last executing test programs: 4m39.905431936s ago: executing program 3 (id=1260): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)={0x38, r1, 0x11, 0x0, 0x0, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_TAGLST={0x14, 0x4, 0x0, 0x1, [{0x5, 0x3, 0x80}, {0x5, 0x3, 0x7}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x3}]}, 0x38}}, 0x2000c110) 4m39.444899163s ago: executing program 3 (id=1272): r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0xc, &(0x7f0000000e00)=0x5, 0x4) sendmsg$nl_generic(r0, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f0000000ec0)=ANY=[@ANYBLOB="140000001a00"], 0x14}}, 0x8000) 4m38.541148224s ago: executing program 3 (id=1274): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) rt_sigprocmask(0x2, &(0x7f00000001c0)={[0x5]}, &(0x7f0000000240), 0x8) 4m37.644118545s ago: executing program 3 (id=1281): syz_mount_image$ext4(&(0x7f00000008c0)='ext4\x00', &(0x7f0000000900)='./file0\x00', 0x1000410, &(0x7f0000000940)={[{@grpid}, {@grpquota}]}, 0x4, 0x4eb, &(0x7f0000000980)="$eJzs3c9vVFsdAPDvnXZoKQMFZaFGBRFFQ5j+ABqCC2GjMYTESFy5gNoOTdMZpum0SCuLsnRvIokr/RPcuTBh5cKdO925wYUJKnkv9CVvMS/3zqUd2g7te7Qd6Hw+ye2955xhvufMcM6Ze2B6AuhZZyNiNSKORMS9iBjO85P8iButI33cq5ePp9ZePp5Kotm8878kK0/zou3PpI7lzzkYET/7ccQvk61xG8src5PVamUhT48s1uZHGssrl2YLec74xNjE6LXLV8f3rK1nan968aPZWz//y5+/8fzvq9//dVqt0m+OZ2Xt7dhLraYXo9SW1x8Rt/YjWJf0539/+PCkve1LEXEu6//D0Ze9mwDAYdZsDkdzuD0NABx26f1/KZJCOV8LKEWhUC631vBOx1ChWm8sXhyuLz2YjmwN62QUC/dnq5XRfK3wZBSTND2WXW+kxzelL0fEqYj47cDRLF2eqlenu/nBBwB62LFN8//HA635HwA45Aa7XQEA4MCZ/wGg95j/AaD3fI7537cDAeCQcP8PAL3H/A8AvWfH+f/JwdQDADgQP719Oz2aa/nvv55+uLz0g9LDS9OVxly5tjRVnqovzJdn6vWZaqU81Wzu9HzVen1+7Mp6srG8crdWX3qweHe2NjlTuVsp7nN7AICdnTrz7J9JRKxeP5od0baXg7kaDrdCtysAdE1ftysAdI3v80Dv2sU9vmUAOOS22aL3DR3/i9BTm7/Ch+rCV63/Q6+y/g+964ut//9wz+sBHDzr/9C7ms3Env8A0GOs8QPv9O//AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0KNK2ZEUytle4Kvpz0K5HHE8Ik5GMbk/W62MRsSJiPjHQHEgTY91u9IAwDsq/CfJ9/+6MHy+tLn0SPLJQHaOiF/9/s7vHk0uLi6Mpfn/X89ffJrnjx/pRgMAgHY3tma15un83HYj/+rl46nXx0FW8cXN1uaiady1/GiV9Ed/dh6MYkQMfZTk6Zb080rfHsRffRIRX9lo/6O2CKVsDaS18+nm+Gns4/sQf+P13xy/8Eb8QlaWnovZa/HlPagL9JpnN1vjZN730i6W979CnM3O2/f/wWyEenevx7+1LeNfYX3869sSP8n6/Nn19Ntr8uLKX3+yJbM53Cp7EvG1/u3iJ+vxkw7j7/ldtvFfX//muU5lzT9EXIjt47fUsmF2ZLE2P9JYXrk0W5ucqcxUHoyPT4xNjF67fHV8JFujbv3823Yx/nv94olO8dP2D3WIP7hD+7+zy/b/8dN7v/jWW+J/79vbv/+n3xI/nRO/u8v4k0M3Om7fncaf7tD+nd7/i7uM//zfK9O7fCgAcAAayytzk9VqZWGHi/Sz5k6PcfFhXsRqxHtQDRfv1UW3RyZgv210+m7XBAAAAAAAAAAAAAAA6KSxvDI3EPv7daJutxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIDD67MAAAD//w/PzvM=") socket$nl_generic(0x10, 0x3, 0x10) symlinkat(0x0, 0xffffffffffffff9c, 0x0) sendmsg$SMC_PNETID_ADD(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16, @ANYBLOB="05000000000000000000020100000900010073797a3000000000070011006c6f0000070003"], 0x30}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./proc\x00', 0x4) mount(0x0, &(0x7f0000000640)='./proc\x00', &(0x7f0000000680)='proc\x00', 0x4000, 0x0) r0 = inotify_init1(0x80000) inotify_add_watch(r0, &(0x7f0000000740)='.\x00', 0x1000401) r1 = openat(0xffffffffffffff9c, &(0x7f0000000780)='.\x00', 0x0, 0x0) fchown(r1, 0xee00, 0xee01) 4m36.614491039s ago: executing program 3 (id=1288): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) syz_mount_image$iso9660(&(0x7f00000000c0), &(0x7f0000000340)='./bus\x00', 0x800040, &(0x7f0000000380)=ANY=[], 0x1, 0x577, &(0x7f00000006c0)="$eJzs3W9v09YewPGfS6vm5koI3XuFUG+Bs8KkInXFSSAo4pHnnKQeiR3ZDmqfDFW0RRUBJNgk6BPUB2P/tdewp3sR017F3gXaO1gnHzuQtvnT9V8q9v1EYMc+Pud3HMu/uo2PBQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiOVWbbtgScPz28tqMLcaBs0h67v13dg1GdKuiJX8k1xOLqWLLv3v/eqLyX9zMpu+m5VcMsnJ1r8vXrj738mJ7vZDAjoVL15tPV7tdNafjzuQManrexIFXtOpa+VFgaqUy/bNpVqkal5DRytRrJvKDbUTB6Gad2+oQqVSUnpxJWj79arT0N2Fdz4p2nZZfZVPP2//5meLkbvkNRqeXzdlktVJmTvJgXjPi1WsnaZSG5ud9dKg4LazwyMpVBjVk6RQcVShol0sFgrFYqF8u3L7jm1P7ltg7yH7Soz/oMV4HefpGziSiSz/S0M88aUty6L6vlypSiiBNAesz3Tz/8c39dB2e/N/N8tfer96Rkz+v5K+uzIo/w+I5W+/ppPqs/k/d3Z2DrDN+f+nsb2SLXksq9KRjqzL8+OK6BhfXSdRd120+OJJJIF40hTHLFHZEiUVKUtZbHkgS1KTSJTUxJOGaIlkRSKJRZsjypVQtDjyvQQSipJ5ceWGKClIRSpSEiVaFmVFAmmLL3WpimNq2ZBNs99Lw/rfLVQ4SKHikELkfxzdcZ26gSPb6eZ/AAAAAADwwbLMb9+T6/8puWzmctLQ9rjDAgAAAAAAx8j85X82mUwlc5fFqnlc/wMAAAAA8GGxzD12lojk5Wo6170Til8CAAAAAADwgTB//7+STMzYa1fFOtD1/9SpBQgAAAAAAI7sm0Fj7P9mllqWRK1p69c/JAynrO3W8nXriZOscJ6cS7c7t7fGuDZjnc8qMZPyZPbO1bNWNvrlu0Ew32aTjZ44rH5j/Vp7Avi8W0OfAH6S/gHID/JR2q1u2bXumrSVf2WLG3cL4jjnJ2K9HH/5dPOlmO5/6zcnswIPn3XWTCzbybvtJ1mF+8ZRHLwz5Asz3oK556Lv6MZT5kaMrN28JRubnXW79wOYSDefGNqmXEgXpm2+kbn07Vw20n5+d/9zSZuFxUG9r5sopkXE9Nw6ZM/fyLW0zLX5a+mkTxTFvlFMJTGn+6LYWr6+k+7/CTnQvjhEFKWB+yKLotR7FBwiCgAYl43BWei7nXTN3sR/iLPcxqgn+ezN7of58ULeyHxaZn7GnFgnZ/qc0e1RZ3T7iHn9l33PQBqUY5N2f3zXbsG0+3MStwxsN2oULclJ7uXv75etPlp/tP60WCyV7Vu2fbsoU6Yb2YTcAwDoY/QzdkaWsG6Zq+pk5Vpacs9V9X/efaVgUR7KM+nImiyYuw3MNw761prv+RrCwoir1nzPE14WRlzV5Xse9HLwsqXT+TAAADglcyPy8EHy/8KI6+7duXz41XFvLgcAACdDh2+tfPy1FYZe60GhUik48ZJWYeDeU6FXrWvl+bEO3SXHr2vVCoM4cINGMnPfq+pIRe1WKwhjVQtC1Qoib9k8+V1lj36PdNPxY8+NWg3tRFq5gR87bqyqXuSqVvvThhct6dBsHLW069U814m9wFdR0A5dvahUpHVPQa+q/direcmsr1qh13TCFXU/aLSbWlV15IZeKw7SCrtteX4tCJum2sVx72wAAM6IF6+2Hq92OuvPT3Bm3H0EAAC7kaUBAAAAAAAAAAAAAAAAAAAAADj7hty359SO90bAaTmFew2PKdSzEcY/dea1iGRLdl5L72HTHXT6xFo/N+6+n5mZMZ+YAJy4vwIAAP//NVpGnw==") prlimit64(0x0, 0xe, &(0x7f0000000c40)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000c80)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000cc0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000d00)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000d40)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000dc0), 