last executing test programs: 8m36.622228642s ago: executing program 3 (id=443): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f00000000c0)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0xffffc000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000140)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000001c0), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000200), 0x10106, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, &(0x7f0000000240)=0x39cb, 0x4) shutdown(0xffffffffffffffff, 0x1) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000280), 0x121602, 0x0) r5 = socket$kcm(0x1e, 0x5, 0x0) setsockopt$inet6_buf(r3, 0x29, 0x3d, 0x0, 0x0) sendmsg$kcm(r5, &(0x7f00000002c0)={&(0x7f0000000300)=@tipc=@id={0x1e, 0x3, 0x2}, 0x80, 0x0, 0x0, &(0x7f0000000380)=ANY=[], 0x220}, 0x0) ioctl$TIOCSETD(r4, 0x5423, 0x0) ioctl$TIOCVHANGUP(r4, 0x5437, 0x2) capset(0x0, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ieee802154(0x0, r6) sendmsg$IEEE802154_LLSEC_DEL_KEY(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)={0x20, r7, 0x1, 0x70bd27, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x0) openat$cgroup(0xffffffffffffffff, &(0x7f0000000540)='syz0\x00', 0x200002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x14, 0x10}, [@ldst={0x4}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94) 8m34.412861916s ago: executing program 3 (id=449): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000a00)=ANY=[@ANYBLOB="54000000100003052bbd7000249d020000000000", @ANYRES32=0x0, @ANYBLOB="1544010001800000240012800b0001006d616373656300001400028005000c0001000000080005000400000008000500", @ANYRES32], 0x54}, 0x1, 0x0, 0x0, 0x2040}, 0x800) 8m33.250878065s ago: executing program 3 (id=456): add_key(&(0x7f0000000440)='keyring\x00', &(0x7f0000000480)={'syz', 0x0}, 0x0, 0xfffff, 0xfffffffffffffffc) 8m32.925976077s ago: executing program 3 (id=458): socket$netlink(0x10, 0x3, 0x0) socket$igmp6(0xa, 0x3, 0x2) capset(&(0x7f0000000180)={0x20080522}, &(0x7f00000001c0)={0x7, 0x0, 0x0, 0x81, 0xffffffff}) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x1, 0x401d031, 0xffffffffffffffff, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./sys\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000780)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000007c0)='./sys/devices/system/cpu/cpu1/hotplug/target\x00', 0x1, 0x114) write(r0, &(0x7f0000000800)='0', 0x1) socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$vim2m(0x0, 0x7fff, 0x2) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(0x0, r2) connect$inet(r1, 0x0, 0x0) mkdirat(0xffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000840)='./sys\x00', &(0x7f0000000880)='sysfs\x00', 0x800004, 0x0) r4 = openat(0xffffff9c, &(0x7f00000008c0)='./sys/module/zswap/parameters/compressor\x00', 0x2, 0x0) write(r4, &(0x7f0000000900)='zstd', 0x4) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) syz_mount_image$vfat(&(0x7f0000000940), &(0x7f0000000980)='./file0\x00', 0x200008, &(0x7f0000000000)=ANY=[@ANYRES8=r3, @ANYRES32, @ANYBLOB="5209e709efe40d1cd056a9905b3419e8d8a129f17deab3bb577a23b8"], 0x1, 0x392, &(0x7f0000000b00)="$eJzs3T1vW2UUAOATt/mExBkQEiDEq24sVhL+QCPUSohIoFCj0gFxS5xixY0j2wpyhaADEiv/gL1iZENC/IEMsLOxZWHsUNXIX6mdul+kyaXq80jRPfZ7jvO+tnx1FuscXv3x5s52s7SdtaJwMUUhIgp3I5Z7Ud/U4FroxTMx6na8W7z619uffHbtw/WNjUubKV1ev/LeWkpp6Z3fvv7m5wu/t1759JelX2fjYPnzw3/W/j54/eCNw/tXvqo2U7WZduutlKXr9Xoru16rpK1qc6eU0se1StaspOpus9IYW9+u1ff22inb3Vpc2GtUms2U7bbTTqWdWvXUarRTdiOr7qZSqZQWF4InKd/Z3MzW+/HcY/IuntWGOAWNxnrW/Q7PPrRSvpPLhgCAXJ20/595qv7/WmGk/5+LR/b/06H/fy6mny5ttP//zy/C/1y3/58ZfH/H6f8BAAAAAAAAAAAAAOBFcLfTKXY6neLw2hn+SHjwOOftccoe+vyP/eW9P07XyA/35iJqP+yX98v9a399fTuqUYtKrEQx7nVvC0P9+PIHG5dWUs9yLN78rld/4Y+I8rnx+tUoxvLk+tV+fTqqj+51OhZG69fii3htcv3axPqZWPlppL4Uxfjzy6hHLbZ6t7cH9d+upvT+RxvH6md7eQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC8HEpp6K3oz73fL0fMx/5gfn/pQcLy+Hz8fv3RfP2VKMa9yfP5VybO5z8fb57P9+wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMNRs39rJarVK46yC4cz/3jMzw+DRVVP99NvHluZjPHn2Sa9zwqDwTFXzg0NOWLrf6XR6wY3vn/tW5872ozxJMB0Rj8npDN7Ak/+vVyNi9Jlz4zmzEXGqJ13qBoX83/BnDvK4GwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEC+joZ+dx9M5b0bAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8tJs39rJarVK4xSDvM8IAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwIvk3AAD//8s8Cyw=") close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socket$nl_crypto(0x10, 0x3, 0x15) ioctl$FITRIM(0xffffffffffffffff, 0xc0185879, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x3e, 0x0, 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x89901) move_mount(r5, &(0x7f00000002c0)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000340)='\x00', 0x89901) 8m30.070489077s ago: executing program 3 (id=468): madvise(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0xa) 8m25.551689816s ago: executing program 3 (id=478): ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000100)={0x2, &(0x7f00000006c0)=[{0x12, '\x00', @buffer={"ab557d935f95f143d64163f3aecb9a150f7174a89317d5baa9d1cfcdef55d3b0", 0x20}, 0x4}, {0x34, '\x00', @data, 0x9}]}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = timerfd_create(0x1, 0x0) timerfd_settime(r1, 0x3, &(0x7f00000001c0)={{}, {0x0, 0x989680}}, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x7}, 0x50) fcntl$setflags(r2, 0x2, 0x0) ioperm(0x0, 0x7c9, 0x1) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, r4, {0x0, 0x4}, {0xffff, 0xffff}, {0x3, 0xffe5}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x8000000000000001}, @TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0xc0}, 0x0) memfd_create(&(0x7f0000000000)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\xe4\xda\xf9\xcd7el\xb7\xe6\b\x00\xd8\x8f\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x92\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00uKs\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xd9\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x141<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7\xf2\xa0D-N\xf9\xba!L]h;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\xb7>j0S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x00\x00\xeaq\xbb\x03&\xb4mi\xc7\xff\xca\xd8\x9f\xae\xa3\x04\xaa\x10\xe7\x98\xe48\x8d', 0x3) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x20004001}, 0x4000018) sendmsg$NFT_BATCH(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0xd8, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_EXPRESSIONS={0x94, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}, {0x10, 0x1, 0x0, 0x1, @inner={{0xa}, @void}}, {0x10, 0x1, 0x0, 0x1, @payload={{0xc}, @void}}, {0x1c, 0x1, 0x0, 0x1, @flow_offload={{0x11}, @val={0x4}}}, {0x2c, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0xb}, @NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x40}, @NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}]}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x130}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x100}, 0x1, 0x0, 0x0, 0x4040041}, 0x4000000) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r6 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r6, 0xc0405602, &(0x7f0000000180)={0x0, 0xd, 0x2, "7fc07ac2b0bbfa704e5f4836d8b18cbaacbe5af74374a06adb1776ca886ea04c", 0x35315241}) r7 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x2002) readv(r7, &(0x7f0000000140)=[{&(0x7f00000000c0)=""/103, 0x67}], 0x1) 8m25.243772298s ago: executing program 32 (id=478): ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000100)={0x2, &(0x7f00000006c0)=[{0x12, '\x00', @buffer={"ab557d935f95f143d64163f3aecb9a150f7174a89317d5baa9d1cfcdef55d3b0", 0x20}, 0x4}, {0x34, '\x00', @data, 0x9}]}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = timerfd_create(0x1, 0x0) timerfd_settime(r1, 0x3, &(0x7f00000001c0)={{}, {0x0, 0x989680}}, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x7}, 0x50) fcntl$setflags(r2, 0x2, 0x0) ioperm(0x0, 0x7c9, 0x1) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, r4, {0x0, 0x4}, {0xffff, 0xffff}, {0x3, 0xffe5}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x8000000000000001}, @TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0xc0}, 0x0) memfd_create(&(0x7f0000000000)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\xe4\xda\xf9\xcd7el\xb7\xe6\b\x00\xd8\x8f\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x92\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00uKs\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xd9\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x141<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7\xf2\xa0D-N\xf9\xba!L]h;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\xb7>j0S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x00\x00\xeaq\xbb\x03&\xb4mi\xc7\xff\xca\xd8\x9f\xae\xa3\x04\xaa\x10\xe7\x98\xe48\x8d', 0x3) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x20004001}, 0x4000018) sendmsg$NFT_BATCH(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0xd8, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_EXPRESSIONS={0x94, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}, {0x10, 0x1, 0x0, 0x1, @inner={{0xa}, @void}}, {0x10, 0x1, 0x0, 0x1, @payload={{0xc}, @void}}, {0x1c, 0x1, 0x0, 0x1, @flow_offload={{0x11}, @val={0x4}}}, {0x2c, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0xb}, @NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x40}, @NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}]}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x130}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x100}, 0x1, 0x0, 0x0, 0x4040041}, 0x4000000) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r6 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r6, 0xc0405602, &(0x7f0000000180)={0x0, 0xd, 0x2, "7fc07ac2b0bbfa704e5f4836d8b18cbaacbe5af74374a06adb1776ca886ea04c", 0x35315241}) r7 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x2002) readv(r7, &(0x7f0000000140)=[{&(0x7f00000000c0)=""/103, 0x67}], 0x1) 56.850029021s ago: executing program 1 (id=3187): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xe0802, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f00000000c0)) ioctl$PPPIOCSMAXCID(r0, 0x40047451, &(0x7f0000000200)=0x8) ioctl$PPPIOCSFLAGS1(r0, 0x40047459, &(0x7f0000000100)=0x4) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000000040)="00214500002c000b0000400600000a0000010a0000020050005000f598000b0100000b01601003e80000", 0x2a}], 0x1, 0xfffffffe, 0x0) 56.135317503s ago: executing program 1 (id=3192): ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000100)={0x2, &(0x7f00000006c0)=[{0x12, '\x00', @buffer={"ab557d935f95f143d64163f3aecb9a150f7174a89317d5baa9d1cfcdef55d3b0", 0x20}, 0x4}, {0x34, '\x00', @data, 0x9}]}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = timerfd_create(0x1, 0x0) timerfd_settime(r1, 0x3, &(0x7f00000001c0)={{}, {0x0, 0x989680}}, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x7}, 0x50) fcntl$setflags(r2, 0x2, 0x0) ioperm(0x0, 0x7c9, 0x1) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, r4, {0x0, 0x4}, {0xffff, 0xffff}, {0x3, 0xffe5}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x8000000000000001}, @TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0xc0}, 0x0) memfd_create(&(0x7f0000000000)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\xe4\xda\xf9\xcd7el\xb7\xe6\b\x00\xd8\x8f\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x92\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00uKs\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xd9\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x141<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7\xf2\xa0D-N\xf9\xba!L]h;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\xb7>j0S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x00\x00\xeaq\xbb\x03&\xb4mi\xc7\xff\xca\xd8\x9f\xae\xa3\x04\xaa\x10\xe7\x98\xe48\x8d', 0x3) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x20004001}, 0x4000018) sendmsg$NFT_BATCH(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0xd0, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_EXPRESSIONS={0x8c, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}, {0x10, 0x1, 0x0, 0x1, @inner={{0xa}, @void}}, {0x10, 0x1, 0x0, 0x1, @payload={{0xc}, @void}}, {0x1c, 0x1, 0x0, 0x1, @flow_offload={{0x11}, @val={0x4}}}, {0x24, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0xb}, @NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}]}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x130}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xf8}, 0x1, 0x0, 0x0, 0x4040041}, 0x4000000) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r6 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r6, 0xc0405602, &(0x7f0000000180)={0x0, 0xd, 0x2, "7fc07ac2b0bbfa704e5f4836d8b18cbaacbe5af74374a06adb1776ca886ea04c", 0x35315241}) r7 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x2002) readv(r7, &(0x7f0000000140)=[{&(0x7f00000000c0)=""/103, 0x67}], 0x1) 54.353715105s ago: executing program 1 (id=3207): r0 = syz_open_dev$media(&(0x7f0000000000), 0x7fdffffe, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r0, 0x80047c05, &(0x7f0000000040)=0xffffffffffffffff) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = syz_open_dev$radio(&(0x7f0000000080), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r2, 0xc0205648, &(0x7f00000000c0)={0xf010000, 0x0, 0x4, r1, 0x0, 0x0}) 54.278446523s ago: executing program 1 (id=3208): syz_mount_image$hfs(&(0x7f0000000100), &(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xc10, &(0x7f0000000340)=ANY=[@ANYRES8=0x0, @ANYRESOCT, @ANYRES8, @ANYRES16, @ANYRES32, @ANYRES64, @ANYRES8], 0x3, 0x305, &(0x7f0000000380)="$eJzs3b9v00wYwPHnnKRN31Z9/bZ9Vekd+1KJCUFZEEsR6t+AGABRmiBVjYrUFomyUDEjxMaPjYGNGbEwslcwI5gQA3u7Gd3jM3GJfW7SJm7g+5Eamfju/Jx9Pt9FMicA/liXlz6/Ov/V/hmRilRE5KJIICJ1kaqI/Cuz9bvrW6tbrWbDV1BFc9g/I3FO05FmZb2ZldXm0xxOaP9VlYn0d+iPKIqiLx8r/jR/DywclETv/qizHQQio+7u1J31MoLrg52yAyiZ2Zd9uSeTZccBACiXff7X4oG/fc5PuGd+EIjMu8f+kD3//aPW/cEFciKlnv86y4qMvb56ykx7vqdTOG0HySzRU2LunhGJB5IHRpemaFapsQRjt1dbzTMrd1qNQB7KopNKNqOfjbjpJgqinfMEm6G47nm0xkHN1mEhJ/7pXo741HfQwB/TXmR2zQ0Tygtp/Bz/VSM9I3qlQo07bJen8Z/V7Su1jBLH7Ycxmiqnlv/oQf5zR5C3rw9Ry7rkTktHXJlx030QfxkmcT4Z8eSakoM/K8S1O5d3JJdrOjPXQkGumXaub0nP6Vpzfs7e5VT7F+axuWrm5Lu8kaXU+D+wZ3teEySn3ROk0ZSuZXjrU9WU4SECK2i36FLWrdr2SG7JBZnc3L6/ttxqNTcOu/HuUxeJj2vj+ct4o3KUcpKad+yqylEjjEbjovt1EnqM0HY5XeRKGky/r6mI7LhvkmuSmzjp07LKMZ2Xclg25MjlVGRU1pI+89gCc2d7Z225FW9lD5TGeu2TcMKkusfZa8XJo0HEhIGyfYiJ5386ko9HdZd0n739Qx2n1yRrnF7YHrTEZ9d34+lDam7QHqxO6edfXc3gxvNncKk6eOdc/58WOeU54vuDxYYuzt+EWZIPcpPf/wEAAAAAAAAAAAAAAAAAAIZN4YsBe9HG5rZ7vaXHN0NKriIAAAAAAAAAAAAAAAAAAAAAAEPPt/6vrpFZsP5v8mZA/vq/qf/Vu3j930VbUM76v/5FagF07UcAAAD//+wSa1c=") creat(&(0x7f00000006c0)='./bus\x00', 0x0) openat$vicodec0(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000780)='./dev\x00', &(0x7f00000008c0)='devtmpfs\x00', 0x0, 0x0) 53.958266896s ago: executing program 1 (id=3212): ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000100)={0x2, &(0x7f00000006c0)=[{0x12, '\x00', @buffer={"ab557d935f95f143d64163f3aecb9a150f7174a89317d5baa9d1cfcdef55d3b0", 0x20}, 0x4}, {0x34, '\x00', @data, 0x9}]}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = timerfd_create(0x1, 0x0) timerfd_settime(r1, 0x3, &(0x7f00000001c0)={{}, {0x0, 0x989680}}, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x7}, 0x50) fcntl$setflags(r2, 0x2, 0x0) ioperm(0x0, 0x7c9, 0x1) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, r4, {0x0, 0x4}, {0xffff, 0xffff}, {0x3, 0xffe5}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x8000000000000001}, @TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0xc0}, 0x0) memfd_create(&(0x7f0000000000)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\xe4\xda\xf9\xcd7el\xb7\xe6\b\x00\xd8\x8f\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x92\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00uKs\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xd9\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x141<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7\xf2\xa0D-N\xf9\xba!L]h;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\xb7>j0S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x00\x00\xeaq\xbb\x03&\xb4mi\xc7\xff\xca\xd8\x9f\xae\xa3\x04\xaa\x10\xe7\x98\xe48\x8d', 0x3) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x20004001}, 0x4000018) sendmsg$NFT_BATCH(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0xac, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_EXPRESSIONS={0x68, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}, {0x10, 0x1, 0x0, 0x1, @inner={{0xa}, @void}}, {0x10, 0x1, 0x0, 0x1, @payload={{0xc}, @void}}, {0x1c, 0x1, 0x0, 0x1, @flow_offload={{0x11}, @val={0x4}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x130}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xd4}, 0x1, 0x0, 0x0, 0x4040041}, 0x4000000) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r6 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r6, 0xc0405602, &(0x7f0000000180)={0x0, 0xd, 0x2, "7fc07ac2b0bbfa704e5f4836d8b18cbaacbe5af74374a06adb1776ca886ea04c", 0x35315241}) r7 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x2002) readv(r7, &(0x7f0000000140)=[{&(0x7f00000000c0)=""/103, 0x67}], 0x1) 52.83427501s ago: executing program 1 (id=3221): syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000600)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x10, &(0x7f0000000200)={[{@rodir}, {@numtail}, {@shortname_lower}, {@utf8no}, {@shortname_lower}, {@utf8}, {@numtail}, {@shortname_winnt}, {@fat=@check_normal}, {@fat=@codepage={'codepage', 0x3d, '862'}}, {@uni_xlateno}, {@iocharset={'iocharset', 0x3d, 'cp1250'}}, {@utf8}, {@iocharset={'iocharset', 0x3d, 'cp852'}}, {@iocharset={'iocharset', 0x3d, 'cp950'}}, {@uni_xlate}]}, 0x3, 0x281, &(0x7f0000000340)="$eJzs3c9qY1UYAPDv5k+TKJgsXInQC7pwVVqfoEUqiAVByUJdaLEpSBMKLRSqYnTlE/gEPo+bYV5gHmCG2U0Xw9zh9uZfy01KO21TZn6/TT++c76c7+Rc2tU9/fnjwcHe4fH+3388iWYzicpmbMZZEp2oxNhfUerxs/I8APDAnWVZPM8KjSJ1enFGfU5lrXLnzQEAd2L27/+yewEA7sd33//w9dbOzva3adqMGPxz0k2i+FmMb+3Hr9GPXqxHO15GZBNF/OVXO9tRS3Od+HQwPOnmlYOf/h99/tbTiPP6jWhHp7x+Iy3M1A9PuvV4b7T+Zj963/wX7fiwvP7zkvrorsRnn8z0vxbtePRLHEY/9ka9jev/3EjTL7J/X/z+Y57N65PheP9TWfX+TgUAAAAAAAAAAAAAAAAAAAAAgLfdWjrRuXj/zvji/wXjC+4HGs7cz7OepmmW5LM/iGl9LT6qRW25uwcAAAAAAAAAAAAAAAAAAICH4fj0t4Pdfr93dKvB+LX+kqF4dTHTiIibr7V6KZM1ShedBlEdtdZPIq63Vj0a55VXT65ecxetvJ/eUVKL2zuCZJJpzQ6tRrFWnmkVwUzmjVdvxnkwfroOdpOrDre5+LxuHGQlj191btXK5UxrtIOSya0Fq6+8f6Oes/acoSQi6pMvc/Hn1G/pq2vd328fAAAAAAAAAAAAAAAAAABg1vTt30sDlSU1BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABLMP3//9cIhqPieXOyah7UYpRZ8hYBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4B7wOAAD//45WYzw=") r0 = openat$dir(0xffffffffffffff9c, 0x0, 0x101000, 0x108) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x7, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000300)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000900)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000a00)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000a40)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000a80)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000b00), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000b40), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000b80)=0x6) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f0000000c00)='./file1/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f0000000d00)='./file1\x00') r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000d40)='net/dev_mcast\x00') pread64(r4, &(0x7f0000001f80)=""/102400, 0x19000, 0x41e) syz_emit_vhci(0x0, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000680)=@base={0x1b, 0x0, 0x0, 0x2000}, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0xc, &(0x7f0000000900)=ANY=[], &(0x7f0000000940)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f0000000980)=r6, 0x4) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$cgroup(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f0000000100)={[{@name={'name', 0x3d, 'wuser_'}}, {@name={'name', 0x3d, 'user_.'}}]}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=@random={'trusted.', 'utf8=1'}, &(0x7f00000001c0)='$,{\x00', 0x4, 0x2) getdents64(r0, &(0x7f0000000f80)=""/4096, 0x1000) 52.710836643s ago: executing program 33 (id=3221): syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000600)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x10, &(0x7f0000000200)={[{@rodir}, {@numtail}, {@shortname_lower}, {@utf8no}, {@shortname_lower}, {@utf8}, {@numtail}, {@shortname_winnt}, {@fat=@check_normal}, {@fat=@codepage={'codepage', 0x3d, '862'}}, {@uni_xlateno}, {@iocharset={'iocharset', 0x3d, 'cp1250'}}, {@utf8}, {@iocharset={'iocharset', 0x3d, 'cp852'}}, {@iocharset={'iocharset', 0x3d, 'cp950'}}, {@uni_xlate}]}, 0x3, 0x281, &(0x7f0000000340)="$eJzs3c9qY1UYAPDv5k+TKJgsXInQC7pwVVqfoEUqiAVByUJdaLEpSBMKLRSqYnTlE/gEPo+bYV5gHmCG2U0Xw9zh9uZfy01KO21TZn6/TT++c76c7+Rc2tU9/fnjwcHe4fH+3388iWYzicpmbMZZEp2oxNhfUerxs/I8APDAnWVZPM8KjSJ1enFGfU5lrXLnzQEAd2L27/+yewEA7sd33//w9dbOzva3adqMGPxz0k2i+FmMb+3Hr9GPXqxHO15GZBNF/OVXO9tRS3Od+HQwPOnmlYOf/h99/tbTiPP6jWhHp7x+Iy3M1A9PuvV4b7T+Zj963/wX7fiwvP7zkvrorsRnn8z0vxbtePRLHEY/9ka9jev/3EjTL7J/X/z+Y57N65PheP9TWfX+TgUAAAAAAAAAAAAAAAAAAAAAgLfdWjrRuXj/zvji/wXjC+4HGs7cz7OepmmW5LM/iGl9LT6qRW25uwcAAAAAAAAAAAAAAAAAAICH4fj0t4Pdfr93dKvB+LX+kqF4dTHTiIibr7V6KZM1ShedBlEdtdZPIq63Vj0a55VXT65ecxetvJ/eUVKL2zuCZJJpzQ6tRrFWnmkVwUzmjVdvxnkwfroOdpOrDre5+LxuHGQlj191btXK5UxrtIOSya0Fq6+8f6Oes/acoSQi6pMvc/Hn1G/pq2vd328fAAAAAAAAAAAAAAAAAABg1vTt30sDlSU1BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABLMP3//9cIhqPieXOyah7UYpRZ8hYBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4B7wOAAD//45WYzw=") r0 = openat$dir(0xffffffffffffff9c, 0x0, 0x101000, 0x108) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x7, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000300)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000900)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000a00)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000a40)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000a80)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000b00), 0x651, 0x0) recvmmsg(r2, &(0x7f0000000b40), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000b80)=0x6) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) symlinkat(&(0x7f0000000c00)='./file1/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f0000000d00)='./file1\x00') r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000d40)='net/dev_mcast\x00') pread64(r4, &(0x7f0000001f80)=""/102400, 0x19000, 0x41e) syz_emit_vhci(0x0, 0x0) r5 = socket$packet(0x11, 0x2, 0x300) bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000680)=@base={0x1b, 0x0, 0x0, 0x2000}, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0xc, &(0x7f0000000900)=ANY=[], &(0x7f0000000940)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f0000000980)=r6, 0x4) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) mount$cgroup(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x0, &(0x7f0000000100)={[{@name={'name', 0x3d, 'wuser_'}}, {@name={'name', 0x3d, 'user_.'