syzkaller login: [ 229.459308][ T2893] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. [ 229.520939][ T2893] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. [ 229.601060][ T2893] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. [ 238.269975][ T2893] netlink: 4 bytes leftover after parsing attributes in process `dhcpcd'. Warning: Permanently added '[localhost]:55910' (ECDSA) to the list of known hosts. 1970/01/01 00:04:37 fuzzer started 1970/01/01 00:04:46 dialing manager at localhost:43739 1970/01/01 00:04:50 syscalls: 2768 1970/01/01 00:04:51 code coverage: enabled 1970/01/01 00:04:51 comparison tracing: enabled 1970/01/01 00:04:51 extra coverage: enabled 1970/01/01 00:04:51 setuid sandbox: enabled 1970/01/01 00:04:51 namespace sandbox: enabled 1970/01/01 00:04:51 Android sandbox: /sys/fs/selinux/policy does not exist 1970/01/01 00:04:51 fault injection: enabled 1970/01/01 00:04:51 leak checking: CONFIG_DEBUG_KMEMLEAK is not enabled 1970/01/01 00:04:51 net packet injection: enabled 1970/01/01 00:04:51 net device setup: enabled 1970/01/01 00:04:51 concurrency sanitizer: /sys/kernel/debug/kcsan does not exist 1970/01/01 00:04:51 devlink PCI setup: PCI device 0000:00:10.0 is not available 1970/01/01 00:04:51 USB emulation: enabled 1970/01/01 00:04:51 hci packet injection: /dev/vhci does not exist 1970/01/01 00:04:51 wifi device emulation: /sys/class/mac80211_hwsim/ does not exist 1970/01/01 00:04:51 802.15.4 emulation: /sys/bus/platform/devices/mac802154_hwsim does not exist 1970/01/01 00:04:54 fetching corpus: 50, signal 21984/23728 (executing program) 1970/01/01 00:04:57 fetching corpus: 100, signal 30927/34183 (executing program) 1970/01/01 00:04:58 fetching corpus: 150, signal 35607/40334 (executing program) 1970/01/01 00:05:00 fetching corpus: 200, signal 38817/44984 (executing program) 1970/01/01 00:05:01 fetching corpus: 250, signal 41003/48591 (executing program) 1970/01/01 00:05:03 fetching corpus: 300, signal 43831/52774 (executing program) 1970/01/01 00:05:06 fetching corpus: 350, signal 46274/56491 (executing program) 1970/01/01 00:05:08 fetching corpus: 400, signal 48069/59590 (executing program) 1970/01/01 00:05:10 fetching corpus: 450, signal 51347/63976 (executing program) 1970/01/01 00:05:12 fetching corpus: 500, signal 55178/68764 (executing program) 1970/01/01 00:05:15 fetching corpus: 550, signal 58434/72966 (executing program) 1970/01/01 00:05:17 fetching corpus: 600, signal 59764/75417 (executing program) 1970/01/01 00:05:19 fetching corpus: 650, signal 62027/78632 (executing program) 1970/01/01 00:05:20 fetching corpus: 700, signal 63260/80931 (executing program) 1970/01/01 00:05:21 fetching corpus: 750, signal 65369/83933 (executing program) 1970/01/01 00:05:23 fetching corpus: 800, signal 67934/87216 (executing program) 1970/01/01 00:05:25 fetching corpus: 850, signal 69019/89290 (executing program) 1970/01/01 00:05:27 fetching corpus: 900, signal 69754/91054 (executing program) 1970/01/01 00:05:28 fetching corpus: 950, signal 70855/93106 (executing program) 1970/01/01 00:05:30 fetching corpus: 1000, signal 71749/95017 (executing program) 1970/01/01 00:05:32 fetching corpus: 1050, signal 72864/97040 (executing program) 1970/01/01 00:05:34 fetching corpus: 1100, signal 74494/99381 (executing program) 1970/01/01 00:05:36 fetching corpus: 1150, signal 75535/101220 (executing program) 1970/01/01 00:05:38 fetching corpus: 1200, signal 76584/103076 (executing program) 1970/01/01 00:05:40 fetching corpus: 1250, signal 77386/104801 (executing program) 1970/01/01 00:05:43 fetching corpus: 1300, signal 78774/106838 (executing program) 1970/01/01 00:05:44 fetching corpus: 1350, signal 82564/110491 (executing program) 1970/01/01 00:05:46 fetching corpus: 1400, signal 83889/112417 (executing program) 1970/01/01 00:05:48 fetching corpus: 1450, signal 84802/114017 (executing program) 1970/01/01 00:05:50 fetching corpus: 1500, signal 85762/115613 (executing program) 1970/01/01 00:05:52 fetching corpus: 1550, signal 86307/116962 (executing program) 1970/01/01 00:05:53 fetching corpus: 1600, signal 88145/119109 (executing program) 1970/01/01 00:05:55 fetching corpus: 1650, signal 89091/120616 (executing program) 1970/01/01 00:05:57 fetching corpus: 1700, signal 91338/122904 (executing program) 1970/01/01 00:05:59 fetching corpus: 1750, signal 92886/124722 (executing program) 1970/01/01 00:06:00 fetching corpus: 1800, signal 93671/126109 (executing program) 1970/01/01 00:06:03 fetching corpus: 1850, signal 94136/127270 (executing program) 1970/01/01 00:06:05 fetching corpus: 1900, signal 94956/128620 (executing program) 1970/01/01 00:06:07 fetching corpus: 1950, signal 95976/130021 (executing program) 1970/01/01 00:06:08 fetching corpus: 2000, signal 96565/131200 (executing program) 1970/01/01 00:06:10 fetching corpus: 2050, signal 97202/132398 (executing program) 1970/01/01 00:06:12 fetching corpus: 2100, signal 97900/133604 (executing program) 1970/01/01 00:06:14 fetching corpus: 2150, signal 98517/134744 (executing program) 1970/01/01 00:06:15 fetching corpus: 2200, signal 99110/135918 (executing program) 1970/01/01 00:06:17 fetching corpus: 2250, signal 99827/137078 (executing program) 1970/01/01 00:06:19 fetching corpus: 2300, signal 100583/138286 (executing program) 1970/01/01 00:06:20 fetching corpus: 2350, signal 101269/139403 (executing program) 1970/01/01 00:06:22 fetching corpus: 2400, signal 101836/140496 (executing program) 1970/01/01 00:06:24 fetching corpus: 2450, signal 102426/141513 (executing program) 1970/01/01 00:06:25 fetching corpus: 2500, signal 102780/142502 (executing program) 1970/01/01 00:06:27 fetching corpus: 2550, signal 103146/143461 (executing program) 1970/01/01 00:06:29 fetching corpus: 2600, signal 103619/144456 (executing program) 1970/01/01 00:06:31 fetching corpus: 2650, signal 104487/145563 (executing program) 1970/01/01 00:06:32 fetching corpus: 2700, signal 105092/146558 (executing program) 1970/01/01 00:06:34 fetching corpus: 2750, signal 105844/147570 (executing program) 1970/01/01 00:06:37 fetching corpus: 2800, signal 106196/148423 (executing program) 1970/01/01 00:06:39 fetching corpus: 2850, signal 106638/149345 (executing program) 1970/01/01 00:06:42 fetching corpus: 2900, signal 107238/150287 (executing program) 1970/01/01 00:06:43 