0x651, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f00000003c0)={0x0, 0x38, &(0x7f0000000400)=[@in6={0xa, 0x4e22, 0x3, @remote, 0x40}, @in6={0xa, 0x4e22, 0x0, @private1, 0x80000001}]}, &(0x7f0000000440)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r5, 0x84, 0x1d, &(0x7f0000000480)={0x1, [0x0]}, &(0x7f00000004c0)=0x8) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r5, 0x84, 0x10, &(0x7f0000000500)=@sack_info={r6, 0x4, 0x800003}, 0xc) recvmmsg(r3, &(0x7f0000000e00), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000e40)=0x6) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000ec0)={&(0x7f0000000f00)=@ipv4_newrule={0x34, 0x20, 0x1, 0x70bd2b, 0x25dfdbfc, {0x2, 0x20, 0x20, 0x0, 0x3, 0x0, 0x0, 0x8, 0x10007}, [@FRA_GENERIC_POLICY=@FRA_IP_PROTO={0x5, 0x16, 0x5c}, @FRA_DST={0x8, 0x1, @multicast2}, @FRA_SRC={0x8, 0x2, @initdev={0xac, 0x1e, 0x1, 0x0}}]}, 0x34}}, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r8, 0x6, 0xe, 0x0, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r8, 0x6, 0x13, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, 0x0) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, 0x0, 0x800) openat(0xffffffffffffff9c, &(0x7f0000001180)='./file1\x00', 0x242, 0x40) sendmsg$nl_route_sched(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000850}, 0xc0) 4m34.124691491s ago: executing program 3 (id=1301): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_NEW(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x20, 0x0, 0x7, 0x401, 0x0, 0x0, {0x2}, [@NFACCT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}}, 0x0) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2f0, 0xffffffff, 0xa8, 0xa8, 0x0, 0xffffffff, 0xffffffff, 0x258, 0x258, 0x258, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast1, @empty, 0xffffff00, 0xff, 'veth0_virt_wifi\x00', 'vlan0\x00', {0xff}, {}, 0x1, 0x2, 0x20}, 0x0, 0x70, 0xa8, 0x1ba, {0x46010000, 0x2c000000000000}}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x0, 0x3}, {0xffffffffffffffff}, {0xffffffffffffffff}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'team_slave_0\x00', 'team0\x00', {0xff}, {}, 0x62, 0x3, 0xc}, 0x287, 0xb8, 0x118, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz0\x00', 0x3}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x3, 0x2, 0x0, 0x4], 0x1, 0x3}, {0x0, [0x6, 0x5, 0x6, 0x0, 0x5], 0x1, 0x2}}}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x350) getrlimit(0xd, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) sendto$inet(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x20000800, 0x0, 0x0) mmap(&(0x7f00004ad000/0x1000)=nil, 0x1000, 0xa, 0x2010, r2, 0xbe9f9000) 4m33.852421469s ago: executing program 32 (id=1301): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_NEW(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)={0x20, 0x0, 0x7, 0x401, 0x0, 0x0, {0x2}, [@NFACCT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}}, 0x0) r4 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2f0, 0xffffffff, 0xa8, 0xa8, 0x0, 0xffffffff, 0xffffffff, 0x258, 0x258, 0x258, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast1, @empty, 0xffffff00, 0xff, 'veth0_virt_wifi\x00', 'vlan0\x00', {0xff}, {}, 0x1, 0x2, 0x20}, 0x0, 0x70, 0xa8, 0x1ba, {0x46010000, 0x2c000000000000}}, @common=@inet=@SET3={0x38, 'SET\x00', 0x3, {{0x0, 0x3}, {0xffffffffffffffff}, {0xffffffffffffffff}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'team_slave_0\x00', 'team0\x00', {0xff}, {}, 0x62, 0x3, 0xc}, 0x287, 0xb8, 0x118, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz0\x00', 0x3}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x3, 0x2, 0x0, 0x4], 0x1, 0x3}, {0x0, [0x6, 0x5, 0x6, 0x0, 0x5], 0x1, 0x2}}}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xffffffff}}}}, 0x350) getrlimit(0xd, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) sendto$inet(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x20000800, 0x0, 0x0) mmap(&(0x7f00004ad000/0x1000)=nil, 0x1000, 0xa, 0x2010, r2, 0xbe9f9000) 7.425470307s ago: executing program 4 (id=3297): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f00000000c0)) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="f5af25bd7000000000000e20000008000300"], 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x700) 7.248945605s ago: executing program 4 (id=3300): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$netlink(0x10, 0x3, 0x0) r0 = openat$nci(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000300), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000340)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x4008054) socket(0x1e, 0x4, 0x0) 6.998159841s ago: executing program 0 (id=3303): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_generic(0x10, 0x3, 0x10) epoll_create1(0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) close(0x4) sendmmsg(r0, &(0x7f0000000340), 0x222874f4405e5c0, 0x40840) 6.840907047s ago: executing program 0 (id=3306): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000540)=@filter={'filter\x00', 0xe, 0x2, 0x300, [0x0, 0x200000000000, 0x200000000030, 0x200000000280], 0x0, 0x0, &(0x7f0000000000)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{0x9, 0x4, 0x8100, 'veth1_macvtap\x00', 'veth0_virt_wifi\x00', 'macvtap0\x00', 'pimreg\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x44}, [0x0, 0xff, 0x0, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff], 0x0, 0xa0, 0xa0, 0x1d0, [@vlan={{'vlan\x00', 0x0, 0x8}, {{0x1, 0xb, 0x8864, 0x6, 0x1}}}], [], @common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0x9, 'system_u:object_r:dhcpd_var_run_t:s0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{0x5, 0x7, 0x17, 'veth0\x00', 'ip_vti0\x00', 