}}]}) setxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=@random={'trusted.', 'utf8=1'}, &(0x7f00000001c0)='$,{\x00', 0x4, 0x2) getdents64(r0, &(0x7f0000000f80)=""/4096, 0x1000) 6.830427393s ago: executing program 5 (id=3556): syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0x0, 0x400, 0x2}, &(0x7f0000000100), &(0x7f0000000080), &(0x7f0000000000)) pipe(0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r0) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010025bd7000ffdbdf2502000000080001"], 0x1c}, 0x1, 0x0, 0x0, 0x40005}, 0x8000) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/nullb/nullb1\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0) write(r3, &(0x7f0000000140)='1\n', 0x2) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1/memory_backed\x00', 0x1, 0x0) write(r4, &(0x7f0000000240)='1', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nullb/nullb1/power\x00', 0x1, 0x0) write(r5, &(0x7f00000002c0)='1\n', 0x2) nanosleep(0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat$cuse(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000340)={'macsec0\x00', 0x0}) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040), 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000a00)=ANY=[@ANYBLOB="54000000100003052bbd7000249d020000000000", @ANYRES32=0x0, @ANYBLOB="1544010001800000240012800b0001006d616373656300001400028005000c0001000000080005000400000008000500", @ANYRES32=r8], 0x54}, 0x1, 0x0, 0x0, 0x2040}, 0x800) 5.640961225s ago: executing program 5 (id=3565): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e22, 0x0, @empty, 0x2}, 0x1c) syz_usb_connect(0x3, 0x63, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000404c17aa5500010102030109025100010100c032090400000208065000070501020002000705820200020009040d0104080662000705010200020003240107050202"], 0x0) 3.937278688s ago: executing program 6 (id=3575): syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0x0, 0x400, 0x2}, &(0x7f0000000100), &(0x7f0000000080), &(0x7f0000000000)) pipe(0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r0) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010025bd7000ffdbdf2502000000080001000700"], 0x1c}, 0x1, 0x0, 0x0, 0x40005}, 0x8000) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/nullb/nullb1\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0) write(r3, &(0x7f0000000140)='1\n', 0x2) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1/memory_backed\x00', 0x1, 0x0) write(r4, &(0x7f0000000240)='1', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nullb/nullb1/power\x00', 0x1, 0x0) write(r5, &(0x7f00000002c0)='1\n', 0x2) nanosleep(0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat$cuse(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000340)={'macsec0\x00', 0x0}) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040), 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000a00)=ANY=[@ANYBLOB="54000000100003052bbd7000249d020000000000", @ANYRES32=0x0, @ANYBLOB="1544010001800000240012800b0001006d616373656300001400028005000c0001000000080005000400000008000500", @ANYRES32=r8], 0x54}, 0x1, 0x0, 0x0, 0x2040}, 0x800) 2.925206022s ago: executing program 6 (id=3580): prlimit64(0x0, 0xe, &(0x7f0000000940)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000980)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000009c0)=0x2) r0 = getpid() socket$inet6_udp(0xa, 0x2, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000a00)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000a40)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000b00)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000b80), 0x318, 0x0) recvmmsg(r1, &(0x7f0000000bc0), 0x10106, 0x2, 0x0) mount(0x0, 0x0, &(0x7f0000000c40)='nilfs2\x00', 0x280000, &(0x7f0000000c80)='%/-/\xe1.\x00') socket$nl_route(0x10, 0x3, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000cc0)=0x2) mkdir(&(0x7f0000000f40)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000fc0)='./bus\x00', &(0x7f0000001000), 0x0, &(0x7f0000001040)={[{@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@metacopy_on}]}) chdir(&(0x7f0000001080)='./bus\x00') renameat2(0xffffffffffffff9c, &(0x7f00000010c0)='./file0/file0\x00', 0xffffffffffffff9c, &(0x7f0000001100)='./file1\x00', 0x2) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000100)='./bus\x00', 0x1208002, &(0x7f0000000140)={[{@grpquota}, {@jqfmt_vfsold}, {@resuid}, {@debug}, {@dioread_nolock}, {}, {@nomblk_io_submit}, {@noauto_da_alloc}]}, 0x1, 0x5d8, &(0x7f00000001c0)="$eJzs3c9vFFUcAPDvbH/QUrSFGBUP0sQYSJSWFjDEeICrIQ3+iBcvVloQKdDQGi2aUBK8mBgvxph48iD+F0rkyklPHrx4MiREDUcT18x2pnTb2ZYubacyn0+y9M17O7w33X773r6+NxtAZQ2m/9Qi9kbEdBLRn8wvlnVGVji48Lx7f39yOn0kUa+/8WcSSZaXPz/JvvZlJ/dExM8/JbGnY2W9M3NXzo9PTU1ezo6HZy9MD8/MXTl47sL42cmzkxdHXxo9dvTI0WMjh9q6rqsFeSevv/9h/2djb3/3zT/JyPe/jSVxPF7Nnrj0OjbKYAw2vifJyqK+YxtdWUk6sp+TpS9x0llig1iX/PXrioinoj864v6L1x+fvlZq44BNVU8i6kBFJeIfKiofB+Tv7Ze/D66VMioBtsLdEwsTACvjv3NhbjB6GnMDO+8lsXRaJ4mI9mbmmu2KiNu3xq6fuTV2PTZpHg4oNn8tIp4uiv+kEf8D0RMDjfivNcV/Oi44lX1N819vs/7lU8XiH7bOQvz3rBr/0SL+31kS/++2Wf/g/eR7vU3x39vuJQEAAAAAAEBl3TwRES8W/f2/trj+JwrW//RFxPENqH9w2fHKv//X7mxANUCBuyciXilc/1vLV/8OdGSpxxrrAbqSM+emJg9FxOMRcSC6dqTHI6vUcfDzPV+3KhvM1v/lj7T+29lawKwddzp3NJ8zMT47/rDXDUTcvRbxTOH632Sx/08K+v/098H0A9ax5/kbp1qVrR3/wGapfxuxv7D/v3/XimT1+3MMN8YDw/moYKVnP/7ih1b1txv/bjEBDy/t/3euHv8DydL79cysv47Dc531VmXtjv+7kzcbt5zpzvI+Gp+dvTwS0Z2c7Ehzm/JH199meBTl8ZDHSxr/B55bff6vaPzfGxHzy/7v5K/mPcW5J//t+71Ve4z/oTxp/E+sq/9ff2L0xsCPrep/sP7/SKOvP5DlmP+DBV/lYdrdnF8Qjp1FRVvdXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4FNQiYlcktaHFdK02NBTRFxFPxM7a1KWZ2RfOXPrg4kRa1vj8/1r+Sb/9C8dJ/vn/A0uOR5cdH46I3RHxZUdv43jo9KWpibIvHgAAAAAAAAAAAAAAAAAAALaJvhb7/1N/dJTdOmDTdZbdAKA0BfH/SxntALae/h+qS/xDdYl/qC7xD9Ul/qG6xD9Ul/iH6hL/AAAAAADwSNm97+avSUTMv9zbeKS6s7KuUlsGbLZa2Q0ASuMWP1Bdlv5AdXmPDyRrlPe0PGmtM1czffohTgYAAAAAAAAAAACAytm/1/5/qCr7/6G67P+H6sr3/+8ruR3A1vMeH4g1dvIX7v9f8ywAAAAAAAAAAAAAYCPNzF05Pz41NXlZ4q3t0YytTNTr9avpT8F2ac//PJEvhd8u7VmWyPf6PdhZ5f1OAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAmv0XAAD//xYSJMU=") syz_mount_image$fuse(0x0, &(0x7f00000007c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000800)='./file0\x00', &(0x7f0000000840), 0x4, &(0x7f0000000880)={[{@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) mount$bind(0x0, &(0x7f00000008c0)='.\x00', 0x0, 0x21, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_MEDIA_SET(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000ac0)=ANY=[@ANYBLOB='p\x00\x00', @ANYRES16=r3, @ANYBLOB="010027bd7000fddbdf250c000000180005800c000280080004"], 0x70}, 0x1, 0x0, 0x0, 0x24000040}, 0x20000850) 2.822435182s ago: executing program 5 (id=3581): unshare(0x22020400) r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd824498949714ffaac8a6f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb5447000001000000008f2b9000f22425e4097ed62cbc891061017cfa6fa26fa7088c60897d4a6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe6b1b8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3540546bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=@base={0xf, 0x4, 0x4, 0x12}, 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000002c0)=ANY=[@ANYRES32=r1, @ANYRES32=r0, @ANYBLOB='&'], 0x10) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000002c0)=ANY=[], 0x20) 2.245400081s ago: executing program 6 (id=3586): syz_io_uring_setup(0x82e, 0x0, &(0x7f0000000100), &(0x7f0000000080), &(0x7f0000000000)) pipe(0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="010025bd7000ffdbdf25020000000800010007000000"], 0x1c}, 0x1, 0x0, 0x0, 0x40005}, 0x8000) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/nullb/nullb1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)='1\n', 0x2) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1/memory_backed\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='1', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nullb/nullb1/power\x00', 0x1, 0x0) write(r4, &(0x7f00000002c0)='1\n', 0x2) nanosleep(0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat$cuse(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000340)={'macsec0\x00', 0x0}) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000040), 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000a00)=ANY=[@ANYBLOB="54000000100003052bbd7000249d020000000000", @ANYRES32=0x0, @ANYBLOB="1544010001800000240012800b0001006d616373656300001400028005000c0001000000080005000400000008000500", @ANYRES32=r7], 0x54}, 0x1, 0x0, 0x0, 0x2040}, 0x800) 2.244286181s ago: executing program 5 (id=3587): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000140)='./proc\x00', &(0x7f0000000180)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f00000002c0)='3', 0x4e) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) 1.611410205s ago: executing program 5 (id=3588): pipe(&(0x7f0000000100)={0xffffffffffffffff}) unshare(0x20000400) close(0x3) openat$tun(0xffffffffffffff9c, &(0x7f0000001440), 0x220001, 0x0) readv(r0, 0x0, 0x0) 1.494596497s ago: executing program 5 (id=3589): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000010d804dd0000000000000109022400010000000009040040010300000009210100000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000100)={0x24, 0x0, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="002212"], 0x0}, 0x0) r1 = syz_open_dev$I2C(&(0x7f00000001c0), 0xb, 0x880c0) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000040)={&(0x7f0000000300)=[{0x4, 0x3000, 0x0, 0x0}, {0x5, 0x200, 0x18, &(0x7f00000002c0)="3e6b2736a9d176e3975902e6fdc81e89fa95fb3f0efdae3f"}], 0x2}) 1.46548548s ago: executing program 6 (id=3591): r0 = socket(0x1d, 0x2, 0x6) r1 = socket(0x1d, 0x2, 0x6) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000005c0)={'vcan0\x00', 0x0}) bind$can_j1939(r0, &(0x7f0000000600)={0x1d, r2, 0x8000000000000003, {0x0, 0xf}}, 0x18) sendmmsg$unix(r0, &(0x7f0000012240)=[{{&(0x7f0000000700)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000000880)=[{&(0x7f0000000780)='PP', 0x2}], 0x1, 0x0, 0x0, 0x4000000}}, {{&(0x7f0000007140)=@file={0x0, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x51}}], 0x2, 0x40000) 1.344223973s ago: executing program 6 (id=3593): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000280)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000680)={@val={0x800e}, @void, @eth={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x41}, @val={@val={0x88a8, 0x7, 0x1, 0x1}, {0x8100, 0x5, 0x1}}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x4, 0x1c, 0x0, 0x0, 0x0, 0x4, 0x0, @multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}}, {0x44fe, 0x4e24, 0x8}}}}}}, 0x36) 1.151476143s ago: executing program 6 (id=3595): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000100)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r1, 0x40015b0b, 0x0) 1.036942234s ago: executing program 4 (id=3598): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket$inet6(0xa, 0x3, 0x87) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000200)={'wg0\x00', 0x0}) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000000c0)={{{@in6=@remote, @in=@loopback, 0x4e23, 0x0, 0x4e20, 0x0, 0x2, 0x0, 0x0, 0x0, r2}, {0xfffffffffffffffd, 0x1, 0x1, 0x0, 0x3, 0xb}, {0x1ff, 0xffffffffe, 0x4053e5, 0x20}, 0x6, 0x80001, 0x1, 0x0, 0x0, 0x1}, {{@in6=@empty, 0x4d4, 0x32}, 0x2, @in=@loopback, 0x3502, 0x1, 0x0, 0x0, 0x616a45e7, 0xfffffffd}}, 0xe8) connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x3, 0xfffffffc, @ipv4={'\x00', '\xff\xff', @dev}, 0x9df}, 0x1c) 922.279596ms ago: executing program 4 (id=3599): r0 = openat$kvm(0x0, &(0x7f0000000640), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd(0x3) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000680)={0xf006, 0x8000000, 0x0, r2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000700)={0xb03, 0x3000, 0x0, r2, 0x4}) 859.180492ms ago: executing program 4 (id=3601): syz_mount_image$msdos(&(0x7f00000002c0), &(0x7f0000000a00)='./file0\x00', 0x2000000, &(0x7f0000000a40)=ANY=[], 0x1, 0x29b, &(0x7f0000000000)="$eJzs3c9LFG0AB/DHVfHFF8XTy1uXHurUZVDPHZRQkBaKcoMKghHHWnbalZ097EoHO3cJOvYfRMduQfQP+F90k0A8ecqw8dcKXdI08PO5zJf5zjM8zww8c5zNW29eNFaKZCXthMrMQKjMhFDZGQgToRIOrIebb1+9e/3g0eM7s9Xq3P0Y52cXp6ZjjOPXPj95+eH6l86/Dz+OfxoJGxNPN7emv278t3Fl8/vi83oR60VstjoxjUutViddyrO4XC8aSYz38iwtslhvFlm7r1/JW6urvZg2l8dGV9tZUcS02YuNrBc7rdhp92L6LK03Y5IkcWw0cBq19zu7u2Frt3TRs+H8ef+X27FN/Z8Qtte7tW6tPJb9/EJ1bjL+NHw0arvbrQ0e9lNlH/v74TC630+f7A8+LTfKfq+7fbd6YvxIWP7DawcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAODySuKhiaOz291ubbDsk1/1ZZpfqM5N7l/Q3w+Fq0PntgwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOJWit9ZI8zxrC78f9h7kXzANQTi7cNE7EwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJy//p/YAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcFkVvbVGmudZ+6zCt//LGx+rLnqNAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHBaPwIAAP//P3honA==") r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000e00)='cpu.stat\x00', 0x275a, 0x0) write$UHID_INPUT(r0, &(0x7f0000002600)={0x8, {"85f080a4933d55266e07e799aa0cc421388242df2a3c6b631b65b1c061edd2aa108c3528fe9b0bb3a53ab1200f5d01a68a4acdec8fee09648222f908c1fedc3000342e6139de28366c13509306d00ebcc67497181ac916db98af9d366b76e427d9ab5bb68095f0fb246df32b8af0783653136f8a04c03690312125c7ded6a24fda8685340c575ead69519e3583f89d467ec232d6a1ffd0463ba4ea3cbae5dae6654b5547b5458f02ac307729e57b09e134f68be44f88d72517b230b066f6315b5fb80206397bbff8cbc2976e01c2e7b3aadb32bd3dd5288a69a991d9c674717e3abba7167280b2db3b1b8502afa4f3f296c532510c9d2dd79bb5eeb25adb5edddbdd069c09d14d15c2e7e1e2bd6c108fab3591bb22e97d6992236d2273c8bb95536f7118d007965008b125c7daac2814e6bbe1adbfa3572ad0b7ad5c26c8014118d8374ca9f285779dfee7715a403908146a74de61b3853914c89f444c12e7a38bdd46c4ed36eb806ea598f44d1dec9eff9e2476f43802211f0762b66673b45d236b2391ce322e30fb9c69fe0d514dc1f8b6e3979c1205fd5224b07d18a44fec4f6f1ab041583db6adcc295bf2dd7dea107f59d7e03c61fe5822292e45968956b931bdc4d6445ff1631e0b98e4b4448774dd4b9cd53a45896fdb3f03702778741ae2b45a25bf9a23fc02fb97a630f132bf9def6c6d4a7baeb62972f1a814f6f2377bcfc78e2e86368c138510a04cedf7175af8c2034fae7413e3ace8c71ab9a0af1ca7042011a6ed028e205648535dabf3b2f85196ae18d36b839e3cd54ae4933ad529888fdac7bb8a70c72bc0fc81ba06506f2d5bc7686e219bbe5283959cbef9950e071cb6d9f341fc624a5110341f26cebd7100599a06e61f66fae120c7fc2b34c6221200eba75bd1277114671a3fa8f058b27fd897b052f4a52afcea814df526181c75c4497210a2b8b74e26601561e78735387cf123654b0295d1d60556956b36d96dd038866c4b4db31ebdcddd4829bbc2850cd4901389e6ea6e86041e0efa1158f334e7afda0e11c2fb0e6df6364cb95659f506d5c7e63fb67c8116577d15e4a4b1fc4c27de2e52586cb1f52be9c3601f5066549de8bdc3ec07d1a84caf1961323ec2487a37b751aeabafcd647ce2dae5d9499c0f969467e6cabad198669ac96bd1488954eff085319cdd6bd368e6283625bdb16270782321071fda5d980ded78ffa9dc2b56037d7cbf942547f48a5131f1991f6c17ae1ed5120ca6878f98e68e7997a9a2b70be640a70a34adb80de286c6692abb5f092e4e3a15a83217e03d02a4054f34af3a65ff6b36f395b76a0579cffafd5d3bb0e704c935caecf3a7ab756c23fd60c9fe3f4fb2be7504f5bae22b116ff1588dcf02b327d31bf0488dba8af5b33ccf2d7d87f43bbc48fcd4f191ad6af9313ad38b8b29674bfabd6651bc1f6ce5abb4a2f1413194f96b26d7d6edc4e013fba549075c97eef508af5ca7873664b058b7bcf455a8a04b591d29fab6366c844bb75576bac2d52323e747303d00a5736c9812922b0e17bcec9135550736b54cf6407d61e22e62d7bb75f62935b665acf33e75f688c36ef416f1b890d0f0c8ad1df00e02ec45967834d5649c8e7143978622fa3704672970b7993a87e97d3d926a14265647bc8b8c9e6f83e29572608d24b42c2635ef4abbd0af83860e99c90d7471cf6e8ce99507f5ec2bc572212fa9ee3f5a9dfa3815fe55f0bbb119acce062ae37f2ff921707abba139bccdf42bfd174d29b540161b4113c4e1a13f3a628c638ec4d3a884dfbc093e23ec0d0671b46b41dc8b42d950c8615ba5ee87f49b5d0910ffa4871207995001920db05a95199967f097ba7b55bbd271d818690c4238406b40a3dfc42fa56a67173b53a96b543326c56738b6d043195934018696f5ab49347e5148a78f2d1369a71afab8330273d46ecfba4ee05802a5385649851db949dbfb39e290941641c50b1ac20fb3102754a760b097f464ddb0b83f8168badfa71db6621dcf22fb081e3403f3bac5c7e65905aca52885c807f8ddab18bb2f12ef952c50483c0e251968bc70ff0d42a638ca744dea4c7ebb4fea777cf663bb4f1505ed79730c45bc86e488a13f924377a8e2ee6670a02ca52874ae1c42a35d55b9765757047b2cc3742aa51fa3e43fb2c113c92ad213bad252c1a82966dd016f12a7f1c3900c0f1ab455035163f31899bdd30f3ff43ad17d9e45bb7438c1c986712736f24be14f71ab1bfe92a25ec07f086ee8c7971b8077a13e58a8e8bea39c8e06b251909f02cb0080abf020f27ca160eb26c082dda1fa54ea4094dfdbcb2fa7bddccb67a844e8075f4cc08dad35757006d051e183dced336bc0c2502f93ffc87dca622286ba174c24e1f53f27dc2777baafe170348b0e8d3e743b3aa906bc0764bbe7da08ff403efe2212627d672250658bb513b7312517d1f88c61c7ba5f9647cd619281c5b390b48606ee39fb4171103df2e09d7cfd56c06c721f7c24ad8cce383623fc2dcb15ac56438ea331820ae59c8c474e36fc73f7b1b3b86df1b42490815513681aafbf7e871b4b9686efae6c45ecfca60a640a6f071dfd31f9437c3d03086164b48c1ed802986864bfe0d49bdd7709662262368dbc3ecc05eb240ecc41904c76d78ab5c52b66af5a720fdd6a92f52be0676427a56e32e5bc5085b25f90add28a76f2fce6f8f0ef74f4659698549646bd63175adf77b5cdcfe676e1b1a9af15102946554ba6136cbc83c6268ee40318f3c9d4718025688b35d2265bf60bf889ff629f7834586ef46eab7a9176337536bb6001e676546b987f36b1fe4b9f6e46a8ce73eb22ebbb9c14d8e2b43ea77ef887e5a26448f4086fa819a25e27725ac10298851c8bc45f2ce4430b07917ade5ea8c434c3f2576effbeb521173736e5c9557450643068b0c0fb132a7e99de6ca292246a9937fa7d7e06e59cf59ce5b9f842629049931146af40a8a1256ba373a88d09dc00cdf4453cc6ba78572bf3e1f2352a978cdbad60220cb8ac37d7f614a306492a4b5eee9244b0ca84b6cf2e23013bfb1cb92bf6d126fe550e58c19f84e7a4081437b75b31b2b9fb658dcd8ba077962e0f3359721a148d4fefe5c97941ca9688cb85adf38fd10f5811cdd8e074a21bbfc9541c71465b08d7321281b68ed52bfab789b9c83849c09d52376d419b1e7ba367603236e119cdf4a7b7cf9d81f2229601deace53cea2f14a05f7fa0ca04b39e31c6453e332f4bd0915c0e09e28f4d1125c390c6ff0833a04b6fc37855e65de90333e505b9eb66e00686a3ed499cfb7b8b215dbdc9787b5baa724cfa71ee6745b41e203de8b7794757ac328ec5567540b951b50530c3d4ee34705ea1c66fd6591e88561083e86d48c45ef3b83a3029319d8f3d8e65ce14c1dc3cb92d0a7dbeb609a8d2793928caa079f0fbbb2bc90b9f058cc048f4032041d14c5bca00e99b3027ec3a50c4957199cf016a4594069af8659df0973f20ffb15dbc265ac5b8a2203e90b114a3e9441e357c60ce0b550a7fe66fc34f5702ac8e8992a22e89194c1df69e81a9b7ad3d2634ea8c0388588192fd47d8e803b10044d558617fb2921b69eb4d85c051f86ef63a2f4382b9becd870fb2ecadca6902712b88680792e2f2ec89591cfebb6db3ad31c2a339af10465fcf7988519d382218df52261234f26a6f66ad0d1859de505d0fe819caf2f8d30aa9fd1228ac91d11ca67f1f8d50c8eefa5c441514321507dff6c6ea3cff6f340a1c11e0c40f419e8e60fc94d8828fa47a96cdf7ee4f61e23f40751b25cf9ca1295041a350f83f0e679515d6b4b46e2c9ce8999e07f835abc1663cefcf728df37831f4e17f8c8a4feaf1fbf44c38c9313284404a50ba4cd8abe835b33bfecb02cd6c9d7f435853b4c8d505ab83cf46512739116694765658bae64b3127152d216055aef9b25c70a8a3b302752d7b1e8791c657b9f3fc9001ef299fd1a349491ae6ee9940149160507fc4130fb825d47d97dc2c243209d2403583ac3ef6ddbedcaa76432255487c0a06e59e043e572ab3aec002af6a6b6a2dc9cfaeefa70557886c4d12924a0388f2f1bc8e89e4cfa69705d1ef3c4658f8616278b588011d9dd914beec0b151d65b6524fba3e3f235d58373e021699b07622a51504eade747e0b2f9cf38bc167cabc8cb18c708d1337e25648707e8c0872876514c7a49c0b2aaee5ed9e9ecfcbcc23e032c4deb63e48e7120188056468fad31448e4b42e7d62fbcfc1c2cfb01fcf0db5e8a162bdb9bd820c763f17b96c23f32db9d1c1d74ddbe657b4f9595a9796982a0742153111b15e484d8ffebe47ce0a78a41e470a341616ec2eb6eef813fb415fab50fa965bec6a5977a0ade4fed67f86fc24e11b0e2f5364079f7c7c35b560cac726dbc80f29dbd248f7ecda0286a23ef172a28c96d9bdb1f598eab31c6baf0321312da23920c074b9d2d2e442717f2c21001142a39c2da6b8bd9d06b05a6a8deae1bd1be4108a636ddbebc682d113e715f2f3ee506abc28b1c654b3d2d28e02f73b171ed0deed71dda90ce4a0b728cc75cb576385e7418b545b992b1dd98e2ee53355f464f9250a2a03b3d1e4d2ac1aa71d01de2573530324e14d15a507883411ddbd37be21dc929db9b11f11010e4d2a04c7325a5ae6d24d19900ff97a8a89438f8676457a78cff05201528f4358fe67f61288bf042a8f3c2e0f8b4997b8fb74996b80d465489b2d7807a945eba72a945e8cf8625dbad6f6f6e30537b29e558ca8a8b0625f578c766d34f2d28d704715f94df1f6318a308042aa494baa295640679f1eab1e6a8308af8ce6441d5ad8a2f3d477eb5307af0dfae6644493f1434030b8361621340ad3dcefa6d8f090ed3929d89ad9c0ba01a6903033428dd8f98619304b1803187d2a6130bf1e009b5eb0e7e21c75594b3b8470f3106c92a9e55bfeb026091ced127a90a1f1247f3c07e36d3572923e0de3f73518d0369a25fcd4e65d243b7eab91063a7bfd8bc8ac9e39fbbb32b5c9517886287a18eacd8dbfda9b91db693cb12e42cba5988280e09e51e72b91a0f360656d8f21cc1eb3248ac345ad51d1a6172b18419277851dab01e028c7e8e2cf34095efd28267852a08fccf61c45b5e46930160daf50282be058274e7ff58c48b60b86d0c8cc886ab8778a2a2b5fa2557ad7bf7f01f2175523ce758871d334c20a9839f7a89fe2867c06289c8a2f6456ac7e4fbadee53ac41aee68214bc76669853baa4f58255b39ba581414f2e8c4b49303f8936a33bae5cbc96b29a5c724d5b50e1614144c2acd03bd90de891c3d36ce040d57543682ecbfcae66c4153c337c3a5d01896524c8e0c27e9a08919821ca27bbfe3fc9ba24a823aeec8d4ad8ef8a65c585bee4dcf1acaa3da501a8c11a23b2e22920c1ad0129a038b31fe16c2abc80589dbf7c37211afc5d1a6db908bc5fe8a692060069fcbcdcba7c523d3c424aa3b0c6556387e0e51bcde9e5f850abf62d2c2101c3a2786a0cb94932877a09cb6b64aa61da8cab3b423e7adc4c4700418a65e87225710e1691f6d9cb2eb63cce5b605ce0a4a89cf519767e00845397c5e381141a0ed8a89b01064b495ec8d1e2da37433bf1597d919a69610d2ad26bdf6fca8de422bb2cb80d0516206e8194ee51445a3dcb5dee33c0c310b4751e68e58bebda2fb586985a5a5b06456756f44e6dbfef4bb99ca732f00fb9ea35775f7419681bfbe6f43dc7c4650c13b63d93c1d490bf0173f287a4309531f13ecb1a775d0bd881a", 0x1000}}, 0x1006) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000340)='./bus\x00', 0x18b341, 0x84) 781.27384ms ago: executing program 4 (id=3602): syz_io_uring_setup(0x82e, 0x0, &(0x7f0000000100), &(0x7f0000000080), &(0x7f0000000000)) pipe(0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c000000", @ANYRES16, @ANYBLOB="010025bd7000ffdbdf25020000000800010007000000"], 0x1c}, 0x1, 0x0, 0x0, 0x40005}, 0x8000) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/nullb/nullb1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0) write(r2, &(0x7f0000000140)='1\n', 0x2) close(r2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1/memory_backed\x00', 0x1, 0x0) write(r3, &(0x7f0000000240)='1', 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nullb/nullb1/power\x00', 0x1, 0x0) write(r4, &(0x7f00000002c0)='1\n', 0x2) nanosleep(0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat$cuse(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000340)={'macsec0\x00', 0x0}) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000040), 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000a00)=ANY=[@ANYBLOB="54000000100003052bbd7000249d020000000000", @ANYRES32=0x0, @ANYBLOB="1544010001800000240012800b0001006d616373656300001400028005000c0001000000080005000400000008000500", @ANYRES32=r7], 0x54}, 0x1, 0x0, 0x0, 0x2040}, 0x800) 611.175147ms ago: executing program 2 (id=3606): mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000640)='./tracing\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) syz_mount_image$exfat(&(0x7f0000000480), &(0x7f00000004c0)='./file2\x00', 0x4c080, &(0x7f0000000500)=ANY=[], 0x7d, 