fetching corpus: 2950, signal 107669/151183 (executing program) 1970/01/01 00:06:44 fetching corpus: 2975, signal 107845/151944 (executing program) 1970/01/01 00:06:44 fetching corpus: 2975, signal 107845/152700 (executing program) 1970/01/01 00:06:44 fetching corpus: 2975, signal 107845/153465 (executing program) 1970/01/01 00:06:44 fetching corpus: 2975, signal 107845/154198 (executing program) 1970/01/01 00:06:45 fetching corpus: 2975, signal 107845/154942 (executing program) 1970/01/01 00:06:45 fetching corpus: 2975, signal 107845/155698 (executing program) 1970/01/01 00:06:45 fetching corpus: 2975, signal 107845/156458 (executing program) 1970/01/01 00:06:45 fetching corpus: 2975, signal 107845/157186 (executing program) 1970/01/01 00:06:45 fetching corpus: 2975, signal 107845/157900 (executing program) 1970/01/01 00:06:45 fetching corpus: 2975, signal 107845/158667 (executing program) 1970/01/01 00:06:45 fetching corpus: 2975, signal 107845/159434 (executing program) 1970/01/01 00:06:46 fetching corpus: 2975, signal 107845/160187 (executing program) 1970/01/01 00:06:46 fetching corpus: 2975, signal 107845/160949 (executing program) 1970/01/01 00:06:46 fetching corpus: 2975, signal 107845/161715 (executing program) 1970/01/01 00:06:46 fetching corpus: 2975, signal 107845/162410 (executing program) 1970/01/01 00:06:46 fetching corpus: 2975, signal 107845/163164 (executing program) 1970/01/01 00:06:46 fetching corpus: 2975, signal 107845/163919 (executing program) 1970/01/01 00:06:47 fetching corpus: 2975, signal 107845/164657 (executing program) 1970/01/01 00:06:47 fetching corpus: 2975, signal 107845/165408 (executing program) 1970/01/01 00:06:47 fetching corpus: 2975, signal 107845/166147 (executing program) 1970/01/01 00:06:47 fetching corpus: 2975, signal 107845/166884 (executing program) 1970/01/01 00:06:47 fetching corpus: 2975, signal 107845/167612 (executing program) 1970/01/01 00:06:47 fetching corpus: 2975, signal 107845/168372 (executing program) 1970/01/01 00:06:47 fetching corpus: 2975, signal 107845/169137 (executing program) 1970/01/01 00:06:48 fetching corpus: 2975, signal 107845/169853 (executing program) 1970/01/01 00:06:48 fetching corpus: 2975, signal 107845/170430 (executing program) 1970/01/01 00:06:48 fetching corpus: 2975, signal 107845/170430 (executing program) 1970/01/01 00:08:14 starting 2 fuzzer processes 00:08:29 executing program 0: r0 = semget$private(0x0, 0x0, 0x40) semctl$IPC_RMID(r0, 0x0, 0x0) semtimedop(r0, &(0x7f0000000000)=[{0x2, 0x3, 0x1800}, {0x2, 0x6, 0x1800}, {0x1, 0xbcc6, 0x1000}, {0x3, 0xfff, 0x2000}, {0x3, 0x6, 0x1000}, {0x4, 0x1, 0x1000}, {0x0, 0xfffb}, {0x2, 0x0, 0x1800}], 0x8, &(0x7f0000000040)={0x77359400}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xc) semctl$IPC_SET(r0, 0x0, 0x1, &(0x7f0000000100)={{0x1, 0xee00, 0xee00, 0xee00, r1, 0x40, 0x6}, 0xfb, 0xffff, 0x0, 0x0, 0x0, 0x0, 0xbe}) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000180)={0x0, 0x2, 0x2, 0x0, 0xfffa, 0x3f, 0x0, 0x8, {0x0, @in6={{0xa, 0x4e24, 0x2a, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}, 0x6, 0x7fff, 0x1f, 0xcc67, 0x8}}, &(0x7f0000000240)=0xb0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000280)={r2, 0x80000001}, 0xc) r4 = socket$inet_sctp(0x2, 0x315f99e0a875103e, 0x84) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f00000002c0)={r2, 0xb2c, 0x30}, &(0x7f0000000300)=0xc) semtimedop(r0, &(0x7f0000000340)=[{0x3, 0x3, 0x1800}, {0x4, 0x2, 0x1000}, {0x2, 0x2, 0x1400}, {0x4, 0x1, 0x1800}, {0x0, 0x7}], 0x5, &(0x7f0000000380)={0x0, 0x3938700}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f00000003c0)={r5, 0x3f, 0x0, 0x9ea2, 0x7ff}, &(0x7f0000000400)=0x18) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r6, 0x84, 0x7c, &(0x7f0000000480)={r3, 0x9, 0x7}, 0x8) getsockopt$inet_sctp6_SCTP_MAXSEG(r6, 0x84, 0xd, &(0x7f00000004c0)=@assoc_value={0x0, 0x2}, &(0x7f0000000500)=0x8) semtimedop(0xffffffffffffffff, &(0x7f0000000540)=[{0x1, 0x6ce, 0x1000}, {0x1, 0x4, 0x800}, {0x0, 0x8001, 0x1000}, {0x4, 0xffff, 0x1000}, {0x3, 0x4, 0x800}], 0x5, &(0x7f0000000580)={0x0, 0x989680}) r7 = accept4$nfc_llcp(r6, 0x0, &(0x7f00000005c0), 0x800) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r7, 0x8982, &(0x7f0000000600)={0x0, 'ip_vti0\x00', {0x3}, 0x401}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r6, 0x84, 0x1d, &(0x7f0000000640)={0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000680)=0x18) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f00000006c0)={r8, 0x1, 0xe, "0ee52eff564eae957a67dac4e309"}, 0x16) semctl$SEM_STAT(r0, 0x2, 0x12, &(0x7f0000000700)=""/14) 00:08:50 executing program 1: r0 = socket$kcm(0x29, 0x2, 0x0) io_submit(0x0, 0x2, &(0x7f0000000240)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x7, 0x5, r0, &(0x7f0000000000)="b63f41d5cd9036e1566f5c089f38a3b773fbbfc3f5fab3dde1ee134d6525a569be75c598f5c3dc1276be88581f957a143461130d43707594f15af9b5b0c4c7cff18c98663fce285a989b7e3b1bc82a7cc5d47795f76e6a3262ef08724d75705e6709ddf94549ea90eab9d1f0984f98177425baf36a1e8370b0f2dfd70dd86a90145f943176015fd55994fb6d376665ad33e12514a53dc0255ccca6a7", 0x9c, 0x2, 0x0, 0x2}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0xe219187fb98ebcae, 0x3, 0xffffffffffffffff, &(0x7f0000000100)="08dd838ca8b031a4a476055c01c33eb223ea69999b2382b5fd48d4e97248e9e0e1355efd8a34c0c1d01153382a8bd10e8b63c718b17058286b3a5d16afc66206a899b0112c3bc9f8b6fa8cbbff430e70aae229266ab1bd1f7d1f59f8037a99c832657113fce72a7c836debf546e838059fde00e672b4d377388da54d4ba0bbdc03ab51602bc0aea91fb7ab023989df48513fda5742c7286dfbaaf067696d2d67914d428db7c5ec15658b61454b457c4753a0a5ef45bf5f8e2985ec5e94ffc5f5de9a6a41a0056ea7e866143d9fe2d9f29419083e1bcf47fddb6684e5d242504c6c8abc9652d500e06d690de906de91024e081344b2651dd4aeb7", 0xfa, 0x1f, 0x0, 0x5}]) r1 = syz_io_uring_complete(0x0) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, &(0x7f0000000280)={0xffffffffffffffff, r1}) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000002c0)={0xffffffffffffffff}, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, &(0x7f0000000340)={0xf, 0x8, 0xfa00, {r2, 0xf}}, 0x10) write$RDMA_USER_CM_CMD_NOTIFY(r1, &(0x7f0000000380)={0xf, 0x8, 0xfa00, {r2, 0x5}}, 0x10) write$RDMA_USER_CM_CMD_DISCONNECT(r1, &(0x7f00000003c0)={0xa, 0x4, 0xfa00, {r2}}, 0xc) r3 = openat$cgroup_int(r1, &(0x7f0000000400)='cpu.weight\x00', 