'pimreg0\x00', 'xfrm0\x00', @remote, [0x0, 0xff, 0xff], @local, [0x0, 0xff, 0xff, 0x0, 0xff, 0xff], 0x0, 0x70, 0x70, 0xa0, [], [], @common=@CLASSIFY={'CLASSIFY\x00', 0x8, {{0x6}}}}]}]}, 0x378) 6.743070586s ago: executing program 0 (id=3309): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000340)={0x1c, r1, 0x5, 0x0, 0x3, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x8041}, 0x0) 4.056387319s ago: executing program 0 (id=3311): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000140)='nv', 0x2) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000280)=0x1, 0x4) sendto$inet6(r0, &(0x7f00000002c0)='D', 0x1, 0x2800c044, 0x0, 0x0) 4.030991671s ago: executing program 4 (id=3313): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x60, 0x41, 0x1, 0x0, 0x0, {0x3, 0x1}, [@generic="0f000000", @typed={0x3e, 0x1, 0x0, 0x0, @binary="00112233845500000000aabb86dd2c00001c00002c0001110000010101010253aa58fe6cbdf0357065ae44132403b1fd606412c3258e2c0d0514"}, @nested={0x4, 0x8002}, @nested={0x4, 0x8003}]}, 0x60}}, 0x0) 3.874640167s ago: executing program 2 (id=3316): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="68000000100001040000000000000000000000000000000001000000000000000f00030073797a6b616c6c6572300000340012800a00010076786c616e00000024000280080001000100000008000200e0010101080003000100000005"], 0x68}}, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000040)=ANY=[], 0x0) 3.825493922s ago: executing program 0 (id=3317): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x7101}) r1 = socket$kcm(0x11, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) close(r2) r3 = socket(0x400000000010, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000140)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffff9, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xfffe, 0xa93}}}]}, 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000280)={'syzkaller0\x00', @multicast}) socket$unix(0x1, 0x1, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000e80)={&(0x7f0000000ec0)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd2b, 0x25dfdc00, {0x0, 0x0, 0x0, 0x0, {0xffff, 0x3}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x54, 0x2, [@TCA_MATCHALL_ACT={0x50, 0x2, [@m_vlan={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x2, 0x8, 0x5, 0x2, 0x80}, 0x4}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x4040800}, 0x44000) sendmsg$kcm(r1, &(0x7f0000000f80)={&(0x7f0000000fc0)=@xdp={0x2c, 0x7, 0x0, 0x3e}, 0x80, &(0x7f0000001040)=[{&(0x7f0000001080)="03", 0xe}], 0x1}, 0x20004014) 3.825372812s ago: executing program 4 (id=3318): r0 = socket$inet6(0x10, 0x2, 0x0) write(r0, &(0x7f0000000000)="fc0000001c000705ab092509b86813000aab080102000000b85b0e93210001c0f0060848050000b80000000000039815fa2c53c28648000000b937799f377a00bc000c00f0036cdf0db400600033d44000040060b16a482c0a3c313012dafd5a32e2731c83ab82d710f74cec18444ef90d475ef8b2863ef3d92c94170e5bba2e177312e081f691bc5110556888100000463ae4f5df1b394cfde89d334b2b6af2a8d03f2329622943283f4b9e611183b102b2b8f5566791802e07f050cae2015180a94a27b1d7b02d3f4e84f2013cd1890058a10000c880ac801fe4af00004995c7a596dae744f0d4794eedfca92c09d776e7a90ab79a6f00a1960000", 0xfc) 3.690805746s ago: executing program 5 (id=3320): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000540)=@filter={'filter\x00', 0xe, 0x2, 0x300, [0x0, 0x200000000000, 0x200000000030, 0x200000000280], 0x0, 0x0, &(0x7f0000000000)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffe, 0x1, [{0x9, 0x4, 0x8100, 'veth1_macvtap\x00', 'veth0_virt_wifi\x00', 'macvtap0\x00', 'pimreg\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x44}, [0x0, 0xff, 0x0, 0xff, 0xff, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0xff, 0x0, 0xff, 0x0, 0xff], 0x0, 0xa0, 0xa0, 0x1d0, [@vlan={{'vlan\x00', 0x0, 0x8}, {{0x1, 0xb, 0x8864, 0x6, 0x1}}}], [], @common=@SECMARK={'SECMARK\x00', 0x108, {{0x1, 0x9, 'system_u:object_r:dhcpd_var_run_t:s0\x00'}}}}]}, {0x0, '\x00', 0x1, 0xfffffffffffffffe, 0x1, [{0x5, 0x7, 0x17, 'veth0\x00', 'ip_vti0\x00', 'pimreg0\x00', 'xfrm0\x00', @remote, [0x0, 0xff, 0xff], @local, [0x0, 0xff, 0xff, 0x0, 0xff, 0xff], 0x0, 0x70, 0x70, 0xa0, [], [], @common=@CLASSIFY={'CLASSIFY\x00', 0x8, {{0x6}}}}]}]}, 0x378) 3.560059439s ago: executing program 5 (id=3321): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003580)={0x20, 0x24, 0x107, 0x70bd2e, 0x25dfdbfb, {0x2, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x2, 0x0, 0x0, @u32=0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x4008090) 3.311520434s ago: executing program 5 (id=3323): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x1000, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x0, 0x8}, {0xc, 0xb}, {0x7, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x200000c0}, 0x2000c080) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r8) socket$unix(0x1, 0x5, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 3.25112054s ago: executing program 2 (id=3324): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$netlink(0x10, 0x3, 0x0) r0 = openat$nci(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000300), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000340)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x4008054) write$nci(r0, &(0x7f0000000440)=ANY=[@ANYBLOB="5001", @ANYRES8=r1, @ANYRES16], 0x14) 3.211216094s ago: executing program 4 (id=3325): openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r1, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x3, 0xae0, 0x6361, 0x5, 0xffffffff, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x4, 0x7fffffffffffffff, 0x0, 0x1000, 0xc, 0x215}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r2) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {0x0, 