0x1508, &(0x7f0000000740)="$eJzs3Au0TlXXOPA511qb4+TyJLnvuebmSS6LJAklySVJkpDcE5IkSZLEIbckJCHXk+Qeck8nHff7Jfekk1eSJCEhyfqP0+Xv6633873v1/f3/r8zf2OscdY8e8211zpzPOfZe4/xPF93HVa9UY0q9ZkZ/hX6tw7+8iMJABIAYCAA5ACAAADK5iybM/14Fo1J/9JJxP+QBjOu9ArElST1z9ik/hmb1D9jk/pnbFL/jE3qn7FJ/TM2qb8QGdqsfFdLy7hNnv//f079d5Ll/T9DwH90QOr/v43+p0ZL/TM2qX/GJvXP2KT+GVlwpRcgrjB5/WdsUn8hMrS//JnyhnNX+pm2tH+iCSGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQ/w+c85cYAPit/4eBCVdkeUIIIYQQQgghhPgL+Hev9AqEEEIIIYQQQgjxPw9BgQYDAWSCzJAAWSARroKskA2yQw6IwdWQE66BXHAt5IY8kBfyQX4oAAUhBAILDBEUgsIQh+ugCFwPRaEYFIcS4KAklIIboDTcCGXgJigLN0M5uAXKQ4Wfz5nudqgMd0AVuBOqQjWoDjXgLqgJd0MtuAdqw71QB+6DunA/1IMHoD40gIbwIDSCh6AxNIGm0AyaQwtoeZn85Bx/lv889IAXoCf0giToDX3gRegL/aA/DICB8BIMgpdhMLwCQ2AoDINXYTi8BiPgdRgJo2A0vAFjYCyMg/EwASZCMrwJk+AtmAxvP5QNpsI0mA4zYCbMgndgNsyBufAuzIP5sACSsyyCxbAE3oOl8D6kwAewDD6EVFgOK2AlrILVsAbWwjpYDxtgI2yCzbAFtsI2+Ai2ww7YCbtgN+yBvfAx7INPYD98Cmn42T+Zf/b3+dANAQEVKjRoMBNmwgRMwERMxKyYFbNjdoxhDHNiTsyFuTA35sa8mBeTMD8WxIJISMjIWAgLYRzjWASLYFEsisWxODp0WApLYWm8EctgGSyLZbEclsPyWAEr4K14K1bCSlgZK2MVrIJVsSpWx+p4F96Fd2MtrIW1sTbWwTpYF+tiPayH9bE+NsSG2AgbYWNsjE2xKTbH5tgSW2IrbIWtsTW2xbbYDtthe2yPHbADdsSO2Ak7YWfsjF2wC3bFrtgNn8Pn8Hl8Hl/AF7AXVlW9sQ/2wb7YF/vjAByAL+EgfBlfxldwCA7FYfgqvoqv4Qg8gyNxFI7G0VhJjcVxOB5ZTcRkTMbMMAkn42ScglNxKk7HGTgTZ+EsnI1zcA6+i/NwPs7HhbgQF+MSXIJL8X1MwRRchmcxFZfjClyJq3A1rsK1uA7X4gbciBtwM27GrbgVP8KPcAfuwF24C/fgHvwYP8ZP8BMcgmmYhgfwAB7Eg3gID+FhPIxH8AgexaN4DI/hcTyOJ/AknsKTeBpP4xk8i+cA4Dyexwt4AS/ixfQXv0pnlFGZVCaVoBJUokpUWVVWlV1lVzEVUzlVTpVL5VK5VW6VV+VV+VV+VVAVVKRIsYpUIVVIxVVcFVFFVFFVVBVXxZVTTpVSpVRpVVqVUWVUWXWzKqduUeVVBdXG3apuVZVUW1dZ3aGqqCqqqqqmqqsaqoaqqWqqWqqWqq1qqzqqjqqr7lf1VG/sjw1UemUaqaHYWA3DpqqZaq5aqNfwYdVKjcDWqo1qqx5Vo3AktletXAf1hOqoxmEn9ZQaj0+rLmoidlXPqm7qOdVdPa96qNaup+qlpmBv1UdNx76qn+qvBqjZWE2lV6y6ekU9n3moGqZeVYvxNTVCva5GqlFqtHpDjVFj1Tg1Xk1QE1WyelNNUm+pyeptNUVNVdPUdDVDzVSz1Dtqtpqj5qp31Tw1Xy1QC9UitVgtUe+ppUqrFPWBWqY+VKlquVqhVqpVarVao9aqdWq92qA2qk1qs9qitqpt6iO1Xe1QO9UutVvtUXvVx2qf+kTtV5+qNPWZOqD+pg6qz9Uh9YU6rL5UR9RX6qj6Wh1T36jj6lt1Qp1Up9R36rT6Xp1RZ9U59YM6r35UF9RP6qLyCjRqpbU2OtCZdGadoLPoRH2Vzqqz6ew6h47pq3VOfY3Opa/VuXUendfk0/l1AV1Qh5q01awjXUgX1nF9nS6ir9dFdTFdXJfQTpfUpfQNurS+UZfRN+my+mZdTt+iy+sKuqIHfZuupG/XlfUduoq+U1fV1XR1XUPfpWvqu3UtfY+ure/VdfR9uq6+X9fTD+j6uoFuqB/UjfRDurFuopvqZrq5bqFb6od1K/2Ibq3b6Lb6Ud1OP6bb68d1B/2E7qif1J30U7qzflp30c/orvpZ3U0/p7vrn/RF7XVP3Usn6d66j35R99X9dH89QA/UL+lB+mU9WL+ih+iheph+VQ/Xr+kR+nU9Uo/So/Ubeoweq8fp8XqCnqiT9Zt6kn5LT9Zv6yl6qp6mp+sZeqbu/+tMc/8L+W/9Sf7gn8++VW/TH+nteofeqXfp3XqP3qv36n16n96v9+s0naYP6AP6oD6oD+lD+rA+rI/oI/qoPqqP6WP6uD6uT+iT+gf9nT6tv9dn9Fl9Vv+gz+vz+sKvfwMwaJTRxpjAZDKZTYLJYhLNVSaryWaymxwmZq42Oc01Jpe51uQ2eUxek8/kNwVMQRMaMtawiUwhU9jEzXWmiLneFDXFTHFTwjhT0pQyN/y38y+3vpampWllWpnWprVpa9qadqadaW/amw6mg+loOppOppPpbDqbLqaL6Wq6mm6mm+luupsepofpaXqaJJNk+pgXTV/Tz/Q3A8xA85IZZAaZwWawGWKGmGFmmBluhpsRZoQZaUaa0Wa0GWPGmHFmnJlgJphkn8NMMpPMZDPZTDFTzLSBOcwMM8PMMrPMbDPbzDVzzTwzzywwC8wis8gsMUvMUrPUpJgUs8wsM6lmuVluVpqVZrVZbdaatWa9WW82mo1ms9lsUs02s81sN9vNTrPT7Da7zV6z1+wz+8x+s9+kmTRzwBwwB81Bc8gcMofNYXPEHDFHzVFzzBwzx81xc8KcMKfMKXPanDZnzBlzzpwz5815c8FcMBfNxfTLvkAFKjCBCTIFmYKEICFIDBKDrEHWIHuQPYgFsSBnkDPIFVwb5A7yBHmDfEH+oEBQMAgDCmzAQRQUCgoH8eC6oEhwfVA0KBYUD0oELigZlApuCEoHNwZlgpuCssHNQbnglqB8UCGoGNwa3BZUCm4PKgd3BFWCO4OqQbWgelAjuCuoGdwd1AruCWoH9wZ1gvuCusH9Qb3ggaB+0CBoGDwYNAoeChoHTYKmQbOgedAiaPmXzu/9mTyPuJ5hrzAp7B32CV8M+4b9wv7hgHBg+FI4KHw5HBy+Eg4Jh4bDwlfD4eFr4Yjw9XBkOCocHb4RjgnHhuPC8eGEcGKYHL4ZTgrfCieHb4dTwqnhtGB6OCOcGc4K3wlnh3PCueG74bxwfrggXBguCheH+MslMaSEH4TLwg/D1HB5uCJcGa4KV4drwrXhunB9uCHcGG4KN5cd9MvQcHu4I9wZ7gp3h3vCveHH4b7wk3B/+GmYFn4WHgj/Fh4MPw8PhV+Eh8MvwyPhV+HR8OvwWPhNeDz8NjwRngxPhd+Fp8PvwzPh2fBc+EN4PvwxvBD+FF4MffrFffrbOxkylIkyUQIlUCIlUlbKStkpO8UoRjkpJ+WiXJSbclNeykv5KT8VpIKUjompEBWiOMWpCBWholSUilNxcuSoFJWi0lSaylAZKktlqRyVo/JUnipSRbqNbqPb6Xa6g+6gO+lOqkbVqAbVoJpUk2pRLapNtakO1aG6VJfqUT2qT/WpITWkRtSIGlNjakpNqTk1p5bUklpRK2pNrakttaV21I7aU3vqQB2oI3WkTtSJOlNn6kJdqCt1pW7UjbpTd+pBPagn9aQkSqI+1If6Ul/qT/1pIA2kQTSIBtNgGkJDaBgNo+E0nEbQCBpJo2g0vUFjaCyNo/E0gSZSMiXTJJpEk2kyTaEpNI2m0QyaQbNoFs2m2TSX5tI8mkcLaAEtokW0hJbQUlpKKZRCy2gZpVIqraAVtIpW0RpaQ+toHW2gDbSJNtEW2kLbaBttp+20k3bSbtpNe2kv7aN9tJ/2Uxql0QE6QAfpIB2iQ3SYDtMROkJH6Sgdo2N0nI7TCTpBp+gUnabTdIbO0Dk6R+fpR7pAP9FF8pRgs9hEe5XNarPZ7DaH/fs4r81n89sCtqANbW6b53cxWWuL2mK2uC1hnS1pS9kb/hCXtxVsRXurvc1Wsrfbyra8zQL/Ma5p77a17D22tr3X1rB3/S6uY++zde1Dtp5tYuvbZrahbWEb2YdsY9vENrXNbHPbwrazj9n29nHbwT5hO9on/xAvte/bdXa93WA32n32E3vO/mCP2q/tefuj7Wl72YH2JTvIvmwH21fsEDv09zGAHW3fsGPsWDvOjrcT7MQ/xNPsdDvDzrSz7Dt2tp3zh3iJfc/Osyl2gV1oF9nFP8fpa0qxH9hl9kObapfbFXalXWVX2zV27f9d60q72W6xW+1e+7HdbnfYnXaX3W33/Byn72O//dSm2c/sEfuVPWg/t4fsMXvYfvlznL6/Y/Ybe9x+a0/Yk/aU/c6ett/bM/bsz/tP3/t39id70XoLjKxYs+GAM3FmTuAsnMhXcVbOxtk5B8f4as7J13AuvpZzcx7Oy/k4PxfgghwysWXmiAtxYY7zdVyEr+eiXIyLcwl2XJJL8Q1cmm/kMnwTl+WbuRzfwuW5AlfkW/k2rsS3c2W+g6vwnVyVq3F1rsF3cU2+m2vxPVyb7+U6fB/X5fu5Hj/A9bkBN+QHuRE/xI25CTflZtycW3BLfphb8SPcmttwW36U2/Fj3J4f5w78BHfkJ7kTP8Wd+Wnuws9wV36Wu/Fz3J2f5x78AvfkXpzEvbkPv8h9uR/35wE8kF/iQfwyD+ZXeAgP5WH8Kg/n13gEv84jeRSP5jd4DI/lcTyeJ/BETuY3eRK/xZP5bZ7CU3kaT+cZPJNn8Ts8m+fwXH6X5/F8XsALeREv5iX8Hi/l9zmFP+Bl/CGn8nJewSt5Fa/mNbyW1/F63sAbeRNv5i28lbfxR7ydd/BO3sW7eQ/v5Y95H3/C+/lTTuPP+AD/jQ/y53yIv+DD/CUf4a/4KH/Nx/gbPs7f8gk+yaf4Oz7N3/MZPsvn+Ac+zz/yBf6JL7JniDBSkY5MFESZosxRQpQlSoyuirJG2aLsUY4oFl0d5YyuiXJF10a5ozxR3ihflD8qEBWMwogiG3EURYWiwlE8ui4qEl0fFY2KRcWjEpGLSkalohui0tGNUZnopqhsdHNULrolKh9ViCpGt0a3RZWi26PK0R1RlejOqGpULaoe1YjuimpGd0e1onui2tG9UZnovqhudH9UL3ogqh81iBpGD0aNooeixlGTqGnULGoetYhaRg9HraJHotZRm6ht9GjULnosah89HnWInog6Rk9eOl4s+OXd9O+OJ0W9I/3rE7J79KL44viS+HvxpfH34ynxD+LL4h/GU+PL4yviK+Or4qvja+Jr4+vi6+Mb4hvjm+Kb41viW+Pe18gMDtNvhMG4wGVymV2Cy+IS3VUuq8vmsrscLuaudjndNS6Xu9bldnlcXpfP5XcFXEEXOnLWsYtcIVfYxd11roi73hV1xVxxV8I5V9KVci1cS9fStXKPuNaujWvrHnWPusfcY+7x3z6r4zq5p1xn97Tr4p5xz7hnXTf3nOvunnc93Auup+vlklyS6+P6uL6ur+vv+ruBbqAb5Aa5wW6wG+KGuGFumBvuhrsRboQb6Ua60W60G+PGuHFunJvgJrhkl+wmuUluspvsprgpbpqb5ma4GW6Wm+Vmu9lurpvr5rl5boFb4Ba5RW6JW+KWuqUuxaW4ZW6ZS3WpboVb4Va5VW6NW+PWuXVug9vgNrlNbovb4ra5bW672+52up1ut9vt9rq9bp/b5/a7/S7NpbkD7oA76A66Q+4Ld9h96Y64r9xR97U75r5xx9237oQ76U45r0+7790Zd9adcz+48+5Hd8H95C4675Jjb8Ymxd6KTY69HZsSmxqbFpsemxGbGZsVeyc2OzYnNjf2bmxebH5sQWxhbFFscWxJ7L3Y0tj7sZTYB7FlsQ9jqbHlsRWxlbFVsdUx7wtsj3whX9jH/XW+iL/eF/XFfHFfwjtf0pfyN/jS/kZfxt/ky/qbfTl/iy/vK/iKvolv6pv55r6Fb+kf9q38I761b+Pb+kd9O/+Yb+8f9x38E76jf9J38k/5zv5p38U/47v6Z+f/WmXfw7/ge/pePsn39n38i76v7+f7+wF+oH/JD/Iv+8H+FT/ED/XD/Kt+uH/Nj/Cv+5F+lB/t3/Bj/Fg/zo/3E/xEn+zf9JP8W36yf9tP8VP9ND/dz/Az/Sz/jp/t5/i5/l0/z8/3C/xCv8gv9kv8e36pf9+n+A/8Mv+hT/XL/Qq/0q/yq/0av9av8+v9Br/Rb/Kb/Ra/1W/zH/ntfoff6Xf53X6P3+s/9vv8J36//9Sn+c/8Af83f9B/7g/5L/xh/6U/4r/yR/3X/pj/xh/33/oT/qQ/5b/zp/33/ow/68/5H/x5/6O/4H/yF//sM2tCCCGEEOIP9GWO9/6T36lfW7o+AJBtR77Dfz/npty/9PupfR1jAPBEr64NfmsNGiQlJf06NlVDUHghAMQu5f/8/QO/xsuhLTwGHaANlP7T9fVTFX++7vvP5o/fDJAIkOW3nPTbo0T4+/lv/AfzN3mPLzf/QoCihS/lpJ/ot/jS/GX+wfx72l1m/iyfJwO0/g85WeFSfGn+UvAIPAkdfjdSCCGEEEIIIYT4RT91vtvl7m/T78/zm0s5meFSfLn788uo/FfsQQghhBBCCCGEEP+5p5/r/vjDHTq06fy/uZP532MZ/wYdBIB/g2VI59+/c6X/MwkhhBBCCCH+apcu+q/0SoQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCiIzrX/+GMPVfHnyl9yiEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEJcaf8nAAD//8jaVSM=") r0 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./tracing/events/sched/filter\x00', 0x1, 0x0) write$cgroup_subtree(r0, &(0x7f0000000780)=ANY=[], 0x5b) 561.453323ms ago: executing program 4 (id=3607): syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0x0, 0x400, 0x2}, &(0x7f0000000100), &(0x7f0000000080), &(0x7f0000000000)) pipe(0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r0) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010025bd7000ffdbdf2502000000080001000700"], 0x1c}, 0x1, 0x0, 0x0, 0x40005}, 0x8000) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/nullb/nullb1\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0) write(r3, &(0x7f0000000140)='1\n', 0x2) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1/memory_backed\x00', 0x1, 0x0) write(r4, &(0x7f0000000240)='1', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nullb/nullb1/power\x00', 0x1, 0x0) write(r5, &(0x7f00000002c0)='1\n', 0x2) nanosleep(0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat$cuse(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000340)={'macsec0\x00', 0x0}) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040), 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000a00)=ANY=[@ANYBLOB="54000000100003052bbd7000249d020000000000", @ANYRES32=0x0, @ANYBLOB="1544010001800000240012800b0001006d616373656300001400028005000c0001000000080005000400000008000500", @ANYRES32=r8], 0x54}, 0x1, 0x0, 0x0, 0x2040}, 0x800) 454.456914ms ago: executing program 2 (id=3608): mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000003, 0x2000006, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r0, 0x8983, &(0x7f0000000000)={0x6, 'macvlan0\x00', {0x2}, 0xdd3c}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r1, 0x8983, &(0x7f0000000240)={0x0, 'bridge_slave_1\x00', {0x4}, 0x3ff8}) 449.722504ms ago: executing program 2 (id=3609): openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01002dbd0600ffdbdb252100000008000300", @ANYRES32=r2, @ANYBLOB="0600eb00000800000400ec000a00060008021100000100000600f70000ff000008009e"], 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x20000) 403.776209ms ago: executing program 4 (id=3610): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = syz_usb_connect(0x2, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000e13d6a206419010015d4010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2703) ioctl$I2C_SMBUS(r1, 0x720, &(0x7f0000000280)={0x1, 0x5, 0x0, &(0x7f0000000080)={0x5, "c6000000fa00008c0000c87fb100000000000100"}}) 354.417644ms ago: executing program 0 (id=3611): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001600), 0x2, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000800)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000880)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2d, 0x0, {{@in6=@loopback, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x1e, 0x100000001, 0x2, 0x0, 0x3d, 0xffffffffffffffff, 0x200000000000}, {0xcdab, 0x2f, 0x5, 0x800000000000002}, 0x1, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in=@broadcast, 0x0, 0x3c}, 0x2, @in6=@mcast2, 0x6, 0x4, 0x1}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x20}, 0x4000050) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000001640)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000001680)={0xffffffffffffffff}, 0x106, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f00000016c0)={0x3, 0x40, 0xfa02, {{0x6000000, 0x0, 0x0, @mcast2}, {0xa, 0x4e20, 0xffffffff, @dev={0xfe, 0x80, '\x00', 0x3b}}, r2, 0xffffffff}}, 0x48) 354.129084ms ago: executing program 2 (id=3612): ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000100)={0x2, &(0x7f00000006c0)=[{0x12, '\x00', @buffer={"ab557d935f95f143d64163f3aecb9a150f7174a89317d5baa9d1cfcdef55d3b0", 0x20}, 0x4}, {0x34, '\x00', @data, 0x9}]}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = timerfd_create(0x1, 0x0) timerfd_settime(r1, 0x3, &(0x7f00000001c0)={{}, {0x0, 0x989680}}, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x7}, 0x50) fcntl$setflags(r2, 0x2, 0x0) ioperm(0x0, 0x7c9, 0x1) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, r4, {0x0, 0x4}, {0xffff, 0xffff}, {0x3, 0xffe5}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x8000000000000001}, @TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0xc0}, 0x0) memfd_create(&(0x7f0000000000)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\xe4\xda\xf9\xcd7el\xb7\xe6\b\x00\xd8\x8f\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x92\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00uKs\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xd9\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x141<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7\xf2\xa0D-N\xf9\xba!L]h;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\xb7>j0S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x00\x00\xeaq\xbb\x03&\xb4mi\xc7\xff\xca\xd8\x9f\xae\xa3\x04\xaa\x10\xe7\x98\xe48\x8d', 0x3) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x20004001}, 0x4000018) sendmsg$NFT_BATCH(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0xd0, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_EXPRESSIONS={0x8c, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}, {0x10, 0x1, 0x0, 0x1, @inner={{0xa}, @void}}, {0x10, 0x1, 0x0, 0x1, @payload={{0xc}, @void}}, {0x1c, 0x1, 0x0, 0x1, @flow_offload={{0x11}, @val={0x4}}}, {0x24, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x40}, @NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}]}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x130}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xf8}, 0x1, 0x0, 0x0, 0x4040041}, 0x4000000) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r6 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r6, 0xc0405602, &(0x7f0000000180)={0x0, 0xd, 0x2, "7fc07ac2b0bbfa704e5f4836d8b18cbaacbe5af74374a06adb1776ca886ea04c", 0x35315241}) r7 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x2002) readv(r7, &(0x7f0000000140)=[{&(0x7f00000000c0)=""/103, 0x67}], 0x1) 293.15499ms ago: executing program 0 (id=3613): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000040)={0x1, 0x0, [{0xa, 0x0, 0x0, 0x7280202, 0x0, 0x0, 0x603}]}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000100)={0x1, 0x0, [{0x186, 0x0, 0x2}]}) 276.239472ms ago: executing program 2 (id=3614): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="034886dd010000000000140000006000000001082f00fe88a43de1a400000000000000027d01ff0200000000000000000000000000010000883e"], 0xfdef) 209.686288ms ago: executing program 0 (id=3615): syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0x0, 0x400, 0x2}, &(0x7f0000000100), &(0x7f0000000080), &(0x7f0000000000)) pipe(0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000ac0), r0) sendmsg$NLBL_CALIPSO_C_REMOVE(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c00", @ANYRES16=r1, @ANYBLOB="010025bd7000ffdbdf25020000000800010007000000"], 0x1c}, 0x1, 0x0, 0x0, 0x40005}, 0x8000) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/nullb/nullb1\x00', 0x1ff) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./config/nullb/nullb1/zoned\x00', 0x1, 0x0) write(r3, &(0x7f0000000140)='1\n', 0x2) close(r3) r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/nullb/nullb1/memory_backed\x00', 0x1, 0x0) write(r4, &(0x7f0000000240)='1', 0x1) r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./config/nullb/nullb1/power\x00', 0x1, 0x0) write(r5, &(0x7f00000002c0)='1\n', 0x2) nanosleep(0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) openat$cuse(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000340)={'macsec0\x00', 0x0}) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000040), 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000a00)=ANY=[@ANYBLOB="54000000100003052bbd7000249d020000000000", @ANYRES32=0x0, @ANYBLOB="1544010001800000240012800b0001006d616373656300001400028005000c0001000000080005000400000008000500", @ANYRES32=r8], 0x54}, 0x1, 0x0, 0x0, 0x2040}, 0x800) 107.654159ms ago: executing program 0 (id=3616): ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000100)={0x2, &(0x7f00000006c0)=[{0x12, '\x00', @buffer={"ab557d935f95f143d64163f3aecb9a150f7174a89317d5baa9d1cfcdef55d3b0", 0x20}, 0x4}, {0x34, '\x00', @data, 0x9}]}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = timerfd_create(0x1, 0x0) timerfd_settime(r1, 0x3, &(0x7f00000001c0)={{}, {0x0, 0x989680}}, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x7}, 0x50) fcntl$setflags(r2, 0x2, 0x0) ioperm(0x0, 0x7c9, 0x1) r3 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=@newqdisc={0x48, 0x24, 0xf0b, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, r4, {0x0, 0x4}, {0xffff, 0xffff}, {0x3, 0xffe5}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x18, 0x2, [@TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x8000000000000001}, @TCA_CAKE_AUTORATE={0x8, 0x9, 0x6}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0xc0}, 0x0) memfd_create(&(0x7f0000000000)='\xfd\x0fm3#/\x00n\xaa\xaa\xe4\x01U\x8b\xc2\f\x03\x19\x9c\x8e\xcb\x90\x00\x00\xaegQ\x0e\x94\\y\x0fU2@\'\x8a\x80\x00$\x12\xfc\xe4.)\x9b\xf2@\xf0\xe0\xdb\x1f\xe6\xb4gc\xe4\xda\xf9\xcd7el\xb7\xe6\b\x00\xd8\x8f\x00\xef\xff\x00vob/~\xc2\x00\b\x00\x00\x00\x00\x00\x00 \xff\xf1\xdem\x9c;%\xb5\"\xe4\xf1x2\x8a\x19p\x04\\\xaa-\x93\xd1\xc4 )\xbfK\xf7E\xf3\x05\xa0\xd0\xe6%\x97\x15\xf0\xab\x86\x90k\x10\xcer\x14\xe0a\xaf\xab\xfe\xd9V\x19\xa5d\x16\x8e]:3\xff\t\xe6\xf7\xb3\xbf\xa3\b[?\xb5\x14t\xd3\x8e\xc0\xe8\xefd\x88\xddz\xa25)\x17\xef\xfb4\xff\xdb\t\x8e\xeb\x1d\\\xf9\x14\xc7\v\xa8\x89\xdb A\xbaBAj\xfe\x18\xc3-+\xd6\xb0K\xee\x1b+\xc7lA\x84\xa6\xfe\x8bU<&\x1a\xe7m\x86\xb7\xa1A\xf9\x02S;C\x99\a.$K\x833\x82\x7f\x1b\'nj\x06\b\xb7\xe8] \x87A[y\xdc\x14\f\xcet\x00\x1f\x0f\xef\xca\xcfz\x7f\an0\xebB\xb8}&\xdd\xc9\xa7\x1dp\t\x92\xceb \x81\xaaq{H\x88\xdf\xf8\x80\\\x1c8\xfe\xc4\xe3\xb0\x90\xcb\x8b1r\x94\x9f\x00\xce\xc8\xc3\x84\xa0\xc9\b\x00uKs\xba\xbbC6\xd6\x13\xb5\xe086EzD\x18\xd5\x16\x88E\xc6\xf0A9\xf1u\xb3\x85\x02\x12\\Sp\xf4\x9a\xe8\x96^\xd9\xa8K\x12\b}\xff\xcb{\xc6\xf6\xb4\x8b\xb6\xa8Y\xf2\x91\xeeR\v#\xb5)\xb0\x99\x9b-p\xe3\x17\x04\xb0\xdc\x0fk\x11\xe1\x9a\a\x16\xb7\x9b\x88\xfa\x1e`\x84$\xfc\xd7\xf5^X\xd8[}\x032\xd0\x84\xdby\x94Vp\xa5\xcd(\xab\xb6\x95sR\xab\xfc\x8c\'\x9c\x16Q\xad\xbc\xb04%\xb7\xe5\x141<\xd9\xad\x9f\x12@!\xfaI\x88\xab\xef\x86\xe9\a>\xdd7\xb7\x8e\x9c0-o\xc9\xec_|\x02\xc8Ru\x95\xa8#U\xd6J\x87\xf6X\xb6{\x11$\x00\xc8\x14\xcb\xd1nK\xd8\xb9\x0e\x9bA\xed\xbcs\x1fS\r\x12O\x83\x15\xcb(\xdb\xb1S\x1f%\x04\x9a\xa0l\xa3}\xe7\xf2\xa0D-N\xf9\xba!L]h;F[\xe2\x1c\xe26 \x19k&.\x7f\x1d~\xdaI\xd4\x99\a+\xdf]\xbc\xa6\xc3\x0f\x99W\x9c-t\v\xc7J\xfd\x91\x853\xd1j;\x19W\x96V\x8az+\xf9\x82#\xfaC\xa3YN:\xe8\xda\xbc\xb2h\x8f\xe0\xc6d\x96\xccy\xb3\xc2\x98\x1c\xca\xde\"\xaeW\x89\x83\xc2sB\xe7\b\x9b9~}\xc2\xb3\x1d\xcc?\xd1\x89\xef\xca\x00\x00\x00\x00\x00\x00\x00\x00\x00J[\xc4\x04\xc1\xa6\x10\xc2\x9d\x11\t|\xc0\t\xd9(\x80\xe6s\xaa\x88\x8a\xd6\xa2\x01\x10W]Z\x8d\xf7\xd1P\xf9d\x01|\xa3\x03hSq\x95\x8f\xe1J\xd3#/fcCz\xff\x80\xe2M\xa3-r\xf6\x1a\xd74\xdc\xe1\xe4\xc3\x9dU t}\x02\xb7>j0S\xf4\x98\x05\xb9\x15}\xfa\"\xdc\xc2r\xf9\a\xadnD\xb6\x06\xd3\'\x10\x9f|\x17\xd6\x89O\f\x98@\x85\xa5m\x9d\\&\x17o\x11Z=l\xfb\x93\x8exZ\x00\x00\xeaq\xbb\x03&\xb4mi\xc7\xff\xca\xd8\x9f\xae\xa3\x04\xaa\x10\xe7\x98\xe48\x8d', 0x3) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x20004001}, 0x4000018) sendmsg$NFT_BATCH(r5, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0xc8, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xd}, @NFTA_SET_EXPRESSIONS={0x84, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @counter={{0xc}, @val={0x4}}}, {0x10, 0x1, 0x0, 0x1, @payload={{0xc}, @void}}, {0x1c, 0x1, 0x0, 0x1, @flow_offload={{0x11}, @val={0x4}}}, {0x2c, 0x1, 0x0, 0x1, @redir={{0xa}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0xb}, @NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x40}, @NFTA_REDIR_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}]}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x130}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xf0}, 0x1, 0x0, 0x0, 0x4040041}, 0x4000000) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r6 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r6, 0xc0405602, &(0x7f0000000180)={0x0, 0xd, 0x2, "7fc07ac2b0bbfa704e5f4836d8b18cbaacbe5af74374a06adb1776ca886ea04c", 0x35315241}) r7 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x2002) readv(r7, &(0x7f0000000140)=[{&(0x7f00000000c0)=""/103, 0x67}], 0x1) 91.5174ms ago: executing program 2 (id=3617): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000480)=ANY=[@ANYBLOB="1201000000000040ac054382408b0b00000109022400010000002009040000fd0301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000004c0)={0x24, 0x0, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="002281"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f00000005c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r1, 0x81044820, 0x0) 56.459194ms ago: executing program 0 (id=3618): r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000bc0)={{0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x8}, 0x809}, {0xa, 0x8, 0x0, @empty}, 0x2, {[0x0, 0x1, 0xfffffffe, 0x0, 0xffffffff, 0x8, 0x40]}}, 0x5c) setsockopt$MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f0000000c40)={{0xa, 0x4e21, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1}, {0xa, 0x4e21, 0x3, @empty, 0x99}, 0x1, {[0x7, 0xffffffff, 0x4, 0x9, 0x4, 0x1ff, 0x33ba8, 0x7]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000cc0)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x0, {[0x1, 0x0, 0xfffffffc, 0x0, 0x9]}}, 0x5c) setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000d40)={{0xa, 0x0, 0x0, @local}, {0xa, 0x4e22, 0x800, @empty}, 0x0, {[0x0, 0x8000, 0x0, 0xfffffffc]}}, 0x5c) 0s ago: executing program 0 (id=3619): socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$erofs(&(0x7f00000009c0), &(0x7f0000000a00)='./file0\x00', 0x2800091, &(0x7f00000001c0)=ANY=[@ANYRES64=0x0, @ANYRESOCT, @ANYRESOCT, @ANYBLOB="0784dddcebe094ed47da922d40c8ba0e50d385dc7623889db5587b0e31ceade0f7b4dea0c04367815516b9d9ce6a48433f75", @ANYRESDEC, @ANYRES16], 0x55, 0x1bd, &(0x7f0000000ac0)="$eJzsmLFv00AUxr+zHVtGSGGFBSQiJQw4tgOIDAwRIwNIIBBbImKigENQ4iHJBP8AKzMzQ+eoS/6Pdmg7dWi7dapUV2ef42sat4oSRZH6fsPzZ9/r+btX5YsUEARxaznYP93bKhZMru+iAEM8P1TTHkXqH+fPnuy0327/tU92x5M31Znt9EXfrwGY1FQE4j4Mw1BeL4jrByiJzqGern8CgyV0HQo+Cu2B4bPQ3yTd5f2W9bXte9aXrt/kwubF4cXlpTLr7/g3Q1Pyx6T1/nD0veH7Xm958ZrbnreUNTsj8VdT8EryJ/+/ktnY6fzgQIEjdAUM74V+CSOZTTwS6fwPtHR/dcnz8/mtbGobL+7nb+jJYVOsbqww02RZ59vFB/3XQn/FwMWRuV6rqxL/TWA1G6b5Gf5jKEr5pEn5UQ46P8v94ehpu9NoeS3vh+tWXtjPbPu5W46CKK5ZEQgNZpRPd6b7q2Euo1dnOgaNIOg5cZ3euwMDQc+dl7h6lH8KSo9j12zOl1yUt/fYI34pqcB5GJNh40/mYQiCIAiCIAiCIAiCIAiCIK7loRn/ynqJ6pVH7ruo+yIAAP//dXZrbQ==") r0 = openat(0xffffffffffffff9c, &(0x7f0000000c80)='./file2\x00', 0x80000, 0x82) read$FUSE(r0, &(0x7f0000000d00)={0x2020}, 0x2020) mount$cgroup(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x2208000, 0x0) kernel console output (not intermixed with test programs): [ 482.556043][T10467] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1810'. [ 482.857696][T10485] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1819'. [ 483.761235][T10504] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1825'. [ 483.950515][T10511] tipc: Enabling of bearer rejected, failed to enable media [ 484.334018][T10525] overlayfs: missing 'lowerdir' [ 484.405607][T10522] loop5: detected capacity change from 0 to 256 [ 485.534345][T10540] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1838'. [ 485.826823][T10554] loop5: detected capacity change from 0 to 4096 [ 486.643116][T10554] ntfs3: loop5: Different NTFS' sector size (4096) and media sector size (512) [ 486.692057][T10550] ntfs3: loop5: ntfs_set_state r=3 failed, -22. [ 486.705631][ T26] audit: type=1800 audit(1793726589.815:183): pid=10550 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.1839" name="file1" dev="loop5" ino=34 res=0 errno=0 [ 486.737446][T10563] overlayfs: missing 'lowerdir' [ 486.793333][T10563] loop1: detected capacity change from 0 to 1024 [ 486.901332][T10563] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 486.911257][T10563] EXT4-fs (loop1): Ignoring removed nomblk_io_submit option [ 486.918697][T10563] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 487.054843][T10563] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e055c01c, mo2=0002] [ 487.063523][T10563] System zones: 0-1, 3-36 [ 487.125515][T10563] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpquota,jqfmt=vfsold,resuid=0x0000000000000000,debug,dioread_nolock,bsddf,nomblk_io_submit,noauto_da_alloc,,errors=continue. Quota mode: writeback. [ 487.476359][ T8919] ntfs3: loop5: ntfs3_write_inode r=3 failed, -22. [ 487.483341][ T6050] ntfs3: loop5: ntfs_set_state r=3 failed, -22. [ 487.492310][ T6050] ntfs3: loop5: Mark volume as dirty due to NTFS errors [ 487.494061][T10563] EXT4-fs (loop1): re-mounted. Opts: (null). Quota mode: writeback. [ 487.506086][ T6050] ntfs3: loop5: ntfs_set_state r=3 failed, -22. [ 487.608206][ T7574] ntfs3: loop5: ntfs3_write_inode r=3 failed, -22. [ 487.625559][ T6050] ntfs3: loop5: ntfs_evict_inode r=5 failed, -22. [ 487.678090][ T6050] ntfs3: loop5: ntfs_evict_inode r=3 failed, -22. [ 487.720084][T10572] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1847'. [ 487.888554][T10579] device-mapper: table: 248:1: raid: Insufficient number of devices [ 487.924747][T10584] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1851'. [ 487.944745][T10579] device-mapper: ioctl: error adding target to table [ 488.549928][T10599] loop5: detected capacity change from 0 to 4096 [ 489.088020][T10599] ntfs3: loop5: Different NTFS' sector size (4096) and media sector size (512) [ 489.140817][T10598] ntfs3: loop5: ntfs_set_state r=3 failed, -22. [ 489.159008][ T26] audit: type=1800 audit(1793726592.265:184): pid=10598 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.1856" name="file1" dev="loop5" ino=34 res=0 errno=0 [ 489.207315][T10606] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 489.442796][ T7574] ntfs3: loop5: ntfs3_write_inode r=3 failed, -22. [ 489.470322][ T6050] ntfs3: loop5: ntfs_set_state r=3 failed, -22. [ 489.476676][ T6050] ntfs3: loop5: Mark volume as dirty due to NTFS errors [ 489.524502][T10610] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1860'. [ 489.548266][ T6050] ntfs3: loop5: ntfs_set_state r=3 failed, -22. [ 489.568765][T10604] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1859'. [ 489.599885][ T7574] ntfs3: loop5: ntfs3_write_inode r=3 failed, -22. [ 489.606676][ T6050] ntfs3: loop5: ntfs_evict_inode r=5 failed, -22. [ 489.730918][ T6050] ntfs3: loop5: ntfs_evict_inode r=3 failed, -22. [ 490.226251][T10626] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1866'. [ 490.283685][T10631] loop1: detected capacity change from 0 to 256 [ 490.670580][T10651] loop1: detected capacity change from 0 to 4096 [ 491.482972][T10653] overlayfs: missing 'lowerdir' [ 492.280716][T10651] ntfs3: loop1: Different NTFS' sector size (4096) and media sector size (512) [ 492.426829][T10644] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1877'. [ 492.495665][T10650] ntfs3: loop1: ntfs_set_state r=3 failed, -22. [ 492.505348][ T26] audit: type=1800 audit(1793726595.615:185): pid=10650 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1873" name="file1" dev="loop1" ino=34 res=0 errno=0 [ 492.540276][T10658] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1880'. [ 492.677744][T10663] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1882'. [ 492.717684][ T4344] ntfs3: loop1: ntfs3_write_inode r=3 failed, -22. [ 492.730163][ T4189] ntfs3: loop1: ntfs_set_state r=3 failed, -22. [ 492.740307][ T4189] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 492.756975][ T4189] ntfs3: loop1: ntfs_set_state r=3 failed, -22. [ 492.781827][ T9] ntfs3: loop1: ntfs3_write_inode r=3 failed, -22. [ 492.788757][ T4189] ntfs3: loop1: ntfs_evict_inode r=5 failed, -22. [ 492.809096][T10667] loop5: detected capacity change from 0 to 512 [ 492.825449][ T4189] ntfs3: loop1: ntfs_evict_inode r=3 failed, -22. [ 492.948736][T10667] EXT4-fs (loop5): mounted filesystem without journal. Opts: norecovery,,errors=continue. Quota mode: writeback. [ 493.030003][T10667] ext4 filesystem being mounted at /187/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 494.322381][T10697] loop1: detected capacity change from 0 to 512 [ 494.490253][T10697] FAT-fs (loop1): Unrecognized mount option "ÿÿÿÿÿR ç ïäÐV©[4èØ¡)ñ}ê³»Wz#¸" or missing value [ 494.817672][T10709] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1896'. [ 494.909175][T10715] loop5: detected capacity change from 0 to 512 [ 494.951005][T10715] FAT-fs (loop5): Unrecognized mount option "ÿÿÿÿÿR ç ïäÐV©[4èØ¡)ñ}ê³»Wz#¸" or missing value [ 495.032105][T10721] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1901'. [ 496.464936][ T7016] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 496.540816][T10743] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1911'. [ 496.736832][ T7016] usb 6-1: Using ep0 maxpacket: 16 [ 496.869551][ T7016] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 496.877676][ T7016] usb 6-1: config 0 has no interface number 0 [ 496.909293][ T7016] usb 6-1: config 0 interface 1 altsetting 3 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 496.930825][ T7016] usb 6-1: config 0 interface 1 altsetting 3 endpoint 0x81 has invalid wMaxPacketSize 0 [ 496.949754][ T7016] usb 6-1: config 0 interface 1 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 496.979298][ T7016] usb 6-1: config 0 interface 1 has no altsetting 0 [ 496.996266][ T7016] usb 6-1: New USB device found, idVendor=04f3, idProduct=074d, bcdDevice= 0.00 [ 497.019711][ T7016] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 497.043734][ T7016] usb 6-1: config 0 descriptor?? [ 497.103370][ T7016] usbhid 6-1:0.1: fixing wrong optional hid class descriptors count [ 497.968460][ T7016] elan 0003:04F3:074D.0001: unknown main item tag 0x0 [ 497.969567][ T4321] usb 2-1: new full-speed USB device number 3 using dummy_hcd [ 498.002334][ T7016] elan 0003:04F3:074D.0001: unknown main item tag 0x0 [ 498.019708][ T7016] elan 0003:04F3:074D.0001: unknown main item tag 0x0 [ 498.036811][ T7016] elan 0003:04F3:074D.0001: unknown main item tag 0x0 [ 498.057201][ T7016] elan 0003:04F3:074D.0001: unknown main item tag 0x0 [ 498.086037][ T7016] elan 0003:04F3:074D.0001: unknown main item tag 0x0 [ 498.102775][ T7016] elan 0003:04F3:074D.0001: unknown main item tag 0x0 [ 498.137737][ T7016] elan 0003:04F3:074D.0001: unknown main item tag 0x0 [ 498.170624][ T7016] elan 0003:04F3:074D.0001: unknown main item tag 0x0 [ 498.177485][ T7016] elan 0003:04F3:074D.0001: unknown main item tag 0x0 [ 498.215069][ T7016] elan 0003:04F3:074D.0001: unknown main item tag 0x0 [ 498.222628][ T7016] elan 0003:04F3:074D.0001: unknown main item tag 0x0 [ 498.255048][ T7016] elan 0003:04F3:074D.0001: unknown main item tag 0x0 [ 498.262170][ T7016] elan 0003:04F3:074D.0001: unknown main item tag 0x0 [ 498.275691][ T7016] elan 0003:04F3:074D.0001: unbalanced collection at end of report description [ 498.301499][ T7016] elan 0003:04F3:074D.0001: Hid Parse failed [ 498.307619][ T7016] elan: probe of 0003:04F3:074D.0001 failed with error -22 [ 498.365322][ T7016] usb 6-1: USB disconnect, device number 3 [ 498.379576][ T4321] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 498.405387][ T4321] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 498.449939][ T4321] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 498.489401][ T4321] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 498.512213][ T4321] usb 2-1: config 0 descriptor?? [ 498.561731][ T4321] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 498.570794][ T4321] dvb-usb: bulk message failed: -22 (3/0) [ 498.608674][ T4321] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 498.640000][ T4321] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 498.651565][ T4321] usb 2-1: media controller created [ 498.664542][ T4321] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 498.684463][ T4321] dvb-usb: bulk message failed: -22 (6/0) [ 498.698624][ T4321] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 498.753138][ T4321] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input5 [ 498.828659][ T4321] dvb-usb: schedule remote query interval to 150 msecs. [ 498.874041][ T4321] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 498.927786][ T4321] usb 2-1: USB disconnect, device number 3 [ 499.095386][T10803] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1933'. [ 500.137360][ T4321] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 500.154698][T10804] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1934'. [ 500.217248][T10816] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1940'. [ 500.238464][T10814] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1939'. [ 500.357054][T10822] loop5: detected capacity change from 0 to 256 [ 501.137876][T10841] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1952'. [ 501.176393][T10848] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1951'. [ 501.323704][ T1426] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.330316][ T1426] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.386712][T10851] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1955'. [ 501.416332][T10853] loop1: detected capacity change from 0 to 256 [ 502.022102][T10871] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1963'. [ 502.263309][T10883] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1970'. [ 502.341465][T10886] overlayfs: missing 'lowerdir' [ 502.756581][T10879] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1967'. [ 502.830245][T10891] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1971'. [ 502.980905][T10899] overlayfs: missing 'lowerdir' [ 503.045463][T10899] loop1: detected capacity change from 0 to 1024 [ 503.943481][T10899] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 503.953214][T10899] EXT4-fs (loop1): Ignoring removed nomblk_io_submit option [ 503.960622][T10899] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 504.012121][T10899] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e055c01c, mo2=0002] [ 504.020438][T10899] System zones: 0-1, 3-36 [ 504.061096][T10899] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpquota,jqfmt=vfsold,resuid=0x0000000000000000,debug,dioread_nolock,bsddf,nomblk_io_submit,noauto_da_alloc,,errors=continue. Quota mode: writeback. [ 504.096844][T10896] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 504.105850][T10896] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 504.128181][T10896] EXT4-fs (loop1): re-mounted. Opts: (null). Quota mode: writeback. [ 504.138554][ T6408] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 504.409302][ T6408] usb 6-1: Using ep0 maxpacket: 32 [ 504.719566][ T6408] usb 6-1: New USB device found, idVendor=13d8, idProduct=0001, bcdDevice= e.22 [ 504.741952][ T6408] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.876803][ T6408] usb 6-1: Product: syz [ 504.889779][ T6408] usb 6-1: Manufacturer: syz [ 504.909400][ T6408] usb 6-1: SerialNumber: syz [ 504.931820][ T6408] usb 6-1: config 0 descriptor?? [ 504.964047][T10931] loop1: detected capacity change from 0 to 256 [ 504.980539][T10931] exfat: Deprecated parameter 'utf8' [ 505.038169][T10931] exfat: Deprecated parameter 'namecase' [ 505.070814][ T6408] usb 6-1: selecting invalid altsetting 3 [ 505.076912][ T6408] comedi comedi5: could not set alternate setting 3 in high speed [ 505.086171][ T6408] usbdux 6-1:0.0: driver 'usbdux' failed to auto-configure device. [ 505.100490][T10931] exfat: Deprecated parameter 'namecase' [ 505.111372][ T6408] usbdux: probe of 6-1:0.0 failed with error -22 [ 505.128345][T10931] exFAT-fs (loop1): failed to load upcase table (idx : 0x0001fe89, chksum : 0xbf24f927, utbl_chksum : 0xe619d30d) [ 505.182841][T10935] __nla_validate_parse: 3 callbacks suppressed [ 505.182867][T10935] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1987'. [ 505.252853][ T6408] usb 6-1: USB disconnect, device number 4 [ 505.604311][T10945] overlayfs: missing 'lowerdir' [ 505.711514][T10945] netlink: 68 bytes leftover after parsing attributes in process `syz.0.1991'. [ 507.136637][T10956] overlayfs: missing 'lowerdir' [ 508.350466][T10968] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1996'. [ 508.469838][T10973] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1998'. [ 509.362724][T10980] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1999'. [ 509.456677][T10979] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2001'. [ 509.597786][T10984] ip_tables: iptables: counters copy to user failed while replacing table [ 510.891944][T11004] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2011'. [ 511.262147][T11014] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2013'. [ 511.282445][T11013] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2014'. [ 511.422575][T10988] loop5: detected capacity change from 0 to 32768 [ 511.929350][ T4321] usb 6-1: new full-speed USB device number 5 using dummy_hcd [ 512.280406][T11035] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2022'. [ 512.389627][ T4321] usb 6-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 512.402206][ T4321] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 512.442418][ T4321] usb 6-1: config 0 descriptor?? [ 512.510915][ T4321] cp210x 6-1:0.0: cp210x converter detected [ 512.794591][T11057] netlink: 'syz.0.2032': attribute type 4 has an invalid length. [ 512.819815][T11057] netlink: 17 bytes leftover after parsing attributes in process `syz.0.2032'. [ 512.976986][ T4321] usb 6-1: cp210x converter now attached to ttyUSB0 [ 513.048696][T11065] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2035'. [ 513.171720][ T4321] usb 6-1: USB disconnect, device number 5 [ 513.275278][ T4321] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 513.325818][ T4321] cp210x 6-1:0.0: device disconnected [ 513.410973][T11072] loop1: detected capacity change from 0 to 128 [ 513.468510][T11076] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2037'. [ 513.501463][T11072] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a802c018, mo2=0002] [ 513.513014][T11072] System zones: 1-3, 19-19, 35-36 [ 513.522696][T11072] EXT4-fs (loop1): mounted filesystem without journal. Opts: journal_ioprio=0x0000000000000004,debug,,errors=continue. Quota mode: none. [ 513.543998][T11072] ext4 filesystem being mounted at /295/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 513.661490][T11072] EXT4-fs warning (device loop1): ext4_group_extend:1852: can't read last block, resize aborted [ 514.039063][T11100] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2049'. [ 514.081295][T11105] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2051'. [ 514.259601][ T21] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 514.850608][T11129] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2063'. [ 514.939801][ T21] usb 2-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 514.969682][ T21] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 514.977912][ T21] usb 2-1: Product: syz [ 515.028602][ T21] usb 2-1: Manufacturer: syz [ 515.049894][ T21] usb 2-1: SerialNumber: syz [ 515.074554][ T21] usb 2-1: config 0 descriptor?? [ 515.154270][ T21] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 515.185947][T11137] loop5: detected capacity change from 0 to 512 [ 515.243086][T11137] FAT-fs (loop5): Unrecognized mount option "ÿÿÿÿÿR ç ïäÐV©[4èØ¡)ñ}ê³»Wz#¸" or missing value [ 515.999709][ T21] gspca_sunplus: reg_w_riv err -71 [ 516.005324][ T21] sunplus: probe of 2-1:0.0 failed with error -71 [ 516.047410][ T21] usb 2-1: USB disconnect, device number 4 [ 517.103460][T11166] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2074'. [ 517.144971][T11170] netlink: 24 bytes leftover after parsing attributes in process `syz.2.2076'. [ 517.549708][T11181] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2080'. [ 517.982458][T11198] netlink: 'syz.2.2088': attribute type 29 has an invalid length. [ 518.016664][T11196] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2087'. [ 518.061515][T11198] netlink: 'syz.2.2088': attribute type 29 has an invalid length. [ 518.075178][T11199] netlink: 'syz.2.2088': attribute type 29 has an invalid length. [ 518.116677][T11168] loop5: detected capacity change from 0 to 32768 [ 518.210212][T11203] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2089'. [ 518.252461][T11168] BTRFS info (device loop5): using sha256 (sha256-avx2) checksum algorithm [ 518.349285][T11207] overlayfs: missing 'lowerdir' [ 518.380410][T11168] BTRFS info (device loop5): allowing degraded mounts [ 518.399968][T11168] BTRFS info (device loop5): metadata ratio 4 [ 518.437648][T11168] BTRFS info (device loop5): turning on sync discard [ 518.444676][T11168] BTRFS info (device loop5): turning off discard [ 518.457200][T11168] BTRFS info (device loop5): turning on sync discard [ 518.464422][T11168] BTRFS info (device loop5): disabling tree log [ 518.480502][T11168] BTRFS info (device loop5): using free space tree [ 518.487235][T11168] BTRFS info (device loop5): has skinny extents [ 518.977163][T11168] BTRFS info (device loop5): enabling ssd optimizations [ 519.133340][T11235] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2095'. [ 520.192280][T11251] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2102'. [ 520.343905][T11256] overlayfs: missing 'lowerdir' [ 521.475838][T11265] netlink: 256 bytes leftover after parsing attributes in process `syz.2.2107'. [ 521.550876][T11265] unsupported nlmsg_type 40 [ 521.639386][T11270] netlink: 48 bytes leftover after parsing attributes in process `syz.2.2109'. [ 521.884947][T11274] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2110'. [ 522.186233][T11286] overlayfs: missing 'lowerdir' [ 522.253610][T11286] loop1: detected capacity change from 0 to 1024 [ 523.019301][T11287] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2101'. [ 523.249950][T11286] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 523.259604][T11286] EXT4-fs (loop1): Ignoring removed nomblk_io_submit option [ 523.267217][T11286] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 523.295210][T11286] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e055c01c, mo2=0002] [ 523.304088][T11286] System zones: 0-1, 3-36 [ 523.312554][T11286] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpquota,jqfmt=vfsold,resuid=0x0000000000000000,debug,dioread_nolock,bsddf,nomblk_io_submit,noauto_da_alloc,,errors=continue. Quota mode: writeback. [ 523.362289][T11285] EXT4-fs (loop1): re-mounted. Opts: (null). Quota mode: writeback. [ 523.597032][T11301] overlayfs: missing 'lowerdir' [ 523.994586][T11305] ip_tables: iptables: counters copy to user failed while replacing table [ 524.243923][T11323] tipc: Started in network mode [ 525.113766][T11323] tipc: Node identity 1000001, cluster identity 4711 [ 525.122853][T11323] tipc: Node number set to 16777217 [ 525.339382][T11340] overlayfs: missing 'lowerdir' [ 525.889304][T11354] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2135'. [ 526.760735][T11359] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2139'. [ 527.093336][T11366] loop5: detected capacity change from 0 to 4096 [ 527.674652][T11366] ntfs3: loop5: Different NTFS' sector size (4096) and media sector size (512) [ 527.723130][T11364] ntfs3: loop5: ntfs_set_state r=3 failed, -22. [ 527.733625][ T26] audit: type=1800 audit(1793726630.845:186): pid=11364 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.2141" name="file1" dev="loop5" ino=34 res=0 errno=0 [ 527.893816][ T4386] ntfs3: loop5: ntfs3_write_inode r=3 failed, -22. [ 527.922118][ T6050] ntfs3: loop5: ntfs_set_state r=3 failed, -22. [ 527.928497][ T6050] ntfs3: loop5: Mark volume as dirty due to NTFS errors [ 527.956839][ T6050] ntfs3: loop5: ntfs_set_state r=3 failed, -22. [ 528.029883][T11380] overlayfs: missing 'lowerdir' [ 528.117727][ T4344] ntfs3: loop5: ntfs3_write_inode r=3 failed, -22. [ 528.199788][ T6050] ntfs3: loop5: ntfs_evict_inode r=5 failed, -22. [ 528.217582][ T6050] ntfs3: loop5: ntfs_evict_inode r=3 failed, -22. [ 528.402660][T11388] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2151'. [ 528.531566][T11390] loop5: detected capacity change from 0 to 256 [ 528.635813][T11397] netlink: 32 bytes leftover after parsing attributes in process `syz.1.2154'. [ 528.893813][T11396] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2155'. [ 529.179705][T11415] device-mapper: table: 248:0: adding target device ram2 caused an alignment inconsistency: physical_block_size=4096, logical_block_size=512, alignment_offset=0, start=4193792 [ 529.205344][T11415] device-mapper: table: 248:0: ram2 too small for target: start=8191, len=3072, dev_size=8192 [ 529.219528][T11415] device-mapper: core: Cannot calculate initial queue limits [ 529.237919][T11415] device-mapper: ioctl: unable to set up device queue for new table. [ 529.252775][T11418] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2163'. [ 529.446788][T11427] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2167'. [ 529.617661][T11439] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2172'. [ 529.678707][T11440] loop1: detected capacity change from 0 to 512 [ 529.771323][T11440] FAT-fs (loop1): Unrecognized mount option "ÿÿÿÿÿR ç ïäÐV©[4èØ¡)ñ}ê³»Wz#¸" or missing value [ 529.858127][T11446] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2176'. [ 530.517364][T11461] loop5: detected capacity change from 0 to 4096 [ 531.034428][T11461] ntfs3: loop5: Different NTFS' sector size (4096) and media sector size (512) [ 531.088035][T11459] ntfs3: loop5: ntfs_set_state r=3 failed, -22. [ 531.108542][ T26] audit: type=1800 audit(1793726634.215:187): pid=11459 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.2180" name="file1" dev="loop5" ino=34 res=0 errno=0 [ 531.207318][T11469] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2185'. [ 531.235105][T11470] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2184'. [ 531.278144][ T4933] ntfs3: loop5: ntfs3_write_inode r=3 failed, -22. [ 531.315214][ T6050] ntfs3: loop5: ntfs_set_state r=3 failed, -22. [ 531.329548][ T6050] ntfs3: loop5: Mark volume as dirty due to NTFS errors [ 531.354367][ T6050] ntfs3: loop5: ntfs_set_state r=3 failed, -22. [ 531.414429][ T8914] ntfs3: loop5: ntfs3_write_inode r=3 failed, -22. [ 531.427268][ T6050] ntfs3: loop5: ntfs_evict_inode r=5 failed, -22. [ 531.444803][ T6050] ntfs3: loop5: ntfs_evict_inode r=3 failed, -22. [ 531.685973][T11484] loop1: detected capacity change from 0 to 512 [ 531.753792][T11484] FAT-fs (loop1): Unrecognized mount option "ÿÿÿÿÿR ç ïäÐV©[4èØ¡)ñ}ê³»Wz#¸" or missing value [ 531.959971][T11493] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2192'. [ 532.721800][T11495] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 532.857505][T11501] loop1: detected capacity change from 0 to 512 [ 533.012553][T11501] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpid,grpquota,,errors=continue. Quota mode: writeback. [ 533.026989][T11501] ext4 filesystem being mounted at /313/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 533.560652][T11540] __nla_validate_parse: 1 callbacks suppressed [ 533.560742][T11540] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2209'. [ 534.504401][T11537] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2212'. [ 534.552833][T11543] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2213'. [ 535.165662][T11577] overlayfs: missing 'lowerdir' [ 535.542209][T11575] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2226'. [ 535.671222][T11580] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2227'. [ 536.804060][T11584] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2229'. [ 536.901305][T11591] syz.0.2230 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 537.092209][T11606] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2239'. [ 537.255105][T11611] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2240'. [ 538.086697][T11621] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2245'. [ 538.173639][T11619] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2244'. [ 540.097053][T11646] __nla_validate_parse: 