] netlink: 12 bytes leftover after parsing attributes in process `syz.2.964'. [ 225.022203][ T7565] 8021q: adding VLAN 0 to HW filter on device bond2 [ 225.169576][ T7570] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 227.048071][ T7599] device syzkaller0 entered promiscuous mode [ 227.273036][ T7605] netlink: 12 bytes leftover after parsing attributes in process `syz.2.977'. [ 227.277171][ T7607] loop1: detected capacity change from 0 to 128 [ 227.372066][ T7607] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 227.391946][ T7607] ext4 filesystem being mounted at /208/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 227.520304][ T7605] 8021q: adding VLAN 0 to HW filter on device bond3 [ 227.538746][ T4276] EXT4-fs (loop1): unmounting filesystem. [ 227.571003][ T7615] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 229.411745][ T7651] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 230.342041][ T7672] netlink: 'syz.2.998': attribute type 1 has an invalid length. [ 230.498590][ T7672] 8021q: adding VLAN 0 to HW filter on device bond4 [ 230.536656][ T7674] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 230.809453][ T7686] device syzkaller0 entered promiscuous mode [ 230.958943][ T7696] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 231.048656][ T4326] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 231.231196][ T4326] usb 5-1: Using ep0 maxpacket: 16 [ 231.240727][ T4326] usb 5-1: config 0 interface 0 has no altsetting 0 [ 231.274685][ T4326] usb 5-1: New USB device found, idVendor=258a, idProduct=6a88, bcdDevice= 0.00 [ 231.331419][ T4326] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 231.397021][ T7709] loop2: detected capacity change from 0 to 1024 [ 231.399643][ T4326] usb 5-1: config 0 descriptor?? [ 231.404394][ T7709] EXT4-fs: Ignoring removed bh option [ 231.565329][ T7709] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 231.872576][ T4285] EXT4-fs (loop2): unmounting filesystem. [ 232.059764][ T4326] input: HID 258a:6a88 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:258A:6A88.0001/input/input5 [ 232.258196][ T4326] itetech 0003:258A:6A88.0001: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 258a:6a88] on usb-dummy_hcd.4-1/input0 [ 232.353601][ T4326] usb 5-1: USB disconnect, device number 2 [ 232.404256][ T7727] netlink: 'syz.5.1016': attribute type 1 has an invalid length. [ 232.527453][ T7727] 8021q: adding VLAN 0 to HW filter on device bond1 [ 232.535805][ T7730] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 232.826173][ T7729] fido_id[7729]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 232.870010][ T7742] device syzkaller0 entered promiscuous mode [ 232.905110][ T7744] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 233.597393][ T7772] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 233.648068][ T7776] netlink: 'syz.2.1033': attribute type 1 has an invalid length. [ 233.722283][ T7776] 8021q: adding VLAN 0 to HW filter on device bond5 [ 233.900563][ T7786] FAULT_INJECTION: forcing a failure. [ 233.900563][ T7786] name failslab, interval 1, probability 0, space 0, times 0 [ 233.975856][ T7786] CPU: 1 PID: 7786 Comm: syz.1.1036 Not tainted syzkaller #0 [ 233.983310][ T7786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 233.993413][ T7786] Call Trace: [ 233.996727][ T7786] [ 233.999696][ T7786] dump_stack_lvl+0x188/0x24e [ 234.004443][ T7786] ? show_regs_print_info+0x12/0x12 [ 234.009689][ T7786] ? load_image+0x410/0x410 [ 234.014251][ T7786] ? __might_sleep+0xd0/0xd0 [ 234.018879][ T7786] ? __lock_acquire+0x7c40/0x7c40 [ 234.023960][ T7786] should_fail_ex+0x390/0x4c0 [ 234.028687][ T7786] should_failslab+0x5/0x20 [ 234.033248][ T7786] slab_pre_alloc_hook+0x59/0x300 [ 234.038314][ T7786] ? loopback_open+0x276/0xa50 [ 234.043122][ T7786] __kmem_cache_alloc_node+0x4f/0x270 [ 234.048540][ T7786] ? loopback_open+0x276/0xa50 [ 234.053343][ T7786] kmalloc_trace+0x26/0xe0 [ 234.057799][ T7786] loopback_open+0x276/0xa50 [ 234.062447][ T7786] snd_pcm_open_substream+0x109a/0x26a0 [ 234.068239][ T7786] ? snd_pcm_drop+0x250/0x250 [ 234.072979][ T7786] snd_pcm_oss_open+0x107e/0x1e60 [ 234.078081][ T7786] ? snd_pcm_oss_mmap+0x440/0x440 [ 234.083161][ T7786] ? soundcore_open+0x270/0x4b0 [ 234.088085][ T7786] ? __lock_acquire+0x7c40/0x7c40 [ 234.093158][ T7786] ? do_task_dead+0xd0/0xd0 [ 234.097731][ T7786] ? do_raw_spin_unlock+0x11d/0x230 [ 234.103076][ T7786] chrdev_open+0x585/0x5f0 [ 234.107627][ T7786] ? cd_forget+0x160/0x160 [ 234.112094][ T7786] ? fsnotify_perm+0x39b/0x550 [ 234.116908][ T7786] ? cd_forget+0x160/0x160 [ 234.121364][ T7786] do_dentry_open+0x7dd/0x10b0 [ 234.126192][ T7786] path_openat+0x2674/0x2f10 [ 234.130856][ T7786] ? verify_lock_unused+0x140/0x140 [ 234.136187][ T7786] ? do_sys_openat2+0xdd/0x4f0 [ 234.141021][ T7786] ? do_filp_open+0x420/0x420 [ 234.145752][ T7786] do_filp_open+0x1ee/0x420 [ 234.150298][ T7786] ? vfs_tmpfile+0x470/0x470 [ 234.154958][ T7786] ? _raw_spin_unlock+0x24/0x40 [ 234.159859][ T7786] ? alloc_fd+0x590/0x640 [ 234.164255][ T7786] do_sys_openat2+0x14b/0x4f0 [ 234.168985][ T7786] ? do_sys_open+0xe0/0xe0 [ 234.173452][ T7786] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 234.179487][ T7786] ? lock_chain_count+0x20/0x20 [ 234.184403][ T7786] __x64_sys_openat+0x135/0x160 [ 234.189305][ T7786] do_syscall_64+0x4c/0xa0 [ 234.193777][ T7786] ? clear_bhb_loop+0x60/0xb0 [ 234.198497][ T7786] ? clear_bhb_loop+0x60/0xb0 [ 234.203235][ T7786] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 234.209261][ T7786] RIP: 0033:0x7f79d7f9e159 [ 234.213733][ T7786] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 234.233357][ T7786] RSP: 002b:00007f79d8e09028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 234.241804][ T7786] RAX: ffffffffffffffda RBX: 00007f79d8225fa0 RCX: 00007f79d7f9e159 [ 234.249798][ T7786] RDX: 0000000000040280 RSI: 0000200000000200 RDI: ffffffffffffff9c [ 234.257782][ T7786] RBP: 00007f79d803506b R08: 0000000000000000 R09: 0000000000000000 [ 234.265847][ T7786] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 234.273842][ T7786] R13: 00007f79d8226038 R14: 00007f79d8225fa0 R15: 00007ffff1b2dfc8 [ 234.281838][ T7786] [ 236.531830][ T7817] loop4: detected capacity change from 0 to 1024 [ 236.543289][ T7817] EXT4-fs: Ignoring removed bh option [ 236.622441][ T7817] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 236.624228][ T7818] netlink: 'syz.2.1049': attribute type 1 has an invalid length. [ 236.948311][ T7818] 8021q: adding VLAN 0 to HW filter on device bond6 [ 236.979309][ T4275] EXT4-fs (loop4): unmounting filesystem. [ 237.236691][ T7840] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1054'. [ 238.345031][ T7856] device erspan0 entered promiscuous mode [ 238.580654][ T7857] loop1: detected capacity change from 0 to 1024 [ 238.591139][ T7857] EXT4-fs: Ignoring removed bh option [ 238.746880][ T7857] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 239.384969][ T4276] EXT4-fs (loop1): unmounting filesystem. [ 239.683789][ T7888] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1067'. [ 239.746796][ T7889] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 240.592788][ T7907] loop1: detected capacity change from 0 to 1024 [ 240.603560][ T7907] EXT4-fs: Ignoring removed bh option [ 240.872425][ T7907] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 241.023208][ T4276] EXT4-fs (loop1): unmounting filesystem. [ 241.298720][ T7928] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 241.326888][ T7931] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1085'. [ 242.151341][ T7947] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1092'. [ 242.476803][ T7966] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1100'. [ 242.501152][ T7966] netlink: 48 bytes leftover after parsing attributes in process `syz.5.1100'. [ 242.553769][ T7968] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 242.742794][ T7973] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1101'. [ 244.498285][ T8007] loop2: detected capacity change from 0 to 164 [ 244.591912][ T8007] rock: corrupted directory entry. extent=28, offset=16056320, size=0 [ 244.685866][ T8007] rock: corrupted directory entry. extent=28, offset=16056320, size=0 [ 244.770909][ T8007] Symlink component flag not implemented [ 244.794779][ T8010] Symlink component flag not implemented (7) [ 244.826401][ T8007] Symlink component flag not implemented (7) [ 245.021448][ T8009] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 245.083619][ T8015] device bridge3 entered promiscuous mode [ 245.265472][ T8019] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1118'. [ 245.388220][ T8023] loop3: detected capacity change from 0 to 1024 [ 245.397296][ T8023] EXT4-fs: Ignoring removed bh option [ 245.484847][ T8023] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 246.020698][ T4274] EXT4-fs (loop3): unmounting filesystem. [ 246.321564][ T8045] loop4: detected capacity change from 0 to 1024 [ 246.329769][ T8045] EXT4-fs: Ignoring removed bh option [ 246.420271][ T8045] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 246.801225][ T26] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 246.920218][ T4275] EXT4-fs (loop4): unmounting filesystem. [ 248.341255][ T26] usb 3-1: Using ep0 maxpacket: 32 [ 248.611869][ T26] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 248.654407][ T26] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 248.713556][ T26] usb 3-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 248.762910][ T26] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 248.820392][ T26] usb 3-1: Product: syz [ 248.845144][ T26] usb 3-1: Manufacturer: syz [ 248.880748][ T26] usb 3-1: SerialNumber: syz [ 248.916432][ T26] usb 3-1: config 0 descriptor?? [ 248.956441][ T26] hub 3-1:0.0: bad descriptor, ignoring hub [ 248.977615][ T26] hub: probe of 3-1:0.0 failed with error -5 [ 249.266067][ T4321] usb 3-1: USB disconnect, device number 4 [ 249.504237][ T8091] loop3: detected capacity change from 0 to 1024 [ 249.512866][ T8091] EXT4-fs: Ignoring removed bh option [ 249.610418][ T8091] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 249.949975][ T4274] EXT4-fs (loop3): unmounting filesystem. [ 250.182262][ T8106] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1140'. [ 250.454871][ T8117] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 250.483508][ T8112] device syzkaller0 entered promiscuous mode [ 250.703246][ T8126] device syzkaller0 entered promiscuous mode [ 250.968920][ T8133] loop3: detected capacity change from 0 to 1024 [ 250.978200][ T8133] EXT4-fs: Ignoring removed bh option [ 251.057196][ T8133] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 251.450360][ T8145] loop1: detected capacity change from 0 to 128 [ 251.517579][ T4274] EXT4-fs (loop3): unmounting filesystem. [ 251.554108][ T8145] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 251.650538][ T8152] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 251.693267][ T8145] ext4 filesystem being mounted at /240/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 252.060829][ T8163] device syzkaller0 entered promiscuous mode [ 252.298301][ T8169] device syzkaller0 entered promiscuous mode [ 252.865599][ T8184] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 254.188489][ T8200] device syzkaller0 entered promiscuous mode [ 254.519799][ T8205] device syzkaller0 entered promiscuous mode [ 254.684622][ T8211] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1182'. [ 254.686239][ T4276] EXT4-fs (loop1): unmounting filesystem. [ 254.707667][ T8211] 8021q: adding VLAN 0 to HW filter on device bond2 [ 254.745676][ T8211] device macvlan2 entered promiscuous mode [ 255.254258][ T8238] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1190'. [ 255.613130][ T8243] device syzkaller0 entered promiscuous mode [ 255.691200][ T26] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 255.691824][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.705475][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.770314][ T8251] loop4: detected capacity change from 0 to 128 [ 255.780992][ T8249] device syzkaller0 entered promiscuous mode [ 255.891316][ T26] usb 6-1: Using ep0 maxpacket: 8 [ 255.924834][ T26] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 255.986635][ T8251] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 256.023330][ T26] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 256.102966][ T8251] ext4 filesystem being mounted at /225/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 256.287135][ T26] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 256.299399][ T26] usb 6-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 256.310532][ T26] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 256.334552][ T26] usb 6-1: config 168 interface 0 has no altsetting 0 [ 256.434969][ T8261] usb usb7: check_ctrlrecip: process 8261 (syz.3.1198) requesting ep 01 but needs 81 [ 256.924440][ T26] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 257.061936][ T26] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 257.101405][ T26] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 257.172388][ T26] usb 6-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 257.220207][ T26] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 257.294509][ T26] usb 6-1: config 168 interface 0 has no altsetting 0 [ 257.324313][ T26] usb 6-1: config 168 descriptor has 1 excess byte, ignoring [ 257.351744][ T26] usb 6-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 257.407830][ T26] usb 6-1: config 168 interface 0 altsetting 188 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 257.431393][ T26] usb 6-1: config 168 interface 0 altsetting 188 has an invalid endpoint with address 0xFF, skipping [ 257.450052][ T26] usb 6-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 257.475922][ T26] usb 6-1: config 168 interface 0 has no altsetting 0 [ 257.494615][ T26] usb 6-1: string descriptor 0 read error: -22 [ 257.526552][ T26] usb 6-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 257.550612][ T26] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 257.578109][ T26] adutux 6-1:168.0: interrupt endpoints not found [ 258.193802][ T8241] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 258.231670][ T8241] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 258.248763][ T8241] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 258.301327][ T8241] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 258.545178][ T8241] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 258.564396][ T8241] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 258.595888][ T14] usb 6-1: USB disconnect, device number 2 [ 258.909033][ T8297] device syzkaller0 entered promiscuous mode [ 258.931688][ T4275] EXT4-fs (loop4): unmounting filesystem. [ 260.855554][ T8324] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1220'. [ 260.901234][ T8324] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1220'. [ 260.942564][ T8324] netlink: 31 bytes leftover after parsing attributes in process `syz.1.1220'. [ 261.201228][ T4288] Bluetooth: hci0: command 0x0407 tx timeout [ 262.241381][ T27] audit: type=1326 audit(1789832884.766:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8338 comm="syz.1.1226" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d7f9e159 code=0x7ffc0000 [ 262.287286][ T8339] device syzkaller0 entered promiscuous mode [ 262.390213][ T27] audit: type=1326 audit(1789832884.826:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8338 comm="syz.1.1226" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d7f9e159 code=0x7ffc0000 [ 262.444986][ T27] audit: type=1326 audit(1789832884.826:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8338 comm="syz.1.1226" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d7f9e159 code=0x7ffc0000 [ 262.549508][ T27] audit: type=1326 audit(1789832884.826:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8338 comm="syz.1.1226" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d7f9e159 code=0x7ffc0000 [ 262.649073][ T27] audit: type=1326 audit(1789832884.826:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8338 comm="syz.1.1226" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=107 compat=0 ip=0x7f79d7f9e159 code=0x7ffc0000 [ 264.081104][ T27] audit: type=1326 audit(1789832884.826:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8338 comm="syz.1.1226" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d7f9e159 code=0x7ffc0000 [ 264.161258][ T27] audit: type=1326 audit(1789832884.836:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8338 comm="syz.1.1226" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d7f9e159 code=0x7ffc0000 [ 264.341175][ T27] audit: type=1326 audit(1789832884.836:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8338 comm="syz.1.1226" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d7f9e159 code=0x7ffc0000 [ 264.451826][ T27] audit: type=1326 audit(1789832884.836:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8338 comm="syz.1.1226" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f79d7f9e159 code=0x7ffc0000 [ 264.572452][ T8368] netlink: 'syz.2.1237': attribute type 1 has an invalid length. [ 264.581677][ T27] audit: type=1326 audit(1789832884.836:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8338 comm="syz.1.1226" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d7f9e159 code=0x7ffc0000 [ 264.600669][ T8368] netlink: 'syz.2.1237': attribute type 2 has an invalid length. [ 264.680072][ T8372] loop1: detected capacity change from 0 to 1024 [ 264.687643][ T8372] EXT4-fs: Ignoring removed bh option [ 264.738665][ T8366] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 264.781365][ T8372] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 264.807933][ T8368] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1237'. [ 264.842107][ T8368] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1237'. [ 264.851765][ T8368] netlink: 31 bytes leftover after parsing attributes in process `syz.2.1237'. [ 264.914317][ T4276] EXT4-fs (loop1): unmounting filesystem. [ 265.009582][ T8366] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.196808][ T8366] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.282844][ T8384] device syzkaller0 entered promiscuous mode [ 265.380304][ T8366] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 265.679103][ T8366] netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 265.743191][ T8366] netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 265.766452][ T8366] netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 265.826808][ T8366] netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 265.991193][ T26] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 266.181133][ T26] usb 4-1: Using ep0 maxpacket: 8 [ 266.189118][ T26] usb 4-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 266.221885][ T8407] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1249'. [ 266.231171][ T26] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 266.266940][ T8407] 8021q: adding VLAN 0 to HW filter on device bond3 [ 266.276602][ T8409] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1249'. [ 266.297049][ T26] usb 4-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 266.343892][ T26] usb 4-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 266.406877][ T26] usb 4-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 266.436328][ T8409] device macvlan3 entered promiscuous mode [ 266.457359][ T26] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 266.724895][ T26] usb 4-1: GET_CAPABILITIES returned 0 [ 266.730629][ T26] usbtmc 4-1:16.0: can't read capabilities [ 267.023674][ T8421] device syzkaller0 entered promiscuous mode [ 267.058957][ T14] usb 4-1: USB disconnect, device number 3 [ 270.685598][ T8453] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1266'. [ 271.158059][ T8459] loop1: detected capacity change from 0 to 1024 [ 271.165675][ T8459] EXT4-fs: Ignoring removed bh option [ 271.189831][ T8453] 8021q: adding VLAN 0 to HW filter on device bond3 [ 271.233220][ T8456] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1266'. [ 271.271570][ T8459] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 271.320937][ T8456] device macvlan3 entered promiscuous mode [ 271.406635][ T4276] EXT4-fs (loop1): unmounting filesystem. [ 272.064644][ T27] kauditd_printk_skb: 61 callbacks suppressed [ 272.064659][ T27] audit: type=1326 audit(1789832894.596:97): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8475 comm="syz.1.1273" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d7f9e159 code=0x7ffc0000 [ 272.164556][ T27] audit: type=1326 audit(1789832894.626:98): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8475 comm="syz.1.1273" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d7f9e159 code=0x7ffc0000 [ 272.241312][ T27] audit: type=1326 audit(1789832894.626:99): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8475 comm="syz.1.1273" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d7f9e159 code=0x7ffc0000 [ 272.298421][ T27] audit: type=1326 audit(1789832894.626:100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8475 comm="syz.1.1273" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d7f9e159 code=0x7ffc0000 [ 272.342546][ T27] audit: type=1326 audit(1789832894.626:101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8475 comm="syz.1.1273" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=107 compat=0 ip=0x7f79d7f9e159 code=0x7ffc0000 [ 272.401094][ T27] audit: type=1326 audit(1789832894.626:102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8475 comm="syz.1.1273" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d7f9e159 code=0x7ffc0000 [ 272.507649][ T27] audit: type=1326 audit(1789832894.636:103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8475 comm="syz.1.1273" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d7f9e159 code=0x7ffc0000 [ 272.551275][ T27] audit: type=1326 audit(1789832894.636:104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8475 comm="syz.1.1273" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d7f9e159 code=0x7ffc0000 [ 272.604280][ T27] audit: type=1326 audit(1789832894.636:105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8475 comm="syz.1.1273" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f79d7f9e159 code=0x7ffc0000 [ 272.629222][ T27] audit: type=1326 audit(1789832894.636:106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8475 comm="syz.1.1273" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79d7f9e159 code=0x7ffc0000 [ 272.834678][ T8493] netlink: 'syz.1.1279': attribute type 1 has an invalid length. [ 272.843893][ T8493] netlink: 'syz.1.1279': attribute type 2 has an invalid length. [ 272.865401][ T8493] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1279'. [ 272.884511][ T8493] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1279'. [ 272.908599][ T8493] netlink: 31 bytes leftover after parsing attributes in process `syz.1.1279'. [ 273.436036][ T8500] loop3: detected capacity change from 0 to 1024 [ 273.496997][ T8500] EXT4-fs: Ignoring removed bh option [ 273.506948][ T8502] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1282'. [ 273.629068][ T8502] 8021q: adding VLAN 0 to HW filter on device bond4 [ 273.715490][ T8500] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 273.786414][ T8507] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1282'. [ 274.439631][ T8507] device macvlan4 entered promiscuous mode [ 274.775891][ T8520] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 274.913102][ T4274] EXT4-fs (loop3): unmounting filesystem. [ 275.165639][ T8523] device syzkaller0 entered promiscuous mode [ 277.948882][ T8543] netlink: 'syz.1.1294': attribute type 1 has an invalid length. [ 278.009268][ T8543] netlink: 'syz.1.1294': attribute type 2 has an invalid length. [ 278.325789][ T8546] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1294'. [ 278.437698][ T8546] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1294'. [ 278.500961][ T8546] netlink: 31 bytes leftover after parsing attributes in process `syz.1.1294'. [ 278.857775][ T8563] loop2: detected capacity change from 0 to 1024 [ 278.870164][ T8563] EXT4-fs: Ignoring removed bh option [ 278.931438][ T8563] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 279.278920][ T4285] EXT4-fs (loop2): unmounting filesystem. [ 279.619039][ T8585] FAULT_INJECTION: forcing a failure. [ 279.619039][ T8585] name failslab, interval 1, probability 0, space 0, times 0 [ 279.680477][ T8585] CPU: 1 PID: 8585 Comm: syz.3.1308 Not tainted syzkaller #0 [ 279.687942][ T8585] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 279.698043][ T8585] Call Trace: [ 279.701356][ T8585] [ 279.704315][ T8585] dump_stack_lvl+0x188/0x24e [ 279.709045][ T8585] ? show_regs_print_info+0x12/0x12 [ 279.714286][ T8585] ? load_image+0x410/0x410 [ 279.718834][ T8585] ? __might_sleep+0xd0/0xd0 [ 279.723471][ T8585] ? __lock_acquire+0x7c40/0x7c40 [ 279.728551][ T8585] should_fail_ex+0x390/0x4c0 [ 279.733276][ T8585] should_failslab+0x5/0x20 [ 279.737818][ T8585] slab_pre_alloc_hook+0x59/0x300 [ 279.742882][ T8585] ? memcg_list_lru_alloc+0x22d/0xb00 [ 279.748295][ T8585] __kmem_cache_alloc_node+0x4f/0x270 [ 279.753711][ T8585] ? memcg_list_lru_alloc+0x22d/0xb00 [ 279.759136][ T8585] __kmalloc+0xa3/0x240 [ 279.763348][ T8585] memcg_list_lru_alloc+0x22d/0xb00 [ 279.768597][ T8585] ? slab_pre_alloc_hook+0xb1/0x300 [ 279.773842][ T8585] ? memcg_reparent_list_lrus+0x850/0x850 [ 279.779625][ T8585] ? get_obj_cgroup_from_current+0xd0/0x280 [ 279.785565][ T8585] ? get_obj_cgroup_from_current+0xd0/0x280 [ 279.791495][ T8585] slab_pre_alloc_hook+0x2ad/0x300 [ 279.796659][ T8585] ? slab_pre_alloc_hook+0xb1/0x300 [ 279.801879][ T8585] kmem_cache_alloc_lru+0x49/0x2e0 [ 279.807007][ T8585] ? __d_alloc+0x2e/0x6e0 [ 279.811353][ T8585] __d_alloc+0x2e/0x6e0 [ 279.815522][ T8585] d_make_root+0x46/0xd0 [ 279.819772][ T8585] devpts_fill_super+0x3b7/0x900 [ 279.824724][ T8585] ? free_anon_bdev+0x20/0x20 [ 279.829413][ T8585] ? devpts_kill_sb+0x60/0x60 [ 279.834099][ T8585] mount_nodev+0x52/0xe0 [ 279.838353][ T8585] legacy_get_tree+0xe6/0x180 [ 279.843046][ T8585] ? devpts_pty_kill+0x280/0x280 [ 279.847998][ T8585] vfs_get_tree+0x88/0x270 [ 279.852429][ T8585] do_new_mount+0x247/0xa40 [ 279.856950][ T8585] __se_sys_mount+0x2e3/0x3d0 [ 279.861641][ T8585] ? __x64_sys_mount+0xc0/0xc0 [ 279.866423][ T8585] ? lockdep_hardirqs_on+0x94/0x140 [ 279.872414][ T8585] ? __x64_sys_mount+0x1c/0xc0 [ 279.877199][ T8585] do_syscall_64+0x4c/0xa0 [ 279.881626][ T8585] ? clear_bhb_loop+0x60/0xb0 [ 279.886314][ T8585] ? clear_bhb_loop+0x60/0xb0 [ 279.891000][ T8585] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 279.896913][ T8585] RIP: 0033:0x7fdd4e59e159 [ 279.901352][ T8585] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 279.921055][ T8585] RSP: 002b:00007fdd4f4a1028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 279.929480][ T8585] RAX: ffffffffffffffda RBX: 00007fdd4e825fa0 RCX: 00007fdd4e59e159 [ 279.937480][ T8585] RDX: 0000200000000040 RSI: 00002000000000c0 RDI: 0000000000000000 [ 279.945468][ T8585] RBP: 00007fdd4e63506b R08: 0000000000000000 R09: 0000000000000000 [ 279.953445][ T8585] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 279.961423][ T8585] R13: 00007fdd4e826038 R14: 00007fdd4e825fa0 R15: 00007ffd6a374928 [ 279.969417][ T8585] [ 279.981397][ T8585] devpts: get root dentry failed [ 281.153616][ T8604] netlink: 'syz.2.1314': attribute type 1 has an invalid length. [ 281.191198][ T8604] netlink: 'syz.2.1314': attribute type 2 has an invalid length. [ 281.212670][ T8607] loop3: detected capacity change from 0 to 1024 [ 281.219876][ T8607] EXT4-fs: Ignoring removed bh option [ 281.283431][ T8604] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1314'. [ 281.331185][ T8604] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1314'. [ 281.387615][ T8604] netlink: 31 bytes leftover after parsing attributes in process `syz.2.1314'. [ 281.530586][ T8607] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 281.676360][ T4274] EXT4-fs (loop3): unmounting filesystem. [ 283.248366][ T8644] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 283.632088][ T8651] loop4: detected capacity change from 0 to 1024 [ 283.657208][ T8651] EXT4-fs: Ignoring removed bh option [ 283.824553][ T8651] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 283.898429][ T8659] netlink: 'syz.3.1333': attribute type 1 has an invalid length. [ 284.012747][ T8659] netlink: 'syz.3.1333': attribute type 2 has an invalid length. [ 284.127697][ T8661] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1333'. [ 284.153082][ T8664] xt_CT: You must specify a L4 protocol and not use inversions on it [ 284.437116][ T8661] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1333'. [ 284.667804][ T8661] netlink: 31 bytes leftover after parsing attributes in process `syz.3.1333'. [ 284.695620][ T4275] EXT4-fs (loop4): unmounting filesystem. [ 286.367104][ T8692] FAULT_INJECTION: forcing a failure. [ 286.367104][ T8692] name failslab, interval 1, probability 0, space 0, times 0 [ 286.393368][ T27] kauditd_printk_skb: 20 callbacks suppressed [ 286.393386][ T27] audit: type=1326 audit(1789832908.926:127): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8690 comm="syz.5.1344" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79ad79e159 code=0x7ffc0000 [ 286.394631][ T8692] CPU: 1 PID: 8692 Comm: syz.2.1345 Not tainted syzkaller #0 [ 286.399797][ T27] audit: type=1326 audit(1789832908.926:128): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8690 