0x2, 0x0) ioctl$FS_IOC_FSGETXATTR(r3, 0x801c581f, &(0x7f0000000440)={0x8, 0x6, 0x7, 0x1, 0x4}) r4 = syz_open_dev$sndmidi(&(0x7f0000000480)='/dev/snd/midiC#D#\x00', 0x8, 0x100) ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(r4, 0x8008f512, &(0x7f00000004c0)) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$F2FS_IOC_FLUSH_DEVICE(r5, 0x4008f50a, &(0x7f0000000500)={0x9, 0x800}) openat$mice(0xffffffffffffff9c, &(0x7f0000000540)='/dev/input/mice\x00', 0x90000) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000580)='/dev/hwrng\x00', 0x40000, 0x0) write$RDMA_USER_CM_CMD_DISCONNECT(r6, &(0x7f00000005c0)={0xa, 0x4, 0xfa00, {r2}}, 0xc) ioctl$DRM_IOCTL_SWITCH_CTX(r1, 0x40086424, &(0x7f0000000600)={0x0, 0x3}) ioctl$F2FS_IOC_DEFRAGMENT(0xffffffffffffffff, 0xc010f508, &(0x7f0000000640)={0x8001, 0x1}) write$RDMA_USER_CM_CMD_CONNECT(r1, &(0x7f0000000680)={0x6, 0x118, 0xfa00, {{0x8, 0x9, "0c56eb35eb30423ee4608a8738c567447543a3cc1b27da08df7b044103b6d34bd67f4b0fac1c38effc92998fc7a2519f3ddc7c5d03eda0707b17bb7fa517131626cbfa3f9ee887c018a978a89b9a2ebd0ea6b813fcaf1991ec9e1d957454193d40fa5807edb9382021e442b456f05e4e049719509878bd75350e2fe8ceeb2fd57ea74a1ec709d2d836901845ea7b29420dde3cc05dcab60a00b1f8891f5bb1bbc946ed9015729098eb5b73263efd8e949be7dbfa97d397f8e09cdde867cdc8991b48da6b6f4f549cc80bc016f8175fa9f67415a35bd89ba8a206a557b09d86d88d50f7052d1f9e5e5f15bf77b0bc308bca909f01a91e16310df03363a2ac3651", 0x7, 0x3, 0x0, 0x1f, 0x7f, 0x3c, 0x4, 0x1}, r2}}, 0x120) [ 533.366802][ T3069] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 533.499120][ T3069] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 540.940122][ T3069] device hsr_slave_0 entered promiscuous mode [ 541.011037][ T3069] device hsr_slave_1 entered promiscuous mode [ 544.755770][ T3069] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 544.870571][ T3069] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 544.964356][ T3069] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 545.062567][ T3069] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 553.616077][ T3069] 8021q: adding VLAN 0 to HW filter on device bond0 [ 554.047181][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 554.112459][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 559.076504][ T3271] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 559.120902][ T3271] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 559.289281][ T3271] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 559.341395][ T3271] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 559.537985][ T3271] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 559.819105][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 560.438185][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 560.488963][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 560.671679][ T3183] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 560.715318][ T3183] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 560.870704][ T3069] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 561.598273][ T3227] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 561.860721][ T3227] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 562.576201][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 562.580069][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 569.550435][ T3227] device hsr_slave_0 entered promiscuous mode [ 569.585232][ T3227] device hsr_slave_1 entered promiscuous mode [ 569.632661][ T3227] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 569.639746][ T3227] Cannot create hsr debugfs directory [ 573.020011][ T3271] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 573.101687][ T3271] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 573.631593][ T3227] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 573.761338][ T3227] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 573.842460][ T3227] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 574.005427][ T3227] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 578.247621][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 578.309390][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 578.485115][ T3183] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 578.516594][ T3183] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 578.556595][ T3069] device veth0_vlan entered promiscuous mode [ 578.990645][ T3069] device veth1_vlan entered promiscuous mode [ 580.062123][ T3271] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 580.085385][ T3271] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 580.227979][ T3069] device veth0_macvtap entered promiscuous mode [ 580.286630][ T3271] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 580.479698][ T3069] device veth1_macvtap entered promiscuous mode [ 581.437234][ T3148] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 581.497206][ T3148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 581.749716][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 581.791361][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 581.985963][ T3069] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.988520][ T3069] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.989678][ T3069] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 581.990923][ T3069] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 584.489218][ T3227] 8021q: adding VLAN 0 to HW filter on device bond0 [ 584.804651][ T3271] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 584.849370][ T3271] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 585.551882][ T3069] cgroup: cgroup: disabling cgroup2 socket matching due to net_prio or net_cls activation 00:09:48 executing program 0: r0 = semget$private(0x0, 0x0, 0x40) semctl$IPC_RMID(r0, 0x0, 0x0) semtimedop(r0, &(0x7f0000000000)=[{0x2, 0x3, 0x1800}, {0x2, 0x6, 0x1800}, {0x1, 0xbcc6, 0x1000}, {0x3, 0xfff, 0x2000}, {0x3, 0x6, 0x1000}, {0x4, 0x1, 0x1000}, {0x0, 0xfffb}, {0x2, 0x0, 0x1800}], 0x8, &(0x7f0000000040)={0x77359400}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000080)={0x0, 0x0, 0x0}, &(0x7f00000000c0)=0xc) semctl$IPC_SET(r0, 0x0, 0x1, &(0x7f0000000100)={{0x1, 0xee00, 0xee00, 0xee00, r1, 0x40, 0x6}, 0xfb, 0xffff, 0x0, 0x0, 0x0, 0x0, 0xbe}) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000180)={0x0, 0x2, 0x2, 0x0, 0xfffa, 