3 callbacks suppressed [ 540.097069][T11646] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2255'. [ 540.419578][T11660] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2259'. [ 541.292789][T11662] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2258'. [ 541.539846][T11652] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2257'. [ 541.859520][T11679] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2267'. [ 542.199411][ T7012] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 542.676533][T11685] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2270'. [ 542.834289][T11689] device-mapper: table: 248:2: snapshot: Chunk size not set [ 542.842316][T11689] device-mapper: ioctl: error adding target to table [ 542.982387][T11700] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2276'. [ 543.042541][T11706] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2277'. [ 543.099565][ T7012] usb 6-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 543.116387][ T7012] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 543.125255][ T7012] usb 6-1: Product: syz [ 543.136968][ T7012] usb 6-1: Manufacturer: syz [ 543.147155][ T7012] usb 6-1: SerialNumber: syz [ 543.185184][ T7012] usb 6-1: config 0 descriptor?? [ 543.209194][T11715] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 543.745781][T11719] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2282'. [ 543.808952][T11725] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2284'. [ 543.871297][ T7012] usb 6-1: USB disconnect, device number 6 [ 544.242617][T11722] udevd[11722]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 545.650284][T11781] ODEBUG: Out of memory. ODEBUG disabled [ 546.139390][T11796] __nla_validate_parse: 5 callbacks suppressed [ 546.139445][T11796] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2311'. [ 547.012966][T11805] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2316'. [ 547.297370][T11816] ip_tables: iptables: counters copy to user failed while replacing table [ 547.498654][T11822] overlayfs: missing 'lowerdir' [ 547.602965][T11822] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2321'. [ 547.612127][T11822] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2321'. [ 548.405170][T11826] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2323'. [ 548.419474][T11828] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2324'. [ 548.473233][T11829] netlink: 60 bytes leftover after parsing attributes in process `syz.2.2324'. [ 548.539574][T11829] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2324'. [ 548.780808][T11839] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2326'. [ 550.406793][T11871] syz.4.2340 uses obsolete (PF_INET,SOCK_PACKET) [ 550.431761][T11872] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2338'. [ 551.966504][T11889] ip_tables: iptables: counters copy to user failed while replacing table [ 552.117555][T11889] ip_tables: iptables: counters copy to user failed while replacing table [ 552.235016][T11902] device-mapper: verity: blake2b-256 using implementation "blake2b-256-generic" [ 552.264085][T11902] device-mapper: table: 248:3: verity: Invalid root digest [ 552.274031][T11902] device-mapper: ioctl: error adding target to table [ 553.116763][T11916] overlayfs: missing 'lowerdir' [ 553.535978][T11922] 9pnet: Insufficient options for proto=fd [ 553.717314][T11930] __nla_validate_parse: 2 callbacks suppressed [ 553.717334][T11930] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2354'. [ 554.218427][T11943] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2360'. [ 554.872069][T11963] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2365'. [ 554.999504][ T21] usb 6-1: new full-speed USB device number 7 using dummy_hcd [ 555.038427][T11969] overlayfs: missing 'lowerdir' [ 555.167521][T11969] netlink: 68 bytes leftover after parsing attributes in process `syz.0.2368'. [ 555.178927][T11969] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2368'. [ 555.441064][ T21] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 555.537487][ T21] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 3 [ 555.902649][ T21] usb 6-1: New USB device found, idVendor=08e4, idProduct=017f, bcdDevice= 0.40 [ 555.932588][ T21] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 555.973323][T11975] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2370'. [ 556.004749][ T21] usb 6-1: Product: syz [ 556.018719][ T21] usb 6-1: Manufacturer: syz [ 556.035484][ T21] usb 6-1: SerialNumber: syz [ 556.146042][T11984] loop1: detected capacity change from 0 to 4096 [ 556.197128][T11984] ntfs3: loop1: Different NTFS' sector size (4096) and media sector size (512) [ 556.245752][T11984] ntfs3: loop1: ntfs_set_state r=3 failed, -22. [ 556.261272][ T26] audit: type=1800 audit(1793726659.365:188): pid=11984 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2369" name="file1" dev="loop1" ino=34 res=0 errno=0 [ 556.321104][T11987] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2374'. [ 556.338894][T11988] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2375'. [ 556.407928][ T21] usb 6-1: USB disconnect, device number 7 [ 557.557028][T12015] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2386'. [ 557.642648][T12018] overlayfs: missing 'lowerdir' [ 557.745732][T12018] netlink: 68 bytes leftover after parsing attributes in process `syz.2.2385'. [ 559.152498][ T4384] ntfs3: loop1: ntfs3_write_inode r=3 failed, -22. [ 559.165457][ T4189] ntfs3: loop1: ntfs_set_state r=3 failed, -22. [ 559.189453][ T4189] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 559.223494][ T4189] ntfs3: loop1: ntfs_set_state r=3 failed, -22. [ 559.256833][ T4880] ntfs3: loop1: ntfs3_write_inode r=3 failed, -22. [ 559.271176][ T4189] ntfs3: loop1: ntfs_evict_inode r=5 failed, -22. [ 559.291202][ T4189] ntfs3: loop1: ntfs_evict_inode r=3 failed, -22. [ 559.490207][T12038] loop1: detected capacity change from 0 to 512 [ 559.594685][T12038] EXT4-fs (loop1): mounted filesystem without journal. Opts: nojournal_checksum,,errors=continue. Quota mode: none. [ 559.702168][T12038] fs-verity: sha256 using implementation "sha256-avx2" [ 559.748633][T12038] EXT4-fs warning (device loop1): ext4_begin_enable_verity:136: inode #15: comm syz.1.2391: verity is only allowed on extent-based files [ 559.778889][T12047] EXT4-fs warning (device loop1): ext4_begin_enable_verity:136: inode #15: comm syz.1.2391: verity is only allowed on extent-based files [ 559.874816][ T4203] usb 6-1: new full-speed USB device number 8 using dummy_hcd [ 559.980747][T12053] __nla_validate_parse: 2 callbacks suppressed [ 559.980762][T12053] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2398'. [ 560.231793][T12063] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2401'. [ 560.659592][ T4203] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 560.681963][ T4203] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 560.784259][ T4203] pvrusb2: Hardware description: Terratec Grabster AV400 [ 560.815737][ T4203] pvrusb2: ********** [ 560.830079][ T4203] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 560.858851][T12077] block device autoloading is deprecated and will be removed. [ 560.909150][ T4203] pvrusb2: Important functionality might not be entirely working. [ 560.940549][T12076] block device autoloading is deprecated and will be removed. [ 560.993113][ T4203] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 561.044958][ T4203] pvrusb2: ********** [ 561.263151][ T2428] pvrusb2: Invalid write control endpoint [ 561.375616][ T6408] usb 6-1: USB disconnect, device number 8 [ 561.661984][ T2428] pvrusb2: Invalid write control endpoint [ 561.691126][ T2428] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 561.711487][ T2428] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 561.725780][ T2428] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 561.743287][ T2428] pvrusb2: Device being rendered inoperable [ 561.766617][ T2428] cx25840 1-0044: Unable to detect h/w, assuming cx23887 [ 561.783259][ T2428] cx25840 1-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 561.807275][T12098] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2411'. [ 561.916393][ T2428] pvrusb2: Attached sub-driver cx25840 [ 561.929986][ T2428] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 561.969478][ T2428] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 562.475192][T12114] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2416'. [ 562.592538][T12120] 9pnet: Insufficient options for proto=fd [ 562.769645][ T1426] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.781404][ T1426] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.098273][T12135] overlayfs: missing 'lowerdir' [ 563.199540][T12135] netlink: 68 bytes leftover after parsing attributes in process `syz.4.2425'. [ 563.209290][T12135] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2425'. [ 564.045361][T12139] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2426'. [ 564.494927][T12158] loop1: detected capacity change from 0 to 512 [ 564.601055][T12158] FAT-fs (loop1): Unrecognized mount option "ÿÿÿÿÿR ç ïäÐV©[4èØ¡)ñ}ê³»Wz#¸" or missing value [ 564.650071][T12160] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2436'. [ 564.807263][T12169] overlayfs: missing 'lowerdir' [ 565.370369][T12174] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2441'. [ 565.619371][T11278] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 565.880102][T11278] usb 6-1: Using ep0 maxpacket: 32 [ 566.009980][T11278] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 566.488632][T11278] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 566.517597][T11278] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 566.616756][T11278] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 566.910464][T11278] usb 6-1: config 0 descriptor?? [ 566.961526][T11278] hub 6-1:0.0: USB hub found [ 567.106980][T12205] overlayfs: missing 'lowerdir' [ 567.291612][T11278] hub 6-1:0.0: 3 ports detected [ 567.549963][T11278] hub 6-1:0.0: config failed, can't get hub status (err -5) [ 567.573292][T12206] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2452'. [ 567.719524][T11278] usbhid 6-1:0.0: can't add hid device: -71 [ 567.729084][T11278] usbhid: probe of 6-1:0.0 failed with error -71 [ 567.790943][T11278] usb 6-1: USB disconnect, device number 9 [ 567.804927][T12217] loop1: detected capacity change from 0 to 512 [ 567.834383][T12216] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2455'. [ 567.881532][T12217] FAT-fs (loop1): Unrecognized mount option "ÿÿÿÿÿR ç ïäÐV©[4èØ¡)ñ}ê³»Wz#¸" or missing value [ 568.073544][T12219] loop5: detected capacity change from 0 to 164 [ 568.142037][T12222] batman_adv: batadv0: Adding interface: netdevsim0 [ 568.185077][T12222] batman_adv: batadv0: The MTU of interface netdevsim0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 568.242400][T12224] IPVS: lblc: FWM 3 0x00000003 - no destination available [ 568.266920][ C1] IPVS: lblc: FWM 3 0x00000003 - no destination available [ 568.279473][T12222] batman_adv: batadv0: Interface activated: netdevsim0 [ 569.471737][T12254] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2471'. [ 569.867842][T12259] loop1: detected capacity change from 0 to 2048 [ 569.938894][T12259] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 570.026288][T12260] block device autoloading is deprecated and will be removed. [ 570.302376][T12267] pimreg0: tun_chr_ioctl cmd 1074025676 [ 570.308379][T12267] pimreg0: owner set to 0 [ 570.579382][T11278] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 570.595107][T12283] loop5: detected capacity change from 0 to 512 [ 570.644727][T12283] FAT-fs (loop5): Unrecognized mount option "ÿÿÿÿÿR ç ïäÐV©[4èØ¡)ñ}ê³»Wz#¸" or missing value [ 570.724271][T12275] zswap: compressor zs not available [ 570.835902][T12290] netlink: 'syz.0.2487': attribute type 10 has an invalid length. [ 570.960629][T12290] team0: Port device netdevsim0 added [ 570.999933][T11278] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 571.028474][T11278] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 571.059303][T11278] usb 2-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 571.091016][T11278] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 571.121649][T11278] usb 2-1: config 0 descriptor?? [ 571.359154][T12318] loop5: detected capacity change from 0 to 256 [ 571.686844][T11278] playstation 0003:054C:0DF2.0002: unknown main item tag 0x0 [ 571.697210][T11278] playstation 0003:054C:0DF2.0002: unknown main item tag 0x0 [ 571.714426][T11278] playstation 0003:054C:0DF2.0002: unknown main item tag 0x0 [ 571.727538][T11278] playstation 0003:054C:0DF2.0002: unknown main item tag 0x0 [ 571.738910][T11278] playstation 0003:054C:0DF2.0002: unknown main item tag 0x0 [ 571.763432][T11278] playstation 0003:054C:0DF2.0002: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.1-1/input0 [ 571.910589][T11278] playstation 0003:054C:0DF2.0002: Invalid byte count transferred, expected 20 got 0 [ 571.935864][T11278] playstation 0003:054C:0DF2.0002: Failed to retrieve DualSense pairing info: -22 [ 571.969028][T11278] playstation 0003:054C:0DF2.0002: Failed to get MAC address from DualSense [ 572.002385][T11278] playstation 0003:054C:0DF2.0002: Failed to create dualsense. [ 572.055750][T12336] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2504'. [ 572.090979][T11278] playstation: probe of 0003:054C:0DF2.0002 failed with error -22 [ 572.134397][T11278] usb 2-1: USB disconnect, device number 5 [ 572.339609][T12341] fido_id[12341]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 573.736436][T12369] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2517'. [ 574.037252][T12373] loop1: detected capacity change from 0 to 4096 [ 574.068464][T12373] ntfs3: loop1: Different NTFS' sector size (4096) and media sector size (512) [ 574.166743][T12373] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 574.235065][T12373] ntfs3: loop1: mft corrupted [ 574.256148][T12373] ntfs3: loop1: Failed to load $Extend. [ 574.392190][T12386] loop5: detected capacity change from 0 to 8 [ 574.770748][T12391] SQUASHFS error: Failed to read block 0x2d7: -5 [ 574.777981][T12391] SQUASHFS error: Unable to read metadata cache entry [2d5] [ 575.441996][T12405] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2530'. [ 576.416181][T12425] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2538'. [ 577.463584][T12442] loop5: detected capacity change from 0 to 512 [ 577.531885][T12442] EXT4-fs (loop5): inline encryption not supported [ 577.573024][T12442] EXT4-fs (loop5): Ignoring removed oldalloc option [ 577.617844][T12442] EXT4-fs (loop5): Test dummy encryption mode enabled [ 577.647728][T12442] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 577.709072][T12442] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 577.775583][T12442] EXT4-fs error (device loop5): ext4_orphan_get:1436: comm syz.5.2546: bad orphan inode 131083 [ 577.837069][T12442] EXT4-fs (loop5): mounted filesystem without journal. Opts: stripe=0x0000000000000008,resgid=0x0000000000000000,inlinecrypt,oldalloc,discard,journal_ioprio=0x0000000000000003,acl,test_dummy_encryption=v1,noblock_validity,,errors=continue. Quota mode: none. [ 577.972201][T12453] overlayfs: failed to clone upperpath [ 578.044586][T12460] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2552'. [ 578.310058][T12442] fscrypt (loop5): Missing crypto API support for AES-256-CTS-CBC (API name: "cts(cbc(aes))") [ 578.504906][T12478] 9pnet: Insufficient options for proto=fd [ 578.784733][T12490] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2560'. [ 579.571691][T12487] loop1: detected capacity change from 0 to 256 [ 579.619106][T12489] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2563'. [ 580.188100][T12508] overlayfs: missing 'lowerdir' [ 580.428488][T12513] loop5: detected capacity change from 0 to 1024 [ 580.668203][T12513] EXT4-fs (loop5): Ignoring removed nobh option [ 580.762961][T12513] EXT4-fs (loop5): Ignoring removed bh option [ 580.829587][T12513] EXT4-fs (loop5): Ignoring removed nobh option [ 580.935985][T12513] EXT4-fs (loop5): mounted filesystem without journal. Opts: nobh,dioread_lock,barrier=0x0000000000000004,nolazytime,debug_want_extra_isize=0x0000000000000080,lazytime,errors=remount-ro,stripe=0x0000000000000011,bh,nombcache,mb_optimize_scan=0x0000000000000001,nobh,. Quota mode: none. [ 581.294114][T12529] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2577'. [ 581.742679][T12540] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2581'. [ 582.020516][T12548] overlayfs: missing 'lowerdir' [ 582.118473][T12548] loop5: detected capacity change from 0 to 1024 [ 582.202041][T12548] EXT4-fs (loop5): Quota format mount options ignored when QUOTA feature is enabled [ 582.214963][T12548] EXT4-fs (loop5): Ignoring removed nomblk_io_submit option [ 582.224675][T12548] EXT4-fs (loop5): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 582.348402][T12548] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e055c01c, mo2=0002] [ 582.360807][T12548] System zones: 0-1, 3-36 [ 582.414797][T12548] EXT4-fs (loop5): mounted filesystem without journal. Opts: grpquota,jqfmt=vfsold,resuid=0x0000000000000000,debug,dioread_nolock,bsddf,nomblk_io_submit,noauto_da_alloc,,errors=continue. Quota mode: writeback. [ 582.566316][T12548] EXT4-fs (loop5): re-mounted. Opts: (null). Quota mode: writeback. [ 583.565423][T12572] overlayfs: missing 'lowerdir' [ 584.066014][T12577] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2590'. [ 584.661667][T12605] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2603'. [ 585.889431][ T4203] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 585.909922][T12629] overlayfs: missing 'lowerdir' [ 586.349674][ T4203] usb 2-1: config 0 has an invalid interface number: 50 but max is 0 [ 586.379405][ T4203] usb 2-1: config 0 has no interface number 0 [ 586.406095][ T4203] usb 2-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 586.625108][ T4203] usb 2-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 586.648657][ T4203] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 586.676386][ T4203] usb 2-1: Product: syz [ 586.699335][ T4203] usb 2-1: Manufacturer: syz [ 586.707692][ T4203] usb 2-1: SerialNumber: syz [ 586.747437][ T4203] usb 2-1: config 0 descriptor?? [ 586.795049][T12619] loop5: detected capacity change from 0 to 32768 [ 586.852744][ T4203] yurex 2-1:0.50: USB YUREX device now attached to Yurex #0 [ 587.092718][T12619] XFS (loop5): Mounting V5 Filesystem [ 587.239691][T12619] XFS (loop5): Ending clean mount [ 587.258852][ T4203] usb 2-1: USB disconnect, device number 6 [ 587.293913][T12616] yurex 2-1:0.50: yurex_write - failed to send bulk msg, error -19 [ 587.335788][ T4203] yurex 2-1:0.50: USB YUREX #0 now disconnected [ 587.473746][T12659] overlayfs: missing 'lowerdir' [ 587.766626][T12667] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2619'. [ 587.983094][T12619] XFS (loop5): Quotacheck needed: Please wait. [ 588.179780][T12619] XFS (loop5): Quotacheck: Done. [ 588.225738][T12619] jffs2: notice: (12619) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 588.420921][T12687] overlayfs: missing 'lowerdir' [ 588.890704][ T6050] XFS (loop5): Unmounting Filesystem [ 589.285201][T12707] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2635'. [ 590.101440][T12727] overlayfs: missing 'lowerdir' [ 590.278418][T12730] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2641'. [ 590.748061][T12744] overlayfs: missing 'lowerdir' [ 590.847687][T12746] loop5: detected capacity change from 0 to 512 [ 591.346694][T12758] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2650'. [ 591.514516][T12766] overlayfs: missing 'lowerdir' [ 592.365650][T12768] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2654'. [ 592.544992][T12772] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2656'. [ 592.663572][T12780] loop1: detected capacity change from 0 to 128 [ 593.065561][T12780] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 593.142372][T12780] ext4 filesystem being mounted at /383/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 593.308995][T12780] fscrypt (loop1, inode 12): Direct key flag not allowed with different contents and filenames modes [ 593.668274][T12813] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2670'. [ 593.777534][T12817] overlayfs: missing 'lowerdir' [ 594.680029][T12818] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2671'. [ 595.061729][T12824] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2672'. [ 596.608212][T12853] device bond0 entered promiscuous mode [ 596.625719][T12853] device bond_slave_0 entered promiscuous mode [ 596.655931][T12853] device bond_slave_1 entered promiscuous mode [ 596.678730][T12853] device batadv0 entered promiscuous mode [ 596.695389][T12853] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 596.705741][ T9638] IPv6: ADDRCONF(NETDEV_CHANGE): hsr1: link becomes ready [ 596.929595][T12861] overlayfs: missing 'lowerdir' [ 597.846087][T12865] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2690'. [ 598.153535][T12874] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2693'. [ 598.408793][T12882] loop1: detected capacity change from 0 to 256 [ 598.733186][T12891] loop5: detected capacity change from 0 to 512 [ 598.920975][T12891] FAT-fs (loop5): Unrecognized mount option "ÿÿÿÿÿR ç ïäÐV©[4èØ¡)ñ}ê³»Wz#¸" or missing value [ 599.297127][T12885] zswap: compressor zst not available [ 599.621757][T12911] overlayfs: missing 'lowerdir' [ 600.347714][T12934] overlayfs: missing 'lowerdir' [ 601.470891][T12948] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2716'. [ 602.343743][ T7014] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 602.520424][T12967] loop1: detected capacity change from 0 to 4096 [ 602.639663][ T7014] usb 6-1: Using ep0 maxpacket: 8 [ 603.012364][T12967] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 603.023155][ T7014] usb 6-1: config 0 interface 0 altsetting 24 endpoint 0x81 has an invalid bInterval 125, changing to 10 [ 603.045367][ T7014] usb 6-1: config 0 interface 0 altsetting 24 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 603.072380][T12967] ntfs3: loop1: Failed to load $Extend. [ 603.100355][ T7014] usb 6-1: config 0 interface 0 has no altsetting 0 [ 603.118023][ T7014] usb 6-1: New USB device found, idVendor=056a, idProduct=00fa, bcdDevice= 0.00 [ 603.148586][ T7014] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 603.177444][T12977] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2728'. [ 603.255292][ T7014] usb 6-1: config 0 descriptor?? [ 603.452988][T12987] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2734'. [ 603.638682][T12999] block device autoloading is deprecated and will be removed. [ 603.709118][T13005] overlayfs: missing 'lowerdir' [ 603.819711][ T7014] wacom 0003:056A:00FA.0003: hidraw0: USB HID v10.01 Device [HID 056a:00fa] on usb-dummy_hcd.5-1/input0 [ 604.046311][ T4281] usb 6-1: USB disconnect, device number 10 [ 604.296566][T13012] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2742'. [ 604.605631][T13010] fido_id[13010]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 605.311709][T13031] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2748'. [ 