last executing test programs: 49.287913908s ago: executing program 1 (id=382): userfaultfd(0x1) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x3, 0x20132, 0xffffffffffffffff, 0xb299b000) mremap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x3000, 0x7, &(0x7f0000ffd000/0x3000)=nil) syz_io_uring_setup(0x141c, &(0x7f00000000c0)={0x0, 0xf9ee, 0x400, 0x3, 0x212}, 0x0, 0x0, 0x0) socket(0x10, 0x803, 0x0) socket(0x10, 0x803, 0x0) socket$unix(0x1, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$key(0xf, 0x3, 0x2) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="1f003300d00000000802110000010802110000005050505050500000", @ANYRES8=r0], 0x3c}, 0x1, 0x0, 0x0, 0x2400c881}, 0x10) munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000) 48.116852139s ago: executing program 1 (id=385): bpf$MAP_CREATE(0x0, &(0x7f0000000680)=@base={0x1c, 0x10, 0x2, 0x0, 0x200, 0xffffffffffffffff, 0x4}, 0x50) 47.856008308s ago: executing program 1 (id=389): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./my_debugfs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./my_debugfs\x00', &(0x7f0000000300)='debugfs\x00', 0x2, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./my_debugfs/usb/devices\x00', 0x0, 0x0) lseek(r0, 0xfffffffffffffff7, 0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 45.055286352s ago: executing program 1 (id=395): syz_mount_image$ext4(&(0x7f00000001c0)='ext4\x00', &(0x7f0000000340)='./file1\x00', 0x210000, &(0x7f0000000400)={[{@nobarrier}, {@dioread_lock}, {@barrier_val}, {@nolazytime}, {@dax_inode}, {@lazytime}, {@errors_remount}, {@stripe={'stripe', 0x3d, 0x4}}, {@bh}, {@mb_optimize_scan={'mb_optimize_scan', 0x3d, 0x1}}]}, 0xfc, 0x56f, &(0x7f0000003780)="$eJzs3d9rW1UcAPDvTdPup66DMdQHGezByVy6tv6YIDgfRYcDfZ+hzcpouowmHWsduD24F19kCCIOxD/Adx+H/4B/xUAHQ0bRBxEiN73psjZp2i4z2fL5wG3Pyb23535z7vf2nNyEBDC0jqU/chEvR8Q3ScShlnX5yFYeW9tu9eH1mXRJol7/9M8kkuyx5vZJ9vtAVnkpIn79KuJkbnO71eWV+WK5XFrM6hO1hSsT1eWVU5cWinOludLlqenpM29NT737zts9i/X1839//8ndD898fXz1u5/vH76dxNk4mK1rjeMJ3GitHCv+m5VG4+yGDSd70NggSfp9AOzKSJbno5FeAw7FSJb1wPPvy4ioA0Mqkf8wpJrjgObcvkfz4GfGgw/WJkCN2Mda48+vvTYSextzo/2ryWMzo3S+O96D9tM2fvnjzu10ia1fh9jXpQ6wIzduRsTpfH7z9T/Jrn+7d7rx4vHWNrYxbP9/oJ/upuOfN9qN/3Lr459oM/450CZ3d6N7/ufu96CZjtLx33ttx7/rl67xkaz2QmPMN5pcvFQunY6IFyPiRNS73vo4s3qv3mld6/gvXdL2m2PB7Dju5/c8vs9ssVaMiLFdhvyYBzcjXsm3iz9Z7/+kTf+nz8f5bbZxtHTn1U7rusf/dNV/initbf8/6tZk6/uTE43zYaJ5Vmz2162jv3Vqv9/xp/2/f+v4x5PW+7XVnbfx495/Sp3W7fb8H0s+a5SbSXCtWKstTkaMJR9vfnzq0b7NenP7NP4Tx7e+/rU7/9PJ1+fbjP/WkVsdNx2E/p/dUf/vvHDvoy9+6NT+9vr/zUbpRPZIdv1rLztXtnuAT/r8AQAAAAAAwCDJRcTBSHKF9XIuVyisvb/jSOzPlSvV2smLlaXLs9H4rOx4jOaad7oPtbwfYjJ7P2yzPrWhPh0RhyPi25F9jXphplKe7XfwAAAAAAAAAAAAAAAAAAAAMCAOdPj8f+r3kX4fHfDUNb7YYE+/jwLoh65f+d+Lb3oCBlLX/AeeW/Ifhpf8h+El/2F4yX8YXvIfhpf8h+El/wEAAAAAAAAAAAAAAAAAAAAAAAAAAKCnzp87ly711YfXZ9L67NXlpfnK1VOzpep8YWFppjBTWbxSmKtU5sqlwkxlodvfK1cqVyanYunaRK1UrU1Ul1cuLFSWLtcuXFoozpUulEb/l6gAAAAAAAAAAAAAAAAAAADg2VJdXpkvlsulRYWOhfdjIA7jaQa4Zle75wclCoUOhZtZ9+5srz5elAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABgg/8CAAD//4yLMZo=") mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, &(0x7f0000000540)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') symlinkat(&(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000002400)='.\x00', 0x0, 0xa0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0xd2f0, 0x1, 0x2, 0x8000, 0xffffff01}) 44.543839078s ago: executing program 1 (id=400): r0 = socket$tipc(0x1e, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x10, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000711029000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) listen(r0, 0x8) socket$tipc(0x1e, 0x5, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder1\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x84}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.test\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/usb_gadget/naa.test/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.test/tpgt_1/lun/lun_0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/usb_gadget/naa.test/tpgt_1/lun/lun_0/statistics/scsi_transport/device\x00', 0x0, 0x0) 43.883994203s ago: executing program 1 (id=407): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000d00)={[{@noauto_da_alloc}, {@min_batch_time={'min_batch_time', 0x3d, 0x4}}]}, 0x1, 0x4c7, &(0x7f0000002d80)="$eJzs3c9vG1kdAPDvTJImm81usrASPwRsWRYKqtZO3N1otaflAkKrlRArThy6IXGjKHYcxU5pQg/p/4BEJU7wJ3BA4oDUE3ducENI5YBUoAI1SByMZjxJ09ROI5p4uvHnI41m3jzb3/fcznuTbxy/AEbW5YjYi4hLEfFJRMwW55Niiw96W/a4Rw9vL+8/vL2cRLf78T+SvD47F0eek3m5eM2piPjBdyN+nDwdt72zu77UaNS3inK109ystnd2/7LWXFqtr9Y3arXFhcX59669Wzuzvr7R/PWD76x9+MPf/fbL9/+w962fZs2aKeqO9uMs9bo+cRgnMx4RH55HsBKMFf25VHZD+L+kEfGZiHgzu/67ZbcGABiGbnc2urNHywDARZfmObAkrRS5gJlI00qll8N7PabTRqvduXqjtb2x0suVzcVEemOtUZ8vcoVzMZFk5YX8+HG5dqx8LSJei4ifTb6UlyvLrcZKmTc+ADDCXj42//97sjf/AwAX3FTZDQAAhs78DwCjx/wPAKPH/A8Ao8f8DwCjx/wPAKPH/A8AI+X7H32Ubd394vuvV27ubK+3br69Um+vV5rby5Xl1tZmZbXVWs2/s6f5rNdrtFqbC+/E9q1qp97uVNs7u9ebre2NzvX8e72v1yeG0isA4CSvvXHvT0lE7L3/Ur7FkbUczNVwsaVlNwAozVjZDQBKM152A4DS+Bkf6LNE7xMGfkTo7sCnGFrgBXflC/L/MKqezP/7IDCMEvl/GF3y/zC6ut3Emv8AMGLk+IFz+P0/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXHgz+ZaklWIt8JlI00ol4pWImIuJ5MZaoz4fEa9GxB8nJyaz8kLZjQYAnlP6t6RY/+vK7Fszx2svJf+ZzPcR8ZNffPzzW0udztZCdv6fh+c7d4vztRMDWWoQAEpyME8fzOMHHj28vXywDbM9D77dW1w0i7tfbL2a8RjP91P5jcP0v5Ki3JPdr4ydQfy9OxHx+X79T/LcyFyx8unx+FnsV4YaP30ifprX9fbZe/HZM2gLjJp72fjzQb/rL43L+b7/9T+Vj1DP72D8239q/EsPx7+xAePf5dPGeOf33xtYdyfii+P94ieH8ZMB8d86Zfw/f+krbw6q6/4y4kr0j380VrXT3Ky2d3bfXmsurdZX6xu12uLC4vx7196tVfMcdfUgU/20v79/9dWT+j89IP7UM/r/9VP2/1f//eRHXz0h/je/1v/f//UT4mdz4jdOGX9p+jcDl+/O4q/073/xnMH9v3rK+Pf/urtyyocCAEPQ3tldX2o06lsOhnaQ3bu9AM24cAd3PjXvavY/4Cxe53Pn2NSyRybgvD2+6MtuCQAAAAAAAAAAAAAAMMgw/uCp7D4CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwcf0vAAD//1XP1xw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000) 43.688128955s ago: executing program 32 (id=407): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file1\x00', 0x0, &(0x7f0000000d00)={[{@noauto_da_alloc}, {@min_batch_time={'min_batch_time', 0x3d, 0x4}}]}, 0x1, 0x4c7, &(0x7f0000002d80)="$eJzs3c9vG1kdAPDvTJImm81usrASPwRsWRYKqtZO3N1otaflAkKrlRArThy6IXGjKHYcxU5pQg/p/4BEJU7wJ3BA4oDUE3ducENI5YBUoAI1SByMZjxJ09ROI5p4uvHnI41m3jzb3/fcznuTbxy/AEbW5YjYi4hLEfFJRMwW55Niiw96W/a4Rw9vL+8/vL2cRLf78T+SvD47F0eek3m5eM2piPjBdyN+nDwdt72zu77UaNS3inK109ystnd2/7LWXFqtr9Y3arXFhcX59669Wzuzvr7R/PWD76x9+MPf/fbL9/+w962fZs2aKeqO9uMs9bo+cRgnMx4RH55HsBKMFf25VHZD+L+kEfGZiHgzu/67ZbcGABiGbnc2urNHywDARZfmObAkrRS5gJlI00qll8N7PabTRqvduXqjtb2x0suVzcVEemOtUZ8vcoVzMZFk5YX8+HG5dqx8LSJei4ifTb6UlyvLrcZKmTc+ADDCXj42//97sjf/AwAX3FTZDQAAhs78DwCjx/wPAKPH/A8Ao8f8DwCjx/wPAKPH/A8AI+X7H32Ubd394vuvV27ubK+3br69Um+vV5rby5Xl1tZmZbXVWs2/s6f5rNdrtFqbC+/E9q1qp97uVNs7u9ebre2NzvX8e72v1yeG0isA4CSvvXHvT0lE7L3/Ur7FkbUczNVwsaVlNwAozVjZDQBKM152A4DS+Bkf6LNE7xMGfkTo7sCnGFrgBXflC/L/MKqezP/7IDCMEvl/GF3y/zC6ut3Emv8AMGLk+IFz+P0/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXHgz+ZaklWIt8JlI00ol4pWImIuJ5MZaoz4fEa9GxB8nJyaz8kLZjQYAnlP6t6RY/+vK7Fszx2svJf+ZzPcR8ZNffPzzW0udztZCdv6fh+c7d4vztRMDWWoQAEpyME8fzOMHHj28vXywDbM9D77dW1w0i7tfbL2a8RjP91P5jcP0v5Ki3JPdr4ydQfy9OxHx+X79T/LcyFyx8unx+FnsV4YaP30ifprX9fbZe/HZM2gLjJp72fjzQb/rL43L+b7/9T+Vj1DP72D8239q/EsPx7+xAePf5dPGeOf33xtYdyfii+P94ieH8ZMB8d86Zfw/f+krbw6q6/4y4kr0j380VrXT3Ky2d3bfXmsurdZX6xu12uLC4vx7196tVfMcdfUgU/20v79/9dWT+j89IP7UM/r/9VP2/1f//eRHXz0h/je/1v/f//UT4mdz4jdOGX9p+jcDl+/O4q/073/xnMH9v3rK+Pf/urtyyocCAEPQ3tldX2o06lsOhnaQ3bu9AM24cAd3PjXvavY/4Cxe53Pn2NSyRybgvD2+6MtuCQAAAAAAAAAAAAAAMMgw/uCp7D4CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwcf0vAAD//1XP1xw=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) pwrite64(r0, &(0x7f00000000c0)='a', 0x200000c1, 0x9000) 37.495624068s ago: executing program 3 (id=442): write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) mount(0x0, &(0x7f0000000080)='./proc\x00', 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) 37.216716783s ago: executing program 3 (id=446): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000100)={0x5, &(0x7f0000000140)=[{0x46, '\x00', @data, 0x7ff}]}) 36.457529464s ago: executing program 3 (id=447): syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000700)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x80, &(0x7f0000000580)={[{@grpjquota}, {@dioread_lock}, {@delalloc}, {@commit}]}, 0xfe, 0x258, &(0x7f0000000c40)="$eJzs3E1oHGUYB/BnZncTkywS9SKIHyAiGgjxJniJF4WAhCAiqBAR8aIkQkzwlnjy4kHPtuTUSyi9Ne2x5BJ6aSn0lLY5pJdCG3po6KE9bNmdJKTJJmm6252y8/vB7MzsfDzvsPt/Zy7zBlBYgxExGhGliBiKiEpEJHt3eC+bBrdXF/tWJyNqta/vJ439svXMznEDEbEQEZ9GxEqaxK/liLnl7zcern354T+zlQ/OLH/X19GL3La5sf7V1unxv8+PfTJ39frd8SRGo/rUdbVf0uS7chLx+oso9pJIynm3gGcx8ee5G/XcvxER7zfyX4k0sh/v35melUp8fOqwY/+7d+2tTrYVaL9arVK/By7UgMJJI6IaSTocEdlymg4PZ8/wN0v96W/TM38M/TI9O/Vz3j0V0C7ViPUvLvZeGNiX/zulLP9A96rn/5uJpVv15a1S3q0BOuLtbFbP/9CP8x+F/EPhyD90u/TQLSfLf0+b2wXkyf0fikv+oQsc/oh/JPmH4pJ/6GKVozfLPxSX/ENxyT8U1978AwDFUuvN+w1kIC959z8AAAAAAAAAAAAAAAAAAMBBi32rkztTp2pe/j9i8/OIKDerX9oe2vyVxmf/g6S+264kO6wlP7zb4gladDbnt69fvZ1v/Svv5Ft/fipi4a+IGCmXD/7/kucdWn/Xa8dsr/zUYoETSvatf/ZtZ+vv93gp3/pjaxGX6v3PSLP+J403G/Pm/U/1+CGWj/X7oxZPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQMc8CQAA//96pW1W") openat(0xffffffffffffff9c, 0x0, 0x181341, 0x84) symlinkat(&(0x7f0000000700)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') openat(0xffffffffffffff9c, &(0x7f0000000ec0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x28541, 0x140) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000800)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x820008, 0x0, 0xda, 0x0, &(0x7f0000000280)) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6000, 0x0) 35.950644599s ago: executing program 3 (id=451): r0 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_TTY_GET(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={&(0x7f00000007c0)={0x10, 0x3f8, 0x1, 0x70bd2d, 0x25dfdbfd}, 0x10}, 0x1, 0x0, 0x0, 0x8001}, 0x80) 35.636075192s ago: executing program 3 (id=454): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000440)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007917b000000000002d000000000000009500740000000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x61}, 0x48) 34.486838517s ago: executing program 3 (id=457): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000480)='./file0\x00', 0xc0ed0040, &(0x7f00000002c0)={[{@noblock_validity}, {@delalloc}, {@acl}, {@noload}, {@journal_dev={'journal_dev', 0x3d, 0x3}}, {@errors_remount}], [{@fsuuid={'fsuuid', 0x3d, {[0x64, 0x66, 0x64, 0x61, 0x63, 0x33, 0x65, 0x63], 0x2d, [0x39, 0x62, 0x35, 0x39], 0x2d, [0x34, 0x66, 0x32, 0x65], 0x2d, [0x37, 0x37, 0x34, 0x35], 0x2d, [0x66, 0x38, 0x61, 0x32, 0x32, 0x63, 0x63, 0x65]}}}, {@appraise}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}, 0xfe, 0x472, &(0x7f0000000940)="$eJzs3MtvG8UfAPDvOk6a9PFLf6U8WloIFETFI2nSBz1wAYHEAQQSHIo4BSetSt0GNUGiVQSBQxDigCpxRxyR+As4wQUBJySucEeVEMqlhZPRenfTxLVDHk6c4s9H2nZmd92Z786OPTtjN4CuNZT+kUTsjohfI2Iwyy4/YSj76+bCbOWvhdlKErXaa38m9fNuLMxW8n9i8XW7sh21Wp7f0aTc+TcjxqvVyct5fmTm4jsj01euPnX+4vi5yXOTl8ZOnz5x/HDfqbGTbYkzjevGwfenDh148Y1rL1fOXHvrx6/T+u7OjxdxtNNQdnWberTdhXXYniXppNzBirAmabulzdVb7/+D0RMDi8cG44WPOlo5YFPVarVas8/n3FwN+A9LotM1ADqj+KBPn3+LbYuGHtvCH89mD0Bp3DfzLTtSjlJ+Tm/D82079UfEmbm/v0i32KR5CACApb5Nxz9PNhv/leKeJef9L19D2RsR/4+IfRFxV0Tsj4i7I+rn3hsR962x/MYVktvHP6Xr6wpsldLx3zP52tby8V8x+ou9PXluTz3+3uTs+erksfyaHI3eHWl+dNlLlvvu+V8+a9z3aT7NPrRk/JduafnFWDCvx/VywwTdxPjMeFuCT+P/MOJguVn8SRTLOElEHIiIg+ss4/zjXx1qdezf419BG9aZal9GPJa1/1w0xF9IWq5Pjj59auzkSH9UJ4+NFHfF7X76ef7VVuVvKP42SNt/Z9P7P4s/fUZM+iOmr1y9UF+vnV57GfO/fVxJWhzbv877vy95vZ7uy/e9Nz4zc3k0oi95Kc0OLNs/duu1Rb44P43/6JHm/X9f9nhWvxL3R0R6Ex+OiAci4sG87R6KiIcj4sgK8f/w3CNvtzrWuv1XmJVvozT+iRXaP33LS1O32n/tiZ4L33/Tqvzaqtr/RD11NN+zmve/1VZwI9cOAAAA7hSl+nfgk9LwYrpUGh7OvsO/P3aWqlPTM0+cnXr30kT2Xfm90VsqZroGl8yHjuZzw0V+rCF/PJ83/rxnoJ4frkxVJzodPHS5XS36f+r3nk7XDth0fq8F3Uv/h+6l/0P30v+he+n/0KX6mu/+YKvrAXTE2j//+zelHsDWM/6H7qX/Q/fS/6ErtfxtfGlDP/m/UxPl7VGNpomB7VGNIhGlbVGN9iVe+STrEtulPkWivOr/zGKdiR1ND3X6nQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKA9/gkAAP//Uo/mdg==") mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = getpgid(0xffffffffffffffff) syz_open_procfs(r0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='270', 0x3) ioctl$NILFS_IOCTL_CHANGE_CPMODE(r1, 0x40106e80, &(0x7f0000000040)={0x8}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) bind$netlink(r3, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r4, &(0x7f0000000c00)={0x2, 0x13c4, @loopback}, 0x10) sendto$inet(r4, 0x0, 0x4000, 0x0, 0x0, 0x0) getsockname$packet(r3, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r2, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x44840}, 0x20000801) sendmsg$nl_route(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x200e3}, [@IFLA_MASTER={0x8, 0xa, r5}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) unshare(0x40000000) 18.974609924s ago: executing program 33 (id=457): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f0000000480)='./file0\x00', 0xc0ed0040, &(0x7f00000002c0)={[{@noblock_validity}, {@delalloc}, {@acl}, {@noload}, {@journal_dev={'journal_dev', 0x3d, 0x3}}, {@errors_remount}], [{@fsuuid={'fsuuid', 0x3d, {[0x64, 0x66, 0x64, 0x61, 0x63, 0x33, 0x65, 0x63], 0x2d, [0x39, 0x62, 0x35, 0x39], 0x2d, [0x34, 0x66, 0x32, 0x65], 0x2d, [0x37, 0x37, 0x34, 0x35], 0x2d, [0x66, 0x38, 0x61, 0x32, 0x32, 0x63, 0x63, 0x65]}}}, {@appraise}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}]}, 0xfe, 0x472, &(0x7f0000000940)="$eJzs3MtvG8UfAPDvOk6a9PFLf6U8WloIFETFI2nSBz1wAYHEAQQSHIo4BSetSt0GNUGiVQSBQxDigCpxRxyR+As4wQUBJySucEeVEMqlhZPRenfTxLVDHk6c4s9H2nZmd92Z786OPTtjN4CuNZT+kUTsjohfI2Iwyy4/YSj76+bCbOWvhdlKErXaa38m9fNuLMxW8n9i8XW7sh21Wp7f0aTc+TcjxqvVyct5fmTm4jsj01euPnX+4vi5yXOTl8ZOnz5x/HDfqbGTbYkzjevGwfenDh148Y1rL1fOXHvrx6/T+u7OjxdxtNNQdnWberTdhXXYniXppNzBirAmabulzdVb7/+D0RMDi8cG44WPOlo5YFPVarVas8/n3FwN+A9LotM1ADqj+KBPn3+LbYuGHtvCH89mD0Bp3DfzLTtSjlJ+Tm/D82079UfEmbm/v0i32KR5CACApb5Nxz9PNhv/leKeJef9L19D2RsR/4+IfRFxV0Tsj4i7I+rn3hsR962x/MYVktvHP6Xr6wpsldLx3zP52tby8V8x+ou9PXluTz3+3uTs+erksfyaHI3eHWl+dNlLlvvu+V8+a9z3aT7NPrRk/JduafnFWDCvx/VywwTdxPjMeFuCT+P/MOJguVn8SRTLOElEHIiIg+ss4/zjXx1qdezf419BG9aZal9GPJa1/1w0xF9IWq5Pjj59auzkSH9UJ4+NFHfF7X76ef7VVuVvKP42SNt/Z9P7P4s/fUZM+iOmr1y9UF+vnV57GfO/fVxJWhzbv877vy95vZ7uy/e9Nz4zc3k0oi95Kc0OLNs/duu1Rb44P43/6JHm/X9f9nhWvxL3R0R6Ex+OiAci4sG87R6KiIcj4sgK8f/w3CNvtzrWuv1XmJVvozT+iRXaP33LS1O32n/tiZ4L33/Tqvzaqtr/RD11NN+zmve/1VZwI9cOAAAA7hSl+nfgk9LwYrpUGh7OvsO/P3aWqlPTM0+cnXr30kT2Xfm90VsqZroGl8yHjuZzw0V+rCF/PJ83/rxnoJ4frkxVJzodPHS5XS36f+r3nk7XDth0fq8F3Uv/h+6l/0P30v+he+n/0KX6mu/+YKvrAXTE2j//+zelHsDWM/6H7qX/Q/fS/6ErtfxtfGlDP/m/UxPl7VGNpomB7VGNIhGlbVGN9iVe+STrEtulPkWivOr/zGKdiR1ND3X6nQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKA9/gkAAP//Uo/mdg==") mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = getpgid(0xffffffffffffffff) syz_open_procfs(r0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r1, &(0x7f0000000000)='270', 0x3) ioctl$NILFS_IOCTL_CHANGE_CPMODE(r1, 0x40106e80, &(0x7f0000000040)={0x8}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x0) bind$netlink(r3, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r4, &(0x7f0000000c00)={0x2, 0x13c4, @loopback}, 0x10) sendto$inet(r4, 0x0, 0x4000, 0x0, 0x0, 0x0) getsockname$packet(r3, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r2, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x44840}, 0x20000801) sendmsg$nl_route(r2, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x200e3}, [@IFLA_MASTER={0x8, 0xa, r5}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) unshare(0x40000000) 8.638942407s ago: executing program 4 (id=550): r0 = socket(0x200000000000011, 0x2, 0xd) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) bind$packet(r0, &(0x7f0000000080)={0x11, 0x800, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) r2 = socket(0x200000000000011, 0x2, 0xd) bind$packet(r2, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x8000}, 0x4) syz_emit_ethernet(0x86, &(0x7f0000000380)=ANY=[@ANYBLOB="0180c200000ebbbbbbbbbbbb08004500007800000002"], 0x0) 7.57169906s ago: executing program 4 (id=553): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./sys/block/md0/md/dev-ram0/state\x00', 0x1, 0x0) write(r0, 0x0, 0x0) 7.296477053s ago: executing program 4 (id=555): r0 = gettid() timer_create(0x200000000000000, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x100000a, 0x204031, 0xffffffffffffffff, 0xec776000) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200), 0x1, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) 6.939489568s ago: executing program 4 (id=559): r0 = socket$tipc(0x1e, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x10, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000711029000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) listen(r0, 0x8) socket$tipc(0x1e, 0x5, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder1\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x84}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.test\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/usb_gadget/naa.test/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.test/tpgt_1/lun/lun_0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/usb_gadget/naa.test/tpgt_1/lun/lun_0/statistics/scsi_transport/device\x00', 0x0, 0x0) 6.086260755s ago: executing program 5 (id=562): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() fremovexattr(0xffffffffffffffff, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000180)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000042000501"], 0x14}}, 0x44014) 4.962776083s ago: executing program 5 (id=566): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc1}, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={0x0, 0x188}, 0x1, 0x7}, 0x0) socket$key(0xf, 0x3, 0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@struct={0x0, 0x1, 0x0, 0x4, 0x1, 0x1, [{0x0, 0x2, 0x20000000}]}, @restrict={0x0, 0x0, 0x0, 0x6, 0x2}]}}, 0x0, 0x3e}, 0x28) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x38}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="020100090e0000"], 0x70}}, 0x0) r2 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r2, &(0x7f0000000080)={0x28, 0x0, 0x0, @my=0x0}, 0x10) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000400)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000000)="3b000300010001", 0x7) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000100)={0x43, 0x0, 0x3, 0x3}, 0x10) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000040)=@name={0x1e, 0x2, 0x3, {{0x0, 0x4}, 0x3}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x80}, 0x0) sendmsg$NL80211_CMD_SET_PMKSA(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)={0x4c, 0x0, 0x20, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_PMK_REAUTH_THRESHOLD={0x5, 0x120, 0x55}, @NL80211_ATTR_PMK={0xffffffffffffff22, 0xfe, "9f73b2320b3bf3a2ac09fdd7534b78aa"}, @NL80211_ATTR_PMK={0x14}]}, 0x4c}, 0x1, 0x0, 0x0, 0x801}, 0x80) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001000010700000000000000000a000000060001002500000008000a0002"], 0x24}}, 0x0) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={0x0, 0x0, 0x43}, 0x28) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0x18, 0x3, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2c, '\x00', 0x0, 0x0, r4}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r5, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, 0x0, 0x0) 4.831982578s ago: executing program 0 (id=567): ioctl$VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f00000001c0)={0x2, 0x6, 0x4, "f1a252b532d0d49d391c1cc71a882539024f00", 0x38416761}) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000000040)) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e20, @local}, 0x10) listen(r0, 0x10) r1 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r1, &(0x7f0000000100)={0x2, 0x4e20, @local}, 0x10) accept4(r0, 0x0, 0x0, 0x0) 4.826857109s ago: executing program 4 (id=568): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000140)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./sys/class/devcoredump/disabled\x00', 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setns(0xc9, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/ptype\x00') read$FUSE(r4, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) read$FUSE(r0, &(0x7f0000001400)={0x2020}, 0x2020) 4.777058942s ago: executing program 5 (id=569): r0 = socket$tipc(0x1e, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x10, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000711029000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) listen(r0, 0x8) socket$tipc(0x1e, 0x5, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder1\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x84}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.test\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/usb_gadget/naa.test/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.test/tpgt_1/lun/lun_0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/usb_gadget/naa.test/tpgt_1/lun/lun_0/statistics/scsi_transport/device\x00', 0x0, 0x0) 3.785606516s ago: executing program 5 (id=570): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000300)="8b", 0x1, 0x0, &(0x7f0000000140)={0xa, 0x0, 0x0, @private1}, 0x1c) shutdown(r0, 0x1) getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x83, &(0x7f0000000000)=@assoc_value, &(0x7f0000000080)=0x8) 3.535852472s ago: executing program 5 (id=572): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) mincore(&(0x7f0000f0c000/0x3000)=nil, 0xffffffffff600000, &(0x7f0000afaf0a)=""/246) 3.528083344s ago: executing program 0 (id=573): bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x42082, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x4102}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x2a0280, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r4 = openat$cgroup_ro(r3, 0x0, 0x0, 0x0) preadv(r4, &(0x7f00000000c0), 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40088c1}, 0x800) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$kcm(0x11, 0x3, 0x0) r6 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) setsockopt$sock_attach_bpf(r5, 0x107, 0xf, &(0x7f0000000600), 0x56) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbfe, {0x0, 0x0, 0x0, r9, {0x0, 0x5}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1, 0x2}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40040e0}, 0x0) sendmsg$kcm(r5, &(0x7f00000000c0)={&(0x7f0000000580)=@xdp={0x2c, 0x0, r7, 0x3e}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)="27030200e61114120600002fb96dbcf706e10500000086ddffff1144ee1611d4b8bf4a31accb", 0xfdef}], 0x1, 0x0, 0x0, 0x1000000}, 0x0) 3.373910915s ago: executing program 5 (id=574): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000000)={0xfffc, 0x6cc, 0x6, 0xff7d, 0x13, "391e9c44b06e9a73"}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x16, 0x3, &(0x7f0000001280)=ANY=[@ANYBLOB="620ac4ff000000007110920000"], 0x0}, 0x94) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r2, 0x4000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x4001, 0x3, 0x2a0, 0x0, 0xb, 0x148, 0x130, 0x148, 0x208, 0x240, 0x240, 0x208, 0x215, 0x3, 0x0, {[{{@ip={@local, @remote, 0x0, 0x0, 'ip6erspan0\x00', 'nr0\x00', {}, {0xff}, 0x84, 0x0, 0x10}, 0x2e8, 0xe8, 0x130, 0x0, {0xff0f000000000000}, [@common=@inet=@multiport={{0x50}, {0x0, 0x2b, [0x4e24, 0x4e23, 0x4e22, 0x4e21, 0x4e24, 0x4e24, 0x4e22, 0x4e23, 0x4e21, 0x4e20, 0x2, 0x4e22, 0x4e23, 0xeac, 0x4e24], [0x1, 0x0, 0x43, 0x1, 0x0, 0x0, 0x1, 0x1, 0x10, 0x1, 0x41, 0x0, 0x0, 0x0, 0xfc]}}, @inet=@rpfilter={{0x28}, {0xa}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x7, 0xab, 0x6, 'syz1\x00', {0x4}}}}, {{@ip={@dev={0xac, 0x14, 0x14, 0x16}, @local, 0xffffff00, 0xff000000, 'pim6reg0\x00', 'netpci0\x00', {}, {0xff}, 0x1, 0x3, 0x1c}, 0xec010000, 0x70, 0xd8}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x4, 0x5, 0x22000000, 0xfffffffa, '\x00', 'syz1\x00', {0x3}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x300) r3 = dup(r1) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='bpf\x00', 0x6, 0x0) write$UHID_INPUT(r3, &(0x7f0000001040)={0xe, {"a2e3ad21ed0d52f90b9b39094bf70e06d038e7ff7fc6e5539b324b298b089b3208376d090890e0878f0e1ac6e7049b334a959bfc9a240d2567f3988f7ef319520100ffe8d1780700523c921b1b9b31310d075d0936cd3b78130daa61f94b61404d64aec1b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb056d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498be0800000000000000f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c088215ec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6f44ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d208001349b41db6efcffac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ec126c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b8247068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2a15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee53259289d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c1980778efa5ea567b7b7430acc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a0700d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8440daaa69bf5c8f4350aeae9ca1207e76061b28f27da19acc7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211c7847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7beddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c5409711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e781171e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e24919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b906ce2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf3f2aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7ae288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f00000000000000000000b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289d8523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c78e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d53588a0f9455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d664130bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7899484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e7c7b2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df06720ba2b26bbfcc807c8aabb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db38b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ea4cd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f031755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb24ee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1040}}, 0x1006) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000640), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_SET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000280)={0x44, r4, 0x1, 0x3, 0x0, {0x2c}, [@DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x10001}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x58}]}, 0x44}}, 0x0) r5 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newqdisc={0x34, 0x24, 0xd0f, 0x3, 0x0, {0x60, 0x0, 0x0, r6, {0x0, 0xffe0}, {0xffff, 0xffff}, {0x1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8114}, 0x8840) syz_usb_connect(0x0, 0x186, &(0x7f0000000300)={{0x12, 0x1, 0x200, 0x6f, 0x2e, 0x45, 0x20, 0x19d2, 0x1303, 0xfa61, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x174, 0x1, 0x7, 0x7, 0x70, 0x2, "", [{{0x9, 0x4, 0xc3, 0x5, 0x2, 0xff, 0xff, 0xff, 0x40, [@hid_hid={0x9, 0x21, 0x0, 0x3, 0x1, {0x22, 0x60c}}], [{{0x9, 0x5, 0x9, 0x10, 0x20, 0x2, 0x7f, 0xf2, [@generic={0x4f, 0xa, "ce8f248fa6101e1baf227daff1e5f570aa51729f755a7e4045815126f9785f4f6c0da2644eb54e7f36bcbf4e5510f4ba3647b3d80f4787478dfb747afe10199f49e43af34503c3c5e0f585d55b"}, @generic={0xf1, 0x22, "f6469442726dd1ecdd651eb5bf70d06a6046297257dd714da0491b63d12ef042b037698f8ef40a6f4e3e157b818e9cffe60dc52c50deeeb20d04336c88b32efa0db450212334daed52c39f2ab6f83ce4d8092539924f1eb3859e499f7313c7802f1a562c5589848844e7922b8ef7653f4b5e81c381a6f4d7de45dc97678a653943d36e6164bd1f8301ce6a3c74dd7fe46a8d6c36872c727399d5da2b8f9cf883c23b3f67d4d9bf1d10bfdf932da6e9f4c5f7068c02545d37d12219f9dd517ca22899fc59fae797c954eaa4b1ba0c69d659d27d62b2e381d52edce422656e82e424b7d126424be1cb038e8f9b2c0672"}]}}, {{0x9, 0x5, 0x2, 0x2, 0x8, 0x2, 0x6, 0xaa, [@uac_iso={0x7, 0x25, 0x1, 0x8, 0x4, 0x1}]}}]}}]}}]}}, &(0x7f00000007c0)={0xa, &(0x7f00000004c0)={0xa, 0x6, 0x201, 0xa, 0x4, 0x9, 0x0, 0x9}, 0x19, &(0x7f0000000500)={0x5, 0xf, 0x19, 0x2, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x1, 0x9, 0x1, 0x9}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x2, 0xe, 0x80, 0x9}]}, 0x4, [{0x4, &(0x7f0000000540)=@lang_id={0x4, 0x3, 0x439}}, {0x4, &(0x7f00000005c0)=@lang_id={0x4, 0x3, 0x40e}}, {0x100, &(0x7f0000000680)=ANY=[@ANYBLOB="00036ed9225c16389782f0169202aac3df691d17ef30fbd4540b278a952acec8779ce6befd7666205b5788cd2c8803f01004c40a5c0aa78607e00f5866326afa6a3621014a856f96de09d112b2b9c34fde0a2a854103b26125e089c6969cb66603f46f4989172eaf8e62c94370cd90eab64249e28ede2b4c95ddfd5e5588394c0589ebe4ea28e1098409ee54ab39702c52897059845cebaea44b61942ff7f403a1e94ae8a7416584ad8ce218694439e744879b3db8b52d8f5ea533e65e1c81a2245e31648b14bf4b91970603a0d0c3f52818f391acbd11551a06a20e31d07df2c6e52043ff2e9a65949f17f74c1ae14141363222f87a2f930fae732ca604a111"]}, {0x4, &(0x7f0000000780)=@lang_id={0x4, 0x3, 0x1809}}]}) 3.187923604s ago: executing program 2 (id=575): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) 3.006150282s ago: executing program 2 (id=576): r0 = socket$unix(0x1, 0x5, 0x0) close(r0) socket$inet_udp(0x2, 0x2, 0x0) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz1\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0xf, 0x8, 0x83, 0x2, 0x3, 0x7f, 0xa9, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x9, 0x20002, 0x7, 0x5, 0x8006, 0x0, 0x7, 0x3c5b, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x20003, 0x8, 0x4c74, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7, 0x17, 0x4, 0x5, 0x5, 0x3e, 0x18e, 0x5, 0x0, 0x454f, 0x6, 0x4, 0x8, 0x3ff, 0x80, 0x0, 0x5, 0x6, 0x8, 0x8000, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x8004, 0x5302, 0xfffffff3, 0x129432f6, 0xc8, 0xf1, 0xe, 0x2bf, 0x6c7, 0xa, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x66abcbd2, 0xea4, 0x0, 0x4, 0x3, 0x7fff, 0x6, 0x400, 0x9, 0x6, 0x1, 0xff, 0xd9ef, 0xfffff57d, 0x5f31, 0xd, 0x9, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0x6, 0x1, 0x6, 0x1, 0xfe000000, 0x8, 0x2, 0x4, 0x9, 0x13, 0x3, 0x4000009, 0x6, 0x4000000, 0x3, 0xbc45, 0x48c93690, 0x42, 0x3], [0x4, 0x408, 0x4, 0x5, 0xfffffffd, 0x100, 0x4, 0x9, 0x5, 0x8002, 0x0, 0x9, 0xb, 0x4, 0x45, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x303c, 0xfffffffa, 0xb, 0x3, 0x2, 0x2, 0x400003, 0x20000008, 0x4, 0x6d01, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa6, 0x4, 0xa9, 0xff, 0x0, 0xac8, 0xbf, 0x2000002, 0x7d, 0x7ff, 0x12b, 0x1, 0xc921, 0xa, 0xffffffff, 0x4, 0x2, 0x120000, 0x807ff, 0x2006, 0x80a2ed, 0x1, 0x25], [0xc, 0xbb33, 0x7, 0xb, 0x5, 0x1938, 0x6, 0x6, 0x0, 0xb9, 0xfffffc01, 0x1ff, 0x6, 0x57, 0x0, 0x3, 0x2, 0x40, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x5, 0x1, 0x2000002, 0x14c, 0x60a7, 0x6, 0x7, 0xffffffff, 0x80000000, 0x10000, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x3, 0x7e, 0x100, 0x961e, 0x7, 0xaf, 0x20000008, 0x3, 0x226, 0x2, 0x70d0, 0x0, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x530e, 0x6c1b, 0x0, 0x4, 0xf1, 0x803, 0xd7, 0x200, 0xfffffffa, 0xfff]}, 0x45c) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000040)=0x10009, 0x4) ppoll(&(0x7f00000000c0)=[{}, {0xffffffffffffffff, 0x400}], 0x20000000000000dc, 0x0, 0x0, 0xfffffffffffffcdd) 2.828986939s ago: executing program 2 (id=577): r0 = socket$tipc(0x1e, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x10, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000711029000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) listen(r0, 0x8) socket$tipc(0x1e, 0x5, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder1\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x84}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount(0x0, 0x0, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.test\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/usb_gadget/naa.test/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.test/tpgt_1/lun/lun_0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/usb_gadget/naa.test/tpgt_1/lun/lun_0/statistics/scsi_transport/device\x00', 0x0, 0x0) 1.869280724s ago: executing program 6 (id=503): r0 = socket$tipc(0x1e, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x10, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000711029000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) listen(r0, 0x8) socket$tipc(0x1e, 0x5, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder1\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x84}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.test\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/usb_gadget/naa.test/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.test/tpgt_1/lun/lun_0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/usb_gadget/naa.test/tpgt_1/lun/lun_0/statistics/scsi_transport/device\x00', 0x0, 0x0) 1.867907854s ago: executing program 0 (id=587): prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x2, &(0x7f00000001c0)={0xffffffffffffffff}, 0x111, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0xffffffff, @loopback, 0xc}, {0xa, 0x4e1e, 0x800000d, @local}, r1, 0x800}}, 0x48) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x1, 0x0, 0x7fff0000}]}) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 1.791100115s ago: executing program 2 (id=578): r0 = socket(0x10, 0x3, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setregid(r1, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000200), &(0x7f0000000240)='./file0\x00', 0x1000000, &(0x7f0000000000)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x1, 0x0, 0x0) 1.597595426s ago: executing program 0 (id=579): r0 = socket$tipc(0x1e, 0x5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x10, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000711029000000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) listen(r0, 0x8) socket$tipc(0x1e, 0x5, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder1\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x84}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount(0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) openat$binder_debug(0xffffffffffffff9c, &(0x7f0000002780)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/tcm.usb0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/target/usb_gadget\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./config/target/usb_gadget/naa.test\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./config/target/usb_gadget/naa.test/tpgt_1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000700)='./config/target/usb_gadget/naa.test/tpgt_1/lun/lun_0\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000800)='./config/target/usb_gadget/naa.test/tpgt_1/lun/lun_0/statistics/scsi_transport/device\x00', 0x0, 0x0) 1.566015465s ago: executing program 2 (id=580): syz_mount_image$ext4(&(0x7f00000002c0)='ext4\x00', &(0x7f0000000700)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x80, &(0x7f0000000580)={[{@grpjquota}, {@dioread_lock}, {@delalloc}, {@commit}]}, 0xfe, 0x258, &(0x7f0000000c40)="$eJzs3E1oHGUYB/BnZncTkywS9SKIHyAiGgjxJniJF4WAhCAiqBAR8aIkQkzwlnjy4kHPtuTUSyi9Ne2x5BJ6aSn0lLY5pJdCG3po6KE9bNmdJKTJJmm6252y8/vB7MzsfDzvsPt/Zy7zBlBYgxExGhGliBiKiEpEJHt3eC+bBrdXF/tWJyNqta/vJ439svXMznEDEbEQEZ9GxEqaxK/liLnl7zcern354T+zlQ/OLH/X19GL3La5sf7V1unxv8+PfTJ39frd8SRGo/rUdbVf0uS7chLx+oso9pJIynm3gGcx8ee5G/XcvxER7zfyX4k0sh/v35melUp8fOqwY/+7d+2tTrYVaL9arVK/By7UgMJJI6IaSTocEdlymg4PZ8/wN0v96W/TM38M/TI9O/Vz3j0V0C7ViPUvLvZeGNiX/zulLP9A96rn/5uJpVv15a1S3q0BOuLtbFbP/9CP8x+F/EPhyD90u/TQLSfLf0+b2wXkyf0fikv+oQsc/oh/JPmH4pJ/6GKVozfLPxSX/ENxyT8U1978AwDFUuvN+w1kIC959z8AAAAAAAAAAAAAAAAAAMBBi32rkztTp2pe/j9i8/OIKDerX9oe2vyVxmf/g6S+264kO6wlP7zb4gladDbnt69fvZ1v/Svv5Ft/fipi4a+IGCmXD/7/kucdWn/Xa8dsr/zUYoETSvatf/ZtZ+vv93gp3/pjaxGX6v3PSLP+J403G/Pm/U/1+CGWj/X7oxZPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQMc8CQAA//96pW1W") openat(0xffffffffffffff9c, &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x181341, 0x84) symlinkat(&(0x7f0000000700)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') openat(0xffffffffffffff9c, &(0x7f0000000ec0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x28541, 0x140) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000800)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x820008, 0x0, 0xda, 0x0, &(0x7f0000000280)) mknodat$loop(0xffffffffffffff9c, 0x0, 0x6000, 0x0) 652.045077ms ago: executing program 6 (id=581): r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000200)={@cgroup=r1, 0x6, 0x0, 0x50d6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f00000005c0)={r3, r2, 0x15, 0x0, @val=@kprobe_multi=@syms={0x0, 0x0, 0x0}}, 0x30) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet6_int(r4, 0x29, 0x50, 0x0, &(0x7f0000000040)) 461.002018ms ago: executing program 0 (id=582): setresuid(0xee01, 0xee00, 0x0) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x200003, 0x200003, 0x801, 0x4, 0x7, 0x6}) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000480)='task\x00') fchdir(r1) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x0, 0x0) r2 = syz_open_procfs(r0, &(0x7f0000000040)='stat\x00') pread64(r2, &(0x7f0000000140)=""/15, 0xf, 0x4) 211.979954ms ago: executing program 6 (id=583): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) keyctl$read(0xb, 0x0, &(0x7f0000000240)=""/112, 0x349b7f55) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mremap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40186f40, &(0x7f0000000440)=0x20000) 117.915179ms ago: executing program 4 (id=584): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bind$bt_sco(r0, &(0x7f0000000100), 0x8) listen(r0, 0x5) syz_emit_vhci(&(0x7f0000000200)=@HCI_EVENT_PKT={0x4, @hci_ev_conn_request={{0x4, 0xa}, {@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}}}, 0xd) 116.038239ms ago: executing program 2 (id=595): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x28, 0x10, 0x801, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x33}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4841}, 0x0) 0s ago: executing program 0 (id=585): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x18a42000) syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) kernel console output (not intermixed with test programs): ): hsr0: link becomes ready [ 65.973775][ T4191] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 65.990729][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 66.001419][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 66.019640][ T4187] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 66.041251][ T4185] device veth0_vlan entered promiscuous mode [ 66.050644][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 66.058896][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 66.067371][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 66.078784][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 66.102158][ T4187] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.118144][ T4187] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.127595][ T4187] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.136691][ T4187] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.166933][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 66.176606][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 66.197145][ T4185] device veth1_vlan entered promiscuous mode [ 66.253527][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 66.265209][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 66.274970][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 66.283615][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 66.292913][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 66.300408][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 