0x3f, 0x0, 0x8, {0x0, @in6={{0xa, 0x4e24, 0x2a, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}}, 0x6, 0x7fff, 0x1f, 0xcc67, 0x8}}, &(0x7f0000000240)=0xb0) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000280)={r2, 0x80000001}, 0xc) r4 = socket$inet_sctp(0x2, 0x315f99e0a875103e, 0x84) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f00000002c0)={r2, 0xb2c, 0x30}, &(0x7f0000000300)=0xc) semtimedop(r0, &(0x7f0000000340)=[{0x3, 0x3, 0x1800}, {0x4, 0x2, 0x1000}, {0x2, 0x2, 0x1400}, {0x4, 0x1, 0x1800}, {0x0, 0x7}], 0x5, &(0x7f0000000380)={0x0, 0x3938700}) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f00000003c0)={r5, 0x3f, 0x0, 0x9ea2, 0x7ff}, &(0x7f0000000400)=0x18) r6 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000440)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r6, 0x84, 0x7c, &(0x7f0000000480)={r3, 0x9, 0x7}, 0x8) getsockopt$inet_sctp6_SCTP_MAXSEG(r6, 0x84, 0xd, &(0x7f00000004c0)=@assoc_value={0x0, 0x2}, &(0x7f0000000500)=0x8) semtimedop(0xffffffffffffffff, &(0x7f0000000540)=[{0x1, 0x6ce, 0x1000}, {0x1, 0x4, 0x800}, {0x0, 0x8001, 0x1000}, {0x4, 0xffff, 0x1000}, {0x3, 0x4, 0x800}], 0x5, &(0x7f0000000580)={0x0, 0x989680}) r7 = accept4$nfc_llcp(r6, 0x0, &(0x7f00000005c0), 0x800) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r7, 0x8982, &(0x7f0000000600)={0x0, 'ip_vti0\x00', {0x3}, 0x401}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r6, 0x84, 0x1d, &(0x7f0000000640)={0x5, [0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000680)=0x18) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r6, 0x84, 0x17, &(0x7f00000006c0)={r8, 0x1, 0xe, "0ee52eff564eae957a67dac4e309"}, 0x16) semctl$SEM_STAT(r0, 0x2, 0x12, &(0x7f0000000700)=""/14) [ 591.041582][ T3498] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 591.104982][ T3498] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 591.292126][ T3271] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 591.341690][ T3271] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 591.511470][ T3271] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 592.466704][ T2709] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 592.646254][ T3271] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 592.715619][ T3271] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 592.959313][ T2709] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 593.019273][ T2709] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 593.177228][ T3227] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 593.800168][ T3396] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 593.805326][ T3396] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready 00:09:53 executing program 0: r0 = socket$netlink(0x10, 0x3, 0xa) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfd, 0x10000}, 0xc) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="046a"], 0x24}}, 0x0) 00:09:58 executing program 0: r0 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00', 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080)='nl80211\x00', 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x74, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {@wo_ht={{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x74}}, 0x0) sendmsg$NL80211_CMD_SET_MESH_CONFIG(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000400)={&(0x7f00000002c0)={0x110, 0x0, 0x1, 0x70bd29, 0x25dfdbfd, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_WDEV={0xc, 0x99, {0x0, 0x62}}, @NL80211_ATTR_MESH_CONFIG={0x3c, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR={0x8, 0x15, 0xc5}, @NL80211_MESHCONF_TTL={0x5, 0x6, 0x6}, @NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES={0x5, 0x8, 0x3f}, @NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL={0x6, 0x19, 0x1}, @NL80211_MESHCONF_ELEMENT_TTL={0x5, 0xf, 0x9}, @NL80211_MESHCONF_FORWARDING={0x5, 0x13, 0x1}, @NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT={0x6, 0xa, 0x100}]}, @NL80211_ATTR_MESH_CONFIG={0x4c, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_MAX_RETRIES={0x5, 0x5, 0xc}, @NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR={0x8, 0x15, 0x74}, @NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL={0x6, 0x12, 0xfffe}, @NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL={0x6, 0x12, 0x8}, @NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES={0x5, 0x8, 0x20}, @NL80211_MESHCONF_CONNECTED_TO_GATE={0x5}, @NL80211_MESHCONF_HWMP_ROOTMODE={0x5, 0xe, 0x4}, @NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT={0x8, 0x17, 0x3ff}, @NL80211_MESHCONF_MAX_RETRIES={0x5, 0x5, 0x1}]}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r3}, @NL80211_ATTR_WDEV={0xc, 0x99, {0x7ff, 0x43}}, @NL80211_ATTR_MESH_CONFIG={0x4c, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_PATH_REFRESH_TIME={0x8, 0x9, 0x7}, @NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT={0x8, 0x17, 0x1}, @NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL={0x6, 0x12, 0x35a}, @NL80211_MESHCONF_HWMP_ROOT_INTERVAL={0x6, 0x18, 0x4}, @NL80211_MESHCONF_HWMP_ROOTMODE={0x5, 0xe, 0x3}, @NL80211_MESHCONF_AUTO_OPEN_PLINKS={0x5, 0x7, 0x1}, @NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME={0x6}, @NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR={0x8, 0x15, 0x3d}, @NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL={0x6, 0x12, 0xffff}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x20811}, 0x40005) sendmsg$TIPC_CMD_GET_REMOTE_MNG(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r0, 0x4, 0x70bd2b, 0x25dfdbfb, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) openat2(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0xb0040}, 0x18) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='bdev\x00', 0x0, &(0x7f00000000c0)='trusted.overlay.opaque\x00') [ 603.561814][ T3520] bdev: Unknown parameter 'trusted.overlay.opaque' [ 606.398713][ T3525] bdev: Unknown parameter 'trusted.overlay.opaque' [ 610.256417][ T3148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 610.311309][ T3148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 615.100822][ T3148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 615.146927][ T3148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 615.217749][ T3271] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 615.266547][ T3271] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 