0x8}, {0xc, 0xb}, {0x7, 0xffe0}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x200000c0}, 0x2000c080) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r5) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) 3.210705784s ago: executing program 1 (id=3326): r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 3.079444327s ago: executing program 1 (id=3327): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000140)='nv', 0x2) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000280)=0x1, 0x4) sendto$inet6(r0, &(0x7f00000002c0)='D', 0x1, 0x2800c044, 0x0, 0x0) 2.973573539s ago: executing program 1 (id=3328): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="18000000260001031dbd7002fadbdf25010000200400ae"], 0x18}, 0x1, 0x0, 0x0, 0x850}, 0x0) socket$inet(0x2, 0x5, 0x0) recvmsg(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000cc0)=[{&(0x7f0000000dc0)=""/244, 0xf4}, {&(0x7f0000000f00)=""/4132, 0x1024}, {&(0x7f0000001f40)=""/112, 0x70}, {&(0x7f0000001fc0)=""/4094, 0xffe}, {&(0x7f0000002fc0)=""/179, 0xb3}, {&(0x7f0000003080)=""/119, 0x77}, {&(0x7f0000003180)=""/4086, 0xff6}, {&(0x7f0000004180)=""/246, 0xf6}, {&(0x7f0000004280)=""/142, 0x8e}, {&(0x7f0000004340)=""/29, 0x1d}, {&(0x7f0000004380)=""/243, 0xf3}, {&(0x7f0000004480)=""/158, 0x9e}], 0xc}, 0x10082) 2.890553207s ago: executing program 1 (id=3329): syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000740)={0xa, 0x4e22, 0x8, @empty, 0x2}, 0x1c) listen(r1, 0xc) syz_emit_ethernet(0x36, &(0x7f0000000940)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1a}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x67, 0x0, 0x2, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xc2}}}}}}, 0x0) 2.865492109s ago: executing program 2 (id=3330): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_QUEUE_NUM={0x6}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xa}}}, 0xd4}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)={0x28, 0x2, 0x3, 0x1, 0x0, 0x0, {}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1}}, @NFQA_CFG_PARAMS={0x9, 0x2, {0xffff, 0x2}}]}, 0x28}}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000bc0)={@broadcast, @dev, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x18, 0x3a, 0x0, @remote, @mcast2, {[], @mld={0x83, 0x0, 0x0, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x2}}}}}}}, 0x0) sendmsg$NFQNL_MSG_VERDICT(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x54, 0x1, 0x3, 0x1, 0x0, 0x0, {0xa}, [@NFQA_VERDICT_HDR={0xc, 0x2, {0x1, 0x1}}, @NFQA_PAYLOAD={0x34, 0xa, "6000000000080040fe8000000000000000000000000000aafe8000000000000000000000000000bb0000010400000000"}]}, 0x54}}, 0x0) 2.767912939s ago: executing program 5 (id=3331): socket$inet6(0xa, 0x80003, 0x6) socket$kcm(0x2b, 0x1, 0x0) setns(0xc9, 0x0) socket$kcm(0x10, 0x2, 0x4) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) bind$x25(r2, &(0x7f0000000100), 0x12) listen(r2, 0x1) write$tun(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="000008050000010b007e0b0a42b820a8e8c9881db642", @ANYRES8, @ANYRES64=r1], 0x97) 2.589510707s ago: executing program 1 (id=3332): setsockopt$bt_l2cap_L2CAP_CONNINFO(0xffffffffffffffff, 0x6, 0x2, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) close(r1) r2 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff5653f, 0x70bd2d, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x0, 0x9}, {0xffff, 0xffff}, {0x1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x81}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24000000) ioctl$SIOCPNGETOBJECT(0xffffffffffffffff, 0x89e0, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000200)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000240)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newtfilter={0x40, 0x2c, 0xd27, 0x70bd25, 0x2, {0x0, 0x0, 0x0, r5, {0x0, 0x10}, {}, {0x8, 0xffe0}}, [@filter_kind_options=@f_matchall={{0xd}, {0xc, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0xf, 0xf}}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x4894}, 0x2) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000340), 0x56) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f00000003c0)=@xdp={0x2c, 0x0, r5, 0x42}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000540)="27030200dc0f14000e0007000024c1020000ff3207c2fb7fe0406e52534b4f6b3d00000000000000892f3c35d5a8", 0x2e}], 0x1}, 0x0) 2.527726433s ago: executing program 2 (id=3333): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0xa, 0x4, 0x4, 0x12, 0x18d6, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xfffffffc, 0x2}, 0x48) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000080)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f00000000c0)={@val, @void, @eth={@multicast, @remote, @void, {@ipv4={0x800, @generic={{0x5, 0x4, 0x1, 0x9, 0x63, 0x65, 0x0, 0x1, 0x32, 0x0, @dev={0xac, 0x14, 0x14, 0x2d}, @rand_addr=0x64010102}, "b1903e5c0e154f00104d980859f75d0043e894ffa2c2a759face5a21139dd257a10d0310e84dc640369a55b56da4ad44941179082162b77f640f57fdf20ab6d9e1000000000000007fa09d6e4b3fc8"}}}}}, 0x75) r3 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r3, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0) getsockopt$inet6_tcp_buf(r0, 0x6, 0x21, 0x0, 0x0) 246.080015ms ago: executing program 0 (id=3334): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000880), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000008c0)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000940)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000a00)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000000780)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b927, 