comm="syz.5.1344" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79ad79e159 code=0x7ffc0000 [ 286.423464][ T8692] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 286.423479][ T8692] Call Trace: [ 286.423487][ T8692] [ 286.423496][ T8692] dump_stack_lvl+0x188/0x24e [ 286.423527][ T8692] ? show_regs_print_info+0x12/0x12 [ 286.423548][ T8692] ? load_image+0x410/0x410 [ 286.423575][ T8692] ? __might_sleep+0xd0/0xd0 [ 286.423595][ T8692] ? __lock_acquire+0x7c40/0x7c40 [ 286.423627][ T8692] should_fail_ex+0x390/0x4c0 [ 286.423659][ T8692] should_failslab+0x5/0x20 [ 286.423676][ T8692] slab_pre_alloc_hook+0x59/0x300 [ 286.423706][ T8692] kmem_cache_alloc_lru+0x49/0x2e0 [ 286.423727][ T8692] ? __d_alloc+0x2e/0x6e0 [ 286.423750][ T8692] __d_alloc+0x2e/0x6e0 [ 286.523588][ T8692] d_make_root+0x46/0xd0 [ 286.527853][ T8692] devpts_fill_super+0x3b7/0x900 [ 286.532806][ T8692] ? free_anon_bdev+0x20/0x20 [ 286.537500][ T8692] ? devpts_kill_sb+0x60/0x60 [ 286.542186][ T8692] mount_nodev+0x52/0xe0 [ 286.546441][ T8692] legacy_get_tree+0xe6/0x180 [ 286.551130][ T8692] ? devpts_pty_kill+0x280/0x280 [ 286.556078][ T8692] vfs_get_tree+0x88/0x270 [ 286.560505][ T8692] do_new_mount+0x247/0xa40 [ 286.565024][ T8692] __se_sys_mount+0x2e3/0x3d0 [ 286.569720][ T8692] ? __x64_sys_mount+0xc0/0xc0 [ 286.574504][ T8692] ? lockdep_hardirqs_on+0x94/0x140 [ 286.579713][ T8692] ? __x64_sys_mount+0x1c/0xc0 [ 286.584515][ T8692] do_syscall_64+0x4c/0xa0 [ 286.588945][ T8692] ? clear_bhb_loop+0x60/0xb0 [ 286.593642][ T8692] ? clear_bhb_loop+0x60/0xb0 [ 286.598329][ T8692] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 286.604237][ T8692] RIP: 0033:0x7f470799e159 [ 286.608664][ T8692] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 286.628279][ T8692] RSP: 002b:00007f47088eb028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 286.636702][ T8692] RAX: ffffffffffffffda RBX: 00007f4707c25fa0 RCX: 00007f470799e159 [ 286.644680][ T8692] RDX: 0000200000000040 RSI: 00002000000000c0 RDI: 0000000000000000 [ 286.652761][ T8692] RBP: 00007f4707a3506b R08: 0000000000000000 R09: 0000000000000000 [ 286.660758][ T8692] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 [ 286.668732][ T8692] R13: 00007f4707c26038 R14: 00007f4707c25fa0 R15: 00007ffc6f2c4048 [ 286.676727][ T8692] [ 286.683042][ T8692] devpts: get root dentry failed [ 286.691497][ T27] audit: type=1326 audit(1789832909.216:129): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8690 comm="syz.5.1344" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79ad79e159 code=0x7ffc0000 [ 286.753130][ T27] audit: type=1326 audit(1789832909.216:130): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8690 comm="syz.5.1344" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79ad79e159 code=0x7ffc0000 [ 286.838020][ T27] audit: type=1326 audit(1789832909.216:131): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8690 comm="syz.5.1344" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=65 compat=0 ip=0x7f79ad79e159 code=0x7ffc0000 [ 286.962273][ T27] audit: type=1326 audit(1789832909.216:132): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8690 comm="syz.5.1344" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79ad79e159 code=0x7ffc0000 [ 287.011827][ T27] audit: type=1326 audit(1789832909.216:133): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8690 comm="syz.5.1344" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79ad79e159 code=0x7ffc0000 [ 287.084674][ T27] audit: type=1326 audit(1789832909.216:134): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8690 comm="syz.5.1344" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79ad79e159 code=0x7ffc0000 [ 287.142034][ T27] audit: type=1326 audit(1789832909.216:135): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8690 comm="syz.5.1344" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79ad79e159 code=0x7ffc0000 [ 287.191295][ T4262] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 287.201560][ T27] audit: type=1326 audit(1789832909.216:136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8690 comm="syz.5.1344" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=253 compat=0 ip=0x7f79ad79e159 code=0x7ffc0000 [ 287.396681][ T4262] usb 4-1: Using ep0 maxpacket: 8 [ 287.403822][ T4262] usb 4-1: config 0 has an invalid interface number: 186 but max is 0 [ 287.448958][ T4262] usb 4-1: config 0 has no interface number 0 [ 287.469584][ T4262] usb 4-1: config 0 interface 186 altsetting 0 has an invalid endpoint with address 0x0, skipping [ 287.518286][ T4262] usb 4-1: config 0 interface 186 altsetting 0 endpoint 0x1 has an invalid bInterval 18, changing to 8 [ 287.568857][ T4262] usb 4-1: config 0 interface 186 altsetting 0 has an invalid endpoint with address 0x9A, skipping [ 289.723310][ T4262] usb 4-1: config 0 interface 186 altsetting 0 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 289.748326][ T4262] usb 4-1: New USB device found, idVendor=07c0, idProduct=1505, bcdDevice=b8.c5 [ 289.761166][ T4262] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 289.804083][ T4262] usb 4-1: Product: syz [ 289.808320][ T4262] usb 4-1: Manufacturer: syz [ 289.813601][ T4262] usb 4-1: SerialNumber: syz [ 289.823043][ T4262] usb 4-1: config 0 descriptor?? [ 289.838525][ T4262] iowarrior 4-1:0.186: no interrupt-in endpoint found [ 289.943976][ T4262] usb 4-1: USB disconnect, device number 4 [ 290.479407][ T8738] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1359'. [ 290.484080][ T8740] loop5: detected capacity change from 0 to 1024 [ 290.625357][ T8740] EXT4-fs: Ignoring removed bh option [ 290.824203][ T8740] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 290.834856][ T8738] 8021q: adding VLAN 0 to HW filter on device bond4 [ 290.893696][ T8743] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1362'. [ 290.925104][ T8744] device macvlan3 entered promiscuous mode [ 291.278722][ T8756] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 291.389360][ T5781] EXT4-fs (loop5): unmounting filesystem. [ 293.223235][ T4361] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 293.461318][ T4361] usb 5-1: Using ep0 maxpacket: 32 [ 294.219680][ T4361] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 294.248023][ T4361] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 294.261157][ T4361] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 294.279683][ T4361] usb 5-1: Product: syz [ 294.284038][ T4361] usb 5-1: Manufacturer: syz [ 294.288668][ T4361] usb 5-1: SerialNumber: syz [ 294.295526][ T4361] usb 5-1: config 0 descriptor?? [ 294.301313][ T8760] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 294.334410][ T8779] netlink: 'syz.5.1372': attribute type 1 has an invalid length. [ 294.369443][ T8779] netlink: 'syz.5.1372': attribute type 2 has an invalid length. [ 294.408570][ T8779] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1372'. [ 294.458335][ T8779] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1372'. [ 294.481316][ T8779] netlink: 31 bytes leftover after parsing attributes in process `syz.5.1372'. [ 294.900817][ T8262] usb 5-1: USB disconnect, device number 3 [ 295.029811][ T8789] FAULT_INJECTION: forcing a failure. [ 295.029811][ T8789] name failslab, interval 1, probability 0, space 0, times 0 [ 295.077063][ T8789] CPU: 0 PID: 8789 Comm: syz.5.1375 Not tainted syzkaller #0 [ 295.084519][ T8789] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 295.094619][ T8789] Call Trace: [ 295.097933][ T8789] [ 295.100979][ T8789] dump_stack_lvl+0x188/0x24e [ 295.105698][ T8789] ? show_regs_print_info+0x12/0x12 [ 295.110937][ T8789] ? load_image+0x410/0x410 [ 295.115484][ T8789] ? __might_sleep+0xd0/0xd0 [ 295.120110][ T8789] ? __lock_acquire+0x7c40/0x7c40 [ 295.125191][ T8789] should_fail_ex+0x390/0x4c0 [ 295.129919][ T8789] should_failslab+0x5/0x20 [ 295.134451][ T8789] slab_pre_alloc_hook+0x59/0x300 [ 295.139512][ T8789] ? vfs_write+0x777/0x9a0 [ 295.143974][ T8789] kmem_cache_alloc+0x56/0x2f0 [ 295.148767][ T8789] ? getname_flags+0xb7/0x500 [ 295.153570][ T8789] getname_flags+0xb7/0x500 [ 295.158116][ T8789] do_sys_openat2+0xdd/0x4f0 [ 295.162754][ T8789] ? do_sys_open+0xe0/0xe0 [ 295.167206][ T8789] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 295.173232][ T8789] ? lock_chain_count+0x20/0x20 [ 295.178210][ T8789] __x64_sys_openat+0x135/0x160 [ 295.183162][ T8789] do_syscall_64+0x4c/0xa0 [ 295.187617][ T8789] ? clear_bhb_loop+0x60/0xb0 [ 295.192323][ T8789] ? clear_bhb_loop+0x60/0xb0 [ 295.197036][ T8789] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 295.202971][ T8789] RIP: 0033:0x7f79ad79e159 [ 295.207417][ T8789] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 295.227071][ T8789] RSP: 002b:00007f79ae6e7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 295.235535][ T8789] RAX: ffffffffffffffda RBX: 00007f79ada25fa0 RCX: 00007f79ad79e159 [ 295.243544][ T8789] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffffffff9c [ 295.251555][ T8789] RBP: 00007f79ad83506b R08: 0000000000000000 R09: 0000000000000000 [ 295.259654][ T8789] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 295.267655][ T8789] R13: 00007f79ada26038 R14: 00007f79ada25fa0 R15: 00007fff95d82608 [ 295.275696][ T8789] [ 295.640690][ T47] nci: nci_rf_intf_activated_ntf_packet: unsupported activation_rf_tech_and_mode 0xe3 [ 295.808139][ T8806] loop4: detected capacity change from 0 to 128 [ 295.880197][ T8806] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 295.910094][ T8806] ext4 filesystem being mounted at /262/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 296.647236][ T4275] EXT4-fs (loop4): unmounting filesystem. [ 296.909578][ T8823] netlink: 'syz.3.1384': attribute type 1 has an invalid length. [ 296.930332][ T8823] netlink: 'syz.3.1384': attribute type 2 has an invalid length. [ 296.946032][ T8823] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1384'. [ 296.955123][ T8823] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1384'. [ 296.964730][ T8823] netlink: 31 bytes leftover after parsing attributes in process `syz.3.1384'. [ 297.028719][ T8831] FAULT_INJECTION: forcing a failure. [ 297.028719][ T8831] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 297.043540][ T8831] CPU: 1 PID: 8831 Comm: syz.4.1387 Not tainted syzkaller #0 [ 297.050959][ T8831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 297.061051][ T8831] Call Trace: [ 297.064363][ T8831] [ 297.067327][ T8831] dump_stack_lvl+0x188/0x24e [ 297.072050][ T8831] ? show_regs_print_info+0x12/0x12 [ 297.077289][ T8831] ? load_image+0x410/0x410 [ 297.081839][ T8831] ? __lock_acquire+0x7c40/0x7c40 [ 297.086899][ T8831] ? __kasan_slab_alloc+0x6b/0x80 [ 297.091981][ T8831] should_fail_ex+0x390/0x4c0 [ 297.096707][ T8831] strncpy_from_user+0x32/0x340 [ 297.101600][ T8831] getname_flags+0xf2/0x500 [ 297.106135][ T8831] do_sys_openat2+0xdd/0x4f0 [ 297.110762][ T8831] ? do_sys_open+0xe0/0xe0 [ 297.115214][ T8831] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 297.121328][ T8831] ? lock_chain_count+0x20/0x20 [ 297.126312][ T8831] __x64_sys_openat+0x135/0x160 [ 297.131206][ T8831] do_syscall_64+0x4c/0xa0 [ 297.135681][ T8831] ? clear_bhb_loop+0x60/0xb0 [ 297.140397][ T8831] ? clear_bhb_loop+0x60/0xb0 [ 297.145133][ T8831] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 297.151181][ T8831] RIP: 0033:0x7f32e419e159 [ 297.155632][ T8831] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 297.175286][ T8831] RSP: 002b:00007f32e515d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 297.183836][ T8831] RAX: ffffffffffffffda RBX: 00007f32e4425fa0 RCX: 00007f32e419e159 [ 297.191839][ T8831] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffffffff9c [ 297.199838][ T8831] RBP: 00007f32e423506b R08: 0000000000000000 R09: 0000000000000000 [ 297.207929][ T8831] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 297.215939][ T8831] R13: 00007f32e4426038 R14: 00007f32e4425fa0 R15: 00007ffe021d4968 [ 297.223970][ T8831] [ 297.997725][ T8841] loop3: detected capacity change from 0 to 8 [ 298.011166][ T8841] MTD: Attempt to mount non-MTD device "/dev/loop3" [ 298.488842][ T4832] udevd[4832]: incorrect cramfs checksum on /dev/loop3 [ 298.517344][ T8795] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 299.068978][ T4832] udevd[4832]: incorrect cramfs checksum on /dev/loop3 [ 299.129580][ T8841] syz.3.1389 (8841): drop_caches: 2 [ 300.377962][ T8867] FAULT_INJECTION: forcing a failure. [ 300.377962][ T8867] name failslab, interval 1, probability 0, space 0, times 0 [ 300.419517][ T8867] CPU: 1 PID: 8867 Comm: syz.1.1399 Not tainted syzkaller #0 [ 300.426981][ T8867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 300.437074][ T8867] Call Trace: [ 300.440377][ T8867] [ 300.443335][ T8867] dump_stack_lvl+0x188/0x24e [ 300.448046][ T8867] ? show_regs_print_info+0x12/0x12 [ 300.453262][ T8867] ? load_image+0x410/0x410 [ 300.457788][ T8867] ? __might_sleep+0xd0/0xd0 [ 300.462409][ T8867] ? __lock_acquire+0x7c40/0x7c40 [ 300.467557][ T8867] should_fail_ex+0x390/0x4c0 [ 300.472265][ T8867] should_failslab+0x5/0x20 [ 300.476794][ T8867] slab_pre_alloc_hook+0x59/0x300 [ 300.481929][ T8867] ? vfs_write+0x777/0x9a0 [ 300.486375][ T8867] kmem_cache_alloc+0x56/0x2f0 [ 300.491149][ T8867] ? getname_flags+0xb7/0x500 [ 300.495844][ T8867] getname_flags+0xb7/0x500 [ 300.500356][ T8867] do_sys_openat2+0xdd/0x4f0 [ 300.504967][ T8867] ? do_sys_open+0xe0/0xe0 [ 300.509393][ T8867] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 300.515391][ T8867] ? lock_chain_count+0x20/0x20 [ 300.520255][ T8867] __x64_sys_openat+0x135/0x160 [ 300.525126][ T8867] do_syscall_64+0x4c/0xa0 [ 300.529559][ T8867] ? clear_bhb_loop+0x60/0xb0 [ 300.534241][ T8867] ? clear_bhb_loop+0x60/0xb0 [ 300.538929][ T8867] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 300.544847][ T8867] RIP: 0033:0x7f79d7f9e159 [ 300.549272][ T8867] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 300.568890][ T8867] RSP: 002b:00007f79d8e09028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 300.577315][ T8867] RAX: ffffffffffffffda RBX: 00007f79d8225fa0 RCX: 00007f79d7f9e159 [ 300.585296][ T8867] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffffffff9c [ 300.593304][ T8867] RBP: 00007f79d803506b R08: 0000000000000000 R09: 0000000000000000 [ 300.601312][ T8867] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 300.609288][ T8867] R13: 00007f79d8226038 R14: 00007f79d8225fa0 R15: 00007ffff1b2dfc8 [ 300.617284][ T8867] [ 301.141364][ T8881] loop1: detected capacity change from 0 to 1024 [ 301.149173][ T8881] EXT4-fs: Ignoring removed bh option [ 301.294647][ T8881] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 302.867972][ T4276] EXT4-fs (loop1): unmounting filesystem. [ 302.928714][ T27] kauditd_printk_skb: 4 callbacks suppressed [ 302.928731][ T27] audit: type=1326 