615.398696][ T3227] device veth0_vlan entered promiscuous mode [ 615.786951][ T3227] device veth1_vlan entered promiscuous mode [ 616.606720][ T3148] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 616.678627][ T3148] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 617.061834][ T3227] device veth0_macvtap entered promiscuous mode [ 617.395683][ T3227] device veth1_macvtap entered promiscuous mode [ 617.959993][ T2709] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 617.985138][ T2709] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 618.452155][ T2709] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 618.511739][ T2709] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 618.720806][ T2709] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 618.771480][ T2709] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 619.000453][ T3227] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.002375][ T3227] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.045648][ T3227] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 619.047418][ T3227] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 00:10:26 executing program 0: sendmsg$L2TP_CMD_TUNNEL_DELETE(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x2c, 0x0, 0x1, 0x70bd29, 0x25dfdbfd, {}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x7}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xff}, @L2TP_ATTR_ENCAP_TYPE={0x6}]}, 0x2c}, 0x1, 0x0, 0x0, 0x480}, 0x800) r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_RECV_OWN_MSGS(r0, 0x65, 0x4, 0x0, 0x0) 00:10:26 executing program 1: syslog(0x2, 0x0, 0x0) syslog(0xa, 0x0, 0x0) 00:10:31 executing program 0: syz_open_procfs(0x0, 0x0) syz_open_dev$audion(&(0x7f0000002040)='/dev/audio#\x00', 0x5, 0x20002) r0 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000002080)='/dev/dlm-monitor\x00', 0x840, 0x0) read$FUSE(r0, &(0x7f0000000000)={0x2020}, 0x2020) 00:10:31 executing program 1: r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsu\x00', 0x0, 0x0) preadv2(r0, &(0x7f0000000680)=[{&(0x7f0000000340)=""/8, 0x8}], 0x1, 0x0, 0x0, 0x0) 00:10:35 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="200000008000000006000000660000000f000000000000000100000001000000004000000040000020000000daf4655fdaf4655f0100ffff53ef", 0x3a, 0x400}], 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="696e6f64655f7265616461686561645f626c6b733d307830303030303030303034103030307465735d5f64756d6d795fb80f76db797074696f6e2c00000000"]) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x40, 0x0) 00:10:36 executing program 0: r0 = syz_io_uring_setup(0x66a5, &(0x7f0000001880), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000001900)=0x0, &(0x7f0000001940)) syz_io_uring_setup(0x5d61, &(0x7f0000000000)={0x0, 0xdee0, 0x10, 0x1, 0x33e, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000080)=0x0, &(0x7f00000000c0)) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, &(0x7f0000000200), &(0x7f0000000240)='./file1\x00', 0x18}, 0x0) getsockopt$SO_TIMESTAMP(r0, 0x1, 0x3f, &(0x7f0000000280), &(0x7f00000002c0)=0x4) syz_io_uring_submit(r1, r4, &(0x7f0000000180)=@IORING_OP_READ_FIXED={0x4, 0x3, 0x2007, @fd_index=0xa, 0x7, 0x1, 0x20, 0x2, 0x1, {0x3}}, 0x1f) r5 = syz_io_uring_complete(r2) fsetxattr(r0, &(0x7f0000001280)=ANY=[], 0x0, 0x0, 0x0) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r6, r7, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, &(0x7f0000000200), &(0x7f0000000240)='./file1\x00', 0x18}, 0x0) syz_io_uring_submit(r1, r7, &(0x7f0000000140)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, r5, 0x0, &(0x7f0000000100)='./file0\x00', 0x1bc, 0x404400, 0x23456}, 0x2) [ 638.811342][ T3560] loop1: detected capacity change from 0 to 4 [ 639.107946][ T3560] EXT4-fs (loop1): Unrecognized mount option "inode_readahead_blks=0x0000000004000tes]_dummy_¸vÛyption" or missing value [ 639.980952][ T3560] loop1: detected capacity change from 0 to 4 [ 640.211246][ T3560] EXT4-fs (loop1): Unrecognized mount option "inode_readahead_blks=0x0000000004000tes]_dummy_¸vÛyption" or missing value 00:10:41 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_buf(r0, 0x6, 0x1f, 0x0, &(0x7f00000012c0)) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsu\x00', 0x0, 0x0) preadv2(r1, &(0x7f0000000680)=[{&(0x7f0000000340)=""/8, 0x8}], 0x1, 0x0, 0x0, 0x0) getsockopt$IP_SET_OP_VERSION(r1, 0x1, 0x53, &(0x7f0000000000), &(0x7f0000000040)=0x8) 00:10:41 executing program 0: r0 = syz_io_uring_setup(0x66a5, &(0x7f0000001880), &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000001900)=0x0, &(0x7f0000001940)) syz_io_uring_setup(0x5d61, &(0x7f0000000000)={0x0, 0xdee0, 0x10, 0x1, 0x33e, 0x0, r0}, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000080)=0x0, &(0x7f00000000c0)) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, &(0x7f0000000200), &(0x7f0000000240)='./file1\x00', 0x18}, 0x0) getsockopt$SO_TIMESTAMP(r0, 0x1, 0x3f, &(0x7f0000000280), &(0x7f00000002c0)=0x4) syz_io_uring_submit(r1, r4, &(0x7f0000000180)=@IORING_OP_READ_FIXED={0x4, 0x3, 0x2007, @fd_index=0xa, 0x7, 0x1, 0x20, 0x2, 0x1, {0x3}}, 0x1f) r5 = syz_io_uring_complete(r2) fsetxattr(r0, &(0x7f0000001280)=ANY=[], 0x0, 0x0, 0x0) syz_io_uring_setup(0x1, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r6, r7, &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffff9c, &(0x7f0000000200), &(0x7f0000000240)='./file1\x00', 0x18}, 0x0) syz_io_uring_submit(r1, r7, &(0x7f0000000140)=@IORING_OP_OPENAT={0x12, 0x5, 0x0, r5, 0x0, &(0x7f0000000100)='./file0\x00', 0x1bc, 0x404400, 0x23456}, 0x2) 00:10:46 executing program 1: prctl$PR_GET_TIMERSLACK(0x1e) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/snd/seq\x00', 0x0) clock_gettime(0x0, &(0x7f0000000240)) r1 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000000c0)={&(0x7f0000000080)='./file0\x00'}, 0x10) r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000140)={&(0x7f0000000100)='./file0\x00', 0x0, 0x10}, 0x10) ppoll(&(0x7f0000000180)=[{r1, 0x8010}, {0xffffffffffffffff, 0x4029}, {0xffffffffffffffff, 0x1001}, {r2, 0x380}], 0x4, &(0x7f0000000280), &(0x7f00000002c0)={[0x800]}, 0x8) prctl$PR_GET_TIMERSLACK(0x1e) ppoll(&(0x7f0000000200)=[{r0}], 0x1, 0x0, 0x0, 0x0) r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsu\x00', 0x0, 0x0) preadv2(r3, &(0x7f0000000680)=[{&(0x7f0000000340)=""/8, 