0x25dfdc01, {0x0, 0x0, 0x0, r2, {0x0, 0x10}, {0x1, 0xb}, {0xffff, 0xa}}, [@qdisc_kind_options=@q_codel={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x240448a4}, 0x0) 181.664281ms ago: executing program 5 (id=3335): bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x2, 0x4, &(0x7f00000000c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x34c57}]}, &(0x7f0000000100)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0x39, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) 181.473341ms ago: executing program 2 (id=3336): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000f80), r0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000fc0)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r0, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000001080)={0x1c, r1, 0x303, 0x4000, 0x25dfdbfb, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4c0c0}, 0x4004010) 146.760464ms ago: executing program 1 (id=3337): recvmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x5e, &(0x7f0000000140)=[{0x0}], 0x1}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000740)=@getqdisc={0x24, 0x26, 0x10, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0x1, 0x5}, {0x10, 0xd}, {0x3, 0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x4000001}, 0x20044081) r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'lo\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000006c0)=@newqdisc={0x60, 0x24, 0xd0f, 0x70bd29, 0x0, {0x60, 0x0, 0x0, r2, {0x0, 0x8}, {0xffff, 0xffff}}, [@TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xe, 0x4, 0x7, 0x4, 0x2, 0x6, 0x6}}, {0x4}}]}, @qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_MEMORY={0x8, 0xa, 0x6}]}}]}, 0x60}, 0x1, 0x0, 0x0, 0x80d1}, 0x34008088) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 136.094776ms ago: executing program 4 (id=3338): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="7400000040000901feffffff00000000017c0000040042800c00018006000600800a0000500002804a00178046"], 0x74}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) 16.801888ms ago: executing program 5 (id=3339): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x82c03, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) close(r1) r2 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40004}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f00000002c0)={'syzkaller0\x00', @multicast}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={'syzkaller0\x00', 0x0}) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)=@newtfilter={0x88, 0x2c, 0xd3f, 0x10bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xc, 0x1}, {}, {0x8, 0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x58, 0x2, [@TCA_BASIC_ACT={0x54, 0x3, [@m_mirred={0x50, 0x1, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x20000007, 0x4, 0x58c66743fee8f43f, 0xb, 0xdc}, 0x1, r3}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x10}, 0x8080) setsockopt$sock_attach_bpf(r6, 0x107, 0xf, &(0x7f0000000480), 0x56) sendmsg$kcm(r6, &(0x7f00000004c0)={&(0x7f0000000500)=@xdp={0x2c, 0x0, r5, 0x42}, 0x80, &(0x7f0000000580)=[{&(0x7f00000005c0)="27030200dc0f14000e0003000024c1020000ff1107c2fb7fe0400018534b4f6b3d327db412f40000000000000000", 0x2e}], 0x1}, 0x4005) 0s ago: executing program 2 (id=3340): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) socket$netlink(0x10, 0x3, 0x0) r0 = openat$nci(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000300), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f0000000340)=0x0) sendmsg$NFC_CMD_DEV_UP(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="010426bd7000f8dbdf250200000008000100", @ANYRES32=r3], 0x1c}}, 0x4008054) write$nci(r0, &(0x7f0000000440)=ANY=[@ANYBLOB="5001", @ANYRES8=r1, @ANYRES16], 0x14) kernel console output (not intermixed with test programs): ftover after parsing attributes in process `syz.2.1601'. [ 235.379243][ T8494] loop5: detected capacity change from 0 to 164 [ 236.225875][ T8489] device lo entered promiscuous mode [ 236.284182][ T8489] device tunl0 entered promiscuous mode [ 236.303274][ T8489] device gre0 entered promiscuous mode [ 236.344666][ T8489] device gretap0 entered promiscuous mode [ 236.361962][ T8489] device erspan0 entered promiscuous mode [ 236.381709][ T8489] device ip_vti0 entered promiscuous mode [ 236.392445][ T8489] device ip6_vti0 entered promiscuous mode [ 236.406696][ T8489] device sit0 entered promiscuous mode [ 236.449078][ T8489] device ip6tnl0 entered promiscuous mode [ 236.464628][ T8489] device ip6gre0 entered promiscuous mode [ 236.477662][ T8489] device ip6gretap0 entered promiscuous mode [ 236.492552][ T8489] device bridge0 entered promiscuous mode [ 236.503159][ T8489] device vcan0 entered promiscuous mode [ 236.513965][ T8489] device bond0 entered promiscuous mode [ 236.528737][ T8489] device team0 entered promiscuous mode [ 236.538281][ T8489] device dummy0 entered promiscuous mode [ 236.552031][ T8489] device nlmon0 entered promiscuous mode [ 236.561813][ T8489] device caif0 entered promiscuous mode [ 236.567554][ T8489] device macvtap1 entered promiscuous mode [ 236.573833][ T8500] netlink: 'syz.5.1597': attribute type 16 has an invalid length. [ 236.581731][ T8500] netlink: 'syz.5.1597': attribute type 17 has an invalid length. [ 236.589673][ T8500] device lo left promiscuous mode [ 236.596472][ T8500] device tunl0 left promiscuous mode [ 236.603005][ T8500] device gre0 left promiscuous mode [ 236.611269][ T8500] device gretap0 left promiscuous mode [ 236.618172][ T8500] device erspan0 left promiscuous mode [ 236.625189][ T8500] device ip_vti0 left promiscuous mode [ 236.631808][ T8500] device ip6_vti0 left promiscuous