audit(1789832925.456:141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8900 comm="syz.5.1409" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79ad79e159 code=0x7ffc0000 [ 302.978313][ T8901] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 303.028460][ T27] audit: type=1326 audit(1789832925.496:142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8900 comm="syz.5.1409" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79ad79e159 code=0x7ffc0000 [ 303.126453][ T27] audit: type=1326 audit(1789832925.496:143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8900 comm="syz.5.1409" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79ad79e159 code=0x7ffc0000 [ 303.187896][ T27] audit: type=1326 audit(1789832925.496:144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8900 comm="syz.5.1409" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79ad79e159 code=0x7ffc0000 [ 303.191566][ T8906] device syzkaller0 entered promiscuous mode [ 303.223983][ T27] audit: type=1326 audit(1789832925.496:145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8900 comm="syz.5.1409" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=107 compat=0 ip=0x7f79ad79e159 code=0x7ffc0000 [ 303.258008][ T27] audit: type=1326 audit(1789832925.496:146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8900 comm="syz.5.1409" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79ad79e159 code=0x7ffc0000 [ 303.301895][ T8910] FAULT_INJECTION: forcing a failure. [ 303.301895][ T8910] name failslab, interval 1, probability 0, space 0, times 0 [ 303.340731][ T8910] CPU: 0 PID: 8910 Comm: syz.5.1412 Not tainted syzkaller #0 [ 303.348187][ T8910] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 303.358277][ T8910] Call Trace: [ 303.361590][ T8910] [ 303.364561][ T8910] dump_stack_lvl+0x188/0x24e [ 303.369295][ T8910] ? show_regs_print_info+0x12/0x12 [ 303.374534][ T8910] ? load_image+0x410/0x410 [ 303.379263][ T8910] ? __might_sleep+0xd0/0xd0 [ 303.383895][ T8910] ? __lock_acquire+0x7c40/0x7c40 [ 303.388975][ T8910] should_fail_ex+0x390/0x4c0 [ 303.393748][ T8910] should_failslab+0x5/0x20 [ 303.398285][ T8910] slab_pre_alloc_hook+0x59/0x300 [ 303.403348][ T8910] ? vfs_write+0x777/0x9a0 [ 303.407814][ T8910] kmem_cache_alloc+0x56/0x2f0 [ 303.412609][ T8910] ? getname_flags+0xb7/0x500 [ 303.417322][ T8910] getname_flags+0xb7/0x500 [ 303.421857][ T8910] do_sys_openat2+0xdd/0x4f0 [ 303.425369][ T27] audit: type=1326 audit(1789832925.496:147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8900 comm="syz.5.1409" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79ad79e159 code=0x7ffc0000 [ 303.426465][ T8910] ? do_sys_open+0xe0/0xe0 [ 303.426497][ T8910] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 303.460919][ T8910] ? lock_chain_count+0x20/0x20 [ 303.465821][ T8910] __x64_sys_openat+0x135/0x160 [ 303.470729][ T8910] do_syscall_64+0x4c/0xa0 [ 303.475185][ T8910] ? clear_bhb_loop+0x60/0xb0 [ 303.479898][ T8910] ? clear_bhb_loop+0x60/0xb0 [ 303.484611][ T8910] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 303.490545][ T8910] RIP: 0033:0x7f79ad79e159 [ 303.494991][ T8910] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 303.512594][ T27] audit: type=1326 audit(1789832925.496:148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8900 comm="syz.5.1409" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79ad79e159 code=0x7ffc0000 [ 303.514609][ T8910] RSP: 002b:00007f79ae6e7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 303.514639][ T8910] RAX: ffffffffffffffda RBX: 00007f79ada25fa0 RCX: 00007f79ad79e159 [ 303.555125][ T8910] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffffffff9c [ 303.563133][ T8910] RBP: 00007f79ad83506b R08: 0000000000000000 R09: 0000000000000000 [ 303.571135][ T8910] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 303.577531][ T27] audit: type=1326 audit(1789832925.496:149): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8900 comm="syz.5.1409" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f79ad79e159 code=0x7ffc0000 [ 303.579110][ T8910] R13: 00007f79ada26038 R14: 00007f79ada25fa0 R15: 00007fff95d82608 [ 303.579145][ T8910] [ 303.709231][ T27] audit: type=1326 audit(1789832925.496:150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8900 comm="syz.5.1409" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=65 compat=0 ip=0x7f79ad79e159 code=0x7ffc0000 [ 304.707585][ T8930] loop2: detected capacity change from 0 to 8 [ 304.717230][ T8930] MTD: Attempt to mount non-MTD device "/dev/loop2" [ 305.310366][ T4832] udevd[4832]: incorrect cramfs checksum on /dev/loop2 [ 305.622205][ T4832] udevd[4832]: incorrect cramfs checksum on /dev/loop2 [ 306.433077][ T8930] syz.2.1419 (8930): drop_caches: 2 [ 306.450281][ T8938] loop1: detected capacity change from 0 to 1024 [ 306.520898][ T8938] EXT4-fs: Ignoring removed bh option [ 306.684356][ T8938] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 307.047318][ T8948] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 307.970163][ T8956] device syzkaller0 entered promiscuous mode [ 308.204216][ T8962] FAULT_INJECTION: forcing a failure. [ 308.204216][ T8962] name failslab, interval 1, probability 0, space 0, times 0 [ 308.282243][ T8962] CPU: 1 PID: 8962 Comm: syz.5.1430 Not tainted syzkaller #0 [ 308.289704][ T8962] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 308.299800][ T8962] Call Trace: [ 308.303113][ T8962] [ 308.306087][ T8962] dump_stack_lvl+0x188/0x24e [ 308.310815][ T8962] ? show_regs_print_info+0x12/0x12 [ 308.316066][ T8962] ? load_image+0x410/0x410 [ 308.320703][ T8962] ? __might_sleep+0xd0/0xd0 [ 308.325338][ T8962] ? __lock_acquire+0x7c40/0x7c40 [ 308.330424][ T8962] should_fail_ex+0x390/0x4c0 [ 308.335173][ T8962] should_failslab+0x5/0x20 [ 308.339718][ T8962] slab_pre_alloc_hook+0x59/0x300 [ 308.344777][ T8962] ? vfs_write+0x777/0x9a0 [ 308.349222][ T8962] kmem_cache_alloc+0x56/0x2f0 [ 308.354008][ T8962] ? getname_flags+0xb7/0x500 [ 308.358785][ T8962] getname_flags+0xb7/0x500 [ 308.363310][ T8962] do_sys_openat2+0xdd/0x4f0 [ 308.367927][ T8962] ? do_sys_open+0xe0/0xe0 [ 308.372363][ T8962] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 308.378449][ T8962] ? lock_chain_count+0x20/0x20 [ 308.383327][ T8962] __x64_sys_openat+0x135/0x160 [ 308.388198][ T8962] do_syscall_64+0x4c/0xa0 [ 308.392649][ T8962] ? clear_bhb_loop+0x60/0xb0 [ 308.397350][ T8962] ? clear_bhb_loop+0x60/0xb0 [ 308.402038][ T8962] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 308.407960][ T8962] RIP: 0033:0x7f79ad79e159 [ 308.412385][ T8962] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 308.432116][ T8962] RSP: 002b:00007f79ae6e7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 308.440543][ T8962] RAX: ffffffffffffffda RBX: 00007f79ada25fa0 RCX: 00007f79ad79e159 [ 308.448550][ T8962] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffffffff9c [ 308.456531][ T8962] RBP: 00007f79ad83506b R08: 0000000000000000 R09: 0000000000000000 [ 308.464509][ T8962] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 308.472505][ T8962] R13: 00007f79ada26038 R14: 00007f79ada25fa0 R15: 00007fff95d82608 [ 308.480496][ T8962] [ 308.762345][ T4276] EXT4-fs (loop1): unmounting filesystem. [ 308.934451][ T8969] loop5: detected capacity change from 0 to 128 [ 309.143933][ T27] kauditd_printk_skb: 28 callbacks suppressed [ 309.143950][ T27] audit: type=1326 audit(1789832931.666:179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8972 comm="syz.3.1434" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd4e59e159 code=0x7ffc0000 [ 309.144350][ T8969] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 309.247736][ T27] audit: type=1326 audit(1789832931.736:180): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8972 comm="syz.3.1434" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd4e59e159 code=0x7ffc0000 [ 309.678562][ T27] audit: type=1326 audit(1789832931.736:181): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8972 comm="syz.3.1434" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=107 compat=0 ip=0x7fdd4e59e159 code=0x7ffc0000 [ 309.870961][ T8969] ext4 filesystem being mounted at /173/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 310.572147][ T27] audit: type=1326 audit(1789832931.746:182): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8972 comm="syz.3.1434" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd4e59e159 code=0x7ffc0000 [ 310.596553][ T27] audit: type=1326 audit(1789832931.746:183): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8972 comm="syz.3.1434" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd4e59e159 code=0x7ffc0000 [ 310.703732][ T27] audit: type=1326 audit(1789832931.756:184): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8972 comm="syz.3.1434" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd4e59e159 code=0x7ffc0000 [ 310.781316][ T27] audit: type=1326 audit(1789832931.766:185): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8972 comm="syz.3.1434" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd4e59e159 code=0x7ffc0000 [ 310.809636][ T8985] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 310.855499][ T27] audit: type=1326 audit(1789832931.766:186): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8972 comm="syz.3.1434" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=65 compat=0 ip=0x7fdd4e59e159 code=0x7ffc0000 [ 310.941096][ T27] audit: type=1326 audit(1789832931.776:187): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8972 comm="syz.3.1434" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd4e59e159 code=0x7ffc0000 [ 310.987156][ T5781] EXT4-fs (loop5): unmounting filesystem. [ 311.015480][ T27] audit: type=1326 audit(1789832931.806:188): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8972 comm="syz.3.1434" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd4e59e159 code=0x7ffc0000 [ 312.325972][ T9002] FAULT_INJECTION: forcing a failure. [ 312.325972][ T9002] name failslab, interval 1, probability 0, space 0, times 0 [ 312.385561][ T9002] CPU: 0 PID: 9002 Comm: syz.3.1442 Not tainted syzkaller #0 [ 312.393019][ T9002] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 312.403114][ T9002] Call Trace: [ 312.406417][ T9002] [ 312.409377][ T9002] dump_stack_lvl+0x188/0x24e [ 312.414094][ T9002] ? show_regs_print_info+0x12/0x12 [ 312.419324][ T9002] ? load_image+0x410/0x410 [ 312.423866][ T9002] ? __might_sleep+0xd0/0xd0 [ 312.428483][ T9002] ? __lock_acquire+0x7c40/0x7c40 [ 312.433558][ T9002] should_fail_ex+0x390/0x4c0 [ 312.438365][ T9002] should_failslab+0x5/0x20 [ 312.442897][ T9002] slab_pre_alloc_hook+0x59/0x300 [ 312.447964][ T9002] ? vfs_write+0x777/0x9a0 [ 312.452431][ T9002] kmem_cache_alloc+0x56/0x2f0 [ 312.457241][ T9002] ? getname_flags+0xb7/0x500 [ 312.461968][ T9002] getname_flags+0xb7/0x500 [ 312.466507][ T9002] do_sys_openat2+0xdd/0x4f0 [ 312.470550][ T9007] loop5: detected capacity change from 0 to 1024 [ 312.471118][ T9002] ? do_sys_open+0xe0/0xe0 [ 312.471150][ T9002] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 312.478343][ T9007] EXT4-fs: Ignoring removed bh option [ 312.481899][ T9002] ? lock_chain_count+0x20/0x20 [ 312.481935][ T9002] __x64_sys_openat+0x135/0x160 [ 312.481978][ T9002] do_syscall_64+0x4c/0xa0 [ 312.481997][ T9002] ? clear_bhb_loop+0x60/0xb0 [ 312.482017][ T9002] ? clear_bhb_loop+0x60/0xb0 [ 312.482038][ T9002] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 312.482065][ T9002] RIP: 0033:0x7fdd4e59e159 [ 312.482084][ T9002] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 312.482101][ T9002] RSP: 002b:00007fdd4f4a1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 312.482126][ T9002] RAX: ffffffffffffffda RBX: 00007fdd4e825fa0 RCX: 00007fdd4e59e159 [ 312.482141][ T9002] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffffffff9c [ 312.482155][ T9002] RBP: 00007fdd4e63506b R08: 0000000000000000 R09: 0000000000000000 [ 312.482168][ T9002] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 312.482180][ T9002] R13: 00007fdd4e826038 R14: 00007fdd4e825fa0 R15: 00007ffd6a374928 [ 312.482210][ T9002] [ 312.919643][ T9007] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 314.492876][ T9033] loop1: detected capacity change from 0 to 8 [ 314.503661][ T9033] MTD: Attempt to mount non-MTD device "/dev/loop1" [ 315.246885][ T4832] udevd[4832]: incorrect cramfs checksum on /dev/loop1 [ 315.390827][ T9036] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 315.437957][ T9038] loop2: detected capacity change from 0 to 164 [ 316.551151][ T9042] rock: directory entry would overflow storage [ 316.557714][ T9042] rock: sig=0x4f50, size=4, remaining=3 [ 316.563513][ T9042] iso9660: Corrupted directory entry in block 5 of inode 1792 [ 317.126007][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.132408][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.178875][ T5781] EXT4-fs (loop5): unmounting filesystem. [ 317.645155][ T9058] loop5: detected capacity change from 0 to 1024 [ 317.705110][ T9058] EXT4-fs: Ignoring removed bh option [ 317.781470][ T9067] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1460'. [ 317.864437][ T9058] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 317.966545][ T9067] 8021q: adding VLAN 0 to HW filter on device bond5 [ 318.024143][ T9075] netlink: 44 bytes leftover after parsing attributes in process `syz.3.1460'. [ 318.150108][ T4286] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 318.160256][ T4286] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 318.168824][ T4286] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 318.177715][ T4286] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 318.189367][ T4291] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 318.198104][ T4291] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 318.580149][ T4306] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.678011][ T9080] wg2 speed is unknown, defaulting to 1000 [ 318.844908][ T4306] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 318.975354][ T4306] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 319.098320][ T9096] loop1: detected capacity change from 0 to 8 [ 319.108022][ T9096] MTD: Attempt to mount non-MTD device "/dev/loop1" [ 319.378449][ T4306] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 319.600934][ T4832] udevd[4832]: incorrect cramfs checksum on /dev/loop1 [ 320.041649][ T4832] udevd[4832]: incorrect cramfs checksum on /dev/loop1 [ 320.097524][ T5781] EXT4-fs (loop5): unmounting filesystem. [ 320.241325][ T4291] Bluetooth: hci5: command 0x0409 tx timeout [ 320.444296][ T9107] FAULT_INJECTION: forcing a failure. [ 320.444296][ T9107] name failslab, interval 1, probability 0, space 0, times 0 [ 320.539873][ T9107] CPU: 1 PID: 9107 Comm: syz.5.1466 Not tainted syzkaller #0 [ 320.547320][ T9107] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 320.557375][ T9107] Call