0x8}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r3, 0xc0605345, &(0x7f0000000000)={0x30, 0x1, {0x3, 0x1, 0x4, 0x0, 0xfffeffff}, 0x1}) 00:10:48 executing program 0: getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000580)={0x0, @in6={{0xa, 0x4e24, 0x2, @dev={0xfe, 0x80, [], 0x3a}, 0x36d8}}, [0x9ce, 0xae9, 0x6, 0x7ff80000, 0x8, 0x462, 0x4, 0xfffffffffffffc78, 0x10000, 0xffffffff, 0x1002, 0x0, 0x7ff, 0x8, 0x7fff]}, &(0x7f0000001540)=0xfffffffffffffd9c) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$inet6(r0, &(0x7f0000001600)={&(0x7f0000000080)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c, 0x0}, 0x0) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsu\x00', 0x101902, 0x0) preadv2(r1, &(0x7f0000000680)=[{&(0x7f0000000340)=""/8, 0x8}], 0x1, 0x0, 0x0, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x77f, @ipv4={[], [], @private=0xa010100}, 0x2}, 0x1c) r2 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsu\x00', 0x0, 0x0) preadv2(r2, &(0x7f0000000680)=[{&(0x7f0000000340)=""/8, 0x8}], 0x1, 0x0, 0x0, 0x0) pwritev2(0xffffffffffffffff, &(0x7f00000001c0)=[{&(0x7f00000000c0)="f5c88fc3787df3e65bc82943656dceebcb4a14fc2c9837df65399b3f2076185c8d870e96c9033a799b5dc4670c4cc6351d58b669a12b4e38d87d9bcba8cd248961b78412433cdd11d9236e80bf1e825af2d2aea0a48d2de5512a40bc4c3676f1d5ac8a5039d2cc97a9e797dad56ab7eb2b66ba15675aff4cdcc2a29f44159238fe24303f8021ec56506d4eb0eec7f6d74b45257f95087b32bd1918cf67c5ac21bee91ca1598890ec8a2ddad8068c1cef5fd8b6d11e4bf80425bbec777493ba30298c0fd29077d382e480db8552c1b852fda78374897048", 0xd7}, {&(0x7f0000000040)="0deda7844b12be5a3012d7606f8480871b66dedaa93b83e9b6b0a54cff2c9072ef3a2dd7c8d29c9ea8f45f1177135136ba0ba4e1cddc3bdd144c2871c62e79", 0x3f}], 0x2, 0x8001, 0x80, 0x11) vmsplice(r2, &(0x7f0000001480), 0x0, 0xc) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000bc0)='/dev/zero\x00', 0x0, 0x0) sendmsg$rds(r3, &(0x7f0000000fc0)={&(0x7f0000000c00)={0x2, 0x4e23, @empty}, 0x10, &(0x7f0000000c80)=[{&(0x7f0000000c40)=""/40, 0x28}], 0x1, &(0x7f0000000f00)=[@fadd={0x58, 0x114, 0x6, {{0x6, 0x10000}, &(0x7f0000000cc0)=0xfffffffffffffffa, &(0x7f0000000d00)=0x8, 0x1000, 0x100, 0xffff, 0xc10, 0x30, 0x101}}, @rdma_args={0x48, 0x114, 0x1, {{0xe92, 0x8}, {&(0x7f0000005c80)=""/4096, 0x1000}, &(0x7f0000000ec0)=[{&(0x7f0000000d40)=""/118, 0x76}, {&(0x7f0000000dc0)=""/30, 0x1e}, {&(0x7f0000000e00)=""/153, 0x99}], 0x3, 0xc8, 0x1}}], 0xa0, 0x4000}, 0x44850) 00:10:52 executing program 0: clone3(&(0x7f0000002a80)={0x16200d00, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsu\x00', 0x0, 0x0) preadv2(r0, &(0x7f0000000680)=[{&(0x7f0000000340)=""/8, 0x8}], 0x1, 0x0, 0x0, 0x0) fcntl$addseals(r0, 0x409, 0x4) 00:10:53 executing program 1: prctl$PR_GET_TIMERSLACK(0x1e) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/snd/seq\x00', 0x0) clock_gettime(0x0, &(0x7f0000000240)) r1 = bpf$OBJ_GET_PROG(0x7, &(0x7f00000000c0)={&(0x7f0000000080)='./file0\x00'}, 0x10) r2 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000140)={&(0x7f0000000100)='./file0\x00', 0x0, 0x10}, 0x10) ppoll(&(0x7f0000000180)=[{r1, 0x8010}, {0xffffffffffffffff, 0x4029}, {0xffffffffffffffff, 0x1001}, {r2, 0x380}], 0x4, &(0x7f0000000280), &(0x7f00000002c0)={[0x800]}, 0x8) prctl$PR_GET_TIMERSLACK(0x1e) ppoll(&(0x7f0000000200)=[{r0}], 0x1, 0x0, 0x0, 0x0) r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsu\x00', 0x0, 0x0) preadv2(r3, &(0x7f0000000680)=[{&(0x7f0000000340)=""/8, 0x8}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r3, 0xc0605345, &(0x7f0000000000)={0x30, 0x1, {0x3, 0x1, 0x4, 0x0, 0xfffeffff}, 0x1}) 00:10:56 executing program 0: clone3(&(0x7f0000002a80)={0x16200d00, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsu\x00', 0x0, 0x0) preadv2(r0, &(0x7f0000000680)=[{&(0x7f0000000340)=""/8, 0x8}], 0x1, 0x0, 0x0, 0x0) fcntl$addseals(r0, 0x409, 0x4) 00:10:59 executing program 1: r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$reject(0x13, r0, 0x4000000000000, 0x3f, r1) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000580)='/dev/ptmx\x00', 0x681b01, 0x0) keyctl$read(0xb, r0, &(0x7f00000005c0)=""/4096, 0x1000) r3 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000180)='pkcs7_test\x00', 0x0, 0x0, 0x0, r3) r4 = add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, r3) add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, r4) ioctl$TCSETS(r2, 0x5402, 0x0) 00:11:01 executing program 0: syz_open_dev$ndb(&(0x7f0000000040)='/dev/nbd#\x00', 0x0, 0x0) r0 = open_tree(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x80100) ioctl$BLKROSET(r0, 0x125d, &(0x7f0000000000)=0x8) 00:11:04 executing program 1: r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$reject(0x13, r0, 0x4000000000000, 0x3f, r1) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000580)='/dev/ptmx\x00', 0x681b01, 0x0) keyctl$read(0xb, r0, &(0x7f00000005c0)=""/4096, 0x1000) r3 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000180)='pkcs7_test\x00', 0x0, 0x0, 0x0, r3) r4 = add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, r3) add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, r4) ioctl$TCSETS(r2, 0x5402, 0x0) 00:11:05 executing program 0: r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$reject(0x13, r0, 0x4000000000000, 0x3f, r1) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000580)='/dev/ptmx\x00', 0x681b01, 0x0) keyctl$read(0xb, r0, &(0x7f00000005c0)=""/4096, 0x1000) r3 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000180)='pkcs7_test\x00', 0x0, 0x0, 0x0, r3) r4 = add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, r3) add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, r4) ioctl$TCSETS(r2, 0x5402, 0x0) 00:11:08 executing program 1: r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcsu\x00', 0x4c0, 0x0) preadv2(r0, &(0x7f0000000680)=[{&(0x7f0000000340)=""/8, 0x8}], 0x1, 0x0, 0x0, 0x0) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsu\x00', 0x0, 0x0) preadv2(r1, &(0x7f0000000680)=[{&(0x7f0000000340)=""/8, 0x8}], 0x1, 0x0, 0x0, 0x0) close(r1) sendmsg$NFNL_MSG_CTHELPER_GET(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x1, 0x9, 0x801, 0x0, 0x0, {0x2, 0x0, 0x9}, [@NFCTH_QUEUE_NUM={0x8, 0x3, 0x1, 0x0, 0xe3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000001}, 0x24010040) 00:11:10 executing program 0: r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$reject(0x13, r0, 0x4000000000000, 0x3f, r1) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000580)='/dev/ptmx\x00', 0x681b01, 0x0) keyctl$read(0xb, r0, &(0x7f00000005c0)=""/4096, 0x1000) r3 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000180)='pkcs7_test\x00', 0x0, 0x0, 0x0, r3) r4 = add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, r3) add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, r4) ioctl$TCSETS(r2, 0x5402, 0x0) 00:11:11 executing program 1: r0 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio1\x00', 0x0, 0x0) read$dsp(r0, &(0x7f0000000500)=""/146, 0x92) r1 = dup(r0) inotify_add_watch(r1, &(0x7f0000000040)='./file0\x00', 0x43000049) ioctl$SNDCTL_DSP_CHANNELS(r1, 0xc0045006, &(0x7f0000000080)) ioctl$SNDCTL_DSP_CHANNELS(r1, 0xc0045006, &(0x7f0000000640)) 00:11:14 executing program 0: r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$reject(0x13, r0, 0x4000000000000, 0x3f, r1) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000580)='/dev/ptmx\x00', 0x681b01, 0x0) keyctl$read(0xb, r0, &(0x7f00000005c0)=""/4096, 0x1000) r3 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000180)='pkcs7_test\x00', 0x0, 0x0, 0x0, r3) r4 = add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, r3) add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, r4) ioctl$TCSETS(r2, 0x5402, 0x0) 00:11:18 executing program 1: syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x2, 0x440080) 00:11:18 executing program 0: r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$reject(0x13, r0, 0x4000000000000, 0x3f, r1) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000580)='/dev/ptmx\x00', 0x681b01, 0x0) keyctl$read(0xb, r0, &(0x7f00000005c0)=""/4096, 0x1000) r2 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000180)='pkcs7_test\x00', 0x0, 0x0, 0x0, r2) r3 = add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, r2) add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000140)={'syz', 0x2}, 0x0, 0x0, r3) 00:11:22 executing program 1: r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsu\x00', 0x0, 0x0) preadv2(r0, &(0x7f0000000680)=[{&(0x7f0000000340)=""/8, 0x8}], 0x1, 0x0, 0x0, 0x0) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsu\x00', 0x0, 0x0) preadv2(r1, &(0x7f0000000680)=[{&(0x7f0000000340)=""/8, 0x8}], 0x1, 0x0, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, &(0x7f0000000480)={r1}) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cachefiles\x00', 0x240002, 0x0) pread64(r2, 0x0, 0x0, 0x0) r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsu\x00', 0x0, 0x0) preadv2(r3, &(0x7f0000000680)=[{&(0x7f0000000340)=""/8, 0x8}], 0x1, 0x0, 0x0, 0x0) r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsu\x00', 0x0, 0x0) preadv2(r4, &(0x7f0000000680)=[{&(0x7f0000000340)=""/8, 0x8}], 0x1, 0x0, 0x0, 0x0) r5 = getpid() move_pages(r5, 0x0, 0x0, 0x0, 0x0, 0x0) fcntl$lock(r4, 0x6, &(0x7f00000004c0)={0x2, 0x3, 0xfffffffffffffffe, 0x10000, r5}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r3, 0xc400941d, &(0x7f0000000080)={0x0, 0xfffffffffffffff8, 0x9, 0x1}) 00:11:22 executing program 0: r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$reject(0x13, r0, 0x4000000000000, 0x3f, r1) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000580)='/dev/ptmx\x00', 0x681b01, 0x0) keyctl$read(0xb, r0, &(0x7f00000005c0)=""/4096, 0x1000) r2 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000180)='pkcs7_test\x00', 0x0, 0x0, 0x0, r2) add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, r2) 00:11:26 executing program 1: r0 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsu\x00', 0x0, 0x0) preadv2(r0, &(0x7f0000000680)=[{&(0x7f0000000340)=""/8, 0x8}], 0x1, 0x0, 0x0, 0x0) r1 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsu\x00', 0x0, 0x0) preadv2(r1, &(0x7f0000000680)=[{&(0x7f0000000340)=""/8, 0x8}], 0x1, 0x0, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, &(0x7f0000000480)={r1}) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cachefiles\x00', 0x240002, 0x0) pread64(r2, 0x0, 0x0, 0x0) r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsu\x00', 0x0, 0x0) preadv2(r3, &(0x7f0000000680)=[{&(0x7f0000000340)=""/8, 0x8}], 0x1, 0x0, 0x0, 0x0) r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcsu\x00', 0x0, 0x0) preadv2(r4, &(0x7f0000000680)=[{&(0x7f0000000340)=""/8, 0x8}], 0x1, 0x0, 0x0, 0x0) r5 = getpid() move_pages(r5, 0x0, 0x0, 0x0, 0x0, 0x0) fcntl$lock(r4, 0x6, &(0x7f00000004c0)={0x2, 0x3, 0xfffffffffffffffe, 0x10000, r5}) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r3, 0xc400941d, &(0x7f0000000080)={0x0, 0xfffffffffffffff8, 0x9, 0x1}) 00:11:26 executing program 0: r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$reject(0x13, r0, 0x4000000000000, 0x3f, r1) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000580)='/dev/ptmx\x00', 0x681b01, 0x0) keyctl$read(0xb, r0, &(0x7f00000005c0)=""/4096, 0x1000) r2 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000180)='pkcs7_test\x00', 0x0, 0x0, 0x0, r2) 00:11:29 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000340)={&(0x7f0000000140)={0x2, 0x4f20, @empty}, 0x10, 0x0, 0x0, &(0x7f0000000040)=[@ip_ttl={{0x14}}], 0x18}, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) ioctl$sock_inet6_tcp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000000)) 00:11:30 executing program 0: r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$reject(0x13, r0, 0x4000000000000, 0x3f, r1) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000580)='/dev/ptmx\x00', 0x681b01, 0x0) keyctl$read(0xb, r0, &(0x7f00000005c0)=""/4096, 0x1000) add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) 00:11:33 executing program 0: r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$reject(0x13, r0, 0x4000000000000, 0x3f, r1) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000580)='/dev/ptmx\x00', 0x681b01, 0x0) keyctl$read(0xb, r0, &(0x7f00000005c0)=""/4096, 0x1000) 00:11:33 executing program 1: r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$reject(0x13, r0, 0x4000000000000, 0x3f, r1) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000580)='/dev/ptmx\x00', 0x681b01, 0x0) keyctl$read(0xb, r0, &(0x7f00000005c0)=""/4096, 0x1000) r2 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000180)='pkcs7_test\x00', 0x0, 0x0, 