66.307811][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 66.316761][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 66.332991][ T4186] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 66.354938][ T4185] device veth0_macvtap entered promiscuous mode [ 66.366567][ T4191] device veth0_vlan entered promiscuous mode [ 66.374725][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 66.385811][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 66.408534][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 66.418194][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 66.426437][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 66.437748][ T4185] device veth1_macvtap entered promiscuous mode [ 66.458593][ T4197] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 66.478360][ T4191] device veth1_vlan entered promiscuous mode [ 66.516127][ T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.536310][ T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.538066][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 66.556493][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.575617][ T4185] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 66.601067][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 66.610016][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 66.617986][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 66.626617][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 66.635521][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 66.644443][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 66.667215][ T4185] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 66.678569][ T4185] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 66.690659][ T4185] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 66.704787][ T4191] device veth0_macvtap entered promiscuous mode [ 66.715373][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 66.725643][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 66.734601][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 66.744717][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 66.754220][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 66.763451][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 66.772011][ T4249] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 66.789765][ T4185] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.798477][ T4185] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.808408][ T4185] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.817729][ T4185] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 66.835389][ T4191] device veth1_macvtap entered promiscuous mode [ 66.844553][ T151] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 66.854713][ T151] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 66.870735][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 66.905059][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 66.914389][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 66.923223][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 66.933222][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 66.941978][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 66.953358][ T4197] device veth0_vlan entered promiscuous mode [ 67.000610][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 67.008374][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 67.021149][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 67.036880][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 67.050105][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 67.057875][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 67.069693][ T4197] device veth1_vlan entered promiscuous mode [ 67.082966][ T4186] device veth0_vlan entered promiscuous mode [ 67.091132][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 67.102341][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.113355][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 67.125501][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.136401][ T4191] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 67.156553][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 67.166381][ T4186] device veth1_vlan entered promiscuous mode [ 67.193249][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 67.202822][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 67.209338][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 67.218672][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 67.233591][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 67.242504][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 67.256315][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 67.273067][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 67.284870][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.295060][ T4191] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 67.312461][ T4191] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.326778][ T4191] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 67.436097][ T4197] device veth0_macvtap entered promiscuous mode [ 67.446831][ T4197] device veth1_macvtap entered promiscuous mode [ 67.463138][ T4197] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 67.474205][ T4197] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.484284][ T4197] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 67.495086][ T4197] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.505339][ T4197] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 67.516491][ T4197] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 67.554641][ T4197] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 67.770216][ T4230] Bluetooth: hci3: command 0x040f tx timeout [ 67.783211][ T4230] Bluetooth: hci4: command 0x040f tx timeout [ 67.900205][ T4230] Bluetooth: hci0: command 0x040f tx timeout [ 67.928769][ T4230] Bluetooth: hci2: command 0x040f tx timeout [ 67.958889][ T4230] Bluetooth: hci1: command 0x040f tx timeout [ 68.474578][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 68.484100][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 68.493411][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 68.506506][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 68.515172][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 68.524096][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 68.532383][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 68.541627][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 68.550846][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 68.559398][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 68.567722][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 68.579375][ T4197] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 68.590381][ T4197] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.600441][ T4197] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 68.611353][ T4197] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.621217][ T4197] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 68.632156][ T4197] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.643756][ T4197] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 68.651447][ T4269] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6'. [ 68.663062][ T4186] device veth0_macvtap entered promiscuous mode [ 68.675059][ T4270] netlink: 32 bytes leftover after parsing attributes in process `syz.1.6'. [ 68.688606][ T4191] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.697939][ T4191] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.707869][ T4191] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.740062][ T4191] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.755685][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 68.770179][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 68.778909][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 68.798755][ T4197] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.808547][ T4197] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.817805][ T4197] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.826924][ T4197] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 68.845426][ T4186] device veth1_macvtap entered promiscuous mode [ 68.853850][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 68.871027][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 68.904905][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 68.917052][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.936965][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 68.956300][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.969278][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 68.980771][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 68.991409][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 69.001949][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.013960][ T4186] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 69.024134][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 69.036203][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.046230][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 69.056902][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.067419][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 69.079120][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.088977][ T4186] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 69.102339][ T4186] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 69.188458][ T4186] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 69.238414][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 69.272100][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 69.321375][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 69.373831][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 69.423385][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 69.812185][ T4186] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.827664][ T4283] loop1: detected capacity change from 0 to 1024 [ 69.835124][ T4282] Bluetooth: hci3: command 0x0419 tx timeout [ 69.846539][ T4186] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.862884][ T4186] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.871989][ T4186] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 69.876231][ T4283] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 69.912150][ T4280] Bluetooth: hci4: command 0x0419 tx timeout [ 69.918885][ T4283] EXT4-fs (loop1): barriers disabled [ 69.935303][ T4283] JBD2: no valid journal superblock found [ 69.942876][ T4283] EXT4-fs (loop1): error loading journal [ 70.000262][ T4282] Bluetooth: hci2: command 0x0419 tx timeout [ 70.012475][ T4282] Bluetooth: hci0: command 0x0419 tx timeout [ 70.070555][ T4282] Bluetooth: hci1: command 0x0419 tx timeout [ 70.208661][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.108117][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.216174][ T1218] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.224778][ T1218] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.233453][ T1218] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 71.266896][ T1218] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 71.342576][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.349155][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.357302][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 71.382775][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 71.391692][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 72.815076][ T4278] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 72.857037][ T4278] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 72.868880][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 72.906743][ T156] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.016529][ T156] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 73.047188][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 73.322329][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 73.777111][ T4310] loop0: detected capacity change from 0 to 2048 [ 74.179826][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 74.292570][ T4278] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 75.239044][ C0] sched: RT throttling activated [ 76.069600][ T4310] EXT4-fs: error -4 creating inode table initialization thread [ 76.077828][ T4310] EXT4-fs (loop0): mount failed [ 76.281733][ T4332] loop4: detected capacity change from 0 to 512 [ 77.372763][ T4332] EXT4-fs (loop4): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 77.399420][ T4332] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 77.496721][ T4332] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 77.731446][ T4332] EXT4-fs error (device loop4): ext4_read_block_bitmap_nowait:476: comm syz.4.15: Invalid block bitmap block 0 in block_group 0 [ 77.828342][ T4346] loop1: detected capacity change from 0 to 256 [ 77.924239][ T4332] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6191: Corrupt filesystem [ 78.216013][ T4346] netlink: 'syz.1.19': attribute type 29 has an invalid length. [ 78.569776][ T4332] EXT4-fs error (device loop4): ext4_clear_blocks:883: inode #11: comm syz.4.15: attempt to clear invalid blocks 983261 len 1 [ 78.632913][ T4332] EXT4-fs error (device loop4): __ext4_get_inode_loc:4334: comm syz.4.15: Invalid inode table block 0 in block_group 0 [ 78.736906][ T4332] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5873: Corrupt filesystem [ 78.755971][ T4332] EXT4-fs error (device loop4) in ext4_orphan_del:303: Corrupt filesystem [ 78.777925][ T4332] EXT4-fs error (device loop4): __ext4_get_inode_loc:4334: comm syz.4.15: Invalid inode table block 0 in block_group 0 [ 78.849305][ T4332] EXT4-fs error (device loop4) in ext4_reserve_inode_write:5873: Corrupt filesystem [ 78.887776][ T4332] EXT4-fs error (device loop4): ext4_truncate:4286: inode #11: comm syz.4.15: mark_inode_dirty error [ 78.896415][ T4352] loop1: detected capacity change from 0 to 4096 [ 78.907558][ T4332] EXT4-fs error (device loop4) in ext4_process_orphan:345: Corrupt filesystem [ 78.918053][ T4332] EXT4-fs error (device loop4): __ext4_get_inode_loc:4334: comm syz.4.15: Invalid inode table block 0 in block_group 0 [ 78.926775][ T4352] EXT4-fs (loop1): Test dummy encryption mode enabled [ 78.932109][ T4332] EXT4-fs (loop4): 1 truncate cleaned up [ 78.946162][ T4352] EXT4-fs (loop1): inline encryption not supported [ 78.957533][ T4332] EXT4-fs (loop4): mounted filesystem without journal. Opts: dioread_nolock,resuid=0x0000000000000000,journal_dev=0x0000000000000002,noblock_validity,,errors=continue. Quota mode: none. [ 79.030180][ T4352] EXT4-fs (loop1): mounted filesystem without journal. Opts: data_err=ignore,test_dummy_encryption=v1,inlinecrypt,errors=remount-ro,noinit_itable,auto_da_alloc,minixdf,usrquota,errors=remount-ro,max_dir_size_kb=0x0000000000000008,nodioread_nolock,mb_optimize_scan=0x0000000000000000,. Quota mode: writeback. [ 79.088397][ T4332] EXT4-fs (loop4): shut down requested (0) [ 79.515968][ T21] nvmet: connect request for invalid subsystem t! [ 79.524025][ T4361] nvme nvme0: Connect Invalid Data Parameter, subsysnqn "t" [ 79.620066][ T4365] capability: warning: `syz.1.21' uses deprecated v2 capabilities in a way that may be insecure [ 80.887529][ T4375] loop4: detected capacity change from 0 to 512 [ 81.022337][ T4375] EXT4-fs (loop4): Ignoring removed nobh option [ 81.682104][ T4381] loop3: detected capacity change from 0 to 2048 [ 82.000618][ T4375] EXT4-fs error (device loop4): ext4_do_update_inode:5229: inode #3: comm syz.4.28: corrupted inode contents [ 82.120863][ T4381] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 82.132605][ T4381] ext4 filesystem being mounted at /5/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 82.250190][ T4381] fs-verity: sha512 using implementation "sha512-avx2" [ 82.489182][ T4375] EXT4-fs error (device loop4): ext4_dirty_inode:6087: inode #3: comm syz.4.28: mark_inode_dirty error [ 82.563418][ T4375] EXT4-fs error (device loop4): ext4_do_update_inode:5229: inode #3: comm syz.4.28: corrupted inode contents [ 82.802940][ T4375] EXT4-fs error (device loop4): __ext4_ext_dirty:183: inode #3: comm syz.4.28: mark_inode_dirty error [ 82.814130][ T23] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 82.841038][ T4375] Quota error (device loop4): write_blk: dquota write failed [ 82.852771][ T4375] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 82.993291][ T26] audit: type=1800 audit(1790356981.480:2): pid=4396 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.30" name="device" dev="configfs" ino=33943 res=0 errno=0 [ 83.021211][ T4375] EXT4-fs error (device loop4): ext4_acquire_dquot:6236: comm syz.4.28: Failed to acquire dquot type 0 [ 83.099265][ T23] usb 4-1: device descriptor read/64, error -71 [ 83.189278][ T4375] EXT4-fs error (device loop4): ext4_do_update_inode:5229: inode #16: comm syz.4.28: corrupted inode contents [ 83.333376][ T4375] EXT4-fs error (device loop4): ext4_dirty_inode:6087: inode #16: comm syz.4.28: mark_inode_dirty error [ 83.429297][ T23] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 83.499702][ T4375] EXT4-fs error (device loop4): ext4_do_update_inode:5229: inode #16: comm syz.4.28: corrupted inode contents [ 83.580012][ T4375] EXT4-fs error (device loop4): __ext4_ext_dirty:183: inode #16: comm syz.4.28: mark_inode_dirty error [ 83.621875][ T23] usb 4-1: device descriptor read/64, error -71 [ 83.629938][ T4375] EXT4-fs error (device loop4): ext4_do_update_inode:5229: inode #16: comm syz.4.28: corrupted inode contents [ 83.658491][ T4375] EXT4-fs error (device loop4) in ext4_orphan_del:303: Corrupt filesystem [ 83.692483][ T4375] EXT4-fs error (device loop4): ext4_do_update_inode:5229: inode #16: comm syz.4.28: corrupted inode contents [ 83.705691][ T4404] loop0: detected capacity change from 0 to 1024 [ 83.723432][ T4375] EXT4-fs error (device loop4): ext4_truncate:4286: inode #16: comm syz.4.28: mark_inode_dirty error [ 83.739275][ T23] usb usb4-port1: attempt power cycle [ 83.762906][ T4404] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 83.775091][ T4375] EXT4-fs error (device loop4) in ext4_process_orphan:345: Corrupt filesystem [ 83.829601][ T4375] EXT4-fs (loop4): 1 truncate cleaned up [ 83.835926][ T4404] EXT4-fs (loop0): barriers disabled [ 83.845751][ T4375] EXT4-fs (loop4): mounted filesystem without journal. Opts: resuid=0x0000000000000000,nobh,,errors=continue. Quota mode: writeback. [ 83.854566][ T4404] JBD2: no valid journal superblock found [ 83.875306][ T4407] loop1: detected capacity change from 0 to 512 [ 83.889391][ T4404] EXT4-fs (loop0): error loading journal [ 83.894684][ T4375] ext4 filesystem being mounted at /4/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 83.918391][ T4407] EXT4-fs (loop1): Warning: mounting with an experimental mount option 'dioread_nolock' for blocksize < PAGE_SIZE [ 83.989356][ T4407] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 84.064516][ T4407] EXT4-fs error (device loop1): ext4_read_block_bitmap_nowait:476: comm syz.1.35: Invalid block bitmap block 0 in block_group 0 [ 84.323368][ T4407] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6191: Corrupt filesystem [ 84.346175][ T4407] EXT4-fs error (device loop1): ext4_clear_blocks:883: inode #11: comm syz.1.35: attempt to clear invalid blocks 983261 len 1 [ 85.330305][ T4407] EXT4-fs error (device loop1): __ext4_get_inode_loc:4334: comm syz.1.35: Invalid inode table block 0 in block_group 0 [ 85.409975][ T4407] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5873: Corrupt filesystem [ 85.459419][ T4407] EXT4-fs error (device loop1) in ext4_orphan_del:303: Corrupt filesystem [ 85.505593][ T4407] EXT4-fs error (device loop1): __ext4_get_inode_loc:4334: comm syz.1.35: Invalid inode table block 0 in block_group 0 [ 85.585525][ T4407] EXT4-fs error (device loop1) in ext4_reserve_inode_write:5873: Corrupt filesystem [ 85.619546][ T4407] EXT4-fs error (device loop1): ext4_truncate:4286: inode #11: comm syz.1.35: mark_inode_dirty error [ 85.691839][ T4407] EXT4-fs error (device loop1) in ext4_process_orphan:345: Corrupt filesystem [ 85.740836][ T4407] EXT4-fs error (device loop1): __ext4_get_inode_loc:4334: comm syz.1.35: Invalid inode table block 0 in block_group 0 [ 85.767433][ T4428] ip_tables: iptables: counters copy to user failed while replacing table [ 85.783416][ T4407] EXT4-fs (loop1): 1 truncate cleaned up [ 85.805815][ T4407] EXT4-fs (loop1): mounted filesystem without journal. Opts: dioread_nolock,resuid=0x0000000000000000,journal_dev=0x0000000000000002,noblock_validity,,errors=continue. Quota mode: none. [ 85.876390][ T4435] tipc: Started in network mode [ 86.041635][ T4435] tipc: Node identity ae7a42160715, cluster identity 4711 [ 86.048969][ T4435] tipc: Enabled bearer , priority 0 [ 86.063446][ T4407] EXT4-fs (loop1): shut down requested (0) [ 86.071191][ T4437] device syzkaller0 entered promiscuous mode [ 86.636195][ T1108] cfg80211: failed to load regulatory.db [ 86.658083][ T4426] tipc: Resetting bearer [ 86.763113][ T4425] tipc: Resetting bearer [ 86.838802][ T4425] tipc: Disabling bearer [ 86.887850][ T4448] loop1: detected capacity change from 0 to 512 [ 87.020749][ T4448] EXT4-fs (loop1): Ignoring removed nobh option [ 87.795990][ T4452] loop4: detected capacity change from 0 to 2048 [ 88.246103][ T4232] Bluetooth: hci5: command 0x1003 tx timeout [ 88.279689][ T4195] Bluetooth: hci5: sending frame failed (-49) [ 88.404890][ T4448] EXT4-fs error (device loop1): ext4_do_update_inode:5229: inode #3: comm syz.1.47: corrupted inode contents [ 88.550322][ T4452] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 88.561459][ T4452] ext4 filesystem being mounted at /10/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 88.929114][ T4448] EXT4-fs error (device loop1): ext4_dirty_inode:6087: inode #3: comm syz.1.47: mark_inode_dirty error [ 88.945614][ T4448] EXT4-fs error (device loop1): ext4_do_update_inode:5229: inode #3: comm syz.1.47: corrupted inode contents [ 88.957962][ T4448] EXT4-fs error (device loop1): __ext4_ext_dirty:183: inode #3: comm syz.1.47: mark_inode_dirty error [ 89.005499][ T4448] Quota error (device loop1): write_blk: dquota write failed [ 89.010233][ T4459] device syzkaller0 entered promiscuous mode [ 89.059310][ T4448] Quota error (device loop1): qtree_write_dquot: Error -117 occurred while creating quota [ 89.099645][ T4448] EXT4-fs error (device loop1): ext4_acquire_dquot:6236: comm syz.1.47: Failed to acquire dquot type 0 [ 89.120318][ T4448] EXT4-fs error (device loop1): ext4_do_update_inode:5229: inode #16: comm syz.1.47: corrupted inode contents [ 89.144929][ T4448] EXT4-fs error (device loop1): ext4_dirty_inode:6087: inode #16: comm syz.1.47: mark_inode_dirty error [ 89.162448][ T4448] EXT4-fs error (device loop1): ext4_do_update_inode:5229: inode #16: comm syz.1.47: corrupted inode contents [ 89.234499][ T4448] EXT4-fs error (device loop1): __ext4_ext_dirty:183: inode #16: comm syz.1.47: mark_inode_dirty error [ 89.278197][ T4448] EXT4-fs error (device loop1): ext4_do_update_inode:5229: inode #16: comm syz.1.47: corrupted inode contents [ 89.324571][ T4448] EXT4-fs error (device loop1) in ext4_orphan_del:303: Corrupt filesystem [ 89.367711][ T4448] EXT4-fs error (device loop1): ext4_do_update_inode:5229: inode #16: comm syz.1.47: corrupted inode contents [ 89.584392][ T4448] EXT4-fs error (device loop1): ext4_truncate:4286: inode #16: comm syz.1.47: mark_inode_dirty error [ 89.604854][ T4448] EXT4-fs error (device loop1) in ext4_process_orphan:345: Corrupt filesystem [ 90.088817][ T4479] input: syz1 as /devices/virtual/input/input5 [ 90.490130][ T1108] Bluetooth: hci5: command 0x1001 tx timeout [ 90.496237][ T4195] Bluetooth: hci5: sending frame failed (-49) [ 90.649539][ T4448] EXT4-fs (loop1): 1 truncate cleaned up [ 90.679146][ T4448] EXT4-fs (loop1): mounted filesystem without journal. Opts: resuid=0x0000000000000000,nobh,,errors=continue. Quota mode: writeback. [ 90.704513][ T4448] ext4 filesystem being mounted at /13/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 90.777842][ T4491] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 91.701539][ T4498] loop0: detected capacity change from 0 to 256 [ 91.890541][ T4498] netlink: 'syz.0.62': attribute type 29 has an invalid length. [ 92.259249][ T4500] loop3: detected capacity change from 0 to 1024 [ 92.509956][ T4506] device syzkaller0 entered promiscuous mode [ 92.593123][ T23] Bluetooth: hci5: command 0x1009 tx timeout [ 92.596297][ T4500] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 92.725092][ T26] audit: type=1804 audit(1790356991.220:3): pid=4500 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.64" name="/newroot/13/file1/file0/file1" dev="overlay" ino=15 res=1 errno=0 [ 93.981072][ T4531] FAULT_INJECTION: forcing a failure. [ 93.981072][ T4531] name failslab, interval 1, probability 0, space 0, times 1 [ 94.119873][ T4531] CPU: 0 PID: 4531 Comm: syz.4.73 Not tainted syzkaller #0 [ 94.127136][ T4531] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 94.137209][ T4531] Call Trace: [ 94.140505][ T4531] [ 94.143447][ T4531] dump_stack_lvl+0x188/0x250 [ 94.148153][ T4531] ? show_regs_print_info+0x20/0x20 [ 94.153364][ T4531] ? load_image+0x410/0x410 [ 94.157886][ T4531] ? __might_sleep+0xf0/0xf0 [ 94.162493][ T4531] ? __lock_acquire+0x7b50/0x7b50 [ 94.167542][ T4531] should_fail+0x383/0x4b0 [ 94.171981][ T4531] should_failslab+0x5/0x20 [ 94.176497][ T4531] slab_pre_alloc_hook+0x51/0xc0 [ 94.181450][ T4531] kmem_cache_alloc_trace+0x47/0x290 [ 94.186748][ T4531] ? bpf_prog_alloc_no_stats+0xac/0x2c0 [ 94.192326][ T4531] bpf_prog_alloc_no_stats+0xac/0x2c0 [ 94.197719][ T4531] bpf_prog_alloc+0x1a/0x1e0 [ 94.202336][ T4531] __get_filter+0xf2/0x400 [ 94.206779][ T4531] sk_attach_filter+0x20/0x140 [ 94.211559][ T4531] sock_setsockopt+0x18c7/0x2480 [ 94.216517][ T4531] ? __sock_set_mark+0x150/0x150 [ 94.221468][ T4531] ? __lock_acquire+0x7b50/0x7b50 [ 94.226514][ T4531] ? aa_sk_perm+0x7dc/0x910 [ 94.231040][ T4531] ? aa_af_perm+0x340/0x340 [ 94.235556][ T4531] ? __fget_files+0x402/0x470 [ 94.240254][ T4531] ? aa_sock_opt_perm+0x74/0x100 [ 94.245211][ T4531] ? bpf_lsm_socket_setsockopt+0x5/0x10 [ 94.250770][ T4531] ? security_socket_setsockopt+0x7a/0xa0 [ 94.256511][ T4531] __sys_setsockopt+0x2f6/0x3d0 [ 94.261380][ T4531] __x64_sys_setsockopt+0xb1/0xc0 [ 94.266420][ T4531] do_syscall_64+0x4c/0xa0 [ 94.270853][ T4531] ? clear_bhb_loop+0x30/0x80 [ 94.275546][ T4531] ? clear_bhb_loop+0x30/0x80 [ 94.280235][ T4531] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 94.286154][ T4531] RIP: 0033:0x7fe9cde91159 [ 94.290583][ T4531] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.310210][ T4531] RSP: 002b:00007fe9cc0e9028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 94.318657][ T4531] RAX: ffffffffffffffda RBX: 00007fe9ce118fa0 RCX: 00007fe9cde91159 [ 94.326654][ T4531] RDX: 000000000000001a RSI: 0000000000000001 RDI: 0000000000000006 [ 94.334638][ T4531] RBP: 00007fe9cdf2806b R08: 0000000000000010 R09: 0000000000000000 [ 94.342625][ T4531] R10: 0000200000000140 R11: 0000000000000246 R12: 0000000000000000 [ 94.350613][ T4531] R13: 00007fe9ce119038 R14: 00007fe9ce118fa0 R15: 00007ffc64c9e2f8 [ 94.358620][ T4531] [ 94.735955][ T4542] ip_tables: iptables: counters copy to user failed while replacing table [ 94.958064][ T4543] device syzkaller0 entered promiscuous mode [ 95.153346][ T4547] loop1: detected capacity change from 0 to 256 [ 95.962636][ T26] audit: type=1800 audit(1790356993.770:4): pid=4549 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.78" name="device" dev="configfs" ino=34195 res=0 errno=0 [ 96.074592][ T4547] netlink: 'syz.1.77': attribute type 29 has an invalid length. [ 96.752701][ T4560] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 96.760834][ T4560] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 96.863713][ T4560] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 99.523784][ T4608] loop2: detected capacity change from 0 to 256 [ 99.734712][ T4608] netlink: 'syz.2.92': attribute type 29 has an invalid length. [ 100.109255][ T4606] device syzkaller0 entered promiscuous mode [ 100.125768][ T4607] loop4: detected capacity change from 0 to 4096 [ 100.170347][ T4614] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 100.240074][ T4607] EXT4-fs (loop4): inline encryption not supported [ 100.337931][ T4621] loop2: detected capacity change from 0 to 512 [ 100.350515][ T4622] loop1: detected capacity change from 0 to 128 [ 100.453907][ T4622] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 100.684511][ T4315] FAT-fs (loop1): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 100.820818][ T4202] Bluetooth: Wrong link type (-22) [ 100.843917][ T4607] EXT4-fs (loop4): Test dummy encryption mode enabled [ 100.896486][ T4607] EXT4-fs (loop4): Quota format mount options ignored when QUOTA feature is enabled [ 101.205036][ T4638] loop3: detected capacity change from 0 to 128 [ 101.511476][ T4607] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a842c018, mo2=0003] [ 101.529310][ T4607] System zones: 0-5 [ 101.558311][ T4607] EXT4-fs (loop4): mounted filesystem without journal. Opts: debug,lazytime,inlinecrypt,test_dummy_encryption,grpjquota=,auto_da_alloc,delalloc,jqfmt=vfsv0,,errors=continue. Quota mode: writeback. [ 101.569959][ T4638] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 101.766833][ T4638] ext4 filesystem being mounted at /24/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 103.099414][ T4656] netlink: 'syz.0.111': attribute type 29 has an invalid length. [ 103.154780][ T4661] Zero length message leads to an empty skb [ 103.206088][ T4658] FAULT_INJECTION: forcing a failure. [ 103.206088][ T4658] name failslab, interval 1, probability 0, space 0, times 0 [ 103.357270][ T4658] CPU: 0 PID: 4658 Comm: syz.2.112 Not tainted syzkaller #0 [ 103.364616][ T4658] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 103.374685][ T4658] Call Trace: [ 103.377974][ T4658] [ 103.380915][ T4658] dump_stack_lvl+0x188/0x250 [ 103.385618][ T4658] ? show_regs_print_info+0x20/0x20 [ 103.390834][ T4658] ? load_image+0x410/0x410 [ 103.395359][ T4658] ? __might_sleep+0xf0/0xf0 [ 103.399964][ T4658] ? __lock_acquire+0x7b50/0x7b50 [ 103.405011][ T4658] should_fail+0x383/0x4b0 [ 103.409448][ T4658] should_failslab+0x5/0x20 [ 103.413963][ T4658] slab_pre_alloc_hook+0x51/0xc0 [ 103.418910][ T4658] ? mempool_free+0x320/0x320 [ 103.423601][ T4658] ? mempool_init_node+0x1e5/0x480 [ 103.428724][ T4658] kmem_cache_alloc+0x3d/0x280 [ 103.433502][ T4658] ? mempool_free+0x320/0x320 [ 103.438201][ T4658] mempool_init_node+0x1e5/0x480 [ 103.443162][ T4658] ? mempool_alloc_slab+0x60/0x60 [ 103.448211][ T4658] ? mempool_free+0x320/0x320 [ 103.452898][ T4658] mempool_init+0x36/0x50 [ 103.457252][ T4658] bioset_init+0x282/0x6d0 [ 103.461691][ T4658] blk_alloc_queue+0xaf/0x580 [ 103.466391][ T4658] __blk_alloc_disk+0x15/0x60 [ 103.471089][ T4658] dm_create+0x57f/0xf90 [ 103.475358][ T4658] dev_create+0x12e/0x2c0 [ 103.479710][ T4658] ? list_devices+0x820/0x820 [ 103.484405][ T4658] ? __might_fault+0xb3/0x110 [ 103.489100][ T4658] ? _copy_from_user+0x111/0x170 [ 103.494060][ T4658] dm_ctl_ioctl+0x947/0xd00 [ 103.498584][ T4658] ? list_devices+0x820/0x820 [ 103.503275][ T4658] ? dm_poll+0x120/0x120 [ 103.507574][ T4658] ? bpf_lsm_file_ioctl+0x5/0x10 [ 103.512537][ T4658] ? security_file_ioctl+0x7c/0xa0 [ 103.517688][ T4658] ? dm_poll+0x120/0x120 [ 103.521951][ T4658] __se_sys_ioctl+0xfa/0x170 [ 103.526563][ T4658] do_syscall_64+0x4c/0xa0 [ 103.530997][ T4658] ? clear_bhb_loop+0x30/0x80 [ 103.535703][ T4658] ? clear_bhb_loop+0x30/0x80 [ 103.540410][ T4658] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 103.546336][ T4658] RIP: 0033:0x7f4a60fe5159 [ 103.550776][ T4658] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 103.570407][ T4658] RSP: 002b:00007f4a5f23d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 103.578848][ T4658] RAX: ffffffffffffffda RBX: 00007f4a6126cfa0 RCX: 00007f4a60fe5159 [ 103.586843][ T4658] RDX: 0000200000000000 RSI: 00000000c138fd03 RDI: 0000000000000004 [ 103.594840][ T4658] RBP: 00007f4a6107c06b R08: 0000000000000000 R09: 0000000000000000 [ 103.602829][ T4658] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 103.610827][ T4658] R13: 00007f4a6126d038 R14: 00007f4a6126cfa0 R15: 00007ffc5b33fa88 [ 103.618837][ T4658] [ 105.693862][ T4232] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 106.814608][ T4723] loop1: detected capacity change from 0 to 2048 [ 107.031376][ T4729] loop2: detected capacity change from 0 to 8192 [ 107.060873][ T4723] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 107.065848][ T4733] device syzkaller0 entered promiscuous mode [ 107.077115][ T4723] ext4 filesystem being mounted at /30/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 107.220125][ T4232] usb 5-1: New USB device found, idVendor=2a39, idProduct=3fd4, bcdDevice= 0.40 [ 107.255124][ T4232] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 107.330834][ T4232] usb 5-1: Product: syz [ 107.368064][ T4232] usb 5-1: Manufacturer: syz [ 107.410786][ T4232] usb 5-1: SerialNumber: syz [ 107.827470][ T4729] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 109.131211][ T4755] netlink: 'syz.3.144': attribute type 30 has an invalid length. [ 109.989502][ T4232] usb 5-1: MIDIStreaming interface descriptor not found [ 110.043730][ T4761] loop4: detected capacity change from 0 to 1024 [ 110.125703][ T26] audit: type=1800 audit(1790357008.620:5): pid=4766 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.149" name="device" dev="configfs" ino=33621 res=0 errno=0 [ 110.425241][ T4762] FAULT_INJECTION: forcing a failure. [ 110.425241][ T4762] name fail_page_alloc, interval 1, probability 0, space 0, times 1 [ 110.438732][ T4762] CPU: 0 PID: 4762 Comm: syz.3.148 Not tainted syzkaller #0 [ 110.446036][ T4762] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 110.456104][ T4762] Call Trace: [ 110.459403][ T4762] [ 110.462351][ T4762] dump_stack_lvl+0x188/0x250 [ 110.467053][ T4762] ? show_regs_print_info+0x20/0x20 [ 110.472275][ T4762] ? load_image+0x410/0x410 [ 110.476800][ T4762] ? __lock_acquire+0x7b50/0x7b50 [ 110.481844][ T4762] should_fail+0x383/0x4b0 [ 110.486282][ T4762] prepare_alloc_pages+0x1e3/0x5b0 [ 110.491419][ T4762] __alloc_pages+0x11b/0x480 [ 110.496026][ T4762] ? unwind_get_return_address+0x49/0x80 [ 110.501680][ T4762] ? zone_statistics+0x170/0x170 [ 110.506648][ T4762] ? alloc_pages+0x452/0x560 [ 110.511265][ T4762] stack_depot_save+0x356/0x460 [ 110.516143][ T4762] kasan_save_stack+0x4b/0x60 [ 110.520840][ T4762] ? kasan_save_stack+0x35/0x60 [ 110.525718][ T4762] ? kasan_record_aux_stack+0xb8/0x100 [ 110.531204][ T4762] ? call_rcu+0x189/0x900 [ 110.535557][ T4762] ? delete_node+0x1b8/0xa30 [ 110.540167][ T4762] ? radix_tree_delete_item+0x2df/0x3f0 [ 110.545740][ T4762] ? __tcf_action_put+0xa9/0xf0 [ 110.550613][ T4762] ? tcf_action_init+0x3cb/0x6b0 [ 110.555568][ T4762] ? tc_ctl_action+0x437/0xba0 [ 110.560342][ T4762] ? rtnetlink_rcv_msg+0x7f1/0xf10 [ 110.565469][ T4762] ? netlink_rcv_skb+0x1e9/0x430 [ 110.570422][ T4762] ? netlink_unicast+0x78f/0x940 [ 110.575356][ T4762] ? netlink_sendmsg+0x8ba/0xbe0 [ 110.580290][ T4762] ? ____sys_sendmsg+0x5be/0x8f0 [ 110.585253][ T4762] ? ___sys_sendmsg+0x236/0x2e0 [ 110.590120][ T4762] ? __se_sys_sendmsg+0x1b7/0x2a0 [ 110.595140][ T4762] ? do_syscall_64+0x4c/0xa0 [ 110.599750][ T4762] ? entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 110.605885][ T4762] kasan_record_aux_stack+0xb8/0x100 [ 110.611167][ T4762] ? plist_check_list+0x240/0x240 [ 110.616201][ T4762] call_rcu+0x189/0x900 [ 110.620358][ T4762] ? __mutex_lock_common+0x435/0x2400 [ 110.625748][ T4762] ? rcu_force_quiescent_state+0x220/0x220 [ 110.631543][ T4762] ? refcount_dec_and_mutex_lock+0x2c/0xa0 [ 110.637340][ T4762] ? tc_action_load_ops+0x550/0x550 [ 110.642542][ T4762] ? mutex_lock_io_nested+0x60/0x60 [ 110.647753][ T4762] delete_node+0x1b8/0xa30 [ 110.652166][ T4762] radix_tree_delete_item+0x2df/0x3f0 [ 110.657553][ T4762] __tcf_action_put+0xa9/0xf0 [ 110.662228][ T4762] tcf_action_init+0x3cb/0x6b0 [ 110.667008][ T4762] ? tcf_action_init_1+0x6b0/0x6b0 [ 110.672145][ T4762] ? __nla_parse+0x3c/0x50 [ 110.676554][ T4762] tc_ctl_action+0x437/0xba0 [ 110.681153][ T4762] ? tcf_free_cookie_rcu+0x40/0x40 [ 110.686304][ T4762] ? tcf_free_cookie_rcu+0x40/0x40 [ 110.691411][ T4762] rtnetlink_rcv_msg+0x7f1/0xf10 [ 110.696354][ T4762] ? rtnetlink_bind+0x80/0x80 [ 110.701027][ T4762] ? lock_chain_count+0x20/0x20 [ 110.705900][ T4762] ? _raw_spin_unlock_irqrestore+0x82/0x120 [ 110.711783][ T4762] ? lockdep_hardirqs_on+0x94/0x140 [ 110.716977][ T4762] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 110.722867][ T4762] ? _raw_spin_unlock+0x40/0x40 [ 110.727733][ T4762] ? rcu_preempt_deferred_qs_irqrestore+0x82d/0xbd0 [ 110.734321][ T4762] ? sync_rcu_exp_done_unlocked+0x140/0x140 [ 110.740212][ T4762] ? __copy_skb_header+0x3ba/0x4f0 [ 110.745337][ T4762] ? rcu_read_unlock_special+0xf0/0x4a0 [ 110.750874][ T4762] netlink_rcv_skb+0x1e9/0x430 [ 110.755651][ T4762] ? rtnetlink_bind+0x80/0x80 [ 110.760328][ T4762] ? netlink_ack+0xb10/0xb10 [ 110.764970][ T4762] ? __rcu_read_unlock+0x78/0xd0 [ 110.769918][ T4762] netlink_unicast+0x78f/0x940 [ 110.774676][ T4762] netlink_sendmsg+0x8ba/0xbe0 [ 110.779444][ T4762] ? netlink_getsockopt+0x570/0x570 [ 110.784652][ T4762] ? audit_tree_destroy_watch+0x20/0x20 [ 110.790190][ T4762] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 110.795464][ T4762] ? security_socket_sendmsg+0x7c/0xa0 [ 110.800922][ T4762] ? netlink_getsockopt+0x570/0x570 [ 110.806142][ T4762] ____sys_sendmsg+0x5be/0x8f0 [ 110.810936][ T4762] ? __sys_sendmsg_sock+0x30/0x30 [ 110.815999][ T4762] ? import_iovec+0x6f/0xa0 [ 110.820532][ T4762] ___sys_sendmsg+0x236/0x2e0 [ 110.825248][ T4762] ? __sys_sendmsg+0x290/0x290 [ 110.830077][ T4762] __se_sys_sendmsg+0x1b7/0x2a0 [ 110.834962][ T4762] ? __x64_sys_sendmsg+0x80/0x80 [ 110.839944][ T4762] ? syscall_enter_from_user_mode+0x2a/0x70 [ 110.845860][ T4762] do_syscall_64+0x4c/0xa0 [ 110.850271][ T4762] ? clear_bhb_loop+0x30/0x80 [ 110.854936][ T4762] ? clear_bhb_loop+0x30/0x80 [ 110.859612][ T4762] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 110.865514][ T4762] RIP: 0033:0x7f0ad44e0159 [ 110.869919][ T4762] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 110.889515][ T4762] RSP: 002b:00007f0ad2738028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 110.897915][ T4762] RAX: ffffffffffffffda RBX: 00007f0ad4767fa0 RCX: 00007f0ad44e0159 [ 110.905891][ T4762] RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000004 [ 110.913853][ T4762] RBP: 00007f0ad457706b R08: 0000000000000000 R09: 0000000000000000 [ 110.921820][ T4762] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 110.929796][ T4762] R13: 00007f0ad4768038 R14: 00007f0ad4767fa0 R15: 00007fff14a92458 [ 110.937775][ T4762] [ 111.378474][ T4232] usb 5-1: USB disconnect, device number 2 [ 111.425393][ T4761] ======================================================= [ 111.425393][ T4761] WARNING: The mand mount option has been deprecated and [ 111.425393][ T4761] and is ignored by this kernel. Remove the mand [ 111.425393][ T4761] option from the mount to silence this warning. [ 111.425393][ T4761] ======================================================= [ 111.648855][ T4778] netlink: 'syz.1.153': attribute type 2 has an invalid length. [ 111.661175][ T4778] netlink: 'syz.1.153': attribute type 1 has an invalid length. [ 111.676844][ T4784] netlink: 224 bytes leftover after parsing attributes in process `syz.3.154'. [ 111.690815][ T4784] netlink: 16 bytes leftover after parsing attributes in process `syz.3.154'. [ 112.309734][ T4761] EXT4-fs (loop4): Ignoring