mode [ 236.638693][ T8500] device sit0 left promiscuous mode [ 236.648006][ T8500] device ip6tnl0 left promiscuous mode [ 236.654865][ T8500] device ip6gre0 left promiscuous mode [ 236.661971][ T8500] device syz_tun left promiscuous mode [ 236.669963][ T8500] device ip6gretap0 left promiscuous mode [ 236.677426][ T8500] device bridge0 left promiscuous mode [ 236.683984][ T8500] device vcan0 left promiscuous mode [ 236.689838][ T8500] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 236.697376][ T8500] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 236.704904][ T8500] device bond0 left promiscuous mode [ 236.711674][ T8500] 8021q: adding VLAN 0 to HW filter on device bond0 [ 236.719050][ T8500] device team0 left promiscuous mode [ 236.725211][ T8500] 8021q: adding VLAN 0 to HW filter on device team0 [ 236.732809][ T8500] device dummy0 left promiscuous mode [ 236.739584][ T8500] device nlmon0 left promiscuous mode [ 236.754203][ T8500] device caif0 left promiscuous mode [ 236.759610][ T8500] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 238.056332][ T8518] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1605'. [ 238.512311][ T8532] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1609'. [ 239.107976][ T8541] loop1: detected capacity change from 0 to 512 [ 239.539815][ T8541] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 239.670159][ T8541] ext4 filesystem being mounted at /300/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 239.846326][ T8554] netlink: 64 bytes leftover after parsing attributes in process `syz.5.1615'. [ 239.933793][ T4281] EXT4-fs (loop1): unmounting filesystem. [ 241.530536][ T8595] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1627'. [ 242.395742][ T8618] loop1: detected capacity change from 0 to 1024 [ 242.479190][ T8618] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 242.506414][ T8618] EXT4-fs (loop1): barriers disabled [ 242.517479][ T8618] JBD2: no valid journal superblock found [ 242.524557][ T8618] EXT4-fs (loop1): error loading journal [ 242.581082][ T8006] I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 243.811821][ T8646] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1649'. [ 245.044303][ T8664] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1656'. [ 245.233257][ T8671] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1660'. [ 245.707482][ T8695] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1669'. [ 245.985649][ T27] audit: type=1326 audit(1793097405.044:98): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8696 comm="syz.5.1670" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f72ea59f559 code=0x7ffc0000 [ 246.171932][ T27] audit: type=1326 audit(1793097405.124:99): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8696 comm="syz.5.1670" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f72ea59f559 code=0x7ffc0000 [ 246.196075][ T27] audit: type=1326 audit(1793097405.144:100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8696 comm="syz.5.1670" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f72ea59f559 code=0x7ffc0000 [ 246.220383][ T27] audit: type=1326 audit(1793097405.144:101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8696 comm="syz.5.1670" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=83 compat=0 ip=0x7f72ea59f559 code=0x7ffc0000 [ 246.249340][ T27] audit: type=1326 audit(1793097405.184:102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8696 comm="syz.5.1670" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f72ea59f559 code=0x7ffc0000 [ 246.331045][ T27] audit: type=1326 audit(1793097405.194:103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8696 comm="syz.5.1670" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f72ea59f559 code=0x7ffc0000 [ 246.434224][ T27] audit: type=1326 audit(1793097405.204:104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8696 comm="syz.5.1670" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f72ea59f559 code=0x7ffc0000 [ 246.530375][ T27] audit: type=1326 audit(1793097405.214:105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8696 comm="syz.5.1670" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f72ea59f559 code=0x7ffc0000 [ 246.609666][ T27] audit: type=1326 audit(1793097405.214:106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8696 comm="syz.5.1670" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=303 compat=0 ip=0x7f72ea59f559 code=0x7ffc0000 [ 246.700307][ T27] audit: type=1326 audit(1793097405.234:107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8696 comm="syz.5.1670" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f72ea59f559 code=0x7ffc0000 [ 247.845861][ T8738] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1685'. [ 247.854826][ T8739] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1689'. [ 247.900949][ T8736] netlink: 'syz.1.1687': attribute type 9 has an invalid length. [ 249.056424][ T8768] netlink: 1363 bytes leftover after parsing attributes in process `syz.4.1697'. [ 251.647454][ T8791] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 251.653614][ T8791] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 251.659664][ T8791] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 251.665762][ T8791] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 251.672861][ T8791] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 251.678882][ T8791] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 251.697064][ T8791] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 252.205643][ T8832] netlink: 56 bytes leftover after parsing attributes in process `syz.0.1725'. [ 252.256596][ T8834] loop1: detected capacity change from 0 to 512 [ 252.291204][ T8834] EXT4-fs: Ignoring removed nobh option [ 252.326796][ T8834] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 252.338206][ T8834] ext4 filesystem being mounted at /321/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 252.362518][ T8834] EXT4-fs error (device loop1): ext4_do_update_inode:5279: inode #2: comm syz.1.1726: corrupted inode contents [ 252.400710][ T8834] EXT4-fs error (device loop1): ext4_dirty_inode:6166: inode #2: comm syz.1.1726: mark_inode_dirty error [ 252.414676][ T8834] EXT4-fs error (device loop1): ext4_do_update_inode:5279: inode #2: comm syz.1.1726: corrupted inode contents [ 252.436980][ T8834] EXT4-fs error (device loop1): __ext4_ext_dirty:202: inode #2: comm syz.1.1726: mark_inode_dirty error [ 252.546338][ T8842] netlink: 1363 bytes leftover after parsing attributes in process `syz.5.1729'. [ 252.568582][ T4281] EXT4-fs (loop1): unmounting filesystem. [ 254.070272][ T4289] Bluetooth: hci4: command 0x0c1a tx timeout [ 254.076379][ T4289] Bluetooth: hci3: command 0x0c1a tx timeout [ 254.082740][ T4282] Bluetooth: hci2: command 0x0c1a tx timeout [ 254.088759][ T4282] Bluetooth: hci1: command 0x0c1a tx timeout [ 254.106863][ T4282] Bluetooth: hci0: command 0x0c1a tx timeout [ 255.155632][ T8885] TC_ACT_REPEAT abuse ? [ 255.622746][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.629344][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.188606][ T4277] Bluetooth: hci4: command 0x0406 tx timeout [ 256.309902][ T8916] netlink: 56 bytes leftover after parsing attributes in process `syz.1.1759'. [ 258.076859][ T9002] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1792'. [ 258.278340][ T4277] Bluetooth: hci4: command 0x0406 tx timeout [ 258.377783][ T9014] fuse: Bad value for 'fd' [ 263.418639][ T9081] netlink: 'syz.5.1823': attribute type 9 has an invalid length. [ 263.475719][ T9081] netlink: 463 bytes leftover after parsing attributes in process `syz.5.1823'. [ 264.648171][ T9110] loop5: detected capacity change from 0 to 512 [ 264.694161][ T9110] EXT4-fs error (device loop5): ext4_orphan_get:1409: inode #15: comm syz.5.1836: iget: bad extended attribute block 134217728 [ 264.720622][ T9110] EXT4-fs error (device loop5): ext4_orphan_get:1414: comm syz.5.1836: couldn't read orphan inode 15 (err -117) [ 264.733409][ T9110] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 264.781553][ T7732] EXT4-fs (loop5): unmounting filesystem. [ 266.054581][ T9155] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1851'. [ 266.711233][ T9165] device gtp0 entered promiscuous mode [ 266.970885][ T9175] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1860'. [ 267.010429][ T9175] FAULT_INJECTION: forcing a failure. [ 267.010429][ T9175] name failslab, interval 1, probability 0, space 0, times 0 [ 267.069352][ T9175] CPU: 0 PID: 9175 Comm: syz.2.1860 Not tainted syzkaller #0 [ 267.076806][ T9175] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 267.086887][ T9175] Call Trace: [ 267.090180][ T9175] [ 267.093122][ T9175] dump_stack_lvl+0x188/0x24e [ 267.097828][ T9175] ? show_regs_print_info+0x12/0x12 [ 267.103063][ T9175] ? load_image+0x410/0x410 [ 267.107599][ T9175] ? __might_sleep+0xd0/0xd0 [ 267.112222][ T9175] ? __lock_acquire+0x7ea0/0x7ea0 [ 267.117292][ T9175] ? lock_chain_count+0x20/0x20 [ 267.122183][ T9175] should_fail_ex+0x390/0x4c0 [ 267.126901][ T9175] should_failslab+0x5/0x20 [ 267.131426][ T9175] slab_pre_alloc_hook+0x59/0x300 [ 267.136472][ T9175] ? nla_strdup+0x94/0x130 [ 267.140908][ T9175] __kmem_cache_alloc_node+0x4f/0x270 [ 267.146320][ T9175] ? nla_strdup+0x94/0x130 [ 267.150766][ T9175] __kmalloc+0xa3/0x240 [ 267.154952][ T9175] nla_strdup+0x94/0x130 [ 267.159225][ T9175] nf_tables_newobj+0xc55/0x1430 [ 267.164217][ T9175] ? nf_tables_getgen+0x220/0x220 [ 267.169276][ T9175] ? __nla_parse+0x3c/0x50 [ 267.173811][ T9175] nfnetlink_rcv+0x1119/0x2470 [ 267.178628][ T9175] ? nfnetlink_net_exit_batch+0xa0/0xa0 [ 267.184217][ T9175] ? lock_chain_count+0x20/0x20 [ 267.189125][ T9175] ? netlink_deliver_tap+0x2e/0x1b0 [ 267.194363][ T9175] ? net_generic+0x1e/0x240 [ 267.198995][ T9175] ? netlink_deliver_tap+0x2e/0x1b0 [ 267.204228][ T9175] netlink_unicast+0x7ad/0x920 [ 267.209043][ T9175] netlink_sendmsg+0x8ad/0xbd0 [ 267.213850][ T9175] ? netlink_getsockopt+0x550/0x550 [ 267.219087][ T9175] ? apparmor_socket_sendmsg+0x8a/0x330 [ 267.224667][ T9175] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 267.230000][ T9175] ? security_socket_sendmsg+0x7c/0xa0 [ 267.235486][ T9175] ? netlink_getsockopt+0x550/0x550 [ 267.240732][ T9175] ____sys_sendmsg+0x5ed/0x9a0 [ 267.245542][ T9175] ? __sys_sendmsg_sock+0x30/0x30 [ 267.250608][ T9175] ? __import_iovec+0x306/0x510 [ 267.255506][ T9175] ? import_iovec+0x6f/0xa0 [ 267.260059][ T9175] ___sys_sendmsg+0x2a2/0x360 [ 267.264779][ T9175] ? __sys_sendmsg+0x2a0/0x2a0 [ 267.269629][ T9175] __se_sys_sendmsg+0x1c3/0x2b0 [ 267.274523][ T9175] ? __x64_sys_sendmsg+0x80/0x80 [ 267.279523][ T9175] ? lockdep_hardirqs_on+0x94/0x140 [ 267.284781][ T9175] do_syscall_64+0x4c/0xa0 [ 267.289225][ T9175] ? clear_bhb_loop+0x60/0xb0 [ 267.293930][ T9175] ? clear_bhb_loop+0x60/0xb0 [ 267.298638][ T9175] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 267.304576][ T9175] RIP: 0033:0x7f701a59f559 [ 267.309017][ T9175] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 267.328660][ T9175] RSP: 002b:00007f701b4f3028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 267.337194][ T9175] RAX: ffffffffffffffda RBX: 00007f701a825fa0 RCX: 00007f701a59f559 [ 267.345217][ T9175] RDX: 0000000000000000 RSI: 