605.498624][T13041] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2755'. [ 605.916893][T13059] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2762'. [ 606.502439][T13062] tipc: Enabling of bearer rejected, media not registered [ 606.714671][T13064] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2765'. [ 606.821642][T13071] Cannot find add_set index 0 as target [ 606.948776][T13075] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2769'. [ 607.643888][T13045] loop5: detected capacity change from 0 to 32768 [ 607.732242][T13045] (syz.5.2757,13045,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 607.815054][T13045] (syz.5.2757,13045,0):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC. [ 607.853444][T13098] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2778'. [ 607.906818][T13100] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2779'. [ 607.971700][T13045] JBD2: Ignoring recovery information on journal [ 608.137825][T13045] ocfs2: Mounting device (7,5) on (node local, slot 0) with ordered data mode. [ 608.829242][T13111] overlayfs: missing 'lowerdir' [ 609.664099][T13117] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2784'. [ 610.013023][ T6050] ocfs2: Unmounting device (7,5) on (node local) [ 610.269124][T13125] overlayfs: missing 'lowerdir' [ 610.918677][T13130] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2788'. [ 610.947943][T13134] loop1: detected capacity change from 0 to 256 [ 612.768076][T13150] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2792'. [ 613.382968][T13162] overlayfs: missing 'lowerdir' [ 614.458064][T13174] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2798'. [ 615.138983][T13181] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2805'. [ 616.200714][T13201] loop1: detected capacity change from 0 to 4096 [ 616.690324][T13205] overlayfs: missing 'lowerdir' [ 616.708105][T13201] ntfs3: loop1: Different NTFS' sector size (4096) and media sector size (512) [ 617.240279][T13199] ntfs3: loop1: ntfs_set_state r=3 failed, -22. [ 617.251755][ T26] audit: type=1800 audit(1793726720.365:189): pid=13199 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2810" name="file1" dev="loop1" ino=34 res=0 errno=0 [ 617.406636][ T8912] ntfs3: loop1: ntfs3_write_inode r=3 failed, -22. [ 617.439669][ T4189] ntfs3: loop1: ntfs_set_state r=3 failed, -22. [ 617.453409][ T4189] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 617.491727][ T4189] ntfs3: loop1: ntfs_set_state r=3 failed, -22. [ 617.514184][ T4880] ntfs3: loop1: ntfs3_write_inode r=3 failed, -22. [ 617.531664][ T4189] ntfs3: loop1: ntfs_evict_inode r=5 failed, -22. [ 617.538766][ T4189] ntfs3: loop1: ntfs_evict_inode r=3 failed, -22. [ 617.552200][T13220] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2820'. [ 617.573025][T13222] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2819'. [ 617.916669][T13239] overlayfs: missing 'lowerdir' [ 619.893448][T13260] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2834'. [ 620.085626][T13270] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2837'. [ 620.664837][T13286] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2844'. [ 620.815738][T13295] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2848'. [ 621.077795][T13309] loop5: detected capacity change from 0 to 512 [ 621.097320][T13307] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2854'. [ 621.119382][ T7012] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 621.138619][T13311] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2856'. [ 621.253081][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.275713][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.312287][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.327950][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.396285][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.412582][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.442246][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.462101][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.476707][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.485596][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.505430][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.519141][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.537783][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.548624][ T7012] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 621.562658][ T7012] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 621.582328][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.601025][ T7012] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 621.611894][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.626521][T13327] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2863'. [ 621.638758][ T7012] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 621.650722][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.671308][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.680125][ T7012] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 621.689092][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.720828][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.733659][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.743919][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.766711][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.790487][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.812803][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.827989][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.834079][ T7012] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 621.855947][ T7012] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 621.864702][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.873570][ T7012] usb 2-1: Product: syz [ 621.891775][ T7012] usb 2-1: Manufacturer: syz [ 621.909682][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.918441][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 621.950760][ T7012] cdc_wdm 2-1:1.0: skipping garbage [ 621.958420][ T7012] cdc_wdm 2-1:1.0: skipping garbage [ 621.983642][ T7012] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 621.999698][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 622.013668][ T7012] cdc_wdm 2-1:1.0: Unknown control protocol [ 622.026372][T13340] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2869'. [ 622.063027][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 622.085153][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 622.102697][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 622.112551][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 622.122048][T13342] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2870'. [ 622.134733][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 622.143701][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 622.156045][T13309] FAT-fs (loop5): error, fat_bmap_cluster: request beyond EOF (i_pos 49) [ 622.178029][ T26] audit: type=1800 audit(1793726725.285:190): pid=13309 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.2855" name="file0" dev="loop5" ino=1048776 res=0 errno=0 [ 622.520490][T13357] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2877'. [ 622.786737][ T7012] usb 2-1: USB disconnect, device number 7 [ 623.380097][T13375] loop5: detected capacity change from 0 to 256 [ 624.201662][ T1426] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.208072][ T1426] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.366210][T13395] loop5: detected capacity change from 0 to 256 [ 624.400654][T13395] exfat: Deprecated parameter 'utf8' [ 624.406213][T13395] exfat: Deprecated parameter 'namecase' [ 624.413237][T13395] exfat: Deprecated parameter 'namecase' [ 624.419018][T13395] exfat: Deprecated parameter 'utf8' [ 624.447386][T13395] exFAT-fs (loop5): failed to load upcase table (idx : 0x0001fe89, chksum : 0xc374f927, utbl_chksum : 0xe619d30d) [ 624.893304][T13421] overlayfs: missing 'lowerdir' [ 624.973355][T13422] __nla_validate_parse: 1 callbacks suppressed [ 624.973405][T13422] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2903'. [ 625.807095][T13428] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2905'. [ 625.872488][T13436] loop5: detected capacity change from 0 to 256 [ 626.187401][T13448] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2914'. [ 626.574717][T13454] overlayfs: missing 'lowerdir' [ 628.006411][T13464] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2918'. [ 628.222183][T13475] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2920'. [ 629.076703][ T7012] kernel write not supported for file /input/event2 (pid: 7012 comm: kworker/0:11) [ 629.295479][T13493] overlayfs: missing 'lowerdir' [ 629.362101][T13493] loop1: detected capacity change from 0 to 1024 [ 629.413596][T13493] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 629.423618][T13493] EXT4-fs (loop1): Ignoring removed nomblk_io_submit option [ 629.431229][T13493] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 629.626302][T13493] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e055c01c, mo2=0002] [ 629.635109][T13493] System zones: 0-1, 3-36 [ 629.715575][T13493] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpquota,jqfmt=vfsold,resuid=0x0000000000000000,debug,dioread_nolock,bsddf,nomblk_io_submit,noauto_da_alloc,,errors=continue. Quota mode: writeback. [ 629.845733][T13493] EXT4-fs (loop1): re-mounted. Opts: (null). Quota mode: writeback. [ 630.138492][T13491] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2930'. [ 630.211864][T13498] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2931'. [ 630.385216][T13503] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2934'. [ 630.643587][T13516] loop5: detected capacity change from 0 to 4096 [ 630.692026][T13516] ntfs3: loop5: Different NTFS' sector size (4096) and media sector size (512) [ 631.481218][T13513] ntfs3: loop5: ntfs_set_state r=3 failed, -22. [ 631.494537][ T26] audit: type=1800 audit(1793726734.605:191): pid=13513 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.2936" name="file1" dev="loop5" ino=34 res=0 errno=0 [ 631.764414][ T6383] ntfs3: loop5: ntfs3_write_inode r=3 failed, -22. [ 631.971627][ T6050] ntfs3: loop5: ntfs_set_state r=3 failed, -22. [ 631.981303][ T6050] ntfs3: loop5: Mark volume as dirty due to NTFS errors [ 632.029550][ T6050] ntfs3: loop5: ntfs_set_state r=3 failed, -22. [ 632.061663][ T145] ntfs3: loop5: ntfs3_write_inode r=3 failed, -22. [ 632.069599][ T6050] ntfs3: loop5: ntfs_evict_inode r=5 failed, -22. [ 632.105486][ T6050] ntfs3: loop5: ntfs_evict_inode r=3 failed, -22. [ 632.508637][T13549] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2945'. [ 633.293270][T13546] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2950'. [ 633.426535][T13562] loop5: detected capacity change from 0 to 1024 [ 634.590209][ T26] audit: type=1800 audit(1793726737.705:192): pid=13562 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.2954" name="file1" dev="loop5" ino=20 res=0 errno=0 [ 635.282461][T13594] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2966'. [ 636.131225][T13606] loop5: detected capacity change from 0 to 512 [ 636.193941][T13606] FAT-fs (loop5): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 636.338772][ T145] FAT-fs (loop5): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 636.358627][T13611] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2973'. [ 636.478968][T13615] loop5: detected capacity change from 0 to 512 [ 636.524657][T13615] EXT4-fs (loop5): Ignoring removed mblk_io_submit option [ 636.555290][T13615] EXT4-fs (loop5): orphan cleanup on readonly fs [ 636.562710][T13615] EXT4-fs (loop5): Cannot turn on journaled quota: type 0: error -13 [ 636.592700][T13615] EXT4-fs error (device loop5): ext4_clear_blocks:883: inode #13: comm syz.5.2974: attempt to clear invalid blocks 2 len 1 [ 636.626521][T13615] EXT4-fs error (device loop5): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 636.834175][T13622] overlayfs: missing 'lowerdir' [ 637.386340][T13615] EXT4-fs error (device loop5): ext4_free_branches:1030: inode #13: comm syz.5.2974: invalid indirect mapped block 1819239214 (level 0) [ 637.556018][T13615] EXT4-fs error (device loop5): ext4_free_branches:1030: inode #13: comm syz.5.2974: invalid indirect mapped block 1819239214 (level 1) [ 637.619745][T13615] EXT4-fs (loop5): 1 truncate cleaned up [ 637.636134][T13615] EXT4-fs (loop5): mounted filesystem without journal. Opts: data_err=abort,init_itable=0x0000000000000008,mblk_io_submit,minixdf,jqfmt=vfsv0,usrjquota=..,errors=continue. Quota mode: writeback. [ 637.876225][T13630] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2979'. [ 638.043828][T13637] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2981'. [ 638.928706][T13650] futex_wake_op: syz.5.2988 tries to shift op by 144; fix this program [ 638.953575][T13649] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2987'. [ 638.969835][T13650] futex_wake_op: syz.5.2988 tries to shift op by 144; fix this program [ 639.007594][T13646] loop1: detected capacity change from 0 to 512 [ 639.057518][T13657] loop5: detected capacity change from 0 to 256 [ 639.166798][T13646] FAT-fs (loop1): Unrecognized mount option "ÿÿÿÿÿR ç ïäÐV©[4èØ¡)ñ}ê³»Wz#¸" or missing value [ 640.111453][T13669] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2994'. [ 640.287020][T13673] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2994'. [ 640.716868][T13678] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2999'. [ 640.836895][T13683] loop5: detected capacity change from 0 to 2048 [ 640.873600][T13688] loop1: detected capacity change from 0 to 256 [ 640.900867][T13690] overlayfs: failed to clone upperpath [ 640.936837][T13690] overlayfs: failed to clone lowerpath [ 640.974784][T13688] exfat: Deprecated parameter 'utf8' [ 641.015747][T13688] exfat: Deprecated parameter 'utf8' [ 641.028746][T13683] EXT4-fs (loop5): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 641.089604][T13683] ext4 filesystem being mounted at /326/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 641.140062][T13688] exFAT-fs (loop1): failed to load upcase table (idx : 0x00010000, chksum : 0x18acca35, utbl_chksum : 0xe619d30d) [ 641.175731][T13702] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3005'. [ 641.473489][T13683] fs-verity: sha512 using implementation "sha512-avx2" [ 641.807537][T13710] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3008'. [ 641.847223][T13714] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3010'. [ 642.032837][T13720] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 642.100514][T13719] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3013'. [ 642.628441][T13738] capability: warning: `syz.0.3021' uses 32-bit capabilities (legacy support in use) [ 642.934174][T13742] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3023'. [ 643.304414][T13746] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3025'. [ 643.440153][T13755] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3025'. [ 644.249518][T13757] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3029'. [ 644.482440][T13769] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3034'. [ 644.494482][ T7012] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 644.869524][ T7012] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 644.891353][ T7012] usb 6-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 644.929271][ T7012] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 644.959576][ T7012] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 645.009983][T13760] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 645.270086][ T7012] usb 6-1: USB disconnect, device number 11 [ 646.014809][T13799] __nla_validate_parse: 1 callbacks suppressed [ 646.014822][T13799] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3046'. [ 646.246686][T13812] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3048'. [ 647.123181][T13818] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3052'. [ 647.221600][T13822] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3055'. [ 647.537744][T13840] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3063'. [ 648.097786][T13853] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3066'. [ 648.202801][T13859] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3068'. [ 649.977511][T13862] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3069'. [ 650.041966][T13876] loop1: detected capacity change from 0 to 256 [ 650.315032][T13879] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3077'. [ 650.828085][T13893] loop1: detected capacity change from 0 to 256 [ 650.919044][T13894] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3082'. [ 651.725544][T13900] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 651.774538][T13899] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3084'. [ 652.478517][T13913] loop5: detected capacity change from 0 to 512 [ 653.053975][T13913] EXT4-fs (loop5): feature flags set on rev 0 fs, running e2fsck is recommended [ 653.357349][T13913] EXT4-fs (loop5): warning: mounting unchecked fs, running e2fsck is recommended [ 653.383639][T13921] loop1: detected capacity change from 0 to 1024 [ 653.407779][T13913] [EXT4 FS bs=2048, gc=1, bpg=16384, ipg=32, mo=a002e01c, mo2=0006] [ 653.436970][T13921] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 653.450580][T13913] System zones: 0-2, 18-18, 34-35 [ 653.469489][T13928] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3095'. [ 653.488639][T13913] EXT4-fs (loop5): mounted filesystem without journal. Opts: nojournal_checksum,init_itable,,errors=continue. Quota mode: none. [ 653.521480][T13913] EXT4-fs (loop5): re-mounted. Opts: . Quota mode: none. [ 653.590059][T13921] EXT4-fs (loop1): mounted filesystem without journal. Opts: discard,bsddf,grpquota,nojournal_checksum,debug_want_extra_isize=0x0000000000000080,delalloc,nogrpid,noauto_da_alloc,dioread_nolock,,errors=continue. Quota mode: writeback. [ 653.764612][T13939] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3102'. [ 654.416004][T13948] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3100'. [ 654.852476][T13960] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3107'. [ 654.963755][T13968] loop5: detected capacity change from 0 to 256 [ 654.997394][ T6408] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 655.033271][T13968] exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0x8f9fe1ed, utbl_chksum : 0xe619d30d) [ 655.259553][ T6408] usb 2-1: Using ep0 maxpacket: 16 [ 655.781258][ T6408] usb 2-1: config 0 has an invalid interface number: 105 but max is 0 [ 655.876098][ T6408] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 656.083767][ T6408] usb 2-1: config 0 has no interface number 0 [ 656.170084][T13989] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3120'. [ 656.309422][ T6408] usb 2-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 656.319669][T13993] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3122'. [ 656.341521][ T6408] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 656.362682][ T6408] usb 2-1: Product: syz [ 656.366978][ T6408] usb 2-1: Manufacturer: syz [ 656.380148][ T6408] usb 2-1: SerialNumber: syz [ 656.412237][ T6408] usb 2-1: config 0 descriptor?? [ 656.461961][ T6408] usb 2-1: Found UVC 0.00 device syz (046d:08f3) [ 656.470331][ T6408] usb 2-1: No valid video chain found. [ 656.693110][ T7012] usb 2-1: USB disconnect, device number 8 [ 656.822618][T14017] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3134'. [ 657.827775][T14025] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3136'. [ 657.870349][T14027] loop1: detected capacity change from 0 to 1024 [ 657.935768][T14027] EXT4-fs (loop1): Ignoring removed bh option [ 657.980073][T14027] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 658.040260][T14027] EXT4-fs (loop1): mounted filesystem without journal. Opts: jqfmt=vfsv0,errors=remount-ro,noquota,barrier,dioread_nolock,quota,bh,. Quota mode: writeback. [ 658.089421][T14027] ext4 filesystem being mounted at /456/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 658.124167][T14044] netlink: 2172 bytes leftover after parsing attributes in process `syz.0.3143'. [ 658.147365][T14027] EXT4-fs error (device loop1): ext4_map_blocks:741: inode #15: block 3: comm syz.1.3137: lblock 3 mapped to illegal pblock 3 (length 3) [ 658.180045][T14027] EXT4-fs (loop1): Remounting filesystem read-only [ 658.294037][T14055] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3150'. [ 658.370588][ T7012] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 658.772236][T14069] loop1: detected capacity change from 0 to 4096 [ 658.839310][ T7012] usb 6-1: Using ep0 maxpacket: 16 [ 658.864714][T14069] ntfs3: loop1: Different NTFS' sector size (4096) and media sector size (512) [ 658.959819][ T7012] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 659.034237][T14069] ntfs3: loop1: ntfs_set_state r=3 failed, -22. [ 659.104785][ T26] audit: type=1800 audit(1793726762.195:193): pid=14069 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.3149" name="file1" dev="loop1" ino=34 res=0 errno=0 [ 659.294979][ T7012] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 659.309319][ T7012] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 659.371119][ T7012] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 659.385471][ T7012] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 659.403000][ T7012] usb 6-1: config 0 descriptor?? [ 659.418792][ T145] ntfs3: loop1: ntfs3_write_inode r=3 failed, -22. [ 659.439539][ T4189] ntfs3: loop1: ntfs_set_state r=3 failed, -22. [ 659.448561][ T4189] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 659.477830][ T4189] ntfs3: loop1: ntfs_set_state r=3 failed, -22. [ 659.489709][ T4386] ntfs3: loop1: ntfs3_write_inode r=3 failed, -22. [ 659.496665][ T4189] ntfs3: loop1: ntfs_evict_inode r=5 failed, -22. [ 659.508596][ T4189] ntfs3: loop1: ntfs_evict_inode r=3 failed, -22. [ 659.610111][T14079] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 659.626409][T14077] loop1: detected capacity change from 0 to 512 [ 659.704546][T14077] EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended [ 659.776903][T14077] EXT4-fs error (device loop1): ext4_orphan_get:1436: comm syz.1.3154: bad orphan inode 13 [ 659.789706][T14077] ext4_test_bit(bit=12, block=18) = 1 [ 659.795146][T14077] is_bad_inode(inode)=0 [ 659.816693][T14077] NEXT_ORPHAN(inode)=0 [ 659.835047][T14077] max_ino=32 [ 659.838341][T14077] i_nlink=1 [ 659.901441][ T7012] microsoft 0003:045E:07DA.0004: unknown main item tag 0x0 [ 659.949577][T14077] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 660.017983][T14088] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3161'. [ 660.049514][ T7012] input: HID 045e:07da as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:045E:07DA.0004/input/input10 [ 660.233045][T14092] EXT4-fs warning (device loop1): ext4_update_dynamic_rev:1062: updating to rev 1 because of new feature flag, running e2fsck is recommended [ 660.518636][ T7012] microsoft 0003:045E:07DA.0004: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.5-1/input0 [ 660.543551][T14092] EXT4-fs error (device loop1): ext4_validate_block_bitmap:438: comm syz.1.3154: bg 0: block 248: padding at end of block bitmap is not set [ 660.587532][ T7012] usb 6-1: USB disconnect, device number 12 [ 660.620061][T14092] Quota error (device loop1): write_blk: dquota write failed [ 660.648043][T14092] Quota error (device loop1): qtree_write_dquot: Error -28 occurred while creating quota [ 660.726573][T14099] fido_id[14099]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 660.746475][T14092] EXT4-fs error (device loop1): ext4_acquire_dquot:6236: comm syz.1.3154: Failed to acquire dquot type 1 [ 660.832880][ T145] Quota error (device loop1): remove_tree: Getting block too big (0 >= 6) [ 660.848638][ T145] EXT4-fs error (device loop1): ext4_release_dquot:6272: comm kworker/u4:1: Failed to release dquot type 1 [ 661.263539][T14125] loop1: detected capacity change from 0 to 128 [ 661.459612][T14125] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=256, location=256 [ 661.811655][T14130] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3176'. [ 662.095872][T14150] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3183'. [ 662.117711][ T26] audit: type=1800 audit(1793726765.225:194): pid=14132 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.3175" name="file1" dev="loop1" ino=94 res=0 errno=0 [ 662.455819][T14164] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3191'. [ 662.982432][T14176] 9pnet: Insufficient options for proto=fd [ 663.156906][T14185] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3198'. [ 663.355207][ T6408] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 664.369657][ T6408] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 664.441897][ T6408] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 664.463463][ T6408] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 64 [ 664.479573][ T6408] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 64 [ 664.506963][ T6408] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x84 has invalid maxpacket 64 [ 664.534057][ T6408] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 64 [ 664.555154][ T6408] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 64 [ 664.572008][ T6408] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x87 has invalid maxpacket 64 [ 664.585235][ T6408] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 64 [ 664.602890][ T6408] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 664.615714][ T6408] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 664.631751][ T6408] usb 6-1: config 1 interface 0 altsetting 0 has 9 endpoint descriptors, different from the interface descriptor's value: 14 [ 664.714986][T14207] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3206'. [ 664.731416][T14209] loop1: detected capacity change from 0 to 64 [ 664.820132][ T6408] usb 6-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 664.849254][ T6408] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 664.861782][ T6408] usb 6-1: Product: syz [ 664.979221][ T6408] usb 6-1: Manufacturer: syz [ 664.983933][ T6408] usb 6-1: SerialNumber: syz [ 665.025992][T14215] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3211'. [ 665.090456][T14180] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 665.108317][T14180] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 665.125277][T14180] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 665.132720][T14180] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 665.145928][T14180] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 665.153443][T14180] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 665.167572][T14180] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 665.174821][T14180] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 665.253060][ T6408] keyspan 6-1:1.0: Keyspan 2 port adapter converter detected [ 665.267581][ T6408] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 7 [ 665.276404][ T6408] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 5 [ 665.653133][ T6408] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB0 [ 665.662427][ T6408] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 3 [ 665.670118][ T6408] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 4 [ 665.677966][ T6408] keyspan 6-1:1.0: found no endpoint descriptor for endpoint 6 [ 665.709926][ T6408] usb 6-1: Keyspan 2 port adapter converter now attached to ttyUSB1 [ 666.069115][ T6408] usb 6-1: USB disconnect, device number 13 [ 666.094850][T14238] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3219'. [ 666.115710][ T6408] keyspan_2 ttyUSB0: Keyspan 2 port adapter converter now disconnected from ttyUSB0 [ 666.164731][ T4386] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 666.170435][ T6408] keyspan_2 ttyUSB1: Keyspan 2 port adapter converter now disconnected from ttyUSB1 [ 666.224240][ T6408] keyspan 6-1:1.0: device disconnected [ 666.367309][ T4386] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 666.458252][ T4386] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 666.592805][ T4386] batman_adv: batadv0: Interface deactivated: netdevsim0 [ 667.101389][ T4386] batman_adv: batadv0: Removing interface: netdevsim0 [ 667.178143][ T4386] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 667.310846][T14248] rxe_eth0 speed is unknown, defaulting to 1000 [ 667.329265][T14256] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3226'. [ 667.854713][T14269] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3233'. [ 668.029048][T14255] loop5: detected capacity change from 0 to 32768 [ 668.187608][T14248] chnl_net:caif_netlink_parms(): no params data found [ 668.222273][T14255] JBD2: Ignoring recovery information on journal [ 668.307215][T14290] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3239'. [ 668.384135][T14255] ocfs2: Mounting device (7,5) on (node local, slot 0) with ordered data mode. [ 668.659519][T14248] bridge0: port 1(bridge_slave_0) entered blocking state [ 668.666807][T14248] bridge0: port 1(bridge_slave_0) entered disabled state [ 668.705302][T14248] device bridge_slave_0 entered promiscuous mode [ 668.714185][T14248] bridge0: port 2(bridge_slave_1) entered blocking state [ 668.722054][T14248] bridge0: port 2(bridge_slave_1) entered disabled state [ 668.730517][T14248] device bridge_slave_1 entered promiscuous mode [ 669.073631][ T6050] ocfs2: Unmounting device (7,5) on (node local) [ 669.425240][ T4356] Bluetooth: hci0: command 0x0409 tx timeout [ 669.459714][T14248] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 669.491825][T14248] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 669.644709][T14248] team0: Port device team_slave_0 added [ 669.689732][T14317] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3245'. [ 669.711383][T14248] team0: Port device team_slave_1 added [ 669.864302][T14248] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 669.874407][T14248] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 669.994431][T14248] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 670.009372][T14248] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 670.025212][T14248] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 670.079452][T14248] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 670.166480][ T4386] device bond0 left promiscuous mode [ 670.172416][ T4386] device bond_slave_0 left promiscuous mode [ 670.178552][ T4386] device bond_slave_1 left promiscuous mode [ 670.216611][ T4386] device batadv0 left promiscuous mode [ 670.245319][ T4386] device hsr_slave_0 left promiscuous mode [ 670.256781][ T4386] device hsr_slave_1 left promiscuous mode [ 670.271386][ T4386] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 670.286310][ T4386] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 670.298899][ T4386] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 670.313369][ T4386] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 670.324230][ T4386] device bridge_slave_1 left promiscuous mode [ 670.336522][ T4386] bridge0: port 2(bridge_slave_1) entered disabled state [ 670.355243][ T4386] device bridge_slave_0 left promiscuous mode [ 670.375324][ T4386] bridge0: port 1(bridge_slave_0) entered disabled state [ 670.418744][ T4386] device veth1_macvtap left promiscuous mode [ 670.428981][ T4386] device veth0_macvtap left promiscuous mode [ 670.445232][ T4386] device veth1_vlan left promiscuous mode [ 670.463960][ T4386] device veth0_vlan left promiscuous mode [ 671.107491][ T4386] team0 (unregistering): Port device team_slave_1 removed [ 671.123829][ T4386] team0 (unregistering): Port device team_slave_0 removed [ 671.139099][ T4386] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 671.157934][ T4386] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 671.237364][ T4386] bond0 (unregistering): Released all slaves [ 671.270953][T14248] device hsr_slave_0 entered promiscuous mode [ 671.278216][T14248] device hsr_slave_1 entered promiscuous mode [ 671.285421][T14248] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 671.293757][T14248] Cannot create hsr debugfs directory [ 671.299695][T14335] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3251'. [ 671.452531][T14366] loop5: detected capacity change from 0 to 512 [ 671.519854][ T7014] Bluetooth: hci0: command 0x041b tx timeout [ 672.520430][T14248] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 672.550086][T14248] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 672.595611][T14248] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 672.622936][T14248] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 673.559282][ T7019] Bluetooth: hci0: command 0x040f tx timeout [ 673.716792][T14398] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3267'. [ 673.738437][T14397] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3269'. [ 673.774717][T14248] 8021q: adding VLAN 0 to HW filter on device bond0 [ 673.851015][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 673.879790][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 673.913319][T14248] 8021q: adding VLAN 0 to HW filter on device team0 [ 673.955113][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 673.990705][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 674.019999][ T4344] bridge0: port 1(bridge_slave_0) entered blocking state [ 674.027175][ T4344] bridge0: port 1(bridge_slave_0) entered forwarding state [ 674.093552][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 674.146643][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 674.175974][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 674.215407][ T4344] bridge0: port 2(bridge_slave_1) entered blocking state [ 674.222764][ T4344] bridge0: port 2(bridge_slave_1) entered forwarding state [ 674.309968][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 674.350756][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 674.391781][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 674.433511][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 674.460572][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 674.502550][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 674.548762][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 674.608371][T14248] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 674.649367][T14248] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 674.692247][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 674.705461][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 674.749964][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 674.789656][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 674.815333][T14418] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3274'. [ 674.953233][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 675.270371][ T4880] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 675.284745][ T4880] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 675.774472][ T7019] Bluetooth: hci0: command 0x0419 tx timeout [ 676.135258][T14248] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 677.392984][T14463] ip6_tables: ip6tables: counters copy to user failed while replacing table [ 677.446397][T14461] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3282'. [ 677.786134][ T4384] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 677.804945][ T4384] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 677.905971][T14486] loop5: detected capacity change from 0 to 512 [ 678.795459][T14248] device veth0_vlan entered promiscuous mode [ 678.849976][T14486] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 678.856990][ T4939] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 678.868794][ T4939] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 678.921276][T14248] device veth1_vlan entered promiscuous mode [ 678.946463][ T4939] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 678.956369][T14486] EXT4-fs (loop5): 1 truncate cleaned up [ 678.962537][T14486] EXT4-fs (loop5): mounted filesystem without journal. Opts: init_itable=0x0000000000000001,norecovery,i_version,jqfmt=vfsold,bsdgroups,grpjquota=,,errors=continue. Quota mode: none. [ 678.992374][ T4939] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 679.064956][ T4880] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 679.087295][ T4880] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 679.151702][T14248] device veth0_macvtap entered promiscuous mode [ 679.176017][T14508] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3296'. [ 679.210357][T14248] device veth1_macvtap entered promiscuous mode [ 679.331115][T14248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 679.376399][T14248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 679.425782][T14248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 679.456795][T14248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 679.495761][T14248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 679.519249][T14248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 679.532432][T14528] loop5: detected capacity change from 0 to 256 [ 679.550971][T14248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 679.589665][T14248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 679.608523][T14248] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 679.633619][ T4939] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 679.651268][ T4939] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 679.705319][ T4939] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 679.733449][ T4939] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 679.755385][T14248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 679.917486][T14248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 680.013036][T14248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 680.023938][T14248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 680.034299][T14248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 680.089411][T14248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 680.177944][T14248] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 680.256342][T14248] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 680.358900][T14248] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 680.416354][T14248] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 680.481651][T14248] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 680.490592][T14248] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 680.499372][T14248] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 680.564692][ T4880] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 680.587067][ T4880] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 680.898147][T14561] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3309'. [ 680.924685][ T4880] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 680.943460][ T4880] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 680.987522][ T4939] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 681.089017][ T8912] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 681.109843][ T8912] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 681.136742][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 681.324274][T14576] loop0: detected capacity change from 0 to 7 [ 681.355311][T14576] Dev loop0: unable to read RDB block 7 [ 681.375198][T14576] loop0: unable to read partition table [ 681.396012][T14576] loop0: partition table beyond EOD, truncated [ 681.413111][T14576] loop_reread_partitions: partition scan of loop0 (þ被xü—ŸÑà– ) failed (rc=-5) [ 681.441211][T14581] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3316'. [ 681.551191][T14590] loop6: detected capacity change from 0 to 256 [ 681.737185][T14590] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0x68afaf67, utbl_chksum : 0xe619d30d) [ 682.815710][T14618] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 683.079084][T14631] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3328'. [ 683.239711][T14640] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3330'. [ 683.266054][T14640] device macsec0 entered promiscuous mode [ 684.222829][T14652] loop5: detected capacity change from 0 to 256 [ 684.290546][T14655] sctp: [Deprecated]: syz.0.3336 (pid 14655) Use of int in maxseg socket option. [ 684.290546][T14655] Use struct sctp_assoc_value instead [ 684.379117][T14651] sctp: [Deprecated]: syz.0.3336 (pid 14651) Use of int in max_burst socket option deprecated. [ 684.379117][T14651] Use struct sctp_assoc_value instead [ 685.377408][T14679] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3343'. [ 685.642501][ T1426] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.648899][ T1426] ieee802154 phy1 wpan1: encryption failed: -22 [ 686.330002][T14697] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3345'. [ 686.418650][T14703] overlayfs: missing 'lowerdir' [ 688.012621][T14735] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3357'. [ 688.404949][T14739] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 688.709655][T14747] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3361'. [ 689.484479][T14752] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3362'. [ 689.854800][T14772] netlink: 64 bytes leftover after parsing attributes in process `syz.0.3368'. [ 689.937803][T14776] loop6: detected capacity change from 0 to 256 [ 691.152015][T14798] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3374'. [ 691.173079][T14801] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3375'. [ 691.213478][T14804] jffs2: notice: (14804) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 691.534638][T14817] block device autoloading is deprecated and will be removed. [ 691.774550][T14832] FAULT_INJECTION: forcing a failure. [ 691.774550][T14832] name failslab, interval 1, probability 0, space 0, times 1 [ 691.870276][T14832] CPU: 1 PID: 14832 Comm: syz.6.3384 Not tainted syzkaller #0 [ 691.877824][T14832] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 691.887953][T14832] Call Trace: [ 691.891324][T14832] [ 691.894355][T14832] dump_stack_lvl+0x188/0x250 [ 691.899345][T14832] ? show_regs_print_info+0x20/0x20 [ 691.904612][T14832] ? load_image+0x410/0x410 [ 691.909250][T14832] ? __might_sleep+0xf0/0xf0 [ 691.914117][T14832] ? __lock_acquire+0x7d40/0x7d40 [ 691.919284][T14832] should_fail+0x383/0x4b0 [ 691.923862][T14832] should_failslab+0x5/0x20 [ 691.928466][T14832] slab_pre_alloc_hook+0x51/0xc0 [ 691.933505][T14832] kmem_cache_alloc_trace+0x47/0x290 [ 691.938851][T14832] ? assoc_array_insert+0x8e/0x2e70 [ 691.944262][T14832] assoc_array_insert+0x8e/0x2e70 [ 691.949339][T14832] ? __siphash_unaligned+0x258/0x3d0 [ 691.954739][T14832] ? rwsem_write_trylock+0x135/0x1c0 [ 691.960075][T14832] ? clear_nonspinnable+0x60/0x60 [ 691.965229][T14832] ? key_set_index_key+0x40b/0x540 [ 691.970470][T14832] ? keyring_read+0x190/0x190 [ 691.975186][T14832] ? x509_key_preparse+0x4fa/0x5d0 [ 691.980421][T14832] __key_link_begin+0xd2/0x1e0 [ 691.985231][T14832] key_create_or_update+0x49e/0xa50 [ 691.990486][T14832] ? key_type_put+0x20/0x20 [ 691.995062][T14832] ? __might_fault+0xb3/0x110 [ 691.999885][T14832] __se_sys_add_key+0x34b/0x410 [ 692.004846][T14832] ? __x64_sys_add_key+0xc0/0xc0 [ 692.009831][T14832] ? lockdep_hardirqs_on+0x94/0x140 [ 692.015134][T14832] ? __x64_sys_add_key+0x1c/0xc0 [ 692.020118][T14832] do_syscall_64+0x4c/0xa0 [ 692.024563][T14832] ? clear_bhb_loop+0x30/0x80 [ 692.029412][T14832] ? clear_bhb_loop+0x30/0x80 [ 692.034160][T14832] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 692.040127][T14832] RIP: 0033:0x7fad38c75b19 [ 692.044631][T14832] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 692.064571][T14832] RSP: 002b:00007fad36ecc028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 692.073064][T14832] RAX: ffffffffffffffda RBX: 00007fad38efbfa0 RCX: 00007fad38c75b19 [ 692.081080][T14832] RDX: 00002000000009c0 RSI: 0000000000000000 RDI: 0000200000000980 [ 692.089114][T14832] RBP: 00007fad38d0db70 R08: ffffffffffffffff R09: 0000000000000000 [ 692.097120][T14832] R10: 0000000000000559 R11: 0000000000000246 R12: 0000000000000000 [ 692.105142][T14832] R13: 00007fad38efc038 R14: 00007fad38efbfa0 R15: 00007fff12a476a8 [ 692.113186][T14832] [ 692.134548][T14838] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3385'. [ 692.861175][T14848] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3388'. [ 692.913699][T14850] loop5: detected capacity change from 0 to 2048 [ 692.972526][T14850] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 693.157101][T14855] overlayfs: missing 'lowerdir' [ 694.253602][T14873] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 694.387269][T14885] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3400'. [ 694.406625][T14883] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3399'. [ 694.539390][ T21] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 695.629390][ T21] usb 6-1: Using ep0 maxpacket: 32 [ 695.668797][T14917] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3414'. [ 695.774323][T14921] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3416'. [ 695.786354][ T4203] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 695.955078][ T21] usb 6-1: New USB device found, idVendor=2304, idProduct=0222, bcdDevice=77.3f [ 695.974718][ T21] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 696.005056][ T21] usb 6-1: Product: syz [ 696.015278][ T21] usb 6-1: Manufacturer: syz [ 696.020965][ T21] usb 6-1: SerialNumber: syz [ 696.054271][ T21] usb 6-1: config 0 descriptor?? [ 696.116983][ T21] dvb-usb: found a 'Pinnacle 450e DVB-S USB2.0' in warm state. [ 696.126177][ T21] dvb-usb: bulk message failed: -22 (4/0) [ 696.132444][ T21] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 696.144312][ T21] dvb-usb: bulk message failed: -22 (5/0) [ 696.150487][ T21] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 696.167310][ T21] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 696.189754][ T21] dvbdev: DVB: registering new adapter (Pinnacle 450e DVB-S USB2.0) [ 696.199898][ T21] usb 6-1: media controller created [ 696.222036][ T4203] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 696.241000][ T21] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 696.259275][ T4203] usb 7-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 696.295584][ T21] usb 6-1: selecting invalid altsetting 3 [ 696.301831][ T21] ttusb2: set interface to alts=3 failed [ 696.322513][T14877] dvb-usb: bulk message failed: -22 (7/0) [ 696.343688][T14877] ttusb2: there might have been an error during control message transfer. (rlen = 3, was 0) [ 696.378380][T14877] ttusb2: i2c transfer failed. [ 696.397144][ T21] DVB: Unable to find symbol tda10086_attach() [ 696.409466][ T21] dvb-usb: no frontend was attached by 'Pinnacle 450e DVB-S USB2.0' [ 696.439630][ T4203] usb 7-1: New USB device found, idVendor=0711, idProduct=0900, bcdDevice= 1.00 [ 696.467075][ T4203] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 696.479359][ T21] dvb-usb: bulk message failed: -22 (4/0) [ 696.485183][ T21] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 696.505673][ T4203] usb 7-1: Product: syz [ 696.510290][ T4203] usb 7-1: Manufacturer: syz [ 696.514940][ T4203] usb 7-1: SerialNumber: syz [ 696.529571][ T21] dvb-usb: bulk message failed: -22 (5/0) [ 696.535507][ T21] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 696.554190][ T21] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully initialized and connected. [ 696.601486][ T21] usb 6-1: USB disconnect, device number 14 [ 696.633339][T14953] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3427'. [ 696.687592][ T21] dvb-usb: Pinnacle 450e DVB-S USB2.0 successfully deinitialized and disconnected. [ 696.816098][ T4203] usblp 7-1:1.0: usblp0: USB Bidirectional printer dev 2 if 0 alt 0 proto 2 vid 0x0711 pid 0x0900 [ 696.883156][T14963] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3432'. [ 697.236030][ T21] usb 7-1: USB disconnect, device number 2 [ 697.267855][ T21] usblp0: removed [ 697.367630][T14990] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3443'. [ 697.608913][T15001] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3447'. [ 697.783762][T14975] loop5: detected capacity change from 0 to 32768 [ 697.951504][T14975] XFS (loop5): Mounting V5 Filesystem [ 698.087353][T14975] XFS (loop5): Ending clean mount [ 698.201161][T14975] XFS (loop5): Metadata CRC error detected at xfs_allocbt_read_verify+0x3a/0xd0, xfs_bnobt block 0x4 [ 698.269618][T14975] XFS (loop5): Unmount and run xfs_repair [ 698.275423][T14975] XFS (loop5): First 128 bytes of corrupted metadata buffer: [ 698.339100][T14975] 00000000: 41 42 33 42 00 00 00 03 ff ff ff ff ff ff ff ff AB3B............ [ 698.369954][T14975] 00000010: 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 10 ................ [ 698.443752][T15034] overlayfs: missing 'lowerdir' [ 698.449516][T14975] 00000020: ed 37 bf 6e 74 ea 4e 01 f8 ba 5f ee 27 4b 0f 3a .7.nt.N..._.'K.: [ 698.619993][T14975] 00000030: 00 00 00 00 f6 3b 25 b5 00 00 00 07 00 00 00 01 .....;%......... [ 699.260161][T14975] 00000040: 00 00 0b fe 00 00 00 02 00 00 0c 20 00 00 13 e0 ........... .... [ 699.279289][T14975] 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 699.304053][T15038] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3455'. [ 699.320427][T15031] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3454'. [ 699.342509][T14975] 00000060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 699.419608][T14975] 00000070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [ 699.444080][T14975] XFS (loop5): metadata I/O error in "xfs_btree_read_buf_block+0x1db/0x2d0" at daddr 0x4 len 4 error 74 [ 699.550105][T14975] XFS (loop5): Metadata I/O Error (0x1) detected at xfs_trans_read_buf_map+0x515/0x8b0 (fs/xfs/xfs_trans_buf.c:296). Shutting down filesystem. [ 699.615573][T14975] XFS (loop5): Please unmount the filesystem and rectify the problem(s) [ 699.704188][ T6050] XFS (loop5): Unmounting Filesystem [ 699.795328][T15060] overlayfs: failed to clone upperpath [ 700.069614][T15073] overlayfs: missing 'lowerdir' [ 700.137694][T15073] loop6: detected capacity change from 0 to 1024 [ 700.887292][T15075] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3468'. [ 700.913852][T15073] EXT4-fs (loop6): Quota format mount options ignored when QUOTA feature is enabled [ 700.923586][T15073] EXT4-fs (loop6): Ignoring removed nomblk_io_submit option [ 700.931048][T15073] EXT4-fs (loop6): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 700.972298][T15073] [EXT4 FS bs=1024, gc=1, bpg=131072, ipg=32, mo=e055c01c, mo2=0002] [ 700.980554][T15073] System zones: 0-1, 3-36 [ 700.987213][T15073] EXT4-fs (loop6): mounted filesystem without journal. Opts: grpquota,jqfmt=vfsold,resuid=0x0000000000000000,debug,dioread_nolock,bsddf,nomblk_io_submit,noauto_da_alloc,,errors=continue. Quota mode: writeback. [ 701.133817][T15071] EXT4-fs (loop6): re-mounted. Opts: (null). Quota mode: writeback. [ 701.148152][T15080] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3469'. [ 701.776611][T15103] loop5: detected capacity change from 0 to 256 [ 701.817431][T15103] exFAT-fs (loop5): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 701.871302][T15103] exFAT-fs (loop5): Medium has reported failures. Some data may be lost. [ 701.910327][T15103] exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0xe62de5da, utbl_chksum : 0xe619d30d) [ 702.162329][T15110] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3478'. [ 702.655799][ C1] vcan0: j1939_tp_rxtimer: 0xffff888060fe0400: rx timeout, send abort [ 702.668120][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff888060fe0400: 0x2ff03: (3) A timeout occurred and this is the connection abort to close the session. [ 703.325240][T15113] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3478'. [ 703.737571][T15115] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3480'. [ 703.964918][T15119] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3482'. [ 704.065998][T15125] FAULT_INJECTION: forcing a failure. [ 704.065998][T15125] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 704.103894][T15125] CPU: 1 PID: 15125 Comm: syz.6.3485 Not tainted syzkaller #0 [ 704.111448][T15125] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 704.121547][T15125] Call Trace: [ 704.124871][T15125] [ 704.127836][T15125] dump_stack_lvl+0x188/0x250 [ 704.132568][T15125] ? show_regs_print_info+0x20/0x20 [ 704.137813][T15125] ? load_image+0x410/0x410 [ 704.142379][T15125] ? __lock_acquire+0x7d40/0x7d40 [ 704.147586][T15125] should_fail+0x383/0x4b0 [ 704.152064][T15125] prepare_alloc_pages+0x1e3/0x5b0 [ 704.157274][T15125] __alloc_pages+0x11b/0x480 [ 704.161924][T15125] ? zone_statistics+0x170/0x170 [ 704.166929][T15125] ? __rwlock_init+0x140/0x140 [ 704.171726][T15125] ? alloc_pages+0x452/0x560 [ 704.176380][T15125] __get_free_pages+0x8/0x30 [ 704.180984][T15125] kasan_populate_vmalloc_pte+0x21/0xc0 [ 704.186645][T15125] __apply_to_page_range+0x987/0xd10 [ 704.191961][T15125] ? kasan_populate_vmalloc+0x70/0x70 [ 704.197413][T15125] alloc_vmap_area+0x19e8/0x1b30 [ 704.202428][T15125] ? vm_map_ram+0xba0/0xba0 [ 704.206991][T15125] __get_vm_area_node+0x14f/0x2d0 [ 704.212037][T15125] __vmalloc_node_range+0xef/0x8b0 [ 704.217303][T15125] ? array_map_alloc+0x428/0x6f0 [ 704.222340][T15125] ? apparmor_capable+0x12c/0x190 [ 704.227455][T15125] ? bpf_lsm_capable+0x5/0x10 [ 704.232263][T15125] bpf_map_area_mmapable_alloc+0xad/0xd0 [ 704.238024][T15125] ? array_map_alloc+0x428/0x6f0 [ 704.243023][T15125] array_map_alloc+0x428/0x6f0 [ 704.247842][T15125] map_create+0x481/0x2330 [ 704.252284][T15125] ? bpf_lsm_bpf+0x5/0x10 [ 704.256740][T15125] __sys_bpf+0x30a/0x6f0 [ 704.261049][T15125] ? bpf_link_show_fdinfo+0x380/0x380 [ 704.266502][T15125] __x64_sys_bpf+0x78/0x90 [ 704.270998][T15125] do_syscall_64+0x4c/0xa0 [ 704.275469][T15125] ? clear_bhb_loop+0x30/0x80 [ 704.280215][T15125] ? clear_bhb_loop+0x30/0x80 [ 704.284922][T15125] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 704.290848][T15125] RIP: 0033:0x7fad38c75b19 [ 704.295301][T15125] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 704.314944][T15125] RSP: 002b:00007fad36ecc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 704.323379][T15125] RAX: ffffffffffffffda RBX: 00007fad38efbfa0 RCX: 00007fad38c75b19 [ 704.331371][T15125] RDX: 0000000000000048 RSI: 00002000000003c0 RDI: 0000000000000000 [ 704.339396][T15125] RBP: 00007fad38d0db70 R08: 0000000000000000 R09: 0000000000000000 [ 704.347602][T15125] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 704.355608][T15125] R13: 00007fad38efc038 R14: 00007fad38efbfa0 R15: 00007fff12a476a8 [ 704.363604][T15125] [ 704.471025][T15134] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3488'. [ 704.956454][T15145] loop6: detected capacity change from 0 to 4096 [ 705.114883][T15145] ntfs3: loop6: Different NTFS' sector size (4096) and media sector size (512) [ 705.496926][T15144] ntfs3: loop6: ntfs_set_state r=3 failed, -22. [ 705.506470][ T26] audit: type=1800 audit(1793726808.615:195): pid=15144 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.3491" name="file1" dev="loop6" ino=34 res=0 errno=0 [ 705.665887][ T145] ntfs3: loop6: ntfs3_write_inode r=3 failed, -22. [ 705.687906][T14248] ntfs3: loop6: ntfs_set_state r=3 failed, -22. [ 705.704732][T14248] ntfs3: loop6: Mark volume as dirty due to NTFS errors [ 705.712988][T15156] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3494'. [ 705.720358][T14248] ntfs3: loop6: ntfs_set_state r=3 failed, -22. [ 705.745392][ T145] ntfs3: loop6: ntfs3_write_inode r=3 failed, -22. [ 705.762673][T14248] ntfs3: loop6: ntfs_evict_inode r=5 failed, -22. [ 705.772842][T14248] ntfs3: loop6: ntfs_evict_inode r=3 failed, -22. [ 705.871198][T15159] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3494'. [ 706.782382][T15175] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3502'. [ 708.103158][T15209] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3513'. [ 708.118877][T15208] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3512'. [ 708.139596][T15212] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3514'. [ 708.395765][T15221] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3517'. [ 708.481971][T15224] loop6: detected capacity change from 0 to 2048 [ 708.503827][T15228] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3520'. [ 708.554384][T15179] loop5: detected capacity change from 0 to 32768 [ 708.625838][T15224] EXT4-fs (loop6): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 708.660935][T15179] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop5 scanned by syz.5.3501 (15179) [ 708.698759][T15224] EXT4-fs (loop6): Online resizing not supported with bigalloc [ 708.719353][T15179] BTRFS info (device loop5): using sha256 (sha256-avx2) checksum algorithm [ 708.778978][T15179] BTRFS info (device loop5): using free space tree [ 708.810471][T15179] BTRFS info (device loop5): has skinny extents [ 709.012948][T15250] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3527'. [ 709.118195][T15258] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3525'. [ 710.217432][T15296] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3533'. [ 710.380865][T15307] overlayfs: missing 'lowerdir' [ 710.815964][T15179] BTRFS error (device loop5): open_ctree failed: -22 [ 710.817904][T14815] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop5 scanned by udevd (14815) [ 711.139687][T15316] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3537'. [ 711.408830][T15339] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3542'. [ 713.140141][T15389] loop6: detected capacity change from 0 to 256 [ 713.161013][T15390] __nla_validate_parse: 4 callbacks suppressed [ 713.161032][T15390] netlink: 116 bytes leftover after parsing attributes in process `syz.2.3557'. [ 713.397877][T15404] loop6: detected capacity change from 0 to 512 [ 713.447008][T15401] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3564'. [ 713.502791][T15404] EXT4-fs (loop6): Ignoring removed nomblk_io_submit option [ 713.561425][T15404] EXT4-fs (loop6): mounting ext3 file system using the ext4 subsystem [ 713.637763][T15404] EXT4-fs (loop6): 1 truncate cleaned up [ 713.644243][T15404] EXT4-fs (loop6): mounted filesystem without journal. Opts: noload,max_dir_size_kb=0x0000000000000007,bsddf,nomblk_io_submit,data_err=ignore,usrjquota=,,errors=continue. Quota mode: none. [ 713.709258][ T21] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 713.795794][T15425] overlayfs: missing 'lowerdir' [ 714.139755][ T21] usb 6-1: config 1 has an invalid interface number: 13 but max is 0 [ 714.183699][ T21] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 714.355277][ T21] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 1 [ 714.577294][ T21] usb 6-1: config 1 has no interface number 1 [ 714.600095][ T21] usb 6-1: config 1 interface 13 altsetting 1 has a duplicate endpoint with address 0x1, skipping [ 714.656834][ T21] usb 6-1: config 1 interface 13 altsetting 1 endpoint 0x2 has invalid wMaxPacketSize 0 [ 714.687465][ T21] usb 6-1: config 1 interface 13 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 0 [ 714.705404][T15432] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3570'. [ 714.725959][ T21] usb 6-1: config 1 interface 13 altsetting 1 has 2 endpoint descriptors, different from the interface descriptor's value: 4 [ 714.751168][ T21] usb 6-1: config 1 interface 13 has no altsetting 0 [ 714.802734][T15431] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3569'. [ 714.909365][ T21] usb 6-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00 [ 714.972281][ T21] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 714.996935][ T21] usb 6-1: Product: syz [ 715.009341][ T21] usb 6-1: Manufacturer: syz [ 715.018998][ T21] usb 6-1: SerialNumber: syz [ 715.081180][ T21] usb-storage 6-1:1.0: USB Mass Storage device detected [ 715.112589][ T21] usb-storage 6-1:1.0: Quirks match for vid 174c pid 55aa: 400000 [ 715.131183][T15445] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3574'. [ 715.155184][ T21] scsi host1: usb-storage 6-1:1.0 [ 715.173073][ T21] usb-storage 6-1:1.13: USB Mass Storage device detected [ 715.195942][ T21] usb-storage 6-1:1.13: Quirks match for vid 174c pid 55aa: 400000 [ 715.301699][T15456] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3575'. [ 716.046367][ T21] usb 6-1: USB disconnect, device number 15 [ 716.119984][T15460] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3577'. [ 716.798898][T15483] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3585'. [ 716.850376][T15487] FAULT_INJECTION: forcing a failure. [ 716.850376][T15487] name failslab, interval 1, probability 0, space 0, times 0 [ 716.939379][T15487] CPU: 1 PID: 15487 Comm: syz.5.3587 Not tainted syzkaller #0 [ 716.946911][T15487] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 716.957001][T15487] Call Trace: [ 716.960335][T15487] [ 716.963297][T15487] dump_stack_lvl+0x188/0x250 [ 716.968022][T15487] ? show_regs_print_info+0x20/0x20 [ 716.973261][T15487] ? load_image+0x410/0x410 [ 716.977813][T15487] ? __might_sleep+0xf0/0xf0 [ 716.982435][T15487] ? __lock_acquire+0x7d40/0x7d40 [ 716.987526][T15487] should_fail+0x383/0x4b0 [ 716.991988][T15487] should_failslab+0x5/0x20 [ 716.996524][T15487] slab_pre_alloc_hook+0x51/0xc0 [ 717.001493][T15487] ? vm_area_dup+0x1e/0xb0 [ 717.006031][T15487] kmem_cache_alloc+0x3d/0x280 [ 717.010844][T15487] vm_area_dup+0x1e/0xb0 [ 717.015124][T15487] __split_vma+0xb1/0x410 [ 717.019499][T15487] ? split_vma+0x6b/0xd0 [ 717.023781][T15487] mprotect_fixup+0x5bb/0x800 [ 717.028515][T15487] ? change_protection+0x1940/0x1940 [ 717.033849][T15487] ? vmacache_find+0x4f0/0x590 [ 717.038653][T15487] ? vmacache_update+0xa0/0x100 [ 717.043572][T15487] ? bpf_lsm_file_mprotect+0x5/0x10 [ 717.048813][T15487] ? security_file_mprotect+0x7e/0xb0 [ 717.054326][T15487] do_mprotect_pkey+0x658/0x910 [ 717.059222][T15487] __x64_sys_mprotect+0x7c/0x90 [ 717.064146][T15487] do_syscall_64+0x4c/0xa0 [ 717.068595][T15487] ? clear_bhb_loop+0x30/0x80 [ 717.073305][T15487] ? clear_bhb_loop+0x30/0x80 [ 717.078020][T15487] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 717.083955][T15487] RIP: 0033:0x7fe2740e2b19 [ 717.088403][T15487] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 717.108044][T15487] RSP: 002b:00007fe272339028 EFLAGS: 00000246 ORIG_RAX: 000000000000000a [ 717.116495][T15487] RAX: ffffffffffffffda RBX: 00007fe274368fa0 RCX: 00007fe2740e2b19 [ 717.124497][T15487] RDX: 0000000000000001 RSI: 0000000000004000 RDI: 0000200000000000 [ 717.132480][T15487] RBP: 00007fe27417ab70 R08: 0000000000000000 R09: 0000000000000000 [ 717.140459][T15487] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 717.148436][T15487] R13: 00007fe274369038 R14: 00007fe274368fa0 R15: 00007ffd87e80e48 [ 717.156455][T15487] [ 717.330596][T15489] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3586'. [ 717.734873][T15509] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3594'. [ 717.824872][ T21] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 718.099379][ T21] usb 6-1: Using ep0 maxpacket: 16 [ 718.179547][ T4203] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 718.219527][ T21] usb 6-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 718.242681][ T21] usb 6-1: config 0 interface 0 altsetting 64 endpoint 0x81 has invalid wMaxPacketSize 0 [ 718.269237][ T21] usb 6-1: config 0 interface 0 has no altsetting 0 [ 718.276011][ T21] usb 6-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 718.285877][ T21] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 718.327895][ T21] usb 6-1: config 0 descriptor?? [ 718.355563][T15539] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3602'. [ 718.430606][ T4203] usb 7-1: Using ep0 maxpacket: 8 [ 718.498069][T15550] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3607'. [ 718.549819][ T4203] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 718.589477][ T4203] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 718.635072][ T4203] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 718.645085][ T4203] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 718.666323][ T4203] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 718.685337][ T4203] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 718.694696][ T4203] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 718.802496][ T21] mcp2221 0003:04D8:00DD.0005: unknown main item tag 0x0 [ 718.812547][T15569] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3615'. [ 718.827151][ T21] mcp2221 0003:04D8:00DD.0005: unknown main item tag 0x0 [ 718.845552][ T21] mcp2221 0003:04D8:00DD.0005: unknown main item tag 0x0 [ 718.853044][ T21] mcp2221 0003:04D8:00DD.0005: unknown main item tag 0x0 [ 718.866879][ T21] mcp2221 0003:04D8:00DD.0005: unknown main item tag 0x0 [ 718.875918][ T21] mcp2221 0003:04D8:00DD.0005: USB HID v0.01 Device [HID 04d8:00dd] on usb-dummy_hcd.5-1/input0 [ 718.979801][ T4203] usb 7-1: usb_control_msg returned -32 [ 718.985544][ T4203] usbtmc 7-1:16.0: can't read capabilities [ 719.002723][T15503] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN [ 719.014628][T15503] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 719.023097][T15503] CPU: 1 PID: 15503 Comm: syz.5.3589 Not tainted syzkaller #0 [ 719.030599][T15503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 719.040698][T15503] RIP: 0010:mcp_i2c_xfer+0x58/0x420 [ 719.046069][T15503] Code: 01 00 00 48 89 d8 48 c1 e8 03 42 80 3c 30 00 74 08 48 89 df e8 e9 3a 4b fa 48 8b 1b 48 89 d8 48 c1 e8 03 4d 89 f4 48 89 04 24 <42> 80 3c 30 00 74 08 48 89 df e8 c9 3a 4b fa 4c 8b 33 4d 8d ae 80 [ 719.065706][T15503] RSP: 0018:ffffc9000338fb38 EFLAGS: 00010246 [ 719.071796][T15503] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000080000 [ 719.079780][T15503] RDX: ffffc9000ccd1000 RSI: 0000000000000479 RDI: 000000000000047a [ 719.087770][T15503] RBP: 0000000000000002 R08: ffff88807daae69f R09: 1ffff1100fb55cd3 [ 719.095803][T15503] R10: dffffc0000000000 R11: ffffed100fb55cd4 R12: dffffc0000000000 [ 719.103806][T15503] R13: 1ffff1100fb55c2b R14: dffffc0000000000 R15: ffff88801c627d40 [ 719.111789][T15503] FS: 00007fe2723396c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 719.120753][T15503] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 719.127341][T15503] CR2: 0000001b2dd1eff8 CR3: 000000007a5de000 CR4: 00000000003506e0 [ 719.135343][T15503] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 719.143345][T15503] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 [ 719.151346][T15503] Call Trace: [ 719.154631][T15503] [ 719.157589][T15503] ? mcp_gpio_get+0x260/0x260 [ 719.162384][T15503] __i2c_transfer+0x88d/0x2090 [ 719.168613][T15503] ? i2c_cmd+0x110/0x110 [ 719.172909][T15503] ? __might_fault+0xb7/0x110 [ 719.177665][T15503] i2c_transfer+0x25d/0x3a0 [ 719.182220][T15503] ? __i2c_transfer+0x2090/0x2090 [ 719.187382][T15503] ? __might_fault+0xb3/0x110 [ 719.192132][T15503] ? _copy_from_user+0x111/0x170 [ 719.197122][T15503] i2cdev_ioctl_rdwr+0x3dc/0x6c0 [ 719.202125][T15503] i2cdev_ioctl+0x610/0x7b0 [ 719.206680][T15503] ? i2cdev_write+0x120/0x120 [ 719.211569][T15503] ? bpf_lsm_file_ioctl+0x5/0x10 [ 719.216550][T15503] ? security_file_ioctl+0x7c/0xa0 [ 719.221818][T15503] ? i2cdev_write+0x120/0x120 [ 719.226531][T15503] __se_sys_ioctl+0xfa/0x170 [ 719.231298][T15503] do_syscall_64+0x4c/0xa0 [ 719.235740][T15503] ? clear_bhb_loop+0x30/0x80 [ 719.240443][T15503] ? clear_bhb_loop+0x30/0x80 [ 719.245223][T15503] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 719.251129][T15503] RIP: 0033:0x7fe2740e2b19 [ 719.255597][T15503] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 719.275213][T15503] RSP: 002b:00007fe272339028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 719.283640][T15503] RAX: ffffffffffffffda RBX: 00007fe274368fa0 RCX: 00007fe2740e2b19 [ 719.291625][T15503] RDX: 0000200000000040 RSI: 0000000000000707 RDI: 0000000000000004 [ 719.299628][T15503] RBP: 00007fe27417ab70 R08: 0000000000000000 R09: 0000000000000000 [ 719.307613][T15503] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 719.315605][T15503] R13: 00007fe274369038 R14: 00007fe274368fa0 R15: 00007ffd87e80e48 [ 719.323597][T15503] [ 719.326686][T15503] Modules linked in: [ 719.356943][T15503] ---[ end trace 9466ad11b27bc7b3 ]--- [ 719.362670][T15503] RIP: 0010:mcp_i2c_xfer+0x58/0x420 [ 719.368368][T15503] Code: 01 00 00 48 89 d8 48 c1 e8 03 42 80 3c 30 00 74 08 48 89 df e8 e9 3a 4b fa 48 8b 1b 48 89 d8 48 c1 e8 03 4d 89 f4 48 89 04 24 <42> 80 3c 30 00 74 08 48 89 df e8 c9 3a 4b fa 4c 8b 33 4d 8d ae 80 [ 719.392409][T15503] RSP: 0018:ffffc9000338fb38 EFLAGS: 00010246 [ 719.403647][T15503] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000080000 [ 719.412123][T15503] RDX: ffffc9000ccd1000 RSI: 0000000000000479 RDI: 000000000000047a [ 719.420675][T15503] RBP: 0000000000000002 R08: ffff88807daae69f R09: 1ffff1100fb55cd3 [ 719.428741][T15503] R10: dffffc0000000000 R11: ffffed100fb55cd4 R12: dffffc0000000000 [ 719.436962][T15503] R13: 1ffff1100fb55c2b R14: dffffc0000000000 R15: ffff88801c627d40 [ 719.445424][T15503] FS: 00007fe2723396c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 719.454828][T15503] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 719.462952][T15503] CR2: 00007ffccd03d828 CR3: 000000007a5de000 CR4: 00000000003506e0 [ 719.471660][T15503] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 719.480150][T15503] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 [ 719.488829][T15503] Kernel panic - not syncing: Fatal exception [ 719.495175][T15503] Kernel Offset: disabled [ 719.499536][T15503] Rebooting in 86400 seconds..