removed oldalloc option [ 112.316521][ T4761] EXT4-fs (loop4): Ignoring removed orlov option [ 112.389154][ T4761] EXT4-fs warning (device loop4): ext4_multi_mount_protect:403: Unable to create kmmpd thread for loop4. [ 113.112435][ T4177] udevd[4177]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 114.507845][ T26] audit: type=1800 audit(1790357013.000:6): pid=4825 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.162" name="device" dev="configfs" ino=34635 res=0 errno=0 [ 115.187263][ T4834] netlink: 'syz.1.168': attribute type 29 has an invalid length. [ 115.289182][ T26] audit: type=1800 audit(1790357013.770:7): pid=4835 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.167" name="device" dev="configfs" ino=34643 res=0 errno=0 [ 116.944704][ T4854] bridge0: port 3(syz_tun) entered blocking state [ 116.968281][ T4854] bridge0: port 3(syz_tun) entered disabled state [ 116.986514][ T4846] sctp: failed to load transform for md5: -2 [ 117.040393][ T4854] device syz_tun entered promiscuous mode [ 117.074576][ T4854] bridge0: port 3(syz_tun) entered blocking state [ 117.081407][ T4854] bridge0: port 3(syz_tun) entered forwarding state [ 117.119969][ T4864] bridge0: port 3(syz_tun) entered disabled state [ 117.151174][ T4864] bridge0: port 1(bridge_slave_0) entered disabled state [ 117.170166][ T4864] bridge0: port 2(bridge_slave_1) entered disabled state [ 117.689200][ T26] audit: type=1800 audit(1790357016.160:8): pid=4876 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.179" name="device" dev="configfs" ino=33783 res=0 errno=0 [ 118.188553][ T4882] sctp: [Deprecated]: syz.3.175 (pid 4882) Use of struct sctp_assoc_value in delayed_ack socket option. [ 118.188553][ T4882] Use struct sctp_sack_info instead [ 118.544788][ T4892] loop7: detected capacity change from 0 to 7 [ 119.078059][ T4892] Dev loop7: unable to read RDB block 7 [ 119.096684][ T4892] loop7: unable to read partition table [ 119.138839][ T4892] loop7: partition table beyond EOD, truncated [ 119.145458][ T4892] loop_reread_partitions: partition scan of loop7 (þ被xü—ŸÑà– ) failed (rc=-5) [ 119.512270][ T26] audit: type=1800 audit(1790357019.014:9): pid=4911 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.186" name="device" dev="configfs" ino=34747 res=0 errno=0 [ 122.029137][ T26] audit: type=1800 audit(1790357021.474:10): pid=4936 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.196" name="device" dev="configfs" ino=34860 res=0 errno=0 [ 123.676889][ T4955] syz.3.204 uses obsolete (PF_INET,SOCK_PACKET) [ 124.056825][ T26] audit: type=1800 audit(1790357023.554:11): pid=4966 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.205" name="device" dev="configfs" ino=35860 res=0 errno=0 [ 124.644133][ T4971] loop2: detected capacity change from 0 to 512 [ 125.393160][ T26] audit: type=1800 audit(1790357024.494:12): pid=4983 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.208" name="device" dev="configfs" ino=34954 res=0 errno=0 [ 125.424180][ T4971] EXT4-fs (loop2): Ignoring removed nobh option [ 125.461548][ T4971] EXT4-fs (loop2): Cannot turn on journaled quota: type 0: error -13 [ 125.570126][ T4971] EXT4-fs error (device loop2): ext4_clear_blocks:883: inode #13: comm syz.2.207: attempt to clear invalid blocks 1 len 1 [ 125.610308][ T4971] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1176: group 0, block bitmap and bg descriptor inconsistent: 218 vs 220 free clusters [ 125.635471][ T4971] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.207: invalid indirect mapped block 1819239214 (level 0) [ 125.651602][ T4971] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #13: comm syz.2.207: invalid indirect mapped block 1819239214 (level 1) [ 125.677179][ T4971] EXT4-fs (loop2): 1 truncate cleaned up [ 125.683500][ T4971] EXT4-fs (loop2): mounted filesystem without journal. Opts: nolazytime,resuid=0x0000000000000000,jqfmt=vfsv1,errors=continue,nobh,usrjquota=..,errors=continue. Quota mode: writeback. [ 125.772199][ T4994] loop0: detected capacity change from 0 to 128 [ 126.150041][ T4994] EXT4-fs (loop0): mounted filesystem without journal. Opts: grpjquota=,dioread_lock,delalloc,commit=0x0000000000000000,,errors=continue. Quota mode: none. [ 126.166988][ T4994] ext4 filesystem being mounted at /53/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 126.980237][ T26] audit: type=1800 audit(1790357026.424:13): pid=4971 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.207" name="file0" dev="loop2" ino=13 res=0 errno=0 [ 127.235534][ T4998] loop3: detected capacity change from 0 to 2048 [ 127.457599][ T5001] ieee802154 phy0 wpan0: encryption failed: -22 [ 127.721298][ T4998] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 127.805996][ T4998] ext4 filesystem being mounted at /40/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 128.147759][ T26] audit: type=1800 audit(1790357027.644:14): pid=5011 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.219" name="device" dev="configfs" ino=35929 res=0 errno=0 [ 128.579301][ T26] audit: type=1800 audit(1790357028.034:15): pid=5021 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.220" name="device" dev="configfs" ino=34989 res=0 errno=0 [ 129.076750][ T5017] device syzkaller0 entered promiscuous mode [ 129.499358][ T26] audit: type=1800 audit(1790357028.954:16): pid=5029 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.223" name="device" dev="configfs" ino=35941 res=0 errno=0 [ 130.602907][ T4188] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 130.637217][ T5061] Illegal XDP return value 4294967274, expect packet loss! [ 131.329140][ T26] audit: type=1800 audit(1790357030.484:17): pid=5065 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.232" name="device" dev="configfs" ino=35062 res=0 errno=0 [ 131.419768][ T4188] usb 3-1: Using ep0 maxpacket: 16 [ 131.584962][ T5070] netlink: 'syz.1.236': attribute type 21 has an invalid length. [ 131.850702][ T4188] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 131.854008][ T5078] device syzkaller0 entered promiscuous mode [ 132.372998][ T4188] usb 3-1: config 0 has no interfaces? [ 132.449448][ T4188] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 132.472696][ T4188] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 132.484941][ T4188] usb 3-1: Manufacturer: syz [ 132.549576][ T4188] usb 3-1: config 0 descriptor?? [ 132.722665][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.722734][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.790188][ T26] audit: type=1800 audit(1790357032.284:18): pid=5092 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.241" name="device" dev="configfs" ino=36028 res=0 errno=0 [ 132.834580][ T4228] usb 3-1: USB disconnect, device number 2 [ 134.044779][ T5114] loop1: detected capacity change from 0 to 512 [ 134.762767][ T5126] netlink: 'syz.0.251': attribute type 29 has an invalid length. [ 134.793154][ T5114] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 134.913086][ T5114] EXT4-fs (loop1): mounted filesystem without journal. Opts: grpid,jqfmt=vfsv0,,errors=continue. Quota mode: writeback. [ 134.995561][ T26] audit: type=1800 audit(1790357034.494:19): pid=5137 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.250" name="device" dev="configfs" ino=36080 res=0 errno=0 [ 135.695386][ T5114] ext4 filesystem being mounted at /63/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 135.958397][ T26] audit: type=1800 audit(1790357035.414:20): pid=5149 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.255" name="device" dev="configfs" ino=35156 res=0 errno=0 [ 136.612462][ T5148] loop4: detected capacity change from 0 to 4096 [ 136.618119][ T5143] loop0: detected capacity change from 0 to 8192 [ 136.679675][ T5148] EXT4-fs (loop4): inline encryption not supported [ 136.687374][ T5143] FAT-fs (loop0): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 136.730430][ T5148] EXT4-fs (loop4): Test dummy encryption mode enabled [ 136.766450][ T5155] loop3: detected capacity change from 0 to 2048 [ 136.829505][ T5148] EXT4-fs (loop4): Quota format mount options ignored when QUOTA feature is enabled [ 137.024027][ T5155] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 137.063372][ T26] audit: type=1800 audit(1790357036.564:21): pid=5171 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.262" name="device" dev="configfs" ino=35179 res=0 errno=0 [ 137.095789][ T5148] [EXT4 FS bs=4096, gc=1, bpg=524288, ipg=32, mo=a842c018, mo2=0003] [ 137.168023][ T5148] System zones: 0-5 [ 137.487721][ T5155] ext4 filesystem being mounted at /46/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 137.650576][ T5148] EXT4-fs (loop4): mounted filesystem without journal. Opts: debug,lazytime,inlinecrypt,test_dummy_encryption,grpjquota=,auto_da_alloc,delalloc,jqfmt=vfsv0,,errors=continue. Quota mode: writeback. [ 137.759618][ T13] Bluetooth: hci3: command 0x0405 tx timeout [ 138.063183][ T5148] fscrypt (loop4): Error allocating 'xts(aes)' transform: -4 [ 138.139500][ T5190] loop0: detected capacity change from 0 to 128 [ 138.192323][ T26] audit: type=1326 audit(1790357037.694:22): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5191 comm="syz.3.269" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0ad44e0159 code=0x7ffc0000 [ 138.236815][ T26] audit: type=1326 audit(1790357037.704:23): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5191 comm="syz.3.269" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0ad44e0159 code=0x7ffc0000 [ 138.339844][ T5190] EXT4-fs (loop0): mounted filesystem without journal. Opts: nodiscard,,errors=continue. Quota mode: none. [ 138.375298][ T5190] ext4 filesystem being mounted at /65/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 138.388752][ T26] audit: type=1326 audit(1790357037.724:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5191 comm="syz.3.269" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f0ad44e0159 code=0x7ffc0000 [ 138.423173][ T26] audit: type=1326 audit(1790357037.724:25): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5191 comm="syz.3.269" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0ad44e0159 code=0x7ffc0000 [ 138.455669][ T26] audit: type=1326 audit(1790357037.724:26): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5191 comm="syz.3.269" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=31 compat=0 ip=0x7f0ad44e0159 code=0x7ffc0000 [ 139.113058][ T5200] loop3: detected capacity change from 0 to 2048 [ 139.364654][ T26] audit: type=1326 audit(1790357037.724:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5191 comm="syz.3.269" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0ad44e0159 code=0x7ffc0000 [ 139.387399][ T5212] loop4: detected capacity change from 0 to 2048 [ 139.758539][ T5200] EXT4-fs (loop3): mounted filesystem without journal. Opts: jqfmt=vfsv1,errors=remount-ro,max_dir_size_kb=0x0000000000000004,quota,. Quota mode: writeback. [ 139.828070][ T5200] EXT4-fs error (device loop3): ext4_find_extent:929: inode #2: comm syz.3.271: pblk 1 bad header/extent: invalid magic - magic 2, entries 0, max 3(0), depth 0(4) [ 139.831394][ T5200] EXT4-fs (loop3): Remounting filesystem read-only [ 139.832814][ T5200] EXT4-fs error (device loop3): ext4_ext_precache:608: inode #2: comm syz.3.271: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 5(5) [ 139.834531][ T5200] EXT4-fs (loop3): Remounting filesystem read-only [ 140.046692][ T5212] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 140.169212][ T5212] ext4 filesystem being mounted at /47/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 140.354319][ T26] audit: type=1800 audit(1790357039.854:28): pid=5232 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.275" name="device" dev="configfs" ino=35235 res=0 errno=0 [ 142.070941][ T5259] FAULT_INJECTION: forcing a failure. [ 142.070941][ T5259] name failslab, interval 1, probability 0, space 0, times 0 [ 142.088610][ T5259] CPU: 1 PID: 5259 Comm: syz.2.288 Not tainted syzkaller #0 [ 142.095936][ T5259] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 142.106017][ T5259] Call Trace: [ 142.109326][ T5259] [ 142.112281][ T5259] dump_stack_lvl+0x188/0x250 [ 142.116995][ T5259] ? show_regs_print_info+0x20/0x20 [ 142.122231][ T5259] ? load_image+0x410/0x410 [ 142.126767][ T5259] ? __might_sleep+0xf0/0xf0 [ 142.131371][ T5259] ? __lock_acquire+0x7b50/0x7b50 [ 142.136427][ T5259] should_fail+0x383/0x4b0 [ 142.140876][ T5259] should_failslab+0x5/0x20 [ 142.145404][ T5259] slab_pre_alloc_hook+0x51/0xc0 [ 142.150365][ T5259] ? __kernfs_new_node+0xa8/0x6b0 [ 142.155427][ T5259] __kmalloc_track_caller+0x69/0x330 [ 142.160734][ T5259] ? __kernfs_new_node+0xa8/0x6b0 [ 142.165794][ T5259] kstrdup_const+0x51/0x90 [ 142.170233][ T5259] __kernfs_new_node+0xa8/0x6b0 [ 142.175125][ T5259] ? kernfs_new_node+0x250/0x250 [ 142.180091][ T5259] ? pointer+0xc60/0xc60 [ 142.184365][ T5259] ? format_decode+0xb38/0x1330 [ 142.189239][ T5259] ? make_kgid+0x1c4/0x650 [ 142.193685][ T5259] ? from_kuid_munged+0x6e0/0x6e0 [ 142.198729][ T5259] kernfs_new_node+0x148/0x250 [ 142.203519][ T5259] kernfs_create_dir_ns+0x40/0x120 [ 142.208646][ T5259] sysfs_create_dir_ns+0x12c/0x290 [ 142.213773][ T5259] ? sysfs_warn_dup+0xa0/0xa0 [ 142.218481][ T5259] ? do_raw_spin_unlock+0x11d/0x230 [ 142.223708][ T5259] kobject_add_internal+0x5ba/0xcd0 [ 142.228933][ T5259] kobject_init_and_add+0x128/0x190 [ 142.234163][ T5259] ? kfree+0xef/0x2a0 [ 142.238176][ T5259] ? kobject_add+0x230/0x230 [ 142.242793][ T5259] ? kobject_uevent_env+0x36c/0x890 [ 142.248021][ T5259] net_rx_queue_update_kobjects+0x1b9/0x4b0 [ 142.253948][ T5259] netdev_register_kobject+0x231/0x320 [ 142.259441][ T5259] register_netdevice+0x10e8/0x1720 [ 142.264678][ T5259] ? netif_stacked_transfer_operstate+0x200/0x200 [ 142.271112][ T5259] ? xdp_rxq_info_reg+0xe0/0x2e0 [ 142.276080][ T5259] ? validate_linkmsg+0x3db/0x4c0 [ 142.281139][ T5259] ? bond_validate+0x150/0x150 [ 142.285931][ T5259] bond_newlink+0x33/0x80 [ 142.290297][ T5259] ? bond_validate+0x150/0x150 [ 142.295084][ T5259] rtnl_newlink+0x139e/0x1920 [ 142.299799][ T5259] ? rtnl_setlink+0x500/0x500 [ 142.304511][ T5259] ? mark_lock+0x94/0x320 [ 142.308873][ T5259] ? __lock_acquire+0x13dc/0x7b50 [ 142.313973][ T5259] ? __lock_acquire+0x1305/0x7b50 [ 142.319095][ T5259] ? rtnetlink_rcv_msg+0x79f/0xf10 [ 142.324258][ T5259] ? rtnl_setlink+0x500/0x500 [ 142.328952][ T5259] rtnetlink_rcv_msg+0x7f1/0xf10 [ 142.333921][ T5259] ? lock_chain_count+0x20/0x20 [ 142.338802][ T5259] ? rtnetlink_bind+0x80/0x80 [ 142.343510][ T5259] ? __local_bh_enable_ip+0x136/0x1c0 [ 142.348907][ T5259] ? lockdep_hardirqs_on+0x94/0x140 [ 142.354130][ T5259] ? __local_bh_enable_ip+0x136/0x1c0 [ 142.359523][ T5259] ? _local_bh_enable+0xa0/0xa0 [ 142.364408][ T5259] ? __dev_queue_xmit+0x1b64/0x2e50 [ 142.369647][ T5259] ? dev_queue_xmit+0x20/0x20 [ 142.374345][ T5259] ? memcpy+0x3c/0x60 [ 142.378346][ T5259] ? __copy_skb_header+0x3ba/0x4f0 [ 142.383494][ T5259] netlink_rcv_skb+0x1e9/0x430 [ 142.388289][ T5259] ? rtnetlink_bind+0x80/0x80 [ 142.392990][ T5259] ? netlink_ack+0xb10/0xb10 [ 142.397613][ T5259] netlink_unicast+0x78f/0x940 [ 142.402407][ T5259] netlink_sendmsg+0x8ba/0xbe0 [ 142.407198][ T5259] ? netlink_getsockopt+0x570/0x570 [ 142.412413][ T5259] ? aa_sock_msg_perm+0x94/0x150 [ 142.417377][ T5259] ? apparmor_socket_sendmsg+0x88/0x230 [ 142.422944][ T5259] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 142.428248][ T5259] ? security_socket_sendmsg+0x7c/0xa0 [ 142.433735][ T5259] ? netlink_getsockopt+0x570/0x570 [ 142.438966][ T5259] ____sys_sendmsg+0x5be/0x8f0 [ 142.443765][ T5259] ? __sys_sendmsg_sock+0x30/0x30 [ 142.448074][ T5266] loop1: detected capacity change from 0 to 4096 [ 142.448818][ T5259] ? import_iovec+0x6f/0xa0 [ 142.448849][ T5259] ___sys_sendmsg+0x236/0x2e0 [ 142.464360][ T5259] ? __sys_sendmsg+0x290/0x290 [ 142.469281][ T5259] __se_sys_sendmsg+0x1b7/0x2a0 [ 142.474156][ T5259] ? __x64_sys_sendmsg+0x80/0x80 [ 142.479117][ T5259] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 142.485144][ T5259] ? lockdep_hardirqs_on+0x94/0x140 [ 142.490372][ T5259] do_syscall_64+0x4c/0xa0 [ 142.494814][ T5259] ? clear_bhb_loop+0x30/0x80 [ 142.499511][ T5259] ? clear_bhb_loop+0x30/0x80 [ 142.504220][ T5259] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 142.510132][ T5259] RIP: 0033:0x7f4a60fe5159 [ 142.514552][ T5259] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 142.534159][ T5259] RSP: 002b:00007f4a5f23d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 142.542573][ T5259] RAX: ffffffffffffffda RBX: 00007f4a6126cfa0 RCX: 00007f4a60fe5159 [ 142.550547][ T5259] RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000004 [ 142.558516][ T5259] RBP: 00007f4a6107c06b R08: 0000000000000000 R09: 0000000000000000 [ 142.566483][ T5259] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 142.574453][ T5259] R13: 00007f4a6126d038 R14: 00007f4a6126cfa0 R15: 00007ffc5b33fa88 [ 142.582436][ T5259] [ 142.587332][ T5259] kobject_add_internal failed for rx-12 (error: -12 parent: queues) [ 142.614234][ T5259] bond1 (unregistered): Released all slaves [ 142.702265][ T5266] EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 142.976439][ T5275] loop2: detected capacity change from 0 to 2048 [ 143.091113][ T5275] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 143.122566][ T5275] ext4 filesystem being mounted at /45/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 143.547812][ T26] audit: type=1800 audit(1790357043.044:29): pid=5287 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.296" name="device" dev="configfs" ino=35337 res=0 errno=0 [ 144.499231][ T26] audit: type=1800 audit(1790357043.974:30): pid=5293 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.298" name="device" dev="configfs" ino=36276 res=0 errno=0 [ 144.853155][ T5294] FAULT_INJECTION: forcing a failure. [ 144.853155][ T5294] name failslab, interval 1, probability 0, space 0, times 0 [ 145.031521][ T5294] CPU: 1 PID: 5294 Comm: syz.1.299 Not tainted syzkaller #0 [ 145.038865][ T5294] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 145.048930][ T5294] Call Trace: [ 145.052219][ T5294] [ 145.055176][ T5294] dump_stack_lvl+0x188/0x250 [ 145.059885][ T5294] ? show_regs_print_info+0x20/0x20 [ 145.065103][ T5294] ? load_image+0x410/0x410 [ 145.069630][ T5294] ? __might_sleep+0xf0/0xf0 [ 145.074244][ T5294] ? __lock_acquire+0x7b50/0x7b50 [ 145.079297][ T5294] should_fail+0x383/0x4b0 [ 145.083737][ T5294] should_failslab+0x5/0x20 [ 145.088257][ T5294] slab_pre_alloc_hook+0x51/0xc0 [ 145.093214][ T5294] kmem_cache_alloc_trace+0x47/0x290 [ 145.098524][ T5294] ? __list_lru_init+0x535/0xac0 [ 145.103491][ T5294] __list_lru_init+0x535/0xac0 [ 145.108295][ T5294] alloc_super+0x787/0x970 [ 145.112732][ T5294] ? kill_litter_super+0xa0/0xa0 [ 145.117689][ T5294] sget_fc+0x2d4/0x6f0 [ 145.121800][ T5294] ? kill_litter_super+0xa0/0xa0 [ 145.126766][ T5294] ? shmem_reconfigure+0x790/0x790 [ 145.131901][ T5294] get_tree_nodev+0x26/0x160 [ 145.136519][ T5294] vfs_get_tree+0x88/0x270 [ 145.140964][ T5294] do_new_mount+0x247/0xa40 [ 145.145498][ T5294] __se_sys_mount+0x2e3/0x3d0 [ 145.150196][ T5294] ? __x64_sys_mount+0xc0/0xc0 [ 145.154984][ T5294] ? lockdep_hardirqs_on+0x94/0x140 [ 145.160200][ T5294] ? __x64_sys_mount+0x1c/0xc0 [ 145.164992][ T5294] do_syscall_64+0x4c/0xa0 [ 145.169420][ T5294] ? clear_bhb_loop+0x30/0x80 [ 145.174115][ T5294] ? clear_bhb_loop+0x30/0x80 [ 145.178814][ T5294] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 145.184741][ T5294] RIP: 0033:0x7f2f36f66159 [ 145.189175][ T5294] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 145.208797][ T5294] RSP: 002b:00007f2f351be028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 145.217241][ T5294] RAX: ffffffffffffffda RBX: 00007f2f371edfa0 RCX: 00007f2f36f66159 [ 145.225239][ T5294] RDX: 0000200000000540 RSI: 0000200000003c40 RDI: 0000000000000000 [ 145.233239][ T5294] RBP: 