Trace: [ 320.560676][ T9107] [ 320.563636][ T9107] dump_stack_lvl+0x188/0x24e [ 320.568334][ T9107] ? show_regs_print_info+0x12/0x12 [ 320.573534][ T9107] ? load_image+0x410/0x410 [ 320.578037][ T9107] ? __might_sleep+0xd0/0xd0 [ 320.582639][ T9107] ? __lock_acquire+0x7c40/0x7c40 [ 320.587787][ T9107] should_fail_ex+0x390/0x4c0 [ 320.592517][ T9107] should_failslab+0x5/0x20 [ 320.597070][ T9107] slab_pre_alloc_hook+0x59/0x300 [ 320.602149][ T9107] kmem_cache_alloc+0x56/0x2f0 [ 320.606956][ T9107] ? prepare_creds+0x3c/0x610 [ 320.611681][ T9107] prepare_creds+0x3c/0x610 [ 320.616244][ T9107] ovl_fill_super+0x1c7/0x42f0 [ 320.621058][ T9107] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 320.627000][ T9107] ? _raw_spin_unlock+0x40/0x40 [ 320.631925][ T9107] ? sget+0x46a/0x4a0 [ 320.635955][ T9107] ? ovl_mount+0x30/0x30 [ 320.640252][ T9107] ? __lock_acquire+0x7c40/0x7c40 [ 320.645325][ T9107] ? rwsem_write_trylock+0x135/0x1c0 [ 320.650660][ T9107] ? clear_nonspinnable+0x60/0x60 [ 320.655736][ T9107] ? __lock_acquire+0x7c40/0x7c40 [ 320.660806][ T9107] ? __rwlock_init+0x140/0x140 [ 320.665609][ T9107] ? up_write+0x1b6/0x410 [ 320.669995][ T9107] ? free_anon_bdev+0x20/0x20 [ 320.674726][ T9107] ? ovl_mount+0x30/0x30 [ 320.679017][ T9107] mount_nodev+0x52/0xe0 [ 320.683312][ T9107] legacy_get_tree+0xe6/0x180 [ 320.688038][ T9107] ? virtio_fs_zero_page_range+0x130/0x130 [ 320.693897][ T9107] vfs_get_tree+0x88/0x270 [ 320.698358][ T9107] do_new_mount+0x247/0xa40 [ 320.702927][ T9107] __se_sys_mount+0x2e3/0x3d0 [ 320.707654][ T9107] ? __x64_sys_mount+0xc0/0xc0 [ 320.712472][ T9107] ? lockdep_hardirqs_on+0x94/0x140 [ 320.717714][ T9107] ? __x64_sys_mount+0x1c/0xc0 [ 320.722525][ T9107] do_syscall_64+0x4c/0xa0 [ 320.727063][ T9107] ? clear_bhb_loop+0x60/0xb0 [ 320.731796][ T9107] ? clear_bhb_loop+0x60/0xb0 [ 320.736514][ T9107] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 320.742536][ T9107] RIP: 0033:0x7f79ad79e159 [ 320.746985][ T9107] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 320.766693][ T9107] RSP: 002b:00007f79ae6c6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 320.775160][ T9107] RAX: ffffffffffffffda RBX: 00007f79ada26090 RCX: 00007f79ad79e159 [ 320.783175][ T9107] RDX: 00002000000003c0 RSI: 0000200000000340 RDI: 0000000000000000 [ 320.791185][ T9107] RBP: 00007f79ad83506b R08: 0000200000000680 R09: 0000000000000000 [ 320.799197][ T9107] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000 [ 320.802083][ T9080] chnl_net:caif_netlink_parms(): no params data found [ 320.807186][ T9107] R13: 00007f79ada26128 R14: 00007f79ada26090 R15: 00007fff95d82608 [ 320.822021][ T9107] [ 321.014892][ T4306] tipc: Left network mode [ 321.125891][ T9080] bridge0: port 1(bridge_slave_0) entered blocking state [ 321.151303][ T9080] bridge0: port 1(bridge_slave_0) entered disabled state [ 321.159904][ T9080] device bridge_slave_0 entered promiscuous mode [ 321.170017][ T9080] bridge0: port 2(bridge_slave_1) entered blocking state [ 321.182227][ T9080] bridge0: port 2(bridge_slave_1) entered disabled state [ 321.200528][ T9080] device bridge_slave_1 entered promiscuous mode [ 321.392280][ T9130] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1470'. [ 321.454994][ T9130] 8021q: adding VLAN 0 to HW filter on device bond6 [ 321.534814][ T9133] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1470'. [ 321.626789][ T9133] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1470'. [ 321.850000][ T9144] device syzkaller0 entered promiscuous mode [ 321.900951][ T9080] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 322.331182][ T4291] Bluetooth: hci5: command 0x041b tx timeout [ 322.450364][ T9166] FAULT_INJECTION: forcing a failure. [ 322.450364][ T9166] name failslab, interval 1, probability 0, space 0, times 0 [ 322.511556][ T9166] CPU: 0 PID: 9166 Comm: syz.2.1477 Not tainted syzkaller #0 [ 322.519012][ T9166] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 322.529112][ T9166] Call Trace: [ 322.532430][ T9166] [ 322.535392][ T9166] dump_stack_lvl+0x188/0x24e [ 322.540115][ T9166] ? show_regs_print_info+0x12/0x12 [ 322.545352][ T9166] ? load_image+0x410/0x410 [ 322.549987][ T9166] ? __might_sleep+0xd0/0xd0 [ 322.554620][ T9166] ? __lock_acquire+0x7c40/0x7c40 [ 322.559695][ T9166] should_fail_ex+0x390/0x4c0 [ 322.564507][ T9166] should_failslab+0x5/0x20 [ 322.569056][ T9166] slab_pre_alloc_hook+0x59/0x300 [ 322.574121][ T9166] ? vfs_write+0x777/0x9a0 [ 322.578583][ T9166] kmem_cache_alloc+0x56/0x2f0 [ 322.583384][ T9166] ? getname_flags+0xb7/0x500 [ 322.588095][ T9166] getname_flags+0xb7/0x500 [ 322.592623][ T9166] do_sys_openat2+0xdd/0x4f0 [ 322.597247][ T9166] ? do_sys_open+0xe0/0xe0 [ 322.601705][ T9166] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 322.607717][ T9166] ? lock_chain_count+0x20/0x20 [ 322.612579][ T9166] __x64_sys_openat+0x135/0x160 [ 322.617439][ T9166] do_syscall_64+0x4c/0xa0 [ 322.621869][ T9166] ? clear_bhb_loop+0x60/0xb0 [ 322.626574][ T9166] ? clear_bhb_loop+0x60/0xb0 [ 322.631278][ T9166] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 322.637173][ T9166] RIP: 0033:0x7f470799e159 [ 322.641611][ T9166] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 322.661264][ T9166] RSP: 002b:00007f47088eb028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 322.669711][ T9166] RAX: ffffffffffffffda RBX: 00007f4707c25fa0 RCX: 00007f470799e159 [ 322.677782][ T9166] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffffffff9c [ 322.685762][ T9166] RBP: 00007f4707a3506b R08: 0000000000000000 R09: 0000000000000000 [ 322.693751][ T9166] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 322.701731][ T9166] R13: 00007f4707c26038 R14: 00007f4707c25fa0 R15: 00007ffc6f2c4048 [ 322.709754][ T9166] [ 322.925393][ T9170] loop2: detected capacity change from 0 to 512 [ 323.059087][ T9170] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 323.405105][ T4285] EXT4-fs (loop2): unmounting filesystem. [ 324.401399][ T4288] Bluetooth: hci5: command 0x040f tx timeout [ 324.985434][ T9080] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 325.420320][ T9080] team0: Port device team_slave_0 added [ 325.731546][ T9080] team0: Port device team_slave_1 added [ 326.481174][ T4291] Bluetooth: hci5: command 0x0419 tx timeout [ 327.606514][ T9080] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 327.620888][ T9080] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 327.718118][ T9080] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 327.746685][ T9080] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 327.759123][ T9204] FAULT_INJECTION: forcing a failure. [ 327.759123][ T9204] name failslab, interval 1, probability 0, space 0, times 0 [ 327.764030][ T9080] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 327.781761][ T9204] CPU: 0 PID: 9204 Comm: syz.1.1487 Not tainted syzkaller #0 [ 327.805282][ T9204] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 327.815374][ T9204] Call Trace: [ 327.818685][ T9204] [ 327.821648][ T9204] dump_stack_lvl+0x188/0x24e [ 327.826373][ T9204] ? show_regs_print_info+0x12/0x12 [ 327.831612][ T9204] ? load_image+0x410/0x410 [ 327.836187][ T9204] ? __might_sleep+0xd0/0xd0 [ 327.840820][ T9204] ? __lock_acquire+0x7c40/0x7c40 [ 327.845891][ T9204] should_fail_ex+0x390/0x4c0 [ 327.850615][ T9204] should_failslab+0x5/0x20 [ 327.855155][ T9204] slab_pre_alloc_hook+0x59/0x300 [ 327.860218][ T9204] ? vfs_write+0x777/0x9a0 [ 327.864679][ T9204] kmem_cache_alloc+0x56/0x2f0 [ 327.869368][ T9080] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 327.869461][ T9204] ? getname_flags+0xb7/0x500 [ 327.884764][ T9204] getname_flags+0xb7/0x500 [ 327.889303][ T9204] do_sys_openat2+0xdd/0x4f0 [ 327.893942][ T9204] ? do_sys_open+0xe0/0xe0 [ 327.898406][ T9204] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 327.904435][ T9204] ? lock_chain_count+0x20/0x20 [ 327.909333][ T9204] __x64_sys_openat+0x135/0x160 [ 327.909765][ T9179] loop2: detected capacity change from 0 to 32768 [ 327.914208][ T9204] do_syscall_64+0x4c/0xa0 [ 327.914231][ T9204] ? clear_bhb_loop+0x60/0xb0 [ 327.914250][ T9204] ? clear_bhb_loop+0x60/0xb0 [ 327.914269][ T9204] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 327.914298][ T9204] RIP: 0033:0x7f79d7f9e159 [ 327.914316][ T9204] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 327.964516][ T9204] RSP: 002b:00007f79d8e09028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 327.972947][ T9204] RAX: ffffffffffffffda RBX: 00007f79d8225fa0 RCX: 00007f79d7f9e159 [ 327.980946][ T9204] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffffffff9c [ 327.988928][ T9204] RBP: 00007f79d803506b R08: 0000000000000000 R09: 0000000000000000 [ 327.996905][ T9204] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 328.004883][ T9204] R13: 00007f79d8226038 R14: 00007f79d8225fa0 R15: 00007ffff1b2dfc8 [ 328.012875][ T9204] [ 328.063189][ T9179] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop2 scanned by syz.2.1481 (9179) [ 328.092202][ T9198] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1485'. [ 328.145723][ T9179] BTRFS info (device loop2): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 328.153106][ T9198] 8021q: adding VLAN 0 to HW filter on device bond4 [ 328.171392][ T9179] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 328.180109][ T9179] BTRFS info (device loop2): setting nodatacow, compression disabled [ 328.193647][ T4361] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 328.206326][ T9179] BTRFS info (device loop2): setting datasum, datacow enabled [ 328.214849][ T9202] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1485'. [ 328.221924][ T9179] BTRFS info (device loop2): setting incompat feature flag for COMPRESS_ZSTD (0x10) [ 328.249986][ T9179] BTRFS info (device loop2): force zstd compression, level 3 [ 328.254820][ T9202] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1485'. [ 328.258042][ T9179] BTRFS info (device loop2): turning on sync discard [ 328.280951][ T9179] BTRFS warning (device loop2): excessive commit interval 43283 [ 328.288968][ T9179] BTRFS info (device loop2): enabling ssd optimizations [ 328.303694][ T9179] BTRFS info (device loop2): using spread ssd allocation scheme [ 328.315722][ T9179] BTRFS info (device loop2): not using ssd optimizations [ 328.338210][ T9179] BTRFS info (device loop2): not using spread ssd allocation scheme [ 328.391800][ T9179] BTRFS info (device loop2): using free space tree [ 328.401054][ T4361] usb 4-1: Using ep0 maxpacket: 8 [ 328.408379][ T4361] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 328.503696][ T4361] usb 4-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 328.547409][ T4361] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 328.601882][ T4361] usb 4-1: config 0 descriptor?? [ 328.639075][ T9179] BTRFS error (device loop2): open_ctree failed: -12 [ 328.786785][ T9080] device hsr_slave_0 entered promiscuous mode [ 328.851448][ T4361] iowarrior 4-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 329.002088][ T9080] device hsr_slave_1 entered promiscuous mode [ 329.041096][ T9080] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 329.049847][ T9080] Cannot create hsr debugfs directory [ 329.521890][ T4347] usb 4-1: USB disconnect, device number 5 [ 329.985946][ T4306] device hsr_slave_0 left promiscuous mode [ 329.995300][ T4306] device hsr_slave_1 left promiscuous mode [ 330.232761][ T4306] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 330.432508][ T4306] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 330.653165][ T4306] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 330.837639][ T4306] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 330.932666][ T4306] device bridge_slave_1 left promiscuous mode [ 330.946837][ T4306] bridge0: port 2(bridge_slave_1) entered disabled state [ 330.973880][ T4306] device bridge_slave_0 left promiscuous mode [ 330.989619][ T4306] bridge0: port 1(bridge_slave_0) entered disabled state [ 331.135175][ T4306] device bond2 left promiscuous mode [ 331.154817][ T4306] device veth1_macvtap left promiscuous mode [ 331.160943][ T4306] device veth0_macvtap left promiscuous mode [ 331.197707][ T4306] device veth1_vlan left promiscuous mode [ 331.218497][ T4306] device veth0_vlan left promiscuous mode [ 331.327837][ T9238] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 331.553161][ T9238] usb 6-1: config 0 has an invalid interface number: 117 but max is 0 [ 331.562983][ T9238] usb 6-1: config 0 has no interface number 0 [ 331.569120][ T9238] usb 6-1: config 0 interface 117 has no altsetting 0 [ 331.579013][ T9238] usb 6-1: New USB device found, idVendor=03f0, idProduct=1b1d, bcdDevice=91.6c [ 331.590164][ T9238] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 331.598502][ T9238] usb 6-1: Product: syz [ 331.608769][ T9238] usb 6-1: Manufacturer: syz [ 331.614845][ T9238] usb 6-1: SerialNumber: syz [ 331.634039][ T9238] usb 6-1: config 0 descriptor?? [ 331.738292][ T4306] bond4 (unregistering): Released all slaves [ 331.865425][ T9238] sierra 6-1:0.117: Sierra USB modem converter detected [ 331.877515][ T9238] usb 6-1: Sierra USB modem converter now attached to ttyUSB0 [ 331.914874][ T9238] usb 6-1: USB disconnect, device number 3 [ 331.922922][ T4306] bond3 (unregistering): Released all slaves [ 331.943078][ T9238] sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0 [ 331.960939][ T9238] sierra 6-1:0.117: device disconnected [ 332.198478][ T4306] team0 (unregistering): Port device macvlan2 removed [ 332.327621][ T4306] bond2 (unregistering): Released all slaves [ 332.565648][ T9294] loop5: detected capacity change from 0 to 2048 [ 332.582766][ T4306] bond1 (unregistering): Released all slaves [ 332.600044][ T9294] UDF-fs: bad mount option "gid=00000000000000060928" or missing value [ 333.777501][ T4306] team0 (unregistering): Port device team_slave_1 removed [ 333.821054][ T4306] team0 (unregistering): Port device team_slave_0 removed [ 333.871477][ T4306] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 333.914334][ T4306] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 334.252892][ T4306] bond0 (unregistering): Released all slaves [ 334.367534][ T9284] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1497'. [ 334.389292][ T9284] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 334.534280][ T9284] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 334.575343][ T9317] FAULT_INJECTION: forcing a failure. [ 334.575343][ T9317] name failslab, interval 1, probability 0, space 0, times 0 [ 334.591496][ T4347] wg2 speed is unknown, defaulting to 1000 [ 334.596082][ T9317] CPU: 0 PID: 9317 Comm: syz.2.1503 Not tainted syzkaller #0 [ 334.605097][ T9317] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 334.615165][ T9317] Call Trace: [ 334.618462][ T9317] [ 334.621402][ T9317] dump_stack_lvl+0x188/0x24e [ 