last executing test programs: 3.010644465s ago: executing program 2 (id=3): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000280)={'lo\x00', &(0x7f0000000000)=@ethtool_cmd={0xa, 0x9, 0xffffffff, 0x2001, 0x7, 0x7, 0x0, 0x5, 0xff, 0x5, 0xffd, 0x6, 0x9c, 0xa2, 0x0, 0x6, [0x5, 0xc]}}) 2.770876541s ago: executing program 2 (id=5): r0 = socket$pppoe(0x18, 0x1, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000240)) 2.521938966s ago: executing program 2 (id=6): syz_mount_image$reiserfs(&(0x7f00000000c0), &(0x7f0000001140)='./file6\x00', 0x88b, &(0x7f0000000040), 0x1, 0x10ef, &(0x7f0000001180)="$eJzs2DGLE0EYBuB3dg/kqshcvx5oYSHHHfEPXKGQxsLaLljZmUrJz/HnyFX2R3pTBOyVTQwJEhDJYuB4Hlh252Vmvp1yvgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEDvLPlekosmqdusSVKSrrubLJJ02/zx17ZJydv3k9mrj+PXs8209FmT0q9aj+vN01rHdVxv6suL22d19unzh3avZEmX+9V8ev5mOehR+trtoDsCAADAw/DzaKMT1wcAAAD+ZrBGAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMAA6vajSVKSrrubLJJ0p/0tAAAA4EglTd6NDuWbNsDOi3wblZRHu+RH6edc58uB9QAAAMC/KXv38ec5z5O9/DJnubrajH+/srxN2iTXf+xzv5pP18/lfFr+5wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgF/swLEAAAAAgDB/6zQ6NgAAAAAAAAAAAAAAAGCqAAAA//9TGNII") mount(0x0, &(0x7f0000000240)='.\x00', 0x0, 0x2200020, 0x0) 2.384762889s ago: executing program 1 (id=7): syz_mount_image$erofs(&(0x7f0000000180), &(0x7f00000001c0)='./file1\x00', 0x40, &(0x7f0000003340)=ANY=[@ANYBLOB="00ea2eb34e7ea51c9446c55a2d1e0be39af9faf44ad59cb6ad1c94490d970e811439edddc71c9b18946b559ce53bee0a1abe562fc3f3898e5826eda1962cf6e3c4c0ade52151923a70b46eacfc1aaaebcf156e549e884bcabc1333f344f31cd30cd93cb2814e0dbc24a7a107e295e86e09283c825fe177c89c6385f68f2c843cffffffff15539bab6142ceed9265ba989d1a283fc4ffc83f3a7a6c746823e656ad78f3b5a336cdbd83dad59e0debb36b4ea5e658e253f01637cc03f704a08019f95b92fffffffff8dd21552d6967ab1b01e5d52a5793eb179deee4572770a5197127b090287bca2a4eaa1705b42c16968d0201d3ba3cc8000000657ea095f152b1b6a1e6ad8d24ad17f649ccc23d4ecbcdb5620cc48f95f563c2230f859d196e6c4f00b8e3a7b01fcb1d79dcc09b7a854ec8c31dd27ff9b4a2864e1dcaf719d20b56769d51228ecc1915fb8c8b598c11b3c296b05f9c5355fc6f19a7b28f5ae9a0d0804ccc5716cfac0246ddffa2f12077a02a959aa1b74373c38b2bcc90743b80666eae25dea73e127263b8fdbc64fe862b994ca8473d0000000000000000", @ANYRES16], 0x1, 0x17d, &(0x7f00000004c0)="$eJzsmD9P6lAYxp/TciH35iY6u2giCTBY2qJGBgdmB038FzeJVIIWMdBB2PwUzn4CZ+JC4sfQQZ1ccHNyqGl7gAP+HdTE+PyG9zzv6dvTc94mT5OCEPJrub15uD5LJS90AP+RRELO3+mDGk2pb489Zi4ry+cn5v1Vu7OUH11PAPD9jz8/BqBT0OHJ3PeH707KcQ1aX69DQ0bqTQgYUm9Dw4bUDgS2pN5TdC2oN4zdiusYOzW3FAgzCFYQ7CDkRvfXPRYoKfsTyvVGs7VfdF2n/oXivf51CxoWlf2p76vXG1PpnwUNltQ5CKxKvYBErzdRS5TzT8QG6+vffH4KCoqfJgb+5J8KpBR/iin+kfWqh9lGszVTqRbLTtk5sO3cvDlrmnN2NjSiKL7hf39Df/qnrP/nldq4iOOo6Hl1K4r93I7iS44bD/1PQ3o6yoWcUwm/B+NiKhjSuswJIYQQQgghhBBCCCHk05mECP+CDpF/NmWvhNVPAQAA//94vnZt") execveat(0xffffffffffffff9c, &(0x7f0000000240)='./file2\x00', 0x0, 0x0, 0x100) 1.685388544s ago: executing program 0 (id=10): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@newtaction={0xb8, 0x30, 0x9e54f29ff072a93b, 0x0, 0x25dfdbfc, {}, [{0xa4, 0x1, [@m_csum={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x0, 0xffffffff}}}]}, {0x4}, {0xc}, {0xc}}}, @m_nat={0x54, 0x2, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x19a, 0x8, 0x20000000, 0x2, 0x6}, @local, @broadcast, 0xffffff00, 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0xb8}}, 0x0) 1.432388479s ago: executing program 0 (id=11): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sysvipc/sem\x00', 0x0, 0x0) pread64(r0, &(0x7f0000000040)=""/59, 0x3b, 0x55) 1.363158031s ago: executing program 1 (id=12): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000340)={'batadv0\x00', &(0x7f0000000300)=@ethtool_sset_info={0x37, 0x0, 0xffffffffffffffff}}) 1.329753891s ago: executing program 3 (id=13): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000604000000002e"], 0x0, 0x37}, 0x20) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000340)={r0, 0x36, &(0x7f00000002c0)={0x0, 0x0, 0x0, &(0x7f00000003c0)=""/185, 0xb9}}, 0x7) 1.121686696s ago: executing program 2 (id=14): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000016c0)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001509000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000500)={0x24, &(0x7f0000000400)={0x20, 0xb, 0x9, {0x9, 0x5, "09c5d54682ae78"}}, 0x0, 0x0, 0x0}, 0x0) 1.121030696s ago: executing program 0 (id=15): r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, 0x0) 969.879739ms ago: executing program 3 (id=16): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000000340)=@newtaction={0x88c, 0x30, 0x12f, 0x0, 0x0, {}, [{0x878, 0x1, [@m_police={0x874, 0x1, 0x0, 0x0, {{0xb}, {0x848, 0x2, 0x0, 0x1, [[@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd143, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf76, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}], [@TCA_POLICE_RATE={0x404, 0x2, [0x10000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2df, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9636, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, {0x7, 0x0, 0x0, 0x0, 0x0, 0x7}, {0x7, 0x0, 0x0, 0x0, 0x0, 0x7}}}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa}}}]}]}, 0x88c}}, 0x0) 926.36652ms ago: executing program 1 (id=17): r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000040), 0x100, 0x0) fstat(r0, &(0x7f0000000180)) 847.311942ms ago: executing program 0 (id=18): syz_mount_image$vfat(&(0x7f0000001200), &(0x7f0000001040)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xa18c56, &(0x7f0000001280)=ANY=[@ANYBLOB='nfs,iocharset=cp863,flush,codepage=949,shortname=win95,nonumtail=0,utf8=1,uni_xlate=0,utf8=1,uni_xlate=1,rodir,usefree,\x00'/136], 0x7f, 