0x0, r2) 00:11:37 executing program 1: r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$reject(0x13, r0, 0x4000000000000, 0x3f, r1) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000580)='/dev/ptmx\x00', 0x681b01, 0x0) keyctl$read(0xb, r0, &(0x7f00000005c0)=""/4096, 0x1000) r2 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) add_key(&(0x7f0000000180)='pkcs7_test\x00', 0x0, 0x0, 0x0, r2) 00:11:37 executing program 0: r0 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$reject(0x13, r0, 0x4000000000000, 0x3f, r1) keyctl$read(0xb, r0, &(0x7f00000005c0)=""/4096, 0x1000) [ 700.101162][ T3644] Unable to handle kernel access to user memory without uaccess routines at virtual address 00000000129820d0 [ 700.137543][ T3644] Oops [#1] [ 700.138423][ T3644] Modules linked in: [ 700.139434][ T3644] CPU: 1 PID: 3644 Comm: syz-executor.0 Not tainted 5.12.0-rc5-syzkaller-00715-ga5e13c6df0e4 #0 [ 700.140723][ T3644] Hardware name: riscv-virtio,qemu (DT) [ 700.141672][ T3644] epc : schedule_tail+0x72/0xb2 [ 700.143118][ T3644] ra : schedule_tail+0x70/0xb2 [ 700.144621][ T3644] epc : ffffffe00008f4c4 ra : ffffffe00008f4c2 sp : ffffffe009267ec0 [ 700.145666][ T3644] gp : ffffffe004588b08 tp : ffffffe007d80000 t0 : 0000000000000000 [ 700.146718][ T3644] t1 : 0000000000000001 t2 : 00000000000f4240 s0 : ffffffe009267ee0 [ 700.147811][ T3644] s1 : 00000000129820d0 a0 : 000000000000003c a1 : 0000000000000003 [ 700.148816][ T3644] a2 : 1ffffffc0cfac108 a3 : ffffffe0000d30bc a4 : 358f52400c101900 [ 700.149895][ T3644] a5 : 0000000000000000 a6 : 0000000000f00000 a7 : ffffffe0001041aa [ 700.150977][ T3644] s2 : 0000000000040000 s3 : ffffffe005f397c0 s4 : ffffffe00a3dffe0 [ 700.152067][ T3644] s5 : 0000000000004000 s6 : ffffffe067d55ec0 s7 : ffffffe067d55910 [ 700.154086][ T3644] s8 : ffffffe067d54ed8 s9 : ffffffe067d55ec0 s10: ffffffe005f39bf8 [ 700.155264][ T3644] s11: 000000a2f02fa5b0 t3 : 358f52400c101900 t4 : ffffffc40398afb2 [ 700.156311][ T3644] t5 : ffffffc40398afba t6 : 0000000000040000 [ 700.157235][ T3644] status: 0000000000000120 badaddr: 00000000129820d0 cause: 000000000000000f [ 700.158394][ T3644] Call Trace: [ 700.159094][ T3644] [] schedule_tail+0x72/0xb2 [ 700.160449][ T3644] [] ret_from_exception+0x0/0x14 [ 700.175037][ T3644] ---[ end trace 621867b6c18eaeee ]--- [ 700.178281][ T3644] Kernel panic - not syncing: Fatal exception [ 700.179577][ T3644] SMP: stopping secondary CPUs [ 700.181224][ T3644] Rebooting in 86400 seconds.. VM DIAGNOSIS: 12:59:47 Registers: info registers vcpu 0 pc ffffffe00033ab66 mhartid 0000000000000000 mstatus 00000000000000a2 mip 0000000000000000 mie 00000000000002aa mideleg 0000000000000222 medeleg 000000000000b109 mtvec 0000000080000540 stvec ffffffe00000542c mepc ffffffe00000e9d4 sepc ffffffe00033ab76 mcause 0000000000000009 scause 8000000000000005 mtval 0000000000000000 stval 0000000000000000 x0/zero 0000000000000000 x1/ra ffffffe0001a2aac x2/sp ffffffe01fbd3940 x3/gp ffffffe004588b08 x4/tp ffffffe0078e8000 x5/t0 ffffffc400e74170 x6/t1 0000000000000001 x7/t2 000000007c17cb6e x8/s0 ffffffe01fbd3980 x9/s1 0000000027a6e817 x10/a0 0000000000000000 x11/a1 ffffffe0078e9000 x12/a2 0000000000000002 x13/a3 ffffffe00033abb2 x14/a4 0000000000000003 x15/a5 0000000000000000 x16/a6 0000000000f00000 x17/a7 ffffffe00033a9b6 x18/s2 00000000000fffff x19/s3 ffffffe005f200c0 x20/s4 0000000000000000 x21/s5 00000000100400fb x22/s6 0ffe000000000000 x23/s7 0000000000000000 x24/s8 0000000000000000 x25/s9 0000003fce86a000 x26/s10 0000003fce819000 x27/s11 0000000000000000 x28/t3 358f52400c101900 x29/t4 0000000000000040 x30/t5 ffffffc400be4200 x31/t6 0000000000000002 f0/ft0 0000000000000000 f1/ft1 0000000000000000 f2/ft2 0000000000000000 f3/ft3 0000000000000000 f4/ft4 0000000000000000 f5/ft5 0000000000000000 f6/ft6 0000000000000000 f7/ft7 0000000000000000 f8/fs0 0000000000000000 f9/fs1 0000000000000000 f10/fa0 0000000000000000 f11/fa1 0000000000000000 f12/fa2 0000000000000000 f13/fa3 0000000000000000 f14/fa4 0000000000000000 f15/fa5 0000000000000000 f16/fa6 0000000000000000 f17/fa7 0000000000000000 f18/fs2 0000000000000000 f19/fs3 0000000000000000 f20/fs4 0000000000000000 f21/fs5 0000000000000000 f22/fs6 0000000000000000 f23/fs7 0000000000000000 f24/fs8 0000000000000000 f25/fs9 0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000 f28/ft8 0000000000000000 f29/ft9 0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000 info registers vcpu 1 pc ffffffe002a90ea8 mhartid 0000000000000001 mstatus 00000000000000a0 mip 0000000000000000 mie 00000000000002aa mideleg 0000000000000222 medeleg 000000000000b109 mtvec 0000000080000540 stvec ffffffe00000542c mepc ffffffe00000e9d4 sepc 0000000000053684 mcause 0000000000000009 scause 0000000000000008 mtval 0000000000000000 stval 0000000000000000 x0/zero 0000000000000000 x1/ra ffffffe00032f910 x2/sp ffffffe01cc57db0 x3/gp ffffffe004588b08 x4/tp ffffffe005f397c0 x5/t0 0000000000000398 x6/t1 0000000000000001 x7/t2 0000000000000003 x8/s0 ffffffe01cc57e10 x9/s1 0000000000000010 x10/a0 ffffffe067d60840 x11/a1 00000000000f0000 x12/a2 1ffffffc00be72f9 x13/a3 0000000000000000 x14/a4 0000000000000000 x15/a5 ffffffe0043963a8 x16/a6 0000000000f00000 x17/a7 ffffffe00032f8d8 x18/s2 0000003fffd233f8 x19/s3 ffffffe01cc57e18 x20/s4 0000003fffd233f8 x21/s5 0000003fffd233f8 x22/s6 ffffffe00458c0d0 x23/s7 ffffffe003004930 x24/s8 ffffffe003004960 x25/s9 0000003fffd234b0 x26/s10 00000000000001f4 x27/s11 0000000000000014 x28/t3 358f52400c101900 x29/t4 ffffffc40398afc3 x30/t5 ffffffc40398afc5 x31/t6 0000000000040000 f0/ft0 0000000000000000 f1/ft1 0000000000000000 f2/ft2 0000000000000000 f3/ft3 0000000000000000 f4/ft4 0000000000000000 f5/ft5 0000000000000000 f6/ft6 0000000000000000 f7/ft7 0000000000000000 f8/fs0 0000000000000000 f9/fs1 0000000000000000 f10/fa0 0000000000000000 f11/fa1 0000000000000000 f12/fa2 0000000000000000 f13/fa3 0000000000000000 f14/fa4 0000000000000000 f15/fa5 0000000000000000 f16/fa6 0000000000000000 f17/fa7 0000000000000000 f18/fs2 0000000000000000 f19/fs3 0000000000000000 f20/fs4 0000000000000000 f21/fs5 0000000000000000 f22/fs6 0000000000000000 f23/fs7 0000000000000000 f24/fs8 0000000000000000 f25/fs9 0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000 f28/ft8 0000000000000000 f29/ft9 0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000