334.626097][ T9317] ? show_regs_print_info+0x12/0x12 [ 334.631310][ T9317] ? load_image+0x410/0x410 [ 334.635832][ T9317] ? __might_sleep+0xd0/0xd0 [ 334.640445][ T9317] ? __lock_acquire+0x7c40/0x7c40 [ 334.645479][ T9317] ? rcu_preempt_deferred_qs_irqrestore+0x84f/0xbd0 [ 334.652096][ T9317] should_fail_ex+0x390/0x4c0 [ 334.656794][ T9317] should_failslab+0x5/0x20 [ 334.661302][ T9317] slab_pre_alloc_hook+0x59/0x300 [ 334.666340][ T9317] kmem_cache_alloc_lru+0x49/0x2e0 [ 334.671459][ T9317] ? __d_alloc+0x2e/0x6e0 [ 334.675799][ T9317] __d_alloc+0x2e/0x6e0 [ 334.679963][ T9317] d_alloc_parallel+0xdc/0x1590 [ 334.684822][ T9317] ? __d_lookup+0x8b/0x7c0 [ 334.689253][ T9317] ? __lock_acquire+0x7c40/0x7c40 [ 334.694301][ T9317] ? __d_lookup+0x8b/0x7c0 [ 334.698728][ T9317] ? d_hash_and_lookup+0x1b0/0x1b0 [ 334.703862][ T9317] path_openat+0x949/0x2f10 [ 334.708391][ T9317] ? verify_lock_unused+0x140/0x140 [ 334.713616][ T9317] ? do_filp_open+0x420/0x420 [ 334.718319][ T9317] do_filp_open+0x1ee/0x420 [ 334.722844][ T9317] ? vfs_tmpfile+0x470/0x470 [ 334.727464][ T9317] ? _raw_spin_unlock+0x24/0x40 [ 334.732357][ T9317] ? alloc_fd+0x590/0x640 [ 334.736711][ T9317] do_sys_openat2+0x14b/0x4f0 [ 334.741402][ T9317] ? do_sys_open+0xe0/0xe0 [ 334.745822][ T9317] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 334.751817][ T9317] ? lock_chain_count+0x20/0x20 [ 334.756684][ T9317] __x64_sys_openat+0x135/0x160 [ 334.761549][ T9317] do_syscall_64+0x4c/0xa0 [ 334.765967][ T9317] ? clear_bhb_loop+0x60/0xb0 [ 334.770681][ T9317] ? clear_bhb_loop+0x60/0xb0 [ 334.775368][ T9317] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 334.781282][ T9317] RIP: 0033:0x7f470795e98e [ 334.785707][ T9317] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 334.805336][ T9317] RSP: 002b:00007f47088eab28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 334.813760][ T9317] RAX: ffffffffffffffda RBX: 00007f47088eb6c0 RCX: 00007f470795e98e [ 334.821740][ T9317] RDX: 0000000000145000 RSI: 00007f47088eac00 RDI: ffffffffffffff9c [ 334.829716][ T9317] RBP: 00007f47088eac00 R08: 0000000000000000 R09: 0000000000000000 [ 334.837697][ T9317] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 334.845680][ T9317] R13: 00007f4707c26038 R14: 00007f4707c25fa0 R15: 00007ffc6f2c4048 [ 334.853761][ T9317] [ 334.899525][ T9303] device syzkaller0 entered promiscuous mode [ 337.622484][ T9324] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 337.678051][ T9333] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1508'. [ 337.948850][ T9080] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 338.007830][ T9080] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 338.042564][ T9354] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1512'. [ 338.159087][ T9080] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 341.086829][ T9382] Can't find ip_set type hash:ne [ 343.064473][ T9080] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 343.355927][ T9080] 8021q: adding VLAN 0 to HW filter on device bond0 [ 343.387924][ T38] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 343.419238][ T38] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 343.447920][ T9405] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 343.484053][ T9080] 8021q: adding VLAN 0 to HW filter on device team0 [ 343.572520][ T4306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 343.578228][ T9411] loop3: detected capacity change from 0 to 1024 [ 343.582074][ T4306] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 343.588000][ T9411] EXT4-fs: Ignoring removed bh option [ 343.688632][ T9411] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 343.763578][ T4306] bridge0: port 1(bridge_slave_0) entered blocking state [ 343.771076][ T4306] bridge0: port 1(bridge_slave_0) entered forwarding state [ 343.857531][ T9409] device syzkaller0 entered promiscuous mode [ 343.955474][ T4306] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 344.012198][ T4306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 344.071618][ T4306] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 344.076409][ T4274] EXT4-fs (loop3): unmounting filesystem. [ 344.080299][ T4306] bridge0: port 2(bridge_slave_1) entered blocking state [ 344.092625][ T4306] bridge0: port 2(bridge_slave_1) entered forwarding state [ 344.107420][ T4306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 344.237943][ T4306] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 344.294582][ T4306] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 344.388438][ T4306] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 345.137863][ T4306] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 345.243305][ T9080] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 345.254187][ T9080] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 345.268453][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 345.333996][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 345.434131][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 345.460190][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 345.497757][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 345.534370][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 345.644439][ T9440] loop5: detected capacity change from 0 to 1024 [ 345.655059][ T9440] EXT4-fs: Ignoring removed bh option [ 346.078195][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 346.269793][ T9427] syz.1.1525 (9427): drop_caches: 2 [ 346.354632][ T9440] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 346.494447][ T5781] EXT4-fs (loop5): unmounting filesystem. [ 346.632244][ T9452] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1529'. [ 346.892906][ T9463] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 347.000681][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 347.027499][ T8928] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 347.081542][ T9080] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 350.110669][ T9500] loop1: detected capacity change from 0 to 1024 [ 350.121647][ T9500] EXT4-fs: Ignoring removed bh option [ 350.373031][ T9500] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 350.406090][ T9502] device syzkaller0 entered promiscuous mode [ 350.594282][ T4276] EXT4-fs (loop1): unmounting filesystem. [ 350.766359][ T9515] loop5: detected capacity change from 0 to 1024 [ 350.777384][ T9515] EXT4-fs: Ignoring removed bh option [ 351.650289][ T9512] syz.2.1542 (9512): drop_caches: 2 [ 351.787101][ T4430] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 351.860999][ T4430] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 351.892931][ T9515] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 351.942275][ T9520] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1544'. [ 352.016998][ T9080] device veth0_vlan entered promiscuous mode [ 352.056883][ T9522] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 352.063162][ T5781] EXT4-fs (loop5): unmounting filesystem. [ 352.160405][ T6485] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 352.201930][ T6485] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 352.217391][ T6485] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 352.262145][ T6485] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 352.299091][ T9080] device veth1_vlan entered promiscuous mode [ 352.429944][ T6450] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 352.466117][ T6450] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 352.500636][ T6450] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 352.515061][ T6450] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 352.537497][ T9080] device veth0_macvtap entered promiscuous mode [ 352.600906][ T9080] device veth1_macvtap entered promiscuous mode [ 352.695242][ T9080] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 352.726447][ T9080] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 352.741116][ T9080] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 352.761136][ T9080] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 352.781084][ T9080] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 352.802551][ T9080] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 352.829057][ T9542] loop5: detected capacity change from 0 to 2048 [ 352.834999][ T9080] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 352.888050][ T9542] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 352.897443][ T9080] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 352.946200][ T9080] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 353.173658][ T6450] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 353.192226][ T6450] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 353.232941][ T6450] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 353.507824][ T6450] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 353.733969][ T9080] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 353.796805][ T9080] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 353.849316][ T9080] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 353.929851][ T9080] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 353.939978][ T9080] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 353.950815][ T9080] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 353.962627][ T9080] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 353.984958][ T6450] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 354.033753][ T6450] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 355.667923][ T9080] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 355.686841][ T9080] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 355.713472][ T9080] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 355.738805][ T9080] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 356.045900][ T4423] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 356.058104][ T4423] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 356.088207][ T7994] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 356.135413][ T4430] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 356.149234][ T4430] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 356.196125][ T6450] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 356.222158][ T9577] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1558'. [ 356.248553][ T9577] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1558'. [ 356.301281][ T9577] netlink: 31 bytes leftover after parsing attributes in process `syz.2.1558'. [ 356.445357][ T9582] device syzkaller0 entered promiscuous mode [ 356.451390][ T9584] loop6: detected capacity change from 0 to 128 [ 356.523007][ T9584] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: writeback. [ 356.566800][ T9584] ext4 filesystem being mounted at /0/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 357.676351][ T9599] loop5: detected capacity change from 0 to 2048 [ 357.763026][ T9080] EXT4-fs (loop6): unmounting filesystem. [ 357.765810][ T9602] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 357.845458][ T9599] NILFS (loop5): invalid segment: Magic number mismatch [ 357.901242][ T9599] NILFS (loop5): trying rollback from an earlier position [ 357.993761][ T9599] NILFS (loop5): recovery complete [ 358.046575][ T9609] NILFS (loop5): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 358.133505][ T9611] loop1: detected capacity change from 0 to 1024 [ 358.144308][ T9611] EXT4-fs: Ignoring removed bh option [ 358.220771][ T9612] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 358.306195][ T9611] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 358.623482][ T4276] EXT4-fs (loop1): unmounting filesystem. [ 359.209100][ T9639] netlink: 'syz.5.1570': attribute type 1 has an invalid length. [ 359.242178][ T9639] netlink: 'syz.5.1570': attribute type 2 has an invalid length. [ 359.251867][ T9638] device syzkaller0 entered promiscuous mode [ 359.290402][ T9639] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1570'. [ 359.341129][ T9639] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1570'. [ 359.350163][ T9639] netlink: 31 bytes leftover after parsing attributes in process `syz.5.1570'. [ 359.577787][ T9654] loop1: detected capacity change from 0 to 1024 [ 359.588434][ T9654] EXT4-fs: Ignoring removed bh option [ 359.714158][ T9654] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 359.729094][ T9651] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 360.038217][ T4276] EXT4-fs (loop1): unmounting filesystem. [ 360.627811][ T9684] loop5: detected capacity change from 0 to 8 [ 360.638034][ T9684] MTD: Attempt to mount non-MTD device "/dev/loop5" [ 360.698522][ T9684] syz.5.1582 (9684): drop_caches: 2 [ 361.423991][ T9685] loop2: detected capacity change from 0 to 8 [ 361.438484][ T9685] MTD: Attempt to mount non-MTD device "/dev/loop2" [ 361.619656][ T4832] udevd[4832]: incorrect cramfs checksum on /dev/loop5 [ 361.708505][ T4825] udevd[4825]: incorrect cramfs checksum on /dev/loop2 [ 365.085477][ T9705] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 365.755640][ T9711] netlink: 'syz.5.1590': attribute type 1 has an invalid length. [ 365.903535][ T9711] netlink: 'syz.5.1590': attribute type 2 has an invalid length. [ 366.372466][ T9711] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1590'. [ 366.515762][ T9711] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1590'. [ 366.527209][ T9711] netlink: 31 bytes leftover after parsing attributes in process `syz.5.1590'. [ 366.578702][ T9722] loop2: detected capacity change from 0 to 128 [ 366.650533][ T9722] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 366.674921][ T9722] ext4 filesystem being mounted at /334/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 367.042211][ T9734] loop6: detected capacity change from 0 to 1024 [ 367.053674][ T9734] EXT4-fs: Ignoring removed bh option [ 367.470160][ T9734] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 367.617164][ T9743] loop3: detected capacity change from 0 to 8 [ 367.626551][ T9743] MTD: Attempt to mount non-MTD device "/dev/loop3" [ 367.674237][ T9743] syz.3.1595 (9743): drop_caches: 2 [ 368.357010][ T4825] udevd[4825]: incorrect cramfs checksum on /dev/loop3 [ 368.379652][ T9080] EXT4-fs (loop6): unmounting filesystem. [ 368.589979][ T9747] loop3: detected capacity change from 0 to 8 [ 368.599807][ T9747] MTD: Attempt to mount non-MTD device "/dev/loop3" [ 369.483347][ T4825] udevd[4825]: incorrect cramfs checksum on /dev/loop3 [ 371.223157][ T4832] udevd[4832]: incorrect cramfs checksum on /dev/loop3 [ 371.384503][ T9758] device syzkaller0 entered promiscuous mode [ 371.429191][ T4832] udevd[4832]: incorrect cramfs checksum on /dev/loop3 [ 371.532713][ T9765] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 371.713943][ T4285] EXT4-fs (loop2): unmounting filesystem. [ 371.900324][ T9779] netlink: 