0x2ba, &(0x7f0000006dc0)="$eJzs3c1qY2UYB/D/SZM2VaFZuBLBA7pwVWbmClqkwmBXSha60cHpgCRhoIXAjGI7K/eCK+/BnRfgBbjxDly4VNw5C/FIPk7TpulMI2lHht9vc56c933Oed+H0w8CefLZm4Pe/YdHD5589Wva7SKNnezkaZFOGqmdBAB4mTytqvxZTTxv7vq5V83Gda4LALg+V/77v3ZjSwIArtlHH3/ywe7+/t6HZdlOBt8Mu0Umx8n47oN8kX4Ocitb+TupTo3iRl67u7+XZlnWbwYMN9NNBp/+PH29+3syzr+drXTm8+t3FMqxvDM4HnZHdx4dW3mlSHarYjLlTrbyelK1Mr3I5PD+3f29O+XF/HTX8+7b30/X/89BtrOVXz7Pw/Rzf3yJWf7Xt8vyveq7v76c7KCbFMfD7sZ43kzlPyAAAAAAAAAAAAAAAAAAAAAAAFZmuzzVOds/p+4GuL09P97sJn8M6vxZf6CdjPsDTTv8HJ/pr3OrLMu6jc+w28qkv08zbzTTfFH7BgAAAAAAAAAAAAAAAAAAgP+To0ePe/f6/YPDc8FP1ShYe+ac+aB55kz9sf7nZy0Oej8ky2ddJUi9qX5x4RZFPbTEBX+8ZGhjmYVtLrppGpfVsNnPZPHfLl+Et5bd4NWDzmyp9dPVu1fktPIn0+qez2ovfkjOPHWb04sdHhVLPJDVgtKtXZq1vqIirL/6X9M3s2hotOPWaTHPZ7Xnitla8U/KnGK1v3gAAAAAAAAAAAAAAAAAAIALZh/6zW8XBp+8kCUBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwI2bff//o8e9nIyCdGZnFgfH0+TxmcazJ28cHi24beeGtwkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBL7t8AAAD//+KaTgk=") openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0xa1c3, 0x6) 711.223515ms ago: executing program 3 (id=19): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="18020000bcffffff00000000000000008500000041000000850000007d00000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffd}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0x2111, 0x300, &(0x7f0000000100), 0x0, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) 657.035366ms ago: executing program 1 (id=20): r0 = syz_open_dev$video4linux(&(0x7f0000000000), 0xffffffffffffffff, 0x88000) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r0, 0xc040564a, &(0x7f00000000c0)={0x0, 0x0, 0x1011, 0x0, 0x5, 0x4010c251, 0x6, 0x1}) 534.359158ms ago: executing program 3 (id=21): r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_int(r0, 0x0, 0x3, 0x0, &(0x7f0000000080)) 513.209379ms ago: executing program 0 (id=22): pipe2(&(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000300), 0x0, &(0x7f0000000880)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_fscache}, {@cachetag={'cachetag', 0x3d, '\x14\xe2\xc3\x11\xe2\xcb\x86\xc8-Hs\xc6\xafm\xdc{\xdeU#\xebp7-\x9f\xb8\xf3A\xb2CX\xd3//\xdd28+\x9dS\"\x9bm\x19\xd0K4a\xe6\xfb\xdb\xf7\xe4K\xb5\xc8\x94_\a\xe61\x91\xe4<@\xc37+\x9c\xb2\xe8E=T\xd5\xb1\'\xc3w\f\'\xd4\x97\xf8\xba\xe8\xa0\n\x8d\xc7\xc9\x7f\xa8\x1d\x88\xa3\x17\xca\xa5e\x7fYj\x82Z\xe9K\xa0T\\\x87u\x8coL\a|\xc8f^\x01\x04\xe4\x8e\x0f\xfe\x16\xa7G\xd4\xa1\xef\xc5\xa7k\x1dE\xb0\x9d!i\x99\\^\\]G?E+\xcd}\xf7i\xe2\xa2\x8dEW\xab\xdc\x8c\xe9Y\xb1\xc8\xc4\x97!\xbc\xf4\xef\xc9\x03v\xf3 \xb2\xc5\xd5\xf0$\xa0KD5\xf4\x9c\xe1\r\xc4\xa0\xd1\'\xadC\xb7Z\f[t\xd1\xadYk\x90v 1 [ 82.639807][ T5786] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 82.648804][ T5786] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 82.656516][ T5786] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 82.664419][ T5786] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 82.671853][ T5786] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 82.680374][ T5790] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 82.682781][ T5786] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 82.695604][ T5786] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 82.705660][ T5786] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 82.714531][ T5786] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 82.723006][ T5790] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 82.723353][ T5786] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 82.730722][ T5790] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 82.747369][ T5792] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 82.755227][ T5792] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 82.762644][ T5792] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 82.770005][ T5792] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 82.774689][ T5789] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 82.785613][ T5789] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 82.794933][ T5789] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 82.809879][ T5783] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 82.819851][ T5783] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 82.827394][ T5783] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 83.277438][ T5777] chnl_net:caif_netlink_parms(): no params data found [ 83.454059][ T5776] chnl_net:caif_netlink_parms(): no params data found [ 83.466164][ T5778] chnl_net:caif_netlink_parms(): no params data found [ 83.483200][ T5775] chnl_net:caif_netlink_parms(): no params data found [ 83.604598][ T5777] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.612660][ T5777] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.620102][ T5777] bridge_slave_0: entered allmulticast mode [ 83.628641][ T5777] bridge_slave_0: entered promiscuous mode [ 83.664970][ T5777] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.672134][ T5777] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.679583][ T5777] bridge_slave_1: entered allmulticast mode [ 83.687244][ T5777] bridge_slave_1: entered promiscuous mode [ 83.805556][ T5776] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.812816][ T5776] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.819987][ T5776] bridge_slave_0: entered allmulticast mode [ 83.830111][ T5776] bridge_slave_0: entered promiscuous mode [ 83.838021][ T5778] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.848179][ T5778] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.855477][ T5778] bridge_slave_0: entered allmulticast mode [ 83.862663][ T5778] bridge_slave_0: entered promiscuous mode [ 83.870504][ T5775] bridge0: port 1(bridge_slave_0) entered blocking state [ 83.880889][ T5775] bridge0: port 1(bridge_slave_0) entered disabled state [ 83.888304][ T5775] bridge_slave_0: entered