00007f2f36ffd06b R08: 0000200000000700 R09: 0000000000000000 [ 145.241238][ T5294] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 145.249239][ T5294] R13: 00007f2f371ee038 R14: 00007f2f371edfa0 R15: 00007ffd9fdc9308 [ 145.257257][ T5294] [ 148.173655][ T5386] netlink: 'syz.4.326': attribute type 4 has an invalid length. [ 149.262284][ T4232] kernel write not supported for file /input/mice (pid: 4232 comm: kworker/0:6) [ 151.195785][ T5437] loop0: detected capacity change from 0 to 2048 [ 151.326109][ T5453] dummy0: mtu less than device minimum [ 151.979794][ T5471] loop3: detected capacity change from 0 to 512 [ 151.995866][ T5437] EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 152.032114][ T5437] ext4 filesystem being mounted at /77/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 152.049288][ T5471] EXT4-fs (loop3): inline encryption not supported [ 152.059282][ T5471] EXT4-fs (loop3): encrypted files will use data=ordered instead of data journaling mode [ 152.121554][ T5471] EXT4-fs (loop3): Cannot turn on journaled quota: type 1: error -13 [ 152.159870][ T5471] EXT4-fs (loop3): 1 truncate cleaned up [ 152.166377][ T5471] EXT4-fs (loop3): mounted filesystem without journal. Opts: usrjquota=,nojournal_checksum,inlinecrypt,debug_want_extra_isize=0x0000000000000080,nojournal_checksum,jqfmt=vfsv1,errors=remount-ro,grpjquota=.,. Quota mode: writeback. [ 152.462028][ T5489] loop3: detected capacity change from 0 to 512 [ 152.769813][ T5489] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=e000e01c, mo2=0002] [ 152.853767][ T26] audit: type=1800 audit(1790357052.354:31): pid=5509 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.358" name="device" dev="configfs" ino=36545 res=0 errno=0 [ 152.901524][ T5489] System zones: 1-12 [ 153.055897][ T5489] EXT4-fs error (device loop3): ext4_xattr_inode_iget:401: inode #12: comm syz.3.355: missing EA_INODE flag [ 153.430942][ T5489] EXT4-fs error (device loop3): ext4_xattr_inode_iget:406: comm syz.3.355: error while reading EA inode 12 err=-117 [ 153.509476][ T5513] loop1: detected capacity change from 0 to 256 [ 153.522765][ T5489] EXT4-fs (loop3): 1 orphan inode deleted [ 153.547172][ T5489] EXT4-fs (loop3): mounted filesystem without journal. Opts: debug,resuid=0x000000000000ee01,,errors=continue. Quota mode: writeback. [ 155.225944][ T26] audit: type=1326 audit(1790357054.724:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5526 comm="syz.0.366" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1af77cc159 code=0x7ffc0000 [ 155.354955][ T26] audit: type=1326 audit(1790357054.724:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5526 comm="syz.0.366" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=51 compat=0 ip=0x7f1af77cc159 code=0x7ffc0000 [ 155.477724][ T26] audit: type=1326 audit(1790357054.724:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5526 comm="syz.0.366" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f1af77cc159 code=0x7ffc0000 [ 155.525532][ T5540] loop3: detected capacity change from 0 to 128 [ 156.410447][ T5540] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 156.461738][ T26] audit: type=1800 audit(1790357055.324:35): pid=5548 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.372" name="device" dev="configfs" ino=36584 res=0 errno=0 [ 156.498349][ T5540] ext4 filesystem being mounted at /67/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 156.534532][ T5556] FAULT_INJECTION: forcing a failure. [ 156.534532][ T5556] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 156.549112][ T5556] CPU: 0 PID: 5556 Comm: syz.2.377 Not tainted syzkaller #0 [ 156.556429][ T5556] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 156.566508][ T5556] Call Trace: [ 156.569810][ T5556] [ 156.572763][ T5556] dump_stack_lvl+0x188/0x250 [ 156.577472][ T5556] ? show_regs_print_info+0x20/0x20 [ 156.582694][ T5556] ? load_image+0x410/0x410 [ 156.587224][ T5556] ? mark_lock+0x94/0x320 [ 156.591580][ T5556] should_fail+0x383/0x4b0 [ 156.596025][ T5556] prepare_alloc_pages+0x1e3/0x5b0 [ 156.601166][ T5556] __alloc_pages+0x11b/0x480 [ 156.605785][ T5556] ? zone_statistics+0x170/0x170 [ 156.610755][ T5556] ? rcu_lock_acquire+0x30/0x30 [ 156.614754][ T5540] EXT4-fs (loop3): shut down requested (2) [ 156.615632][ T5556] ? alloc_pages+0x452/0x560 [ 156.626063][ T5556] __get_free_pages+0x8/0x30 [ 156.630679][ T5556] __tlb_remove_page_size+0x1f2/0x3f0 [ 156.636081][ T5556] unmap_page_range+0xfcf/0x2410 [ 156.641080][ T5556] unmap_vmas+0x131/0x250 [ 156.645442][ T5556] ? unmap_page_range+0x2410/0x2410 [ 156.650657][ T5556] ? __mutex_lock_common+0x435/0x2400 [ 156.656052][ T5556] ? exit_mm_release+0x16/0x30 [ 156.660846][ T5556] exit_mmap+0x3b9/0x640 [ 156.665120][ T5556] ? vm_brk+0x20/0x20 [ 156.669143][ T5556] ? uprobe_clear_state+0x2f6/0x460 [ 156.674367][ T5556] __mmput+0x115/0x390 [ 156.678458][ T5556] exit_mm+0x632/0x7b0 [ 156.680698][ T5561] fscrypt (loop3, inode 12): Error -5 getting encryption context [ 156.682541][ T5556] ? perf_pmu_migrate_context+0xb70/0xb70 [ 156.682575][ T5556] ? do_exit+0x2110/0x2110 [ 156.700409][ T5556] ? __ia32_sys_timer_delete+0x40/0x40 [ 156.705890][ T5556] ? hrtimer_try_to_cancel+0x3d6/0x420 [ 156.711377][ T5556] ? tty_audit_exit+0x149/0x1f0 [ 156.716252][ T5556] do_exit+0x5b8/0x2110 [ 156.720437][ T5556] ? put_task_struct+0x80/0x80 [ 156.725224][ T5556] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 156.731230][ T5556] ? _raw_spin_lock_irq+0xb7/0xf0 [ 156.736276][ T5556] do_group_exit+0x12c/0x2f0 [ 156.740883][ T5556] ? lockdep_hardirqs_on+0x94/0x140 [ 156.746117][ T5556] get_signal+0x7eb/0x12e0 [ 156.750578][ T5556] arch_do_signal_or_restart+0xe6/0x12a0 [ 156.756257][ T5556] ? futex_exit_release+0x1c0/0x1c0 [ 156.761485][ T5556] ? get_sigframe_size+0x10/0x10 [ 156.766446][ T5556] ? __context_tracking_exit+0x4c/0x80 [ 156.771944][ T5556] ? exit_to_user_mode_loop+0x3b/0x130 [ 156.777429][ T5556] exit_to_user_mode_loop+0x9e/0x130 [ 156.782735][ T5556] exit_to_user_mode_prepare+0xee/0x180 [ 156.788306][ T5556] syscall_exit_to_user_mode+0x16/0x40 [ 156.793791][ T5556] do_syscall_64+0x58/0xa0 [ 156.798229][ T5556] ? clear_bhb_loop+0x30/0x80 [ 156.802921][ T5556] ? clear_bhb_loop+0x30/0x80 [ 156.807616][ T5556] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 156.813531][ T5556] RIP: 0033:0x7f4a60fe5159 [ 156.817964][ T5556] Code: Unable to access opcode bytes at RIP 0x7f4a60fe512f. [ 156.825342][ T5556] RSP: 002b:00007f4a5f23d0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 156.833775][ T5556] RAX: 0000000000000001 RBX: 00007f4a6126cfa8 RCX: 00007f4a60fe5159 [ 156.841764][ T5556] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f4a6126cfac [ 156.849751][ T5556] RBP: 00007f4a6126cfa0 R08: 001dbe5cf7127ae2 R09: 0000000000000000 [ 156.857740][ T5556] R10: 0000000000000006 R11: 0000000000000246 R12: 0000000000000000 [ 156.865728][ T5556] R13: 00007f4a6126d038 R14: 00007ffc5b33f9a0 R15: 00007ffc5b33fa88 [ 156.873736][ T5556] [ 157.009685][ T5562] fscrypt (loop3, inode 12): Error -5 getting encryption context [ 157.018639][ T5562] fscrypt (loop3, inode 12): Error -5 getting encryption context [ 157.027161][ T5562] fscrypt (loop3, inode 12): Error -5 getting encryption context [ 157.035508][ T5562] fscrypt (loop3, inode 12): Error -5 getting encryption context [ 160.970816][ T5606] FAULT_INJECTION: forcing a failure. [ 160.970816][ T5606] name failslab, interval 1, probability 0, space 0, times 0 [ 161.079856][ T5606] CPU: 1 PID: 5606 Comm: syz.2.393 Not tainted syzkaller #0 [ 161.087210][ T5606] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 161.097289][ T5606] Call Trace: [ 161.100583][ T5606] [ 161.103522][ T5606] dump_stack_lvl+0x188/0x250 [ 161.108223][ T5606] ? show_regs_print_info+0x20/0x20 [ 161.113446][ T5606] ? load_image+0x410/0x410 [ 161.117977][ T5606] ? __might_sleep+0xf0/0xf0 [ 161.122592][ T5606] ? __lock_acquire+0x7b50/0x7b50 [ 161.127645][ T5606] should_fail+0x383/0x4b0 [ 161.132085][ T5606] should_failslab+0x5/0x20 [ 161.136606][ T5606] slab_pre_alloc_hook+0x51/0xc0 [ 161.141589][ T5606] __kmalloc+0x6b/0x340 [ 161.145762][ T5606] ? ops_init+0x8a/0x5f0 [ 161.150032][ T5606] ops_init+0x8a/0x5f0 [ 161.154121][ T5606] setup_net+0x39e/0xa10 [ 161.158387][ T5606] ? copy_net_ns+0x5b0/0x5b0 [ 161.163001][ T5606] ? copy_net_ns+0x324/0x5b0 [ 161.167617][ T5606] ? down_read_killable+0x1ce/0x340 [ 161.172850][ T5606] copy_net_ns+0x33e/0x5b0 [ 161.177299][ T5606] create_new_namespaces+0x3ce/0x700 [ 161.182626][ T5606] unshare_nsproxy_namespaces+0x116/0x160 [ 161.188379][ T5606] ksys_unshare+0x4f6/0x8e0 [ 161.192908][ T5606] ? __lock_acquire+0x7b50/0x7b50 [ 161.197968][ T5606] ? sighand_ctor+0x40/0x40 [ 161.202500][ T5606] ? lock_chain_count+0x20/0x20 [ 161.207395][ T5606] ? syscall_enter_from_user_mode+0x21/0x70 [ 161.213316][ T5606] __x64_sys_unshare+0x34/0x40 [ 161.218093][ T5606] do_syscall_64+0x4c/0xa0 [ 161.222522][ T5606] ? clear_bhb_loop+0x30/0x80 [ 161.227233][ T5606] ? clear_bhb_loop+0x30/0x80 [ 161.231934][ T5606] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 161.237850][ T5606] RIP: 0033:0x7f4a60fe5159 [ 161.242288][ T5606] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 161.261911][ T5606] RSP: 002b:00007f4a5f23d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 161.270356][ T5606] RAX: ffffffffffffffda RBX: 00007f4a6126cfa0 RCX: 00007f4a60fe5159 [ 161.278350][ T5606] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 [ 161.286345][ T5606] RBP: 00007f4a6107c06b R08: 0000000000000000 R09: 0000000000000000 [ 161.294338][ T5606] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 161.302328][ T5606] R13: 00007f4a6126d038 R14: 00007f4a6126cfa0 R15: 00007ffc5b33fa88 [ 161.310343][ T5606] [ 161.460292][ T5612] loop1: detected capacity change from 0 to 1024 [ 161.567944][ T5612] EXT4-fs (loop1): Ignoring removed bh option [ 161.640692][ T5612] EXT4-fs (loop1): mounted filesystem without journal. Opts: nobarrier,dioread_lock,barrier=0x0000000000000000,nolazytime,dax=inode,lazytime,errors=remount-ro,stripe=0x0000000000000004,bh,mb_optimize_scan=0x0000000000000001,. Quota mode: none. [ 162.091288][ T4187] bridge0: port 3(syz_tun) entered disabled state [ 162.177368][ T4187] device syz_tun left promiscuous mode [ 162.215914][ T4187] bridge0: port 3(syz_tun) entered disabled state [ 162.509148][ T4187] syz-executor (4187) used greatest stack depth: 20336 bytes left [ 162.562673][ T1218] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 162.712420][ T1218] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 162.918374][ T1218] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 162.940561][ T5647] FAULT_INJECTION: forcing a failure. [ 162.940561][ T5647] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 162.954140][ T5647] CPU: 0 PID: 5647 Comm: syz.3.410 Not tainted syzkaller #0 [ 162.961454][ T5647] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 162.971549][ T5647] Call Trace: [ 162.974847][ T5647] [ 162.977792][ T5647] dump_stack_lvl+0x188/0x250 [ 162.982502][ T5647] ? show_regs_print_info+0x20/0x20 [ 162.987726][ T5647] ? load_image+0x410/0x410 [ 162.992256][ T5647] ? mark_lock+0x94/0x320 [ 162.996611][ T5647] should_fail+0x383/0x4b0 [ 163.001056][ T5647] prepare_alloc_pages+0x1e3/0x5b0 [ 163.006208][ T5647] __alloc_pages+0x11b/0x480 [ 163.010826][ T5647] ? zone_statistics+0x170/0x170 [ 163.015785][ T5647] ? rcu_lock_acquire+0x30/0x30 [ 163.020656][ T5647] ? alloc_pages+0x452/0x560 [ 163.025274][ T5647] __get_free_pages+0x8/0x30 [ 163.029882][ T5647] __tlb_remove_page_size+0x1f2/0x3f0 [ 163.035280][ T5647] unmap_page_range+0xfcf/0x2410 [ 163.040268][ T5647] unmap_vmas+0x131/0x250 [ 163.044621][ T5647] ? unmap_page_range+0x2410/0x2410 [ 163.049833][ T5647] ? __mutex_lock_common+0x435/0x2400 [ 163.055225][ T5647] ? exit_mm_release+0x16/0x30 [ 163.060016][ T5647] exit_mmap+0x3b9/0x640 [ 163.064285][ T5647] ? vm_brk+0x20/0x20 [ 163.068306][ T5647] ? uprobe_clear_state+0x2f6/0x460 [ 163.073535][ T5647] __mmput+0x115/0x390 [ 163.077627][ T5647] exit_mm+0x632/0x7b0 [ 163.081719][ T5647] ? perf_pmu_migrate_context+0xb70/0xb70 [ 163.087468][ T5647] ? do_exit+0x2110/0x2110 [ 163.091904][ T5647] ? __ia32_sys_timer_delete+0x40/0x40 [ 163.097379][ T5647] ? hrtimer_try_to_cancel+0x3d6/0x420 [ 163.102866][ T5647] ? tty_audit_exit+0x149/0x1f0 [ 163.107745][ T5647] do_exit+0x5b8/0x2110 [ 163.111927][ T5647] ? put_task_struct+0x80/0x80 [ 163.116709][ T5647] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 163.122719][ T5647] ? _raw_spin_lock_irq+0xb7/0xf0 [ 163.127768][ T5647] do_group_exit+0x12c/0x2f0 [ 163.132375][ T5647] ? lockdep_hardirqs_on+0x94/0x140 [ 163.137598][ T5647] get_signal+0x7eb/0x12e0 [ 163.142052][ T5647] arch_do_signal_or_restart+0xe6/0x12a0 [ 163.147714][ T5647] ? rcu_lock_release+0x9/0x20 [ 163.152507][ T5647] ? futex_exit_release+0x1c0/0x1c0 [ 163.157725][ T5647] ? get_sigframe_size+0x10/0x10 [ 163.162684][ T5647] ? __context_tracking_exit+0x4c/0x80 [ 163.168176][ T5647] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 163.174187][ T5647] ? exit_to_user_mode_loop+0x3b/0x130 [ 163.179682][ T5647] exit_to_user_mode_loop+0x9e/0x130 [ 163.184999][ T5647] exit_to_user_mode_prepare+0xee/0x180 [ 163.190570][ T5647] syscall_exit_to_user_mode+0x16/0x40 [ 163.196059][ T5647] do_syscall_64+0x58/0xa0 [ 163.200496][ T5647] ? clear_bhb_loop+0x30/0x80 [ 163.205194][ T5647] ? clear_bhb_loop+0x30/0x80 [ 163.209896][ T5647] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 163.215812][ T5647] RIP: 0033:0x7f0ad44e0159 [ 163.220249][ T5647] Code: Unable to access opcode bytes at RIP 0x7f0ad44e012f. [ 163.227625][ T5647] RSP: 002b:00007f0ad27380e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 163.236062][ T5647] RAX: fffffffffffffe00 RBX: 00007f0ad4767fa8 RCX: 00007f0ad44e0159 [ 163.244054][ T5647] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f0ad4767fa8 [ 163.252043][ T5647] RBP: 00007f0ad4767fa0 R08: 0000000000000000 R09: 0000000000000000 [ 163.260040][ T5647] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 163.268026][ T5647] R13: 00007f0ad4768038 R14: 00007fff14a92370 R15: 00007fff14a92458 [ 163.276033][ T5647] [ 163.389490][ T1218] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 163.551715][ T5658] netlink: 16 bytes leftover after parsing attributes in process `syz.3.413'. [ 163.877823][ T5669] netlink: 8 bytes leftover after parsing attributes in process `syz.3.416'. [ 164.278447][ T5669] team0: Device wg0 is of different type [ 164.937941][ T5652] chnl_net:caif_netlink_parms(): no params data found [ 165.181437][ T5692] loop3: detected capacity change from 0 to 128 [ 165.352882][ T13] Bluetooth: hci2: command 0x0409 tx timeout [ 165.422902][ T5692] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpjquota=,dioread_lock,delalloc,commit=0x0000000000000000,,errors=continue. Quota mode: none. [ 165.464687][ T5692] ext4 filesystem being mounted at /74/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 165.496242][ C1] vkms_vblank_simulate: vblank timer overrun [ 165.524556][ T5652] bridge0: port 1(bridge_slave_0) entered blocking state [ 165.541111][ T5652] bridge0: port 1(bridge_slave_0) entered disabled state [ 165.550924][ T5652] device bridge_slave_0 entered promiscuous mode [ 165.619982][ T5652] bridge0: port 2(bridge_slave_1) entered blocking state [ 165.706065][ T5652] bridge0: port 2(bridge_slave_1) entered disabled state [ 165.736455][ T5652] device bridge_slave_1 entered promiscuous mode [ 165.755378][ T5712] loop3: detected capacity change from 0 to 512 [ 165.890894][ T5652] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 165.923514][ T5652] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 165.966826][ T5712] EXT4-fs error (device loop3): ext4_validate_block_bitmap:429: comm syz.3.425: bg 0: block 5: invalid block bitmap [ 166.001843][ T5712] EXT4-fs error (device loop3) in ext4_mb_clear_bb:6191: Corrupt filesystem [ 166.100349][ T5712] EXT4-fs error (device loop3): ext4_free_branches:1030: inode #11: comm syz.3.425: invalid indirect mapped block 3 (level 2) [ 166.134189][ T5652] team0: Port device team_slave_0 added [ 166.200237][ T5712] EXT4-fs (loop3): 1 orphan inode deleted [ 166.206029][ T5712] EXT4-fs (loop3): 1 truncate cleaned up [ 166.230804][ T5652] team0: Port device team_slave_1 added [ 166.259225][ T5712] EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: writeback. [ 166.371737][ T5652] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 166.378763][ T5652] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 166.486149][ T5652] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 166.563630][ T5652] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 166.579098][ T5652] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 166.931655][ T5652] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 167.439166][ T13] Bluetooth: hci2: command 0x041b tx timeout [ 167.690302][ T5652] device hsr_slave_0 entered promiscuous mode [ 167.739673][ T5652] device hsr_slave_1 entered promiscuous mode [ 167.758142][ T5652] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 167.768524][ T5746] loop0: detected capacity change from 0 to 512 [ 167.776997][ T5652] Cannot create hsr debugfs directory [ 167.808369][ T5748] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 167.816146][ T5748] IPv6: NLM_F_CREATE should be set when creating new route [ 167.823435][ T5748] IPv6: NLM_F_CREATE should be set when creating new route [ 168.175570][ T1218] device hsr_slave_0 left promiscuous mode [ 168.183062][ T5746] EXT4-fs (loop0): mounted filesystem without journal. Opts: grpquota,nogrpid,quota,,errors=continue. Quota mode: writeback. [ 168.196847][ T1218] device hsr_slave_1 left promiscuous mode [ 168.198671][ T5758] loop3: detected capacity change from 0 to 128 [ 168.216755][ T1218] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 168.238462][ T1218] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 168.276795][ T5746] ext4 filesystem being mounted at /101/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 168.279279][ T5758] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpjquota=,dioread_lock,delalloc,commit=0x0000000000000000,,errors=continue. Quota mode: none. [ 168.305655][ T1218] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 168.313561][ T5758] ext4 filesystem being mounted at /80/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 168.359161][ T1218] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 168.398360][ T1218] device bridge_slave_1 left promiscuous mode [ 168.437317][ T1218] bridge0: port 2(bridge_slave_1) entered disabled state [ 168.488907][ T1218] device bridge_slave_0 left promiscuous mode [ 168.520047][ T1218] bridge0: port 1(bridge_slave_0) entered disabled state [ 168.632783][ T1218] device veth1_macvtap left promiscuous mode [ 168.649493][ T1218] device veth0_macvtap left promiscuous mode [ 168.699410][ T1218] device veth1_vlan left promiscuous mode [ 168.709987][ T1218] device veth0_vlan left promiscuous mode [ 169.411582][ T5781] netlink: 16 bytes leftover after parsing attributes in process `syz.2.445'. [ 169.509185][ T4231] Bluetooth: hci2: command 0x040f tx timeout [ 169.550103][ T5784] i2c i2c-0: dtv_property_process_set: SET cmd 0x00000000 undefined [ 169.565695][ T5778] loop4: detected capacity change from 0 to 2048 [ 169.591760][ T5781] netlink: 16 bytes leftover after parsing attributes in process `syz.2.445'. [ 169.956279][ T5778] EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 169.990861][ T5778] ext4 filesystem being mounted at /81/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 170.000584][ T5790] loop3: detected capacity change from 0 to 128 [ 170.141470][ T5790] EXT4-fs (loop3): mounted filesystem without journal. Opts: grpjquota=,dioread_lock,delalloc,commit=0x0000000000000000,,errors=continue. Quota mode: none. [ 170.227922][ T5790] ext4 filesystem being mounted