'syz.2.1606': attribute type 1 has an invalid length. [ 371.941116][ T9779] netlink: 'syz.2.1606': attribute type 2 has an invalid length. [ 372.016137][ T9779] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1606'. [ 372.074629][ T9779] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1606'. [ 372.108128][ T9779] netlink: 31 bytes leftover after parsing attributes in process `syz.2.1606'. [ 372.227430][ T9788] loop5: detected capacity change from 0 to 1024 [ 372.239236][ T9788] EXT4-fs: Ignoring removed bh option [ 372.373179][ T9788] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 372.701783][ T5781] EXT4-fs (loop5): unmounting filesystem. [ 373.483515][ T9813] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1616'. [ 373.534655][ T9813] netlink: 12 bytes leftover after parsing attributes in process `syz.2.1616'. [ 373.588153][ T9813] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 373.597533][ T9813] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 373.606543][ T9813] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 373.615637][ T9813] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 373.730021][ T9815] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 373.829988][ T9818] device syzkaller0 entered promiscuous mode [ 374.297160][ T9825] loop1: detected capacity change from 0 to 1024 [ 374.311295][ T9825] EXT4-fs: Ignoring removed bh option [ 374.603308][ T9825] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 374.750871][ T4276] EXT4-fs (loop1): unmounting filesystem. [ 375.286665][ T9829] Can't find ip_set type hash:ne [ 375.546948][ T9844] netlink: 'syz.1.1622': attribute type 1 has an invalid length. [ 375.579866][ T9844] netlink: 'syz.1.1622': attribute type 2 has an invalid length. [ 375.665175][ T9854] FAULT_INJECTION: forcing a failure. [ 375.665175][ T9854] name failslab, interval 1, probability 0, space 0, times 0 [ 375.691741][ T9844] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1622'. [ 375.700760][ T9844] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1622'. [ 375.742477][ T9854] CPU: 1 PID: 9854 Comm: syz.5.1624 Not tainted syzkaller #0 [ 375.749933][ T9854] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 375.751049][ T9844] netlink: 31 bytes leftover after parsing attributes in process `syz.1.1622'. [ 375.760006][ T9854] Call Trace: [ 375.760098][ T9854] [ 375.760151][ T9854] dump_stack_lvl+0x188/0x24e [ 375.760256][ T9854] ? show_regs_print_info+0x12/0x12 [ 375.760303][ T9854] ? load_image+0x410/0x410 [ 375.760340][ T9854] ? __might_sleep+0xd0/0xd0 [ 375.760384][ T9854] ? __lock_acquire+0x7c40/0x7c40 [ 375.760441][ T9854] should_fail_ex+0x390/0x4c0 [ 375.760509][ T9854] should_failslab+0x5/0x20 [ 375.809034][ T9854] slab_pre_alloc_hook+0x59/0x300 [ 375.814192][ T9854] kmem_cache_alloc+0x56/0x2f0 [ 375.819000][ T9854] ? single_open+0x118/0x230 [ 375.823658][ T9854] single_open+0x118/0x230 [ 375.828128][ T9854] snd_info_text_entry_open+0x229/0x2b0 [ 375.833777][ T9854] proc_reg_open+0x23b/0x520 [ 375.838435][ T9854] ? proc_reg_mmap+0x280/0x280 [ 375.843291][ T9854] do_dentry_open+0x7dd/0x10b0 [ 375.848356][ T9854] path_openat+0x2674/0x2f10 [ 375.853040][ T9854] ? do_filp_open+0x420/0x420 [ 375.857790][ T9854] do_filp_open+0x1ee/0x420 [ 375.862345][ T9854] ? vfs_tmpfile+0x470/0x470 [ 375.867004][ T9854] ? _raw_spin_unlock+0x24/0x40 [ 375.871965][ T9854] ? alloc_fd+0x590/0x640 [ 375.876345][ T9854] do_sys_openat2+0x14b/0x4f0 [ 375.881061][ T9854] ? do_sys_open+0xe0/0xe0 [ 375.885524][ T9854] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 375.891555][ T9854] ? lock_chain_count+0x20/0x20 [ 375.896550][ T9854] __x64_sys_openat+0x135/0x160 [ 375.901452][ T9854] do_syscall_64+0x4c/0xa0 [ 375.905910][ T9854] ? clear_bhb_loop+0x60/0xb0 [ 375.910663][ T9854] ? clear_bhb_loop+0x60/0xb0 [ 375.915471][ T9854] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 375.921416][ T9854] RIP: 0033:0x7f79ad79e159 [ 375.925912][ T9854] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 375.945580][ T9854] RSP: 002b:00007f79ae6c6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 375.954013][ T9854] RAX: ffffffffffffffda RBX: 00007f79ada26090 RCX: 00007f79ad79e159 [ 375.962002][ T9854] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 00000000ffffff9c [ 375.970086][ T9854] RBP: 00007f79ad83506b R08: 0000000000000000 R09: 0000000000000000 [ 375.978071][ T9854] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 375.986049][ T9854] R13: 00007f79ada26128 R14: 00007f79ada26090 R15: 00007fff95d82608 [ 375.994045][ T9854] [ 376.161223][ T4347] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 376.399084][ T4347] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 376.616600][ T4347] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 376.758497][ T9865] Can't find ip_set type hash:ne [ 376.831273][ T4347] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 376.924890][ T9880] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 376.948843][ T4347] usb 4-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 376.970033][ T4347] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 377.014792][ T4347] usb 4-1: config 0 descriptor?? [ 378.070813][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 378.565238][ T1279] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.572066][ T1279] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.166130][ T9891] loop2: detected capacity change from 0 to 8 [ 379.176540][ T9891] MTD: Attempt to mount non-MTD device "/dev/loop2" [ 379.307999][ T9891] syz.2.1632 (9891): drop_caches: 2 [ 379.438988][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.446956][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.454717][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.462431][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.470015][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.476463][ T4825] udevd[4825]: incorrect cramfs checksum on /dev/loop2 [ 379.477613][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.491978][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.499467][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.507057][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.516052][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.523833][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.533028][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.541054][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.548700][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.556346][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.564034][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.571958][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.579447][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.592817][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.600350][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.608284][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.616986][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.625091][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.649027][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.679918][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.693312][ T9894] device syzkaller0 entered promiscuous mode [ 379.699528][ T4825] udevd[4825]: incorrect cramfs checksum on /dev/loop2 [ 379.706488][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.706623][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.706744][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.706846][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.706946][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.766824][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.780612][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.788928][ T4347] hid-generic 0003:0457:07DA.0002: unknown main item tag 0x0 [ 379.805606][ T4347] hid-generic 0003:0457:07DA.0002: hidraw0: USB HID v0.00 Device [HID 0457:07da] on usb-dummy_hcd.3-1/input0 [ 379.834864][ T4347] usb 4-1: USB disconnect, device number 6 [ 380.099649][ T9912] syz.5.1637[9912] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 380.099750][ T9912] syz.5.1637[9912] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 380.349786][ T9918] netlink: 'syz.5.1640': attribute type 1 has an invalid length. [ 380.352881][ T9904] fido_id[9904]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.3/usb4/report_descriptor': No such file or directory [ 380.441499][ T9918] netlink: 'syz.5.1640': attribute type 2 has an invalid length. [ 380.590574][ T9918] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1640'. [ 380.601096][ T26] usb 3-1: new full-speed USB device number 5 using dummy_hcd [ 380.681575][ T9918] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1640'. [ 380.711760][ T9918] netlink: 31 bytes leftover after parsing attributes in process `syz.5.1640'. [ 380.818719][ T26] usb 3-1: config 0 interface 0 altsetting 251 endpoint 0x9 has an invalid bInterval 39, changing to 4 [ 380.847857][ T26] usb 3-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid maxpacket 15380, setting to 1023 [ 380.882413][ T26] usb 3-1: config 0 interface 0 has no altsetting 0 [ 380.902002][ T26] usb 3-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 380.920724][ T26] usb 3-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 380.929097][ T26] usb 3-1: Product: syz [ 380.941094][ T26] usb 3-1: Manufacturer: syz [ 380.951131][ T26] usb 3-1: SerialNumber: syz [ 380.983418][ T26] usb 3-1: config 0 descriptor?? [ 381.022929][ T26] usb 3-1: selecting invalid altsetting 0 [ 381.073142][ T27] kauditd_printk_skb: 26 callbacks suppressed [ 381.073215][ T27] audit: type=1326 audit(1789833003.606:215): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9923 comm="syz.3.1642" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd4e59e159 code=0x7fc00000 [ 381.521080][ T9933] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 381.539579][ T27] audit: type=1326 audit(1789833004.066:216): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9923 comm="syz.3.1642" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7fdd4e53f4d9 code=0x7fc00000 [ 381.970914][ T9917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 382.038293][ T9946] loop6: detected capacity change from 0 to 8 [ 382.048802][ T9946] MTD: Attempt to mount non-MTD device "/dev/loop6" [ 382.089269][ T9946] syz.6.1647 (9946): drop_caches: 2 [ 382.873246][ T4832] udevd[4832]: incorrect cramfs checksum on /dev/loop6 [ 382.938416][ T9917] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 382.985008][ T3599] usb 3-1: USB disconnect, device number 5 [ 383.030139][ T9951] syz.6.1650[9951] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 383.030243][ T9951] syz.6.1650[9951] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 383.226508][ T9956] device syzkaller0 entered promiscuous mode [ 384.486817][ T9962] netlink: 'syz.6.1654': attribute type 1 has an invalid length. [ 384.531179][ T9962] netlink: 'syz.6.1654': attribute type 2 has an invalid length. [ 384.549578][ T9972] netlink: 36 bytes leftover after parsing attributes in process `syz.6.1654'. [ 384.586803][ T9972] netlink: 36 bytes leftover after parsing attributes in process `syz.6.1654'. [ 384.618663][ T9972] netlink: 31 bytes leftover after parsing attributes in process `syz.6.1654'. [ 384.693369][ T9978] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 385.244834][ T9992] device syzkaller0 entered promiscuous mode [ 385.390303][T10000] loop2: detected capacity change from 0 to 1024 [ 385.401313][T10000] EXT4-fs: Ignoring removed bh option [ 385.565326][T10000] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 385.880505][ T4285] EXT4-fs (loop2): unmounting filesystem. [ 385.925897][T10008] syz.5.1664[10008] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 385.925996][T10008] syz.5.1664[10008] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 386.411074][ T26] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 386.582094][T10023] loop5: detected capacity change from 0 to 2048 [ 386.631076][T10023] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 387.521226][ T26] usb 3-1: Using ep0 maxpacket: 16 [ 387.528490][ T26] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 387.567005][ T26] usb 3-1: config 0 has no interfaces? [ 387.592403][ T26] usb 3-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=a4.96 [ 387.608724][ T26] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.617338][ T26] usb 3-1: Product: syz [ 387.621831][ T26] usb 3-1: Manufacturer: syz [ 387.626458][ T26] usb 3-1: SerialNumber: syz [ 387.651676][ T26] usb 3-1: config 0 descriptor?? [ 387.921075][ T26] usb 3-1: USB disconnect, device number 6 [ 389.555122][T10036] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 389.591162][T10038] netlink: 'syz.2.1671': attribute type 1 has an invalid length. [ 389.599602][T10038] netlink: 'syz.2.1671': attribute type 2 has an invalid length. [ 389.654387][T10040] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1671'. [ 389.691502][T10040] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1671'. [ 389.700520][T10040] netlink: 31 bytes leftover after parsing attributes in process `syz.2.1671'. [ 390.669802][T10053] Can't find ip_set type hash:ne [ 391.108688][T10068] loop1: detected capacity change from 0 to 1024 [ 391.119881][T10068] EXT4-fs: Ignoring removed bh option [ 392.169267][T10065] syz.6.1677[10065] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 392.169376][T10065] syz.6.1677[10065] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 392.215483][T10068] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 392.373778][ T4276] EXT4-fs (loop1): unmounting filesystem. [ 392.414189][T10081] loop5: detected capacity change from 0 to 8 [ 392.424691][T10081] MTD: Attempt to mount non-MTD device "/dev/loop5" [ 392.438216][T10081] syz.5.1681 (10081): drop_caches: 2 [ 392.518244][ T4825] udevd[4825]: incorrect cramfs checksum on /dev/loop5 [ 392.847903][T10090] device syzkaller0 entered promiscuous mode [ 392.956375][T10096] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 393.545210][T10122] syz.3.1692[10122] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 393.545326][T10122] syz.3.1692[10122] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 394.562305][T10132] Can't find ip_set type hash:ne [ 394.947417][T10141] loop3: detected capacity change from 0 to 1024 [ 394.957744][T10141] EXT4-fs: Ignoring removed bh option [ 395.073662][T10141] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 395.467603][ T4274] EXT4-fs (loop3): unmounting filesystem. [ 395.794257][T10148] loop3: detected capacity change from 0 to 8 [ 395.801142][T10148] MTD: Attempt to mount non-MTD device "/dev/loop3" [ 395.820282][T10148] syz.3.1696 (10148): drop_caches: 2 [ 395.849648][ T4832] udevd[4832]: incorrect cramfs checksum on /dev/loop3 [ 395.968366][T10150] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1697'. [ 397.350055][T10106] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1687'. [ 397.359625][T10111] netlink: 'syz.2.1689': attribute type 1 has an invalid length. [ 397.373744][T10111] netlink: 'syz.2.1689': attribute type 2 has an invalid length. [ 397.387523][T10117] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1689'. [ 397.421846][T10117] netlink: 36 bytes leftover after parsing attributes in process `syz.2.1689'. [ 397.451624][T10117] netlink: 31 bytes leftover after parsing attributes in process `syz.2.1689'. [ 397.558319][T10157] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 397.879436][T10170] syz.2.1703[10170] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 397.879535][T10170] syz.2.1703[10170] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 398.337972][T10184] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1708'. [ 399.059556][T10186] loop2: detected capacity change from 0 to 8 [ 399.066923][T10186] MTD: Attempt to mount non-MTD device "/dev/loop2" [ 399.078096][T10186] syz.2.1707 (10186): drop_caches: 2 [ 399.161102][ T4832] udevd[4832]: incorrect cramfs checksum on /dev/loop2 [ 399.431503][T10192] device syzkaller0 entered promiscuous mode [ 399.480706][T10203] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 403.048636][T10207] netlink: 'syz.1.1713': attribute type 1 has an invalid length. [ 403.056671][T10207] netlink: 'syz.1.1713': attribute type 2 has an invalid length. [ 403.072291][T10213] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1713'. [ 403.081657][T10213] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1713'. [ 403.090626][T10213] netlink: 31 bytes leftover after parsing attributes in process `syz.1.1713'. [ 403.590822][T10257] ip_tables: iptables: counters copy to user failed while replacing table [ 403.693322][T10259] loop2: detected capacity change from 0 to 8 [ 403.700055][T10259] MTD: Attempt to mount non-MTD device "/dev/loop2" [ 403.728795][T10259] syz.2.1722 (10259): drop_caches: 2 [ 403.745923][T10261] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1723'. [ 403.767491][ T4832] udevd[4832]: incorrect cramfs checksum on /dev/loop2 [ 405.658531][ T4832] udevd[4832]: incorrect cramfs checksum on /dev/loop2 [ 406.514270][T10276] device syzkaller0 entered promiscuous mode [ 409.172244][T10291] netlink: 'syz.1.1730': attribute type 1 has an invalid length. [ 409.180295][T10291] netlink: 'syz.1.1730': attribute type 2 has an invalid length. [ 409.200615][T10299] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1730'. [ 409.210042][T10299] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1730'. [ 409.219146][T10299] netlink: 31 bytes leftover after parsing attributes in process `syz.1.1730'. [ 409.239507][T10319] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1737'. [ 409.393943][T10323] loop2: detected capacity change from 0 to 8 [ 409.400635][T10323] MTD: Attempt to mount non-MTD device "/dev/loop2" [ 409.422906][T10323] syz.2.1738 (10323): drop_caches: 2 [ 409.493925][ T4832] udevd[4832]: incorrect cramfs checksum on /dev/loop2 [ 410.381602][T10331] Can't find ip_set type hash:ne [ 411.124353][T10364] device syzkaller0 entered promiscuous mode [ 411.165924][T10367] netlink: 'syz.1.1752': attribute type 1 has an invalid length. [ 411.184146][T10367] netlink: 'syz.1.1752': attribute type 2 has an invalid length. [ 411.195603][T10368] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1751'. [ 411.216991][T10372] ================================================================== [ 411.225147][T10372] BUG: KASAN: slab-out-of-bounds in ieee80211_monitor_select_queue+0x23a/0x240 [ 411.234220][T10372] Read of size 2 at addr ffff88801d28edfb by task syz.3.1749/10372 [ 411.242164][T10372] [ 411.244570][T10372] CPU: 1 PID: 10372 Comm: syz.3.1749 Not tainted syzkaller #0 [ 411.252098][T10372] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 411.262371][T10372] Call Trace: [ 411.265685][T10372] [ 411.268640][T10372] dump_stack_lvl+0x188/0x24e [ 411.273399][T10372] ? __lock_acquire+0x7c40/0x7c40 [ 411.278475][T10372] ? show_regs_print_info+0x12/0x12 [ 411.283711][T10372] ? load_image+0x410/0x410 [ 411.288948][T10372] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 411.294449][T10372] ? __virt_addr_valid+0x188/0x540 [ 411.299661][T10372] ? __virt_addr_valid+0x467/0x540 [ 411.304825][T10372] ? ieee80211_monitor_select_queue+0x23a/0x240 [ 411.311106][T10372] print_report+0xa8/0x210 [ 411.315573][T10372] kasan_report+0x10b/0x140 [ 411.320126][T10372] ? ieee80211_monitor_select_queue+0x23a/0x240 [ 411.326497][T10372] ieee80211_monitor_select_queue+0x23a/0x240 [ 411.332608][T10372] ? ieee80211_activate_links_work+0x60/0x60 [ 411.338673][T10372] netdev_core_pick_tx+0x12c/0x360 [ 411.343920][T10372] __dev_queue_xmit+0xb45/0x3810 [ 411.348914][T10372] ? __dev_queue_xmit+0x281/0x3810 [ 411.354068][T10372] ? netdev_core_pick_tx+0x360/0x360 [ 411.359398][T10372] ? virtio_net_hdr_to_skb+0x8c5/0x12b0 [ 411.365049][T10372] ? packet_extra_vlan_len_allowed+0x200/0x200 [ 411.371253][T10372] packet_sendmsg+0x3a9e/0x4c30 [ 411.376152][T10372] ? stack_trace_save+0xf0/0xf0 [ 411.381099][T10372] ? verify_lock_unused+0x140/0x140 [ 411.386340][T10372] ? aa_sk_perm+0x81f/0x950 [ 411.390946][T10372] ? aa_af_perm+0x340/0x340 [ 411.395485][T10372] ? packet_getsockopt+0x980/0x980 [ 411.400652][T10372] ? apparmor_socket_sendmsg+0x8a/0x330 [ 411.406286][T10372] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 411.411663][T10372] ? security_socket_sendmsg+0x7c/0xa0 [ 411.417227][T10372] ? packet_getsockopt+0x980/0x980 [ 411.422385][T10372] ____sys_sendmsg+0x5ed/0x9a0 [ 411.427320][T10372] ? __sys_sendmsg_sock+0x30/0x30 [ 411.432376][T10372] ? __import_iovec+0x306/0x510 [ 411.437336][T10372] ? import_iovec+0x6f/0xa0 [ 411.441898][T10372] ___sys_sendmsg+0x2a2/0x360 [ 411.446616][T10372] ? __lock_acquire+0x7c40/0x7c40 [ 411.451684][T10372] ? __sys_sendmsg+0x2a0/0x2a0 [ 411.456511][T10372] __se_sys_sendmsg+0x1c3/0x2b0 [ 411.461399][T10372] ? __x64_sys_sendmsg+0x80/0x80 [ 411.466394][T10372] ? lockdep_hardirqs_on+0x94/0x140 [ 411.471716][T10372] do_syscall_64+0x4c/0xa0 [ 411.476262][T10372] ? clear_bhb_loop+0x60/0xb0 [ 411.480965][T10372] ? clear_bhb_loop+0x60/0xb0 [ 411.485754][T10372] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 411.491687][T10372] RIP: 0033:0x7fdd4e59e159 [ 411.496134][T10372] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 411.515791][T10372] RSP: 002b:00007fdd4f480028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 411.524341][T10372] RAX: ffffffffffffffda RBX: 00007fdd4e826090 RCX: 00007fdd4e59e159 [ 411.532347][T10372] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000005 [ 411.540350][T10372] RBP: 00007fdd4e63506b R08: 0000000000000000 R09: 0000000000000000 [ 411.548353][T10372] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 411.556360][T10372] R13: 00007fdd4e826128 R14: 00007fdd4e826090 R15: 00007ffd6a374928 [ 411.564355][T10372] [ 411.567405][T10372] [ 411.569754][T10372] Allocated by task 10201: [ 411.574234][T10372] kasan_set_track+0x4b/0x70 [ 411.578850][T10372] __kasan_kmalloc+0x8e/0xa0 [ 411.583536][T10372] __kmalloc_node_track_caller+0xb0/0x240 [ 411.589327][T10372] __alloc_skb+0x226/0x7d0 [ 411.593758][T10372] alloc_skb_with_frags+0xa7/0x710 [ 411.598905][T10372] sock_alloc_send_pskb+0x87f/0x9a0 [ 411.604117][T10372] packet_sendmsg+0x31b9/0x4c30 [ 411.608968][T10372] ____sys_sendmsg+0x5ed/0x9a0 [ 411.613771][T10372] ___sys_sendmsg+0x2a2/0x360 [ 411.618491][T10372] __se_sys_sendmsg+0x1c3/0x2b0 [ 411.623367][T10372] do_syscall_64+0x4c/0xa0 [ 411.627808][T10372] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 411.633742][T10372] [ 411.636086][T10372] The buggy address belongs to the object at ffff88801d28c000 [ 411.636086][T10372] which belongs to the cache kmalloc-8k of size 8192 [ 411.650227][T10372] The buggy address is located 3579 bytes to the right of [ 411.650227][T10372] 8192-byte region [ffff88801d28c000, ffff88801d28e000) [ 411.664235][T10372] [ 411.666582][T10372] The buggy address belongs to the physical page: [ 411.673074][T10372] page:ffffea000074a200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1d288 [ 411.683258][T10372] head:ffffea000074a200 order:3 compound_mapcount:0 compound_pincount:0 [ 411.691619][T10372] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 411.699639][T10372] raw: 00fff00000010200 ffffea0001da6400 dead000000000003 ffff888017442280 [ 411.708256][T10372] raw: 0000000000000000 0000000080020002 00000001ffffffff 0000000000000000 [ 411.716854][T10372] page dumped because: kasan: bad access detected [ 411.723267][T10372] page_owner tracks the page as allocated [ 411.728981][T10372] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 9992, tgid 9991 (syz.6.1661), ts 385122430873, free_ts 376826852400 [ 411.751764][T10372] post_alloc_hook+0x173/0x1a0 [ 411.756615][T10372] get_page_from_freelist+0x206b/0x2180 [ 411.762179][T10372] __alloc_pages+0x1ec/0x4f0 [ 411.766793][T10372] alloc_slab_page+0x5d/0x180 [ 411.771488][T10372] new_slab+0x87/0x2d0 [ 411.775573][T10372] ___slab_alloc+0xbc5/0x1240 [ 411.780256][T10372] __kmem_cache_alloc_node+0x126/0x270 [ 411.785737][T10372] __kmalloc_node+0xa2/0x240 [ 411.790351][T10372] kvmalloc_node+0x6c/0x180 [ 411.794887][T10372] pfifo_fast_init+0x234/0x6a0 [ 411.799712][T10372] qdisc_create_dflt+0x11a/0x490 [ 411.804646][T10372] mq_init+0x2c3/0x650 [ 411.808724][T10372] qdisc_create_dflt+0x11a/0x490 [ 411.813670][T10372] dev_activate+0x1dc/0x1150 [ 411.818273][T10372] __dev_open+0x343/0x430 [ 411.822964][T10372] __dev_change_flags+0x1e4/0x6a0 [ 411.828008][T10372] page last free stack trace: [ 411.832813][T10372] free_unref_page_prepare+0x8e5/0x9e0 [ 411.838396][T10372] free_unref_page+0x2e/0x3f0 [ 411.843120][T10372] __unfreeze_partials+0x188/0x1e0 [ 411.848257][T10372] put_cpu_partial+0x17c/0x250 [ 411.853035][T10372] qlist_free_all+0x76/0xe0 [ 411.857556][T10372] kasan_quarantine_reduce+0x144/0x160 [ 411.863021][T10372] __kasan_slab_alloc+0x1e/0x80 [ 411.867894][T10372] slab_post_alloc_hook+0x4b/0x490 [ 411.873014][T10372] kmem_cache_alloc+0x18b/0x2f0 [ 411.877881][T10372] vm_area_dup+0x23/0x1a0 [ 411.882241][T10372] __split_vma+0xb9/0x4f0 [ 411.886636][T10372] mprotect_fixup+0x5dc/0x840 [ 411.891320][T10372] do_mprotect_pkey+0x7ff/0xba0 [ 411.896212][T10372] __x64_sys_mprotect+0x7c/0x90 [ 411.901068][T10372] do_syscall_64+0x4c/0xa0 [ 411.905502][T10372] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 411.911406][T10372] [ 411.913753][T10372] Memory state around the buggy address: [ 411.919469][T10372] ffff88801d28ec80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 411.927540][T10372] ffff88801d28ed00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 411.935611][T10372] >ffff88801d28ed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 411.943684][T10372] ^ [ 411.951677][T10372] ffff88801d28ee00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 411.959756][T10372] ffff88801d28ee80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 411.967810][T10372] ================================================================== [ 411.975988][T10372] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 411.983381][T10372] CPU: 1 PID: 10372 Comm: syz.3.1749 Not tainted syzkaller #0 [ 411.990885][T10372] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 412.000954][T10372] Call Trace: [ 412.004258][T10372] [ 412.007225][T10372] dump_stack_lvl+0x188/0x24e [ 412.011940][T10372] ? memcpy+0x3c/0x60 [ 412.015956][T10372] ? show_regs_print_info+0x12/0x12 [ 412.021193][T10372] ? load_image+0x410/0x410 [ 412.025741][T10372] panic+0x2d3/0x710 [ 412.029675][T10372] ? asm_common_interrupt+0x22/0x40 [ 412.034902][T10372] ? bpf_jit_dump+0xd0/0xd0 [ 412.039441][T10372] ? _raw_spin_unlock_irqrestore+0xbc/0x120 [ 412.045373][T10372] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 412.051303][T10372] ? _raw_spin_unlock+0x40/0x40 [ 412.056197][T10372] check_panic_on_warn+0x80/0xa0 [ 412.061174][T10372] ? ieee80211_monitor_select_queue+0x23a/0x240 [ 412.067449][T10372] end_report+0x66/0x110 [ 412.071735][T10372] kasan_report+0x118/0x140 [ 412.076323][T10372] ? ieee80211_monitor_select_queue+0x23a/0x240 [ 412.082622][T10372] ieee80211_monitor_select_queue+0x23a/0x240 [ 412.088729][T10372] ? ieee80211_activate_links_work+0x60/0x60 [ 412.094736][T10372] netdev_core_pick_tx+0x12c/0x360 [ 412.099873][T10372] __dev_queue_xmit+0xb45/0x3810 [ 412.104819][T10372] ? __dev_queue_xmit+0x281/0x3810 [ 412.109934][T10372] ? netdev_core_pick_tx+0x360/0x360 [ 412.115222][T10372] ? virtio_net_hdr_to_skb+0x8c5/0x12b0 [ 412.120774][T10372] ? packet_extra_vlan_len_allowed+0x200/0x200 [ 412.126940][T10372] packet_sendmsg+0x3a9e/0x4c30 [ 412.131836][T10372] ? stack_trace_save+0xf0/0xf0 [ 412.136746][T10372] ? verify_lock_unused+0x140/0x140 [ 412.142078][T10372] ? aa_sk_perm+0x81f/0x950 [ 412.146606][T10372] ? aa_af_perm+0x340/0x340 [ 412.151120][T10372] ? packet_getsockopt+0x980/0x980 [ 412.156253][T10372] ? apparmor_socket_sendmsg+0x8a/0x330 [ 412.161811][T10372] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 412.167110][T10372] ? security_socket_sendmsg+0x7c/0xa0 [ 412.172578][T10372] ? packet_getsockopt+0x980/0x980 [ 412.177723][T10372] ____sys_sendmsg+0x5ed/0x9a0 [ 412.182515][T10372] ? __sys_sendmsg_sock+0x30/0x30 [ 412.187561][T10372] ? __import_iovec+0x306/0x510 [ 412.192429][T10372] ? import_iovec+0x6f/0xa0 [ 412.196970][T10372] ___sys_sendmsg+0x2a2/0x360 [ 412.201678][T10372] ? __lock_acquire+0x7c40/0x7c40 [ 412.206742][T10372] ? __sys_sendmsg+0x2a0/0x2a0 [ 412.211641][T10372] __se_sys_sendmsg+0x1c3/0x2b0 [ 412.216509][T10372] ? __x64_sys_sendmsg+0x80/0x80 [ 412.221506][T10372] ? lockdep_hardirqs_on+0x94/0x140 [ 412.226764][T10372] do_syscall_64+0x4c/0xa0 [ 412.231206][T10372] ? clear_bhb_loop+0x60/0xb0 [ 412.235898][T10372] ? clear_bhb_loop+0x60/0xb0 [ 412.240567][T10372] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 412.246470][T10372] RIP: 0033:0x7fdd4e59e159 [ 412.250914][T10372] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 412.270563][T10372] RSP: 002b:00007fdd4f480028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 412.279094][T10372] RAX: ffffffffffffffda RBX: 00007fdd4e826090 RCX: 00007fdd4e59e159 [ 412.287075][T10372] RDX: 0000000000000000 RSI: 00002000000000c0 RDI: 0000000000000005 [ 412.295049][T10372] RBP: 00007fdd4e63506b R08: 0000000000000000 R09: 0000000000000000 [ 412.303031][T10372] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 412.311028][T10372] R13: 00007fdd4e826128 R14: 00007fdd4e826090 R15: 00007ffd6a374928 [ 412.319106][T10372] [ 412.322563][T10372] Kernel Offset: disabled [ 412.326900][T10372] Rebooting in 86400 seconds..