allmulticast mode [ 83.896361][ T5775] bridge_slave_0: entered promiscuous mode [ 83.907625][ T5777] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 83.920024][ T5776] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.927340][ T5776] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.935504][ T5776] bridge_slave_1: entered allmulticast mode [ 83.942862][ T5776] bridge_slave_1: entered promiscuous mode [ 83.964363][ T5778] bridge0: port 2(bridge_slave_1) entered blocking state [ 83.971625][ T5778] bridge0: port 2(bridge_slave_1) entered disabled state [ 83.979019][ T5778] bridge_slave_1: entered allmulticast mode [ 83.986562][ T5778] bridge_slave_1: entered promiscuous mode [ 83.994223][ T5775] bridge0: port 2(bridge_slave_1) entered blocking state [ 84.001400][ T5775] bridge0: port 2(bridge_slave_1) entered disabled state [ 84.008930][ T5775] bridge_slave_1: entered allmulticast mode [ 84.016920][ T5775] bridge_slave_1: entered promiscuous mode [ 84.025700][ T5777] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.092423][ T5776] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.126761][ T5775] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.138345][ T5776] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.154069][ T5777] team0: Port device team_slave_0 added [ 84.164050][ T5778] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 84.175622][ T5775] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.211531][ T5777] team0: Port device team_slave_1 added [ 84.219587][ T5778] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 84.270584][ T5776] team0: Port device team_slave_0 added [ 84.291963][ T5775] team0: Port device team_slave_0 added [ 84.301910][ T5775] team0: Port device team_slave_1 added [ 84.319748][ T5776] team0: Port device team_slave_1 added [ 84.353032][ T5778] team0: Port device team_slave_0 added [ 84.360394][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.368429][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.394698][ T5777] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.408848][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.416067][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.443052][ T5777] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.485483][ T5778] team0: Port device team_slave_1 added [ 84.491998][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.499903][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.526225][ T5775] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.557715][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.568242][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.594606][ T5776] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.616665][ T5775] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.625373][ T5775] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.651867][ T5775] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.681532][ T5776] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.688974][ T5776] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.715435][ T5776] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.745215][ T5778] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 84.752265][ T5778] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.778491][ T5778] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 84.832909][ T5783] Bluetooth: hci1: command tx timeout [ 84.832983][ T5780] Bluetooth: hci0: command tx timeout [ 84.849939][ T5777] hsr_slave_0: entered promiscuous mode [ 84.856689][ T5777] hsr_slave_1: entered promiscuous mode [ 84.867619][ T5778] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 84.874870][ T5778] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 84.901174][ T5778] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 84.913254][ T5780] Bluetooth: hci3: command tx timeout [ 84.918910][ T5780] Bluetooth: hci2: command tx timeout [ 84.936773][ T5775] hsr_slave_0: entered promiscuous mode [ 84.943245][ T5775] hsr_slave_1: entered promiscuous mode [ 84.950194][ T5775] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 84.959275][ T5775] Cannot create hsr debugfs directory [ 85.040338][ T5776] hsr_slave_0: entered promiscuous mode [ 85.047436][ T5776] hsr_slave_1: entered promiscuous mode [ 85.054628][ T5776] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 85.062311][ T5776] Cannot create hsr debugfs directory [ 85.101106][ T5778] hsr_slave_0: entered promiscuous mode [ 85.108025][ T5778] hsr_slave_1: entered promiscuous mode [ 85.114659][ T5778] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 85.122401][ T5778] Cannot create hsr debugfs directory [ 85.572613][ T5775] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 85.591850][ T5775] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 85.602758][ T5775] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 85.613958][ T5775] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 85.683356][ T5777] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 85.699250][ T5777] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 85.709594][ T5777] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 85.721577][ T5777] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 85.824617][ T5778] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 85.846821][ T5778] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 85.878614][ T5778] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 85.888684][ T5778] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 85.965258][ T5776] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 85.978149][ T5776] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 86.000131][ T5776] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 86.028025][ T5776] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 86.090923][ T5775] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.126572][ T5777] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.189242][ T5775] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.208147][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.215632][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.234175][ T5777] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.259026][ T1087] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.266344][ T1087] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.298241][ T1087] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.305444][ T1087] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.338774][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.346021][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.384621][ T5778] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.430159][ T5778] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.472448][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.479676][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.501913][ T11] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.509141][ T11] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.580924][ T5776] 8021q: adding VLAN 0 to HW filter on device bond0 [ 86.656623][ T5776] 8021q: adding VLAN 0 to HW filter on device team0 [ 86.717577][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.725203][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 86.784853][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.792067][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 86.923910][ T5780] Bluetooth: hci1: command tx timeout [ 86.925322][ T5783] Bluetooth: hci0: command tx timeout [ 86.995080][ T5783] Bluetooth: hci3: command tx timeout [ 86.996236][ T5780] Bluetooth: hci2: command tx timeout [ 87.147127][ T5775] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.239230][ T5777] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.366831][ T5776] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.396761][ T5775] veth0_vlan: entered promiscuous mode [ 87.421796][ T5775] veth1_vlan: entered promiscuous mode [ 87.467959][ T5778] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 87.491429][ T5777] veth0_vlan: entered promiscuous mode [ 87.563332][ T5777] veth1_vlan: entered promiscuous mode [ 87.590141][ T5776] veth0_vlan: entered promiscuous mode [ 87.628062][ T5775] veth0_macvtap: entered promiscuous mode [ 87.665765][ T5775] veth1_macvtap: entered promiscuous mode [ 87.715056][ T5776] veth1_vlan: entered promiscuous mode [ 87.780910][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 87.791240][ T5777] veth0_macvtap: entered promiscuous mode [ 87.816142][ T5778] veth0_vlan: entered promiscuous mode [ 87.844963][ T5775] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 87.888437][ T5775] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.898661][ T5775] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.908364][ T5775] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.921729][ T5775] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 87.945240][ T5778] veth1_vlan: entered promiscuous mode [ 87.953869][ T5777] veth1_macvtap: entered promiscuous mode [ 87.977324][ T5776] veth0_macvtap: entered promiscuous mode [ 88.001719][ T5776] veth1_macvtap: entered promiscuous mode [ 88.098656][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.120553][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.141872][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.185986][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.200339][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.217744][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.230822][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.251165][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.261400][ T5776] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.272820][ T5776] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.284495][ T5776] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.310620][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.321524][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.331782][ T5777] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.343689][ T5777] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.357734][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.370635][ T5776] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.380605][ T5776] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.389790][ T5776] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.399462][ T5776] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.428271][ T5777] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.437527][ T1087] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.446292][ T1087] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.456731][ T5777] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.466182][ T5777] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.475381][ T5777] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.487733][ T5778] veth0_macvtap: entered promiscuous mode [ 88.532085][ T5778] veth1_macvtap: entered promiscuous mode [ 88.607603][ T79] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.623901][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.637774][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.654251][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.665226][ T79] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.675460][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.686474][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.697985][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.709753][ T5778] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.749179][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.760737][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.779012][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.789895][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.800272][ T5778] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.810847][ T5778] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.823836][ T5778] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.902733][ T1087] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.910626][ T1087] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.913704][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.933844][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.947548][ T5778] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.958807][ T5778] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.967998][ T5778] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.978268][ T5778] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.995040][ T5780] Bluetooth: hci1: command tx timeout [ 89.000521][ T5780] Bluetooth: hci0: command tx timeout [ 89.067981][ T1079] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.076987][ T5783] Bluetooth: hci3: command tx timeout [ 89.076989][ T5780] Bluetooth: hci2: command tx timeout [ 89.094933][ T1079] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.264509][ T1087] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.292924][ T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.300799][ T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.312335][ T1087] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.405367][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 89.445877][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 89.707608][ T5855] syz.2.6[5855]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 89.856464][ T5858] loop1: detected capacity change from 0 to 16 [ 89.885742][ T5858] ======================================================= [ 89.885742][ T5858] WARNING: The mand mount option has been deprecated and [ 89.885742][ T5858] and is ignored by this kernel. Remove the mand [ 89.885742][ T5858] option from the mount to silence this warning. [ 89.885742][ T5858] ======================================================= [ 89.974416][ T5855] loop2: detected capacity change from 0 to 8192 [ 90.000601][ T5858] erofs: (device loop1): mounted with root inode @ nid 36. [ 90.044570][ T5855] REISERFS warning: read_super_block: reiserfs filesystem is deprecated and scheduled to be removed from the kernel in 2025 [ 90.068139][ T5855] REISERFS (device loop2): found reiserfs format "3.6" with non-standard journal [ 90.070672][ T5858] process 'syz.1.7' launched './file2' with NULL argv: empty string added [ 90.079599][ T5855] REISERFS (device loop2): using ordered data mode [ 90.094101][ T5855] reiserfs: using flush barriers [ 90.108303][ T5855] REISERFS (device loop2): journal params: device loop2, size 512, journal first block 18, max trans len 256, max batch 225, max commit age 30, max trans age 30 [ 90.127302][ T5855] REISERFS (device loop2): checking transaction log (loop2) [ 90.190038][ T5780] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 0] out[9000] [ 90.231054][ T5858] erofs: (device loop1): z_erofs_lz4_decompress_mem: failed to decompress -26 in[46, 4050] out[8192] [ 90.327188][ T28] audit: type=1800 audit(1783114558.275:2): pid=5858 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.7" name="file2" dev="loop1" ino=89 res=0 errno=0 [ 90.346970][ T5862] loop3: detected capacity change from 0 to 4096 [ 90.443862][ T5855] REISERFS (device loop2): Using tea hash to sort names [ 90.560294][ T5862] ntfs3: loop3: Mark volume as dirty due to NTFS errors [ 90.636771][ T5858] syz.1.7 (5858) used greatest stack depth: 20952 bytes left [ 90.667600][ T5862] ntfs3: loop3: ino=9, ntfs_sync_fs failed, -22. [ 90.675089][ T5855] reiserfs: enabling write barrier flush mode [ 90.730263][ T5855] REISERFS (device loop2): Created .reiserfs_priv - reserved for xattr storage. [ 91.087991][ T5780] Bluetooth: hci1: command tx timeout [ 91.096956][ T5789] Bluetooth: hci0: command tx timeout [ 91.153300][ T5780] Bluetooth: hci3: command tx timeout [ 91.158819][ T5789] Bluetooth: hci2: command tx timeout [ 91.311389][ T5881] loop0: detected capacity change from 0 to 256 [ 91.686080][ T5891] ipip0: entered promiscuous mode [ 91.702811][ T5840] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 91.898857][ T5898] loop1: detected capacity change from 0 to 16 [ 91.910466][ T5840] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 91.932113][ T5840] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 91.957306][ T5840] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 91.983332][ T5898] erofs: (device loop1): mounted with root inode @ nid 36. [ 92.021338][ T5840] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 92.049962][ T5898] syz.1.24: attempt to access beyond end of device [ 92.049962][ T5898] loop1: rw=524288, sector=8, nr_sectors = 16 limit=16 [ 92.062475][ T5840] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 92.094106][ T5898] syz.1.24: attempt to access beyond end of device [ 92.094106][ T5898] loop1: rw=524288, sector=16, nr_sectors = 40 limit=16 [ 92.137486][ T5840] usb 3-1: config 0 descriptor?? [ 92.138345][ T5898] ================================================================== [ 92.150806][ T5898] BUG: KASAN: slab-use-after-free in z_erofs_transform_plain+0x3ab/0x4a0 [ 92.159334][ T5898] Read of size 4096 at addr ffff888023e39000 by task syz.1.24/5898 [ 92.167286][ T5898] [ 92.169674][ T5898] CPU: 1 PID: 5898 Comm: syz.1.24 Not tainted syzkaller #0 [ 92.176961][ T5898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 92.187179][ T5898] Call Trace: [ 92.190508][ T5898] [ 92.193486][ T5898] dump_stack_lvl+0x18c/0x250 [ 92.198264][ T5898] ? __lock_acquire+0x7d80/0x7d80 [ 92.203341][ T5898] ? show_regs_print_info+0x20/0x20 [ 92.208598][ T5898] ? load_image+0x420/0x420 [ 92.213157][ T5898] ? _raw_spin_lock_irqsave+0xc0/0x100 [ 92.215834][ T5840] hub 3-1:0.0: USB hub found [ 92.218649][ T5898] ? __virt_addr_valid+0x10c/0x380 [ 92.218679][ T5898] ? __virt_addr_valid+0x10c/0x380 [ 92.218704][ T5898] ? __virt_addr_valid+0x10c/0x380 [ 92.218736][ T5898] ? __virt_addr_valid+0x10c/0x380 [ 92.244099][ T5898] print_report+0xa8/0x210 [ 92.248594][ T5898] ? z_erofs_transform_plain+0x3ab/0x4a0 [ 92.254283][ T5898] kasan_report+0x117/0x150 [ 92.258844][ T5898] ? z_erofs_transform_plain+0x3ab/0x4a0 [ 92.264540][ T5898] kasan_check_range+0x241/0x290 [ 92.269711][ T5898] ? z_erofs_transform_plain+0x3ab/0x4a0 [ 92.275403][ T5898] __asan_memcpy+0x29/0x70 [ 92.279880][ T5898] z_erofs_transform_plain+0x3ab/0x4a0 [ 92.285410][ T5898] ? z_erofs_lz4_decompress+0x1800/0x1800 [ 92.291189][ T5898] z_erofs_decompress_queue+0x1705/0x2670 [ 92.296995][ T5898] ? z_erofs_onlinepage_end+0x360/0x360 [ 92.302605][ T5898] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 92.308637][ T5898] ? lock_chain_count+0x20/0x20 [ 92.313556][ T5898] ? z_erofs_decompressqueue_endio+0x540/0x540 [ 92.319771][ T5898] ? erofs_map_blocks+0x17b0/0x17b0 [ 92.325036][ T5898] ? folio_unlock+0x118/0x2f0 [ 92.329759][ T5898] z_erofs_runqueue+0x1993/0x1b20 [ 92.334860][ T5898] ? z_erofs_do_read_page+0x3500/0x3500 [ 92.340471][ T5898] ? __lock_acquire+0x7d80/0x7d80 [ 92.345562][ T5898] ? put_page+0xea/0x260 [ 92.349857][ T5898] ? z_erofs_pcluster_readmore+0x3a7/0x460 [ 92.355725][ T5898] z_erofs_read_folio+0x321/0x5c0 [ 92.360817][ T5898] ? z_erofs_rcu_callback+0x1b0/0x1b0 [ 92.366266][ T5898] ? up_read+0x20/0x20 [ 92.370390][ T5898] ? __might_sleep+0xe0/0xe0 [ 92.375037][ T5898] ? filemap_add_folio+0x190/0x3d0 [ 92.380202][ T5898] filemap_read_folio+0x16b/0x790 [ 92.385277][ T5898] ? z_erofs_rcu_callback+0x1b0/0x1b0 [ 92.390804][ T5898] ? maybe_unlock_mmap_for_io+0xf0/0xf0 [ 92.396429][ T5898] ? down_read+0x1ac/0x2e0 [ 92.400896][ T5898] filemap_get_pages+0x13ac/0x1f10 [ 92.406063][ T5898] ? is_bpf_text_address+0x28f/0x2a0 [ 92.411422][ T5898] ? kernel_text_address+0xa0/0xd0 [ 92.416616][ T5898] ? filemap_read+0xf20/0xf20 [ 92.421346][ T5898] ? __might_sleep+0xe0/0xe0 [ 92.425997][ T5898] ? folio_mark_accessed+0x203/0x14a0 [ 92.431433][ T5898] ? folio_activate_fn+0x2000/0x2000 [ 92.436781][ T5898] filemap_read+0x409/0xf20 [ 92.441385][ T5898] ? filemap_get_folios_tag+0x840/0x840 [ 92.447007][ T5898] ? generic_file_read_iter+0x9b/0x550 [ 92.452537][ T5898] ? iov_iter_kvec+0xd4/0x1b0 [ 92.457273][ T5898] __kernel_read+0x2e5/0x730 [ 92.461930][ T5898] ? rw_verify_area+0x1b0/0x1b0 [ 92.466860][ T5898] integrity_kernel_read+0x8a/0xd0 [ 92.472047][ T5898] ? integrity_inode_free+0x170/0x170 [ 92.477491][ T5898] ? _sha256_update+0x127/0x1e0 [ 92.482407][ T5898] ? sha256_transform_avx+0xcc0/0xcc0 [ 92.487840][ T5898] ima_calc_file_hash+0xb1f/0x1960 [ 92.493039][ T5898] ? deref_stack_reg+0x1ab/0x230 [ 92.498032][ T5898] ? is_bpf_text_address+0x26/0x2a0 [ 92.503282][ T5898] ? look_up_lock_class+0x75/0x140 [ 92.508458][ T5898] ? ima_alloc_tfm+0x2f0/0x2f0 [ 92.513281][ T5898] ? register_lock_class+0xc4/0x8a0 [ 92.518569][ T5898] ? erofs_init_inode_xattrs+0x2eb/0xb50 [ 92.524272][ T5898] ? generic_fillattr+0x2b5/0x690 [ 92.529356][ T5898] ? __asan_memcpy+0x40/0x70 [ 92.534016][ T5898] ? generic_fillattr+0x451/0x690 [ 92.539097][ T5898] ima_collect_measurement+0x4d4/0xa30 [ 92.544618][ T5898] ? ima_get_action+0xb0/0xb0 [ 92.549349][ T5898] ? erofs_getxattr+0x13f/0x450 [ 92.554268][ T5898] ? rcu_is_watching+0x15/0xb0 [ 92.559101][ T5898] ? ima_get_hash_algo+0x91/0x4a0 [ 92.564183][ T5898] ? ima_get_cache_status+0xd0/0xd0 [ 92.569440][ T5898] process_measurement+0x123a/0x1d50 [ 92.574875][ T5898] ? ima_file_mmap+0x1d0/0x1d0 [ 92.579688][ T5898] ? tomoyo_check_open_permission+0x384/0x460 [ 92.585813][ T5898] ? tomoyo_check_open_permission+0x1cf/0x460 [ 92.591943][ T5898] ? tomoyo_check_path_number_acl+0x280/0x280 [ 92.598066][ T5898] ? get_cached_acl+0x4fb/0x540 [ 92.603011][ T5898] ? apparmor_current_getsecid_subj+0xb5/0x120 [ 92.609219][ T5898] ima_file_check+0xcc/0x110 [ 92.613859][ T5898] ? ima_bprm_check+0x200/0x200 [ 92.618763][ T5898] path_openat+0x2910/0x3270 [ 92.623420][ T5898] ? do_filp_open+0x430/0x430 [ 92.628150][ T5898] do_filp_open+0x1f2/0x430 [ 92.632703][ T5898] ? vfs_tmpfile+0x480/0x480 [ 92.637381][ T5898] ? _raw_spin_unlock+0x28/0x40 [ 92.642311][ T5898] ? alloc_fd+0x590/0x640 [ 92.646705][ T5898] do_sys_openat2+0x134/0x1d0 [ 92.651447][ T5898] ? do_sys_open+0xe0/0xe0 [ 92.654544][ T5901] loop3: detected capacity change from 0 to 4096 [ 92.655898][ T5898] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 92.655931][ T5898] ? lock_chain_count+0x20/0x20 [ 92.673237][ T5898] __x64_sys_openat+0x139/0x160 [ 92.678152][ T5898] do_syscall_64+0x55/0xb0 [ 92.682637][ T5898] ? clear_bhb_loop+0x40/0x90 [ 92.687360][ T5898] ? clear_bhb_loop+0x40/0x90 [ 92.692090][ T5898] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 92.698053][ T5898] RIP: 0033:0x7fcf11b9de59 [ 92.702509][ T5898] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.722166][ T5898] RSP: 002b:00007fcf1298a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 92.730630][ T5898] RAX: ffffffffffffffda RBX: 00007fcf11e25fa0 RCX: 00007fcf11b9de59 [ 92.738645][ T5898] RDX: 0000000000080000 RSI: 0000200000000100 RDI: ffffffffffffff9c [ 92.746668][ T5898] RBP: 00007fcf11c33e6f R08: 0000000000000000 R09: 