at /84/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 170.418061][ T1218] team0 (unregistering): Port device team_slave_1 removed [ 170.453989][ T1218] team0 (unregistering): Port device team_slave_0 removed [ 170.487072][ T1218] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 170.513825][ T1218] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 171.923676][ T4231] Bluetooth: hci2: command 0x0419 tx timeout [ 171.992988][ T5820] loop3: detected capacity change from 0 to 512 [ 172.003353][ T1218] bond0 (unregistering): Released all slaves [ 172.141700][ T5823] sctp: failed to load transform for md5: -2 [ 172.186649][ T5820] EXT4-fs (loop3): Unrecognized mount option "fsuuid=dfdac3ec-9b59-4f2e-7745-f8a22cce" or missing value [ 173.185284][ T5820] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 173.291924][ T5652] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 173.710731][ T5652] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 173.992637][ T5652] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 174.112247][ T5652] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 174.385759][ T5652] 8021q: adding VLAN 0 to HW filter on device bond0 [ 174.892449][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 174.958397][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 175.025455][ T5652] 8021q: adding VLAN 0 to HW filter on device team0 [ 175.056581][ T5861] netlink: 'syz.4.463': attribute type 13 has an invalid length. [ 175.086264][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 175.110392][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 175.206786][ T4397] bridge0: port 1(bridge_slave_0) entered blocking state [ 175.213977][ T4397] bridge0: port 1(bridge_slave_0) entered forwarding state [ 175.243757][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 175.285456][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 175.312485][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 175.339614][ T4397] bridge0: port 2(bridge_slave_1) entered blocking state [ 175.346895][ T4397] bridge0: port 2(bridge_slave_1) entered forwarding state [ 175.428930][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 175.472914][ T4397] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 175.573911][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 175.605905][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 175.635378][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 175.655730][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 175.689418][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 175.698953][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 175.729733][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 175.771826][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 175.780633][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 175.805285][ T5652] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 176.562929][ T5885] Bluetooth: (null): Too short H5 packet [ 177.212724][ T4347] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 177.335632][ T4347] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 177.371559][ T5652] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 179.648138][ T4347] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 179.659685][ T4347] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 180.223889][ T4347] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 180.314829][ T4347] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 180.467077][ T4347] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 180.475376][ T4347] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 180.491430][ T5652] device veth0_vlan entered promiscuous mode [ 180.580745][ T5652] device veth1_vlan entered promiscuous mode [ 180.668098][ T26] audit: type=1800 audit(1790357080.164:36): pid=5946 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.480" name="device" dev="configfs" ino=37518 res=0 errno=0 [ 180.767162][ T4347] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 180.995457][ T5945] FAULT_INJECTION: forcing a failure. [ 180.995457][ T5945] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 181.008909][ T5945] CPU: 0 PID: 5945 Comm: syz.2.481 Not tainted syzkaller #0 [ 181.016215][ T5945] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 181.026286][ T5945] Call Trace: [ 181.029577][ T5945] [ 181.032523][ T5945] dump_stack_lvl+0x188/0x250 [ 181.037227][ T5945] ? show_regs_print_info+0x20/0x20 [ 181.042441][ T5945] ? load_image+0x410/0x410 [ 181.046972][ T5945] should_fail+0x383/0x4b0 [ 181.051412][ T5945] prepare_alloc_pages+0x1e3/0x5b0 [ 181.056548][ T5945] __alloc_pages+0x11b/0x480 [ 181.061158][ T5945] ? zone_statistics+0x170/0x170 [ 181.066119][ T5945] ? rcu_lock_acquire+0x30/0x30 [ 181.070986][ T5945] ? alloc_pages+0x452/0x560 [ 181.075604][ T5945] __get_free_pages+0x8/0x30 [ 181.080213][ T5945] __tlb_remove_page_size+0x1f2/0x3f0 [ 181.085606][ T5945] unmap_page_range+0xfcf/0x2410 [ 181.090597][ T5945] unmap_vmas+0x131/0x250 [ 181.094967][ T5945] ? unmap_page_range+0x2410/0x2410 [ 181.100180][ T5945] ? __mutex_lock_common+0x435/0x2400 [ 181.105584][ T5945] exit_mmap+0x3b9/0x640 [ 181.109845][ T5945] ? vm_brk+0x20/0x20 [ 181.113861][ T5945] ? uprobe_clear_state+0x2f6/0x460 [ 181.119080][ T5945] __mmput+0x115/0x390 [ 181.123167][ T5945] exit_mm+0x632/0x7b0 [ 181.127252][ T5945] ? perf_pmu_migrate_context+0xb70/0xb70 [ 181.132999][ T5945] ? do_exit+0x2110/0x2110 [ 181.137429][ T5945] ? __ia32_sys_timer_delete+0x40/0x40 [ 181.142900][ T5945] ? hrtimer_try_to_cancel+0x3d6/0x420 [ 181.148384][ T5945] ? tty_audit_exit+0x149/0x1f0 [ 181.153255][ T5945] do_exit+0x5b8/0x2110 [ 181.157434][ T5945] ? put_task_struct+0x80/0x80 [ 181.162211][ T5945] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 181.168222][ T5945] ? _raw_spin_lock_irq+0xb7/0xf0 [ 181.173270][ T5945] do_group_exit+0x12c/0x2f0 [ 181.177876][ T5945] ? lockdep_hardirqs_on+0x94/0x140 [ 181.183094][ T5945] get_signal+0x7eb/0x12e0 [ 181.187555][ T5945] arch_do_signal_or_restart+0xe6/0x12a0 [ 181.193216][ T5945] ? key_type_put+0x20/0x20 [ 181.197753][ T5945] ? futex_exit_release+0x1c0/0x1c0 [ 181.202968][ T5945] ? get_sigframe_size+0x10/0x10 [ 181.207935][ T5945] ? __context_tracking_exit+0x4c/0x80 [ 181.213443][ T5945] ? exit_to_user_mode_loop+0x3b/0x130 [ 181.218932][ T5945] exit_to_user_mode_loop+0x9e/0x130 [ 181.224245][ T5945] exit_to_user_mode_prepare+0xee/0x180 [ 181.229817][ T5945] syscall_exit_to_user_mode+0x16/0x40 [ 181.235301][ T5945] do_syscall_64+0x58/0xa0 [ 181.239748][ T5945] ? clear_bhb_loop+0x30/0x80 [ 181.244449][ T5945] ? clear_bhb_loop+0x30/0x80 [ 181.249149][ T5945] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 181.255068][ T5945] RIP: 0033:0x7f4a60fe5159 [ 181.259502][ T5945] Code: Unable to access opcode bytes at RIP 0x7f4a60fe512f. [ 181.266878][ T5945] RSP: 002b:00007f4a5f23d0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 181.275317][ T5945] RAX: 0000000000000001 RBX: 00007f4a6126cfa8 RCX: 00007f4a60fe5159 [ 181.283315][ T5945] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f4a6126cfac [ 181.291318][ T5945] RBP: 00007f4a6126cfa0 R08: 0020b94f3446ce00 R09: 0000000000000000 [ 181.299316][ T5945] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 181.307316][ T5945] R13: 00007f4a6126d038 R14: 00007ffc5b33f9a0 R15: 00007ffc5b33fa88 [ 181.315328][ T5945] [ 181.321746][ T5652] device veth0_macvtap entered promiscuous mode [ 181.385503][ T4347] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 181.478557][ T4347] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 181.531658][ T4347] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 181.553573][ T5652] device veth1_macvtap entered promiscuous mode [ 181.628485][ T5652] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 181.699628][ T5652] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 181.884123][ T5652] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 181.895558][ T5652] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 181.905716][ T5652] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 181.918059][ T5652] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 181.928186][ T5652] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 181.938903][ T5652] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 182.072035][ T5652] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 182.127966][ T4347] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 182.151850][ T4347] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 182.207020][ T4347] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 182.354908][ T5652] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 182.410680][ T5652] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 182.469912][ T5652] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 182.533416][ T5652] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 182.709130][ T5652] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 182.789061][ T5652] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 182.798926][ T5652] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 183.439275][ T5652] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 183.514232][ T5652] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 183.593695][ T4278] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 183.666854][ T4278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 183.739571][ T5652] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 183.748328][ T5652] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 183.879064][ T5652] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 183.887807][ T5652] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 185.622880][ T4278] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 185.646590][ T4278] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 185.753226][ T6001] netlink: 12 bytes leftover after parsing attributes in process `syz.0.493'. [ 185.765399][ T151] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 185.838175][ T151] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 185.865479][ T151] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 185.895903][ T4278] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 185.908178][ T26] audit: type=1326 audit(1790357085.404:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6007 comm="syz.4.495" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9cde91159 code=0x7ffc0000 [ 185.961722][ T6008] sctp: [Deprecated]: syz.4.495 (pid 6008) Use of struct sctp_assoc_value in delayed_ack socket option. [ 185.961722][ T6008] Use struct sctp_sack_info instead [ 185.982454][ T6013] loop0: detected capacity change from 0 to 128 [ 185.999172][ T13] Bluetooth: hci4: command 0x0406 tx timeout [ 186.008013][ T13] Bluetooth: hci3: command 0x0406 tx timeout [ 186.059129][ T13] Bluetooth: hci1: command 0x0406 tx timeout [ 186.095139][ T26] audit: type=1326 audit(1790357085.444:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6007 comm="syz.4.495" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9cde91159 code=0x7ffc0000 [ 186.130528][ T13] Bluetooth: hci0: command 0x0406 tx timeout [ 186.162423][ T6013] FAT-fs (loop0): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 186.226054][ T26] audit: type=1326 audit(1790357085.444:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6007 comm="syz.4.495" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=273 compat=0 ip=0x7fe9cde4d5ac code=0x7ffc0000 [ 186.234518][ T6022] netlink: 24 bytes leftover after parsing attributes in process `syz.4.499'. [ 186.289448][ T6013] FAT-fs (loop0): bogus number of reserved sectors [ 186.299076][ T6013] FAT-fs (loop0): This doesn't look like a DOS 1.x volume; DOS 2.x BPB is non-zero [ 186.308391][ T6013] FAT-fs (loop0): Can't find a valid FAT filesystem [ 186.339319][ T26] audit: type=1326 audit(1790357085.444:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6007 comm="syz.4.495" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=14 compat=0 ip=0x7fe9cde4d60e code=0x7ffc0000 [ 186.411031][ T26] audit: type=1326 audit(1790357085.444:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6007 comm="syz.4.495" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fe9cde90deb code=0x7ffc0000 [ 186.442100][ T26] audit: type=1326 audit(1790357085.444:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6007 comm="syz.4.495" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7fe9cde91159 code=0x7ffc0000 [ 186.631553][ T6027] netlink: 24 bytes leftover after parsing attributes in process `syz.4.499'. [ 187.377833][ T26] audit: type=1326 audit(1790357085.444:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6007 comm="syz.4.495" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9cde91159 code=0x7ffc0000 [ 187.529062][ T26] audit: type=1326 audit(1790357085.444:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6007 comm="syz.4.495" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9cde91159 code=0x7ffc0000 [ 187.666370][ T26] audit: type=1326 audit(1790357085.444:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6007 comm="syz.4.495" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe9cde91159 code=0x7ffc0000 [ 187.740043][ T26] audit: type=1326 audit(1790357085.464:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6007 comm="syz.4.495" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7fe9cde91159 code=0x7ffc0000 [ 188.722980][ T6058] FAULT_INJECTION: forcing a failure. [ 188.722980][ T6058] name failslab, interval 1, probability 0, space 0, times 0 [ 188.803030][ T6058] CPU: 1 PID: 6058 Comm: syz.4.508 Not tainted syzkaller #0 [ 188.810388][ T6058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 188.820467][ T6058] Call Trace: [ 188.823771][ T6058] [ 188.826719][ T6058] dump_stack_lvl+0x188/0x250 [ 188.831434][ T6058] ? show_regs_print_info+0x20/0x20 [ 188.836669][ T6058] ? load_image+0x410/0x410 [ 188.841205][ T6058] ? __might_sleep+0xf0/0xf0 [ 188.845841][ T6058] ? __lock_acquire+0x7b50/0x7b50 [ 188.850894][ T6058] should_fail+0x383/0x4b0 [ 188.855349][ T6058] should_failslab+0x5/0x20 [ 188.859882][ T6058] slab_pre_alloc_hook+0x51/0xc0 [ 188.864855][ T6058] kmem_cache_alloc_trace+0x47/0x290 [ 188.870162][ T6058] ? assoc_array_insert+0x8e/0x2e70 [ 188.875409][ T6058] assoc_array_insert+0x8e/0x2e70 [ 188.880465][ T6058] ? restrict_link_reject+0x10/0x10 [ 188.885683][ T6058] ? rcu_lock_release+0x5/0x20 [ 188.890475][ T6058] ? __lock_acquire+0x7b50/0x7b50 [ 188.895531][ T6058] __key_link_begin+0xd2/0x1e0 [ 188.900322][ T6058] request_key_and_link+0xb36/0x13b0 [ 188.905640][ T6058] ? complete_request_key+0xa0/0xa0 [ 188.910865][ T6058] ? __might_sleep+0xf0/0xf0 [ 188.915482][ T6058] ? restrict_link_reject+0x10/0x10 [ 188.920706][ T6058] ? keyring_search_rcu+0x280/0x280 [ 188.925938][ T6058] ? down_read+0x1aa/0x2e0 [ 188.930380][ T6058] __se_sys_request_key+0x293/0x350 [ 188.935612][ T6058] ? __x64_sys_request_key+0xa0/0xa0 [ 188.940934][ T6058] ? lockdep_hardirqs_on+0x94/0x140 [ 188.946167][ T6058] do_syscall_64+0x4c/0xa0 [ 188.950608][ T6058] ? clear_bhb_loop+0x30/0x80 [ 188.955397][ T6058] ? clear_bhb_loop+0x30/0x80 [ 188.960105][ T6058] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 188.966022][ T6058] RIP: 0033:0x7fe9cde91159 [ 188.970455][ T6058] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 188.990079][ T6058] RSP: 002b:00007fe9cc0e9028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f9 [ 188.998518][ T6058] RAX: ffffffffffffffda RBX: 00007fe9ce118fa0 RCX: 00007fe9cde91159 [ 189.006505][ T6058] RDX: 0000200000001fee RSI: 0000200000000240 RDI: 0000200000000040 [ 189.014494][ T6058] RBP: 00007fe9cdf2806b R08: 0000000000000000 R09: 0000000000000000 [ 189.022483][ T6058] R10: fffffffffffffffe R11: 0000000000000246 R12: 0000000000000000 [ 189.030479][ T6058] R13: 00007fe9ce119038 R14: 00007fe9ce118fa0 R15: 00007ffc64c9e2f8 [ 189.038491][ T6058] [ 189.667102][ T6084] tmpfs: Bad value for 'mpol' [ 189.674277][ T13] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 190.371980][ T6064] chnl_net:caif_netlink_parms(): no params data found [ 190.409393][ T13] usb 5-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 190.439143][ T13] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 190.487099][ T13] usb 5-1: config 0 descriptor?? [ 190.673949][ T6064] bridge0: port 1(bridge_slave_0) entered blocking state [ 190.681807][ T6064] bridge0: port 1(bridge_slave_0) entered disabled state [ 190.690247][ T6064] device bridge_slave_0 entered promiscuous mode [ 190.699564][ T6064] bridge0: port 2(bridge_slave_1) entered blocking state [ 190.706699][ T6064] bridge0: port 2(bridge_slave_1) entered disabled state [ 190.715614][ T6064] device bridge_slave_1 entered promiscuous mode [ 190.740289][ T6064] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 190.752061][ T6064] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 190.793419][ T13] [drm] vendor descriptor length:b9 data:00 00 00 00 00 00 00 00 00 00 00 [ 190.820096][ T13] [drm:udl_init] *ERROR* Unrecognized vendor firmware descriptor [ 190.853247][ T6064] team0: Port device team_slave_0 added [ 190.892288][ T13] [drm:udl_init] *ERROR* Selecting channel failed [ 190.943703][ T6064] team0: Port device team_slave_1 added [ 190.972374][ T6115] loop2: detected capacity change from 0 to 1024 [ 191.010610][ T13] [drm] Initialized udl 0.0.1 20120220 for 5-1:0.0 on minor 2 [ 191.083942][ T26] kauditd_printk_skb: 7 callbacks suppressed [ 191.083981][ T26] audit: type=1800 audit(1790357090.584:54): pid=6120 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.522" name="device" dev="configfs" ino=38973 res=0 errno=0 [ 191.422540][ T13] [drm] Initialized udl on minor 2 [ 191.445095][ T6115] EXT4-fs (loop2): mounted filesystem without journal. Opts: ,errors=continue. Quota mode: none. [ 191.694536][ T4230] Bluetooth: hci3: command 0x0409 tx timeout [ 191.705591][ T13] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 191.930085][ T13] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 191.940800][ T13] usb 5-1: USB disconnect, device number 3 [ 191.953272][ T4231] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffed [ 191.967979][ T4231] [drm:udl_get_edid_block] *ERROR* Read EDID byte 0 failed err ffffffed [ 191.978101][ T4231] udl 5-1:0.0: [drm] Cannot find any crtc or sizes [ 192.023011][ T6064] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 192.037938][ T6064] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 192.063889][ C0] vkms_vblank_simulate: vblank timer overrun [ 192.108379][ T6064] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 192.232840][ T6064] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 192.286316][ T6064] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 192.312297][ C0] vkms_vblank_simulate: vblank timer overrun [ 192.432644][ T6064] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 192.592238][ T6136] device syzkaller0 entered promiscuous mode [ 192.640651][ T6146] netlink: 8 bytes leftover after parsing attributes in process `syz.5.529'. [ 192.808223][ T6064] device hsr_slave_0 entered promiscuous mode [ 192.845634][ T6064] device hsr_slave_1 entered promiscuous mode [ 193.712167][ T4231] Bluetooth: hci3: command 0x041b tx timeout [ 194.920713][ T26] audit: type=1800 audit(1790881381.935:55): pid=6172 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.536" name="device" dev="configfs" ino=39111 res=0 errno=0 [ 194.940737][ C0] vkms_vblank_simulate: vblank timer overrun [ 194.953527][ T1421] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.959900][ T1421] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.155198][ T6064] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 195.210874][ T6064] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 195.254214][ T6064] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 195.325292][ T6064] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 