0000000000000000 [ 92.754682][ T5898] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 92.762704][ T5898] R13: 00007fcf11e26038 R14: 00007fcf11e25fa0 R15: 00007ffe4d119e08 [ 92.770737][ T5898] [ 92.772910][ T5901] ntfs3: loop3: Different NTFS sector size (1024) and media sector size (512). [ 92.773777][ T5898] [ 92.773784][ T5898] Allocated by task 5779: [ 92.773794][ T5898] kasan_set_track+0x4e/0x70 [ 92.794144][ T5898] __kasan_slab_alloc+0x6c/0x80 [ 92.799050][ T5898] slab_post_alloc_hook+0x6a/0x4d0 [ 92.804222][ T5898] kmem_cache_alloc+0x17e/0x2c0 [ 92.809166][ T5898] security_file_alloc+0x34/0x120 [ 92.814240][ T5898] init_file+0x94/0x1f0 [ 92.818446][ T5898] alloc_empty_file+0xb7/0x1d0 [ 92.823270][ T5898] path_openat+0x120/0x3270 [ 92.827850][ T5898] do_filp_open+0x1f2/0x430 [ 92.832411][ T5898] do_sys_openat2+0x134/0x1d0 [ 92.837133][ T5898] __x64_sys_openat+0x139/0x160 [ 92.842037][ T5898] do_syscall_64+0x55/0xb0 [ 92.846506][ T5898] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 92.852482][ T5898] [ 92.854834][ T5898] Freed by task 5779: [ 92.858854][ T5898] kasan_set_track+0x4e/0x70 [ 92.863583][ T5898] kasan_save_free_info+0x28/0x40 [ 92.868651][ T5898] ____kasan_slab_free+0x126/0x1f0 [ 92.870824][ T5840] hub 3-1:0.0: 9 ports detected [ 92.873795][ T5898] slab_free_freelist_hook+0x130/0x1a0 [ 92.873819][ T5898] kmem_cache_free+0xf8/0x290 [ 92.873847][ T5898] __fput+0x5eb/0x930 [ 92.873869][ T5898] __se_sys_close+0x15c/0x1e0 [ 92.873893][ T5898] do_syscall_64+0x55/0xb0 [ 92.873923][ T5898] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 92.873952][ T5898] [ 92.873957][ T5898] The buggy address belongs to the object at ffff888023e39000 [ 92.873957][ T5898] which belongs to the cache lsm_file_cache of size 88 [ 92.924712][ T5898] The buggy address is located 0 bytes inside of [ 92.924712][ T5898] freed 88-byte region [ffff888023e39000, ffff888023e39058) [ 92.938280][ T5898] [ 92.940657][ T5898] The buggy address belongs to the physical page: [ 92.947102][ T5898] page:ffffea00008f8e40 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888023e39168 pfn:0x23e39 [ 92.958590][ T5898] flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff) [ 92.966162][ T5898] page_type: 0xffffffff() [ 92.970534][ T5898] raw: 00fff00000000800 ffff888019e5c280 ffffea0000b75000 0000000000000004 [ 92.979180][ T5898] raw: ffff888023e39168 0000000080220006 00000001ffffffff 0000000000000000 [ 92.987789][ T5898] page dumped because: kasan: bad access detected [ 92.994245][ T5898] page_owner tracks the page as allocated [ 92.999979][ T5898] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 5689, tgid 5689 (sed), ts 71854500382, free_ts 59387395684 [ 93.017553][ T5898] post_alloc_hook+0x1c1/0x200 [ 93.022380][ T5898] get_page_from_freelist+0x2181/0x22a0 [ 93.027948][ T5898] __alloc_pages+0x1f0/0x460 [ 93.032558][ T5898] alloc_slab_page+0x5d/0x180 [ 93.037256][ T5898] new_slab+0x87/0x2d0 [ 93.041349][ T5898] ___slab_alloc+0xc5c/0x12f0 [ 93.046097][ T5898] kmem_cache_alloc+0x109/0x2c0 [ 93.050975][ T5898] security_file_alloc+0x34/0x120 [ 93.056020][ T5898] init_file+0x94/0x1f0 [ 93.060205][ T5898] alloc_empty_file+0xb7/0x1d0 [ 93.064998][ T5898] path_openat+0x120/0x3270 [ 93.069527][ T5898] do_filp_open+0x1f2/0x430 [ 93.074054][ T5898] do_sys_openat2+0x134/0x1d0 [ 93.078773][ T5898] __x64_sys_openat+0x139/0x160 [ 93.083657][ T5898] do_syscall_64+0x55/0xb0 [ 93.088101][ T5898] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 93.094031][ T5898] page last free stack trace: [ 93.098744][ T5898] free_unref_page_prepare+0x7d7/0x8f0 [ 93.104237][ T5898] free_unref_page+0x32/0x2e0 [ 93.108946][ T5898] __unfreeze_partials+0x1cf/0x210 [ 93.114077][ T5898] put_cpu_partial+0x17c/0x250 [ 93.118864][ T5898] __slab_free+0x319/0x400 [ 93.123296][ T5898] qlist_free_all+0x75/0xd0 [ 93.127831][ T5898] kasan_quarantine_reduce+0x143/0x160 [ 93.133324][ T5898] __kasan_slab_alloc+0x22/0x80 [ 93.138195][ T5898] slab_post_alloc_hook+0x6a/0x4d0 [ 93.143329][ T5898] kmem_cache_alloc_node+0x1af/0x310 [ 93.148641][ T5898] dup_task_struct+0x57/0x7b0 [ 93.153353][ T5898] copy_process+0x5a6/0x3df0 [ 93.157968][ T5898] kernel_clone+0x24b/0x8a0 [ 93.162534][ T5898] __x64_sys_clone+0x1b7/0x230 [ 93.167317][ T5898] do_syscall_64+0x55/0xb0 [ 93.171774][ T5898] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 93.177697][ T5898] [ 93.180037][ T5898] Memory state around the buggy address: [ 93.185681][ T5898] ffff888023e38f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 93.193759][ T5898] ffff888023e38f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 93.201836][ T5898] >ffff888023e39000: fa fb fb fb fb fb fb fb fb fb fb fc fc fc fc fa [ 93.209918][ T5898] ^ [ 93.214004][ T5898] ffff888023e39080: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fb fb [ 93.222084][ T5898] ffff888023e39100: fb fb fb fb fb fb fb fb fb fc fc fc fc fb fb fb [ 93.230160][ T5898] ================================================================== [ 93.278275][ T27] cfg80211: failed to load regulatory.db [ 93.349011][ T5840] hub 3-1:0.0: insufficient power available to use all downstream ports [ 93.367983][ T5898] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 93.375254][ T5898] CPU: 1 PID: 5898 Comm: syz.1.24 Not tainted syzkaller #0 [ 93.382498][ T5898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 93.392774][ T5898] Call Trace: [ 93.396101][ T5898] [ 93.399066][ T5898] dump_stack_lvl+0x18c/0x250 [ 93.403808][ T5898] ? show_regs_print_info+0x20/0x20 [ 93.409062][ T5898] ? load_image+0x420/0x420 [ 93.409189][ T5840] hub 3-1:0.0: hub_hub_status failed (err = -71) [ 93.409255][ T5840] hub 3-1:0.0: config failed, can't get hub status (err -71) [ 93.427339][ T5898] panic+0x2ca/0x720 [ 93.431294][ T5898] ? bpf_jit_dump+0xd0/0xd0 [ 93.435867][ T5898] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 93.441900][ T5898] ? _raw_spin_unlock+0x40/0x40 [ 93.446800][ T5898] ? print_memory_metadata+0x314/0x400 [ 93.452314][ T5898] ? z_erofs_transform_plain+0x3ab/0x4a0 [ 93.458019][ T5898] check_panic_on_warn+0x84/0xa0 [ 93.463006][ T5898] ? z_erofs_transform_plain+0x3ab/0x4a0 [ 93.468688][ T5898] end_report+0x6f/0x130 [ 93.472982][ T5898] kasan_report+0x128/0x150 [ 93.477529][ T5898] ? z_erofs_transform_plain+0x3ab/0x4a0 [ 93.483223][ T5898] kasan_check_range+0x241/0x290 [ 93.488213][ T5898] ? z_erofs_transform_plain+0x3ab/0x4a0 [ 93.493905][ T5898] __asan_memcpy+0x29/0x70 [ 93.498372][ T5898] z_erofs_transform_plain+0x3ab/0x4a0 [ 93.500567][ T5840] usb 3-1: USB disconnect, device number 2 [ 93.509708][ T5898] ? z_erofs_lz4_decompress+0x1800/0x1800 [ 93.515490][ T5898] z_erofs_decompress_queue+0x1705/0x2670 [ 93.521282][ T5898] ? z_erofs_onlinepage_end+0x360/0x360 [ 93.526879][ T5898] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 93.532907][ T5898] ? lock_chain_count+0x20/0x20 [ 93.537820][ T5898] ? z_erofs_decompressqueue_endio+0x540/0x540 [ 93.544033][ T5898] ? erofs_map_blocks+0x17b0/0x17b0 [ 93.549287][ T5898] ? folio_unlock+0x118/0x2f0 [ 93.554013][ T5898] z_erofs_runqueue+0x1993/0x1b20 [ 93.559106][ T5898] ? z_erofs_do_read_page+0x3500/0x3500 [ 93.564718][ T5898] ? __lock_acquire+0x7d80/0x7d80 [ 93.569810][ T5898] ? put_page+0xea/0x260 [ 93.574107][ T5898] ? z_erofs_pcluster_readmore+0x3a7/0x460 [ 93.579980][ T5898] z_erofs_read_folio+0x321/0x5c0 [ 93.585062][ T5898] ? z_erofs_rcu_callback+0x1b0/0x1b0 [ 93.590494][ T5898] ? up_read+0x20/0x20 [ 93.594610][ T5898] ? __might_sleep+0xe0/0xe0 [ 93.599253][ T5898] ? filemap_add_folio+0x190/0x3d0 [ 93.604411][ T5898] filemap_read_folio+0x16b/0x790 [ 93.609484][ T5898] ? z_erofs_rcu_callback+0x1b0/0x1b0 [ 93.614911][ T5898] ? maybe_unlock_mmap_for_io+0xf0/0xf0 [ 93.620510][ T5898] ? down_read+0x1ac/0x2e0 [ 93.624973][ T5898] filemap_get_pages+0x13ac/0x1f10 [ 93.630130][ T5898] ? is_bpf_text_address+0x28f/0x2a0 [ 93.635479][ T5898] ? kernel_text_address+0xa0/0xd0 [ 93.640656][ T5898] ? filemap_read+0xf20/0xf20 [ 93.645393][ T5898] ? __might_sleep+0xe0/0xe0 [ 93.650028][ T5898] ? folio_mark_accessed+0x203/0x14a0 [ 93.655450][ T5898] ? folio_activate_fn+0x2000/0x2000 [ 93.660782][ T5898] filemap_read+0x409/0xf20 [ 93.665341][ T5898] ? filemap_get_folios_tag+0x840/0x840 [ 93.670937][ T5898] ? generic_file_read_iter+0x9b/0x550 [ 93.676444][ T5898] ? iov_iter_kvec+0xd4/0x1b0 [ 93.681180][ T5898] __kernel_read+0x2e5/0x730 [ 93.685829][ T5898] ? rw_verify_area+0x1b0/0x1b0 [ 93.690742][ T5898] integrity_kernel_read+0x8a/0xd0 [ 93.696079][ T5898] ? integrity_inode_free+0x170/0x170 [ 93.701504][ T5898] ? _sha256_update+0x127/0x1e0 [ 93.706402][ T5898] ? sha256_transform_avx+0xcc0/0xcc0 [ 93.711817][ T5898] ima_calc_file_hash+0xb1f/0x1960 [ 93.716983][ T5898] ? deref_stack_reg+0x1ab/0x230 [ 93.721961][ T5898] ? is_bpf_text_address+0x26/0x2a0 [ 93.727200][ T5898] ? look_up_lock_class+0x75/0x140 [ 93.732361][ T5898] ? ima_alloc_tfm+0x2f0/0x2f0 [ 93.737166][ T5898] ? register_lock_class+0xc4/0x8a0 [ 93.742435][ T5898] ? erofs_init_inode_xattrs+0x2eb/0xb50 [ 93.748125][ T5898] ? generic_fillattr+0x2b5/0x690 [ 93.753200][ T5898] ? __asan_memcpy+0x40/0x70 [ 93.757840][ T5898] ? generic_fillattr+0x451/0x690 [ 93.762921][ T5898] ima_collect_measurement+0x4d4/0xa30 [ 93.768432][ T5898] ? ima_get_action+0xb0/0xb0 [ 93.773150][ T5898] ? erofs_getxattr+0x13f/0x450 [ 93.778060][ T5898] ? rcu_is_watching+0x15/0xb0 [ 93.782883][ T5898] ? ima_get_hash_algo+0x91/0x4a0 [ 93.787957][ T5898] ? ima_get_cache_status+0xd0/0xd0 [ 93.793205][ T5898] process_measurement+0x123a/0x1d50 [ 93.798546][ T5898] ? ima_file_mmap+0x1d0/0x1d0 [ 93.803356][ T5898] ? tomoyo_check_open_permission+0x384/0x460 [ 93.809487][ T5898] ? tomoyo_check_open_permission+0x1cf/0x460 [ 93.815599][ T5898] ? tomoyo_check_path_number_acl+0x280/0x280 [ 93.821713][ T5898] ? get_cached_acl+0x4fb/0x540 [ 93.826634][ T5898] ? apparmor_current_getsecid_subj+0xb5/0x120 [ 93.832875][ T5898] ima_file_check+0xcc/0x110 [ 93.837509][ T5898] ? ima_bprm_check+0x200/0x200 [ 93.842407][ T5898] path_openat+0x2910/0x3270 [ 93.847059][ T5898] ? do_filp_open+0x430/0x430 [ 93.851787][ T5898] do_filp_open+0x1f2/0x430 [ 93.856361][ T5898] ? vfs_tmpfile+0x480/0x480 [ 93.861009][ T5898] ? _raw_spin_unlock+0x28/0x40 [ 93.865917][ T5898] ? alloc_fd+0x590/0x640 [ 93.870305][ T5898] do_sys_openat2+0x134/0x1d0 [ 93.875037][ T5898] ? do_sys_open+0xe0/0xe0 [ 93.879500][ T5898] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 93.885533][ T5898] ? lock_chain_count+0x20/0x20 [ 93.890436][ T5898] __x64_sys_openat+0x139/0x160 [ 93.895347][ T5898] do_syscall_64+0x55/0xb0 [ 93.899827][ T5898] ? clear_bhb_loop+0x40/0x90 [ 93.904540][ T5898] ? clear_bhb_loop+0x40/0x90 [ 93.909257][ T5898] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 93.915217][ T5898] RIP: 0033:0x7fcf11b9de59 [ 93.919679][ T5898] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 93.939342][ T5898] RSP: 002b:00007fcf1298a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 93.947819][ T5898] RAX: ffffffffffffffda RBX: 00007fcf11e25fa0 RCX: 00007fcf11b9de59 [ 93.955838][ T5898] RDX: 0000000000080000 RSI: 0000200000000100 RDI: ffffffffffffff9c [ 93.963853][ T5898] RBP: 00007fcf11c33e6f R08: 0000000000000000 R09: 0000000000000000 [ 93.972073][ T5898] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.980088][ T5898] R13: 00007fcf11e26038 R14: 00007fcf11e25fa0 R15: 00007ffe4d119e08 [ 93.988095][ T5898] [ 93.991713][ T5898] Kernel Offset: disabled [ 93.996052][ T5898] Rebooting in 86400 seconds..