196.138172][ T4230] Bluetooth: hci3: command 0x040f tx timeout [ 196.300073][ T6064] 8021q: adding VLAN 0 to HW filter on device bond0 [ 196.390194][ T6064] 8021q: adding VLAN 0 to HW filter on device team0 [ 196.448119][ T4278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 196.481656][ T4278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 196.534802][ T4278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 196.562277][ T4278] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 196.591789][ T4278] bridge0: port 1(bridge_slave_0) entered blocking state [ 196.598929][ T4278] bridge0: port 1(bridge_slave_0) entered forwarding state [ 196.668165][ T4278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 196.706859][ T4278] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 196.747877][ T4278] bridge0: port 2(bridge_slave_1) entered blocking state [ 196.755046][ T4278] bridge0: port 2(bridge_slave_1) entered forwarding state [ 196.807355][ T4278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 196.837297][ T4278] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 196.879890][ T6204] device syzkaller0 entered promiscuous mode [ 196.994518][ T5031] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 197.022062][ T5031] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 197.096462][ T26] audit: type=1800 audit(1790881384.716:56): pid=6216 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.548" name="device" dev="configfs" ino=38857 res=0 errno=0 [ 197.157276][ T5031] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 197.338574][ T5031] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 197.564134][ T5031] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 197.658992][ T5031] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 197.695111][ T5031] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 197.844058][ T5031] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 198.058807][ T5031] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 198.273409][ T6064] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 198.437243][ T5031] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 198.656527][ T4231] Bluetooth: hci3: command 0x0419 tx timeout [ 198.796874][ T6229] loop2: detected capacity change from 0 to 128 [ 198.912181][ T6229] EXT4-fs (loop2): mounted filesystem without journal. Opts: grpjquota=,dioread_lock,delalloc,commit=0x0000000000000000,,errors=continue. Quota mode: none. [ 198.965161][ T6229] ext4 filesystem being mounted at /109/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 199.248398][ T4399] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 199.257476][ T4399] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 199.280347][ T6064] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 199.598029][ T26] audit: type=1800 audit(1790881387.281:57): pid=6255 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.557" name="device" dev="configfs" ino=39946 res=0 errno=0 [ 200.117823][ T26] audit: type=1800 audit(1790881387.730:58): pid=6257 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.559" name="device" dev="configfs" ino=39946 res=0 errno=0 [ 200.599646][ T6273] loop0: detected capacity change from 0 to 256 [ 201.556364][ T6288] loop2: detected capacity change from 0 to 128 [ 201.953748][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 201.981113][ T156] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 201.989654][ T26] audit: type=1800 audit(1790881389.695:59): pid=6302 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.569" name="device" dev="configfs" ino=40004 res=0 errno=0 [ 202.139314][ T6288] EXT4-fs (loop2): mounted filesystem without journal. Opts: grpjquota=,dioread_lock,delalloc,commit=0x0000000000000000,,errors=continue. Quota mode: none. [ 202.461416][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 202.520320][ T6295] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 202.553163][ T6288] ext4 filesystem being mounted at /113/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 202.586050][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 202.645992][ T6064] device veth0_vlan entered promiscuous mode [ 202.663554][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 202.730359][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 202.770674][ T6064] device veth1_vlan entered promiscuous mode [ 202.897468][ T4278] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 202.905717][ T4278] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 202.985787][ T4278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 203.009515][ T4278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 203.091094][ T6064] device veth0_macvtap entered promiscuous mode [ 203.240810][ T6317] device syzkaller0 entered promiscuous mode [ 203.270031][ T6064] device veth1_macvtap entered promiscuous mode [ 203.324180][ T6064] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 203.324204][ T6064] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 203.324215][ T6064] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 203.324229][ T6064] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 203.324240][ T6064] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 203.324254][ T6064] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 203.324264][ T6064] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 203.324277][ T6064] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 203.324988][ T6064] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 203.325004][ T6064] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 203.326224][ T6064] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 203.333166][ T4278] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 203.340770][ T4278] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 203.341420][ T4278] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 203.341991][ T4278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 203.358196][ T6064] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 203.358219][ T6064] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 203.358231][ T6064] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 203.358245][ T6064] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 203.358256][ T6064] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 203.358270][ T6064] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 203.358282][ T6064] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 203.358296][ T6064] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 203.358309][ T6064] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 203.358323][ T6064] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 203.360012][ T6064] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 203.362762][ T6064] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 203.362839][ T6064] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 203.362868][ T6064] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 203.362897][ T6064] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 203.422763][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 203.424498][ T1218] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 203.638224][ T4287] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 203.794809][ T5031] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 203.794832][ T5031] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 203.795170][ T5031] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 203.908516][ T4278] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 203.908564][ T4278] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 203.909604][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 203.963233][ T26] audit: type=1800 audit(1790881391.717:60): pid=6342 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.577" name="device" dev="configfs" ino=40210 res=0 errno=0 [ 204.506400][ T4348] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 204.652056][ T4348] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 204.772200][ T4287] usb 6-1: Using ep0 maxpacket: 32 [ 204.919945][ T4348] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 205.369953][ T4287] usb 6-1: config 7 has an invalid interface number: 195 but max is 0 [ 205.370051][ T4287] usb 6-1: config 7 has no interface number 0 [ 205.370201][ T4287] usb 6-1: config 7 interface 195 altsetting 5 bulk endpoint 0x2 has invalid maxpacket 8 [ 205.370272][ T4287] usb 6-1: config 7 interface 195 has no altsetting 0 [ 205.478190][ T26] audit: type=1800 audit(1790881393.249:61): pid=6355 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.579" name="device" dev="configfs" ino=40268 res=0 errno=0 [ 205.877024][ T6363] loop2: detected capacity change from 0 to 128 [ 206.081539][ T4348] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 206.152768][ T6363] EXT4-fs (loop2): mounted filesystem without journal. Opts: grpjquota=,dioread_lock,delalloc,commit=0x0000000000000000,,errors=continue. Quota mode: none. [ 206.152874][ T6363] ext4 filesystem being mounted at /119/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 206.438382][ T6373] ================================================================== [ 206.713643][ T6373] BUG: KASAN: use-after-free in dvb_device_open+0xc5/0x360 [ 206.713676][ T6373] Read of size 8 at addr ffff8880289a8218 by task syz.0.585/6373 [ 206.728599][ T6373] [ 206.730942][ T6373] CPU: 1 PID: 6373 Comm: syz.0.585 Not tainted syzkaller #0 [ 206.738278][ T6373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 206.748361][ T6373] Call Trace: [ 206.751660][ T6373] [ 206.754614][ T6373] dump_stack_lvl+0x188/0x250 [ 206.759321][ T6373] ? show_regs_print_info+0x20/0x20 [ 206.764544][ T6373] ? _printk+0xda/0x130 [ 206.768720][ T6373] ? dvb_device_open+0xc5/0x360 [ 206.773601][ T6373] ? load_image+0x410/0x410 [ 206.778125][ T6373] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 206.780492][ T6379] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 206.783619][ T6373] print_address_description+0x60/0x2d0 [ 206.783652][ T6373] ? dvb_device_open+0xc5/0x360 [ 206.783671][ T6373] kasan_report+0xdf/0x130 [ 206.783696][ T6373] ? dvb_device_open+0xc5/0x360 [ 206.783719][ T6373] dvb_device_open+0xc5/0x360 [ 206.783744][ T6373] chrdev_open+0x585/0x5f0 [ 206.783770][ T6373] ? cd_forget+0x160/0x160 [ 206.783795][ T6373] ? fsnotify_perm+0x3a7/0x560 [ 206.783818][ T6373] ? cd_forget+0x160/0x160 [ 206.783838][ T6373] do_dentry_open+0x7f7/0xf90 [ 206.783861][ T6373] ? vfs_open+0x2b/0x80 [ 206.783888][ T6373] path_openat+0x2718/0x2fb0 [ 206.783934][ T6373] ? __kasan_slab_alloc+0xa9/0xc0 [ 206.783962][ T6373] ? do_filp_open+0x400/0x400 [ 206.784003][ T6373] do_filp_open+0x1df/0x400 [ 206.784040][ T6373] ? vfs_tmpfile+0x300/0x300 [ 206.784084][ T6373] ? _raw_spin_unlock+0x24/0x40 [ 206.784105][ T6373] ? alloc_fd+0x59e/0x650 [ 206.784135][ T6373] do_sys_openat2+0x14b/0x500 [ 206.784154][ T6373] ? __lock_acquire+0x7b50/0x7b50 [ 206.784180][ T6373] ? do_sys_open+0xe0/0xe0 [ 206.784200][ T6373] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 206.816854][ T6379] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 206.820114][ T6373] ? lock_chain_count+0x20/0x20 [ 206.820149][ T6373] __x64_sys_openat+0x135/0x160 [ 206.856834][ T6373] do_syscall_64+0x4c/0xa0 [ 206.856863][ T6373] ? clear_bhb_loop+0x30/0x80 [ 206.856885][ T6373] ? clear_bhb_loop+0x30/0x80 [ 206.879825][ T6373] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 206.930166][ T4287] usb 6-1: New USB device found, idVendor=19d2, idProduct=1303, bcdDevice=fa.61 [ 206.931748][ T6373] RIP: 0033:0x7f1af778c98e [ 206.931774][ T6373] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 206.948290][ T4287] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 206.964799][ T6373] RSP: 002b:00007f1af5a23b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 206.964830][ T6373] RAX: ffffffffffffffda RBX: 00007f1af5a246c0 RCX: 00007f1af778c98e [ 206.964847][ T6373] RDX: 0000000000000002 RSI: 00007f1af5a23c00 RDI: ffffffffffffff9c [ 206.964862][ T6373] RBP: 00007f1af5a23c00 R08: 0000000000000000 R09: 0000000000000000 [ 206.964876][ T6373] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 206.964890][ T6373] R13: 00007f1af7a54038 R14: 00007f1af7a53fa0 R15: 00007fff46f74778 [ 206.964921][ T6373] [ 206.964929][ T6373] [ 206.964935][ T6373] Allocated by task 1: [ 206.964944][ T6373] __kasan_kmalloc+0xaf/0xe0 [ 206.964970][ T6373] dvb_register_device+0x300/0x1dc0 [ 206.964988][ T6373] dvb_register_frontend+0x629/0x900 [ 206.965015][ T6373] vidtv_bridge_probe+0x9c1/0xf30 [ 206.965033][ T6373] platform_probe+0x137/0x1c0 [ 206.965050][ T6373] really_probe+0x276/0xc70 [ 206.965070][ T6373] __driver_probe_device+0x1f5/0x390 [ 206.965090][ T6373] driver_probe_device+0x4f/0x420 [ 206.965110][ T6373] __driver_attach+0x45d/0x660 [ 206.965128][ T6373] bus_for_each_dev+0x182/0x1f0 [ 207.028373][ T4287] usb 6-1: can't set config #7, error -71 [ 207.030785][ T6373] bus_add_driver+0x324/0x5d0 [ 207.051249][ T4287] usb 6-1: USB disconnect, device number 2 [ 207.055572][ T6373] driver_register+0x32d/0x430 [ 207.055603][ T6373] vidtv_bridge_init+0x45/0x80 [ 207.105761][ T6373] do_one_initcall+0x272/0x730 [ 207.105792][ T6373] do_initcall_level+0x13d/0x1f0 [ 207.105813][ T6373] do_initcalls+0x4b/0x90 [ 207.105830][ T6373] kernel_init_freeable+0x3d5/0x560 [ 207.105848][ T6373] kernel_init+0x19/0x1b0 [ 207.105868][ T6373] ret_from_fork+0x1f/0x30 [ 207.105885][ T6373] [ 207.105891][ T6373] Freed by task 6327: [ 207.105902][ T6373] kasan_set_track+0x4b/0x70 [ 207.105920][ T6373] kasan_set_free_info+0x1f/0x40 [ 207.105940][ T6373] ____kasan_slab_free+0xd5/0x110 [ 207.155207][ T6373] slab_free_freelist_hook+0xec/0x170 [ 207.160643][ T6373] kfree+0xef/0x2a0 [ 207.164483][ T6373] dvb_device_open+0x2d2/0x360 [ 207.169274][ T6373] chrdev_open+0x585/0x5f0 [ 207.173714][ T6373] do_dentry_open+0x7f7/0xf90 [ 207.178411][ T6373] path_openat+0x2718/0x2fb0 [ 207.183034][ T6373] do_filp_open+0x1df/0x400 [ 207.187562][ T6373] do_sys_openat2+0x14b/0x500 [ 207.192268][ T6373] __x64_sys_openat+0x135/0x160 [ 207.197141][ T6373] do_syscall_64+0x4c/0xa0 [ 207.201583][ T6373] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 207.207506][ T6373] [ 207.209856][ T6373] The buggy address belongs to the object at ffff8880289a8200 [ 207.209856][ T6373] which belongs to the cache kmalloc-256 of size 256 [ 207.223931][ T6373] The buggy address is located 24 bytes inside of [ 207.223931][ T6373] 256-byte region [ffff8880289a8200, ffff8880289a8300) [ 207.237146][ T6373] The buggy address belongs to the page: [ 207.242805][ T6373] page:ffffea0000a26a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x289a8 [ 207.252981][ T6373] head:ffffea0000a26a00 order:1 compound_mapcount:0 [ 207.259598][ T6373] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 207.267610][ T6373] raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888016c41b40 [ 207.276220][ T6373] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 207.284816][ T6373] page dumped because: kasan: bad access detected [ 207.291239][ T6373] page_owner tracks the page as allocated [ 207.296971][ T6373] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, ts 18473282092, free_ts 0 [ 207.314963][ T6373] get_page_from_freelist+0x24f6/0x2670 [ 207.320541][ T6373] __alloc_pages+0x1ee/0x480 [ 207.325159][ T6373] alloc_page_interleave+0x24/0x1e0 [ 207.330387][ T6373] new_slab+0xc0/0x4b0 [ 207.334476][ T6373] ___slab_alloc+0x807/0xdd0 [ 207.339096][ T6373] kmem_cache_alloc_trace+0xf9/0x290 [ 207.344409][ T6373] bus_add_driver+0xdc/0x5d0 [ 207.349026][ T6373] driver_register+0x32d/0x430 [ 207.353819][ T6373] vicodec_init+0x39/0x70 [ 207.358170][ T6373] do_one_initcall+0x272/0x730 [ 207.362954][ T6373] do_initcall_level+0x13d/0x1f0 [ 207.367944][ T6373] do_initcalls+0x4b/0x90 [ 207.372338][ T6373] kernel_init_freeable+0x3d5/0x560 [ 207.377559][ T6373] kernel_init+0x19/0x1b0 [ 207.381918][ T6373] ret_from_fork+0x1f/0x30 [ 207.386360][ T6373] page_owner free stack trace missing [ 207.391738][ T6373] [ 207.394073][ T6373] Memory state around the buggy address: [ 207.399719][ T6373] ffff8880289a8100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 207.407794][ T6373] ffff8880289a8180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 207.415868][ T6373] >ffff8880289a8200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 207.423940][ T6373] ^ [ 207.428811][ T6373] ffff8880289a8280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 207.436892][ T6373] ffff8880289a8300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 207.444970][ T6373] ================================================================== [ 207.453054][ T6373] Disabling lock debugging due to kernel taint [ 207.459228][ C1] vkms_vblank_simulate: vblank timer overrun [ 207.469356][ T6379] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 207.506723][ T4348] tipc: Left network mode [ 207.551899][ T6373] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 207.559146][ T6373] CPU: 0 PID: 6373 Comm: syz.0.585 Tainted: G B syzkaller #0 [ 207.567837][ T6373] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 207.577915][ T6373] Call Trace: [ 207.581213][ T6373] [ 207.584164][ T6373] dump_stack_lvl+0x188/0x250 [ 207.588867][ T6373] ? show_regs_print_info+0x20/0x20 [ 207.594089][ T6373] ? load_image+0x410/0x410 [ 207.598623][ T6373] panic+0x2f8/0x850 [ 207.602550][ T6373] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 207.608731][ T6373] ? bpf_jit_dump+0xd0/0xd0 [ 207.613263][ T6373] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 207.619269][ T6373] ? _raw_spin_unlock+0x40/0x40 [ 207.624141][ T6373] ? dvb_device_open+0xc5/0x360 [ 207.629012][ T6373] check_panic_on_warn+0x80/0xa0 [ 207.633968][ T6373] ? dvb_device_open+0xc5/0x360 [ 207.638826][ T6373] end_report+0x6d/0xf0 [ 207.642992][ T6373] kasan_report+0x102/0x130 [ 207.647520][ T6373] ? dvb_device_open+0xc5/0x360 [ 207.652407][ T6373] dvb_device_open+0xc5/0x360 [ 207.657111][ T6373] chrdev_open+0x585/0x5f0 [ 207.661564][ T6373] ? cd_forget+0x160/0x160 [ 207.666003][ T6373] ? fsnotify_perm+0x3a7/0x560 [ 207.670793][ T6373] ? cd_forget+0x160/0x160 [ 207.675236][ T6373] do_dentry_open+0x7f7/0xf90 [ 207.679934][ T6373] ? vfs_open+0x2b/0x80 [ 207.684111][ T6373] path_openat+0x2718/0x2fb0 [ 207.688733][ T6373] ? __kasan_slab_alloc+0xa9/0xc0 [ 207.693782][ T6373] ? do_filp_open+0x400/0x400 [ 207.698492][ T6373] do_filp_open+0x1df/0x400 [ 207.703025][ T6373] ? vfs_tmpfile+0x300/0x300 [ 207.707645][ T6373] ? _raw_spin_unlock+0x24/0x40 [ 207.712516][ T6373] ? alloc_fd+0x59e/0x650 [ 207.716880][ T6373] do_sys_openat2+0x14b/0x500 [ 207.721578][ T6373] ? __lock_acquire+0x7b50/0x7b50 [ 207.726628][ T6373] ? do_sys_open+0xe0/0xe0 [ 207.731066][ T6373] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 207.737073][ T6373] ? lock_chain_count+0x20/0x20 [ 207.741952][ T6373] __x64_sys_openat+0x135/0x160 [ 207.746831][ T6373] do_syscall_64+0x4c/0xa0 [ 207.751266][ T6373] ? clear_bhb_loop+0x30/0x80 [ 207.755965][ T6373] ? clear_bhb_loop+0x30/0x80 [ 207.760672][ T6373] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 207.766589][ T6373] RIP: 0033:0x7f1af778c98e [ 207.771026][ T6373] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 207.790657][ T6373] RSP: 002b:00007f1af5a23b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 207.799102][ T6373] RAX: ffffffffffffffda RBX: 00007f1af5a246c0 RCX: 00007f1af778c98e [ 207.807097][ T6373] RDX: 0000000000000002 RSI: 00007f1af5a23c00 RDI: ffffffffffffff9c [ 207.815090][ T6373] RBP: 00007f1af5a23c00 R08: 0000000000000000 R09: 0000000000000000 [ 207.823079][ T6373] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 207.831080][ T6373] R13: 00007f1af7a54038 R14: 00007f1af7a53fa0 R15: 00007fff46f74778 [ 207.839081][ T6373] [ 207.842306][ T6373] Kernel Offset: disabled [ 207.846633][ T6373] Rebooting in 86400 seconds..