0000200000000780 RDI: 0000000000000004 [ 267.353213][ T9175] RBP: 00007f701a636b20 R08: 0000000000000000 R09: 0000000000000000 [ 267.361210][ T9175] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 267.369211][ T9175] R13: 00007f701a826038 R14: 00007f701a825fa0 R15: 00007ffedf5b2898 [ 267.377246][ T9175] [ 268.013408][ T9197] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1866'. [ 268.896247][ T9219] loop5: detected capacity change from 0 to 512 [ 268.930664][ T9219] EXT4-fs: Ignoring removed mblk_io_submit option [ 268.975355][ T9223] loop1: detected capacity change from 0 to 1024 [ 269.016177][ T9219] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 269.220756][ T9219] EXT4-fs (loop5): feature flags set on rev 0 fs, running e2fsck is recommended [ 269.810597][ T9223] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 269.867227][ T9223] EXT4-fs error (device loop1): ext4_validate_block_bitmap:438: comm syz.1.1878: bg 0: block 153: padding at end of block bitmap is not set [ 269.886760][ T9219] EXT4-fs error (device loop5): ext4_mb_mark_diskspace_used:3861: comm syz.5.1874: Allocating blocks 41-42 which overlap fs metadata [ 269.986904][ T9219] __quota_error: 4 callbacks suppressed [ 269.986922][ T9219] Quota error (device loop5): write_blk: dquota write failed [ 270.039566][ T4281] EXT4-fs (loop1): unmounting filesystem. [ 270.076538][ T9219] Quota error (device loop5): find_free_dqentry: Can't write quota data block 5 [ 270.149116][ T9219] Quota error (device loop5): qtree_write_dquot: Error -117 occurred while creating quota [ 270.212300][ T9219] EXT4-fs error (device loop5): ext4_acquire_dquot:6841: comm syz.5.1874: Failed to acquire dquot type 1 [ 270.232740][ T9246] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1884'. [ 270.274596][ T27] audit: type=1326 audit(1793097429.334:112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9247 comm="syz.1.1883" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7321b9f559 code=0x7ffc0000 [ 270.309803][ T9219] EXT4-fs error (device loop5): mb_free_blocks:1839: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 270.346203][ T9219] EXT4-fs error (device loop5): ext4_do_update_inode:5279: inode #12: comm syz.5.1874: corrupted inode contents [ 270.377808][ T9219] EXT4-fs error (device loop5): ext4_dirty_inode:6166: inode #12: comm syz.5.1874: mark_inode_dirty error [ 270.396447][ T27] audit: type=1326 audit(1793097429.364:113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9247 comm="syz.1.1883" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7321b9f559 code=0x7ffc0000 [ 270.439185][ T9219] EXT4-fs error (device loop5): ext4_do_update_inode:5279: inode #12: comm syz.5.1874: corrupted inode contents [ 270.459364][ T27] audit: type=1326 audit(1793097429.364:114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9247 comm="syz.1.1883" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7321b9f559 code=0x7ffc0000 [ 270.502932][ T9219] EXT4-fs error (device loop5): __ext4_ext_dirty:202: inode #12: comm syz.5.1874: mark_inode_dirty error [ 270.528147][ T27] audit: type=1326 audit(1793097429.364:115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9247 comm="syz.1.1883" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f7321b9f559 code=0x7ffc0000 [ 270.564137][ T9219] EXT4-fs error (device loop5): ext4_do_update_inode:5279: inode #12: comm syz.5.1874: corrupted inode contents [ 270.596070][ T27] audit: type=1326 audit(1793097429.364:116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9247 comm="syz.1.1883" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7321b9f559 code=0x7ffc0000 [ 270.627216][ T9219] EXT4-fs error (device loop5) in ext4_orphan_del:303: Corrupt filesystem [ 270.648796][ T27] audit: type=1326 audit(1793097429.384:117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9247 comm="syz.1.1883" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7321b9f559 code=0x7ffc0000 [ 270.673112][ T9219] EXT4-fs error (device loop5): ext4_do_update_inode:5279: inode #12: comm syz.5.1874: corrupted inode contents [ 270.724553][ T27] audit: type=1326 audit(1793097429.384:118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9247 comm="syz.1.1883" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7321b9f559 code=0x7ffc0000 [ 270.779695][ T9219] EXT4-fs error (device loop5): ext4_truncate:4325: inode #12: comm syz.5.1874: mark_inode_dirty error [ 270.836711][ T9219] EXT4-fs error (device loop5) in ext4_process_orphan:345: Corrupt filesystem [ 270.907076][ T9219] EXT4-fs (loop5): 1 truncate cleaned up [ 270.944489][ T9219] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 271.877414][ T7732] EXT4-fs (loop5): unmounting filesystem. [ 272.418881][ T9279] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1899'. [ 275.801088][ T9353] loop1: detected capacity change from 0 to 512 [ 275.808263][ T9353] EXT4-fs: Ignoring removed oldalloc option [ 275.824751][ T9353] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 276.676841][ T9353] EXT4-fs (loop1): 1 truncate cleaned up [ 276.682692][ T9353] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 278.064594][ T9364] device ip6gre1 entered promiscuous mode [ 278.083779][ T4281] EXT4-fs (loop1): unmounting filesystem. [ 279.434020][ T4361] kernel write not supported for file /vcsa1 (pid: 4361 comm: kworker/0:3) [ 282.846422][ T9453] device lo entered promiscuous mode [ 282.883893][ T9453] device tunl0 entered promiscuous mode [ 282.915495][ T9453] device gre0 entered promiscuous mode [ 282.988458][ T9453] device gretap0 entered promiscuous mode [ 283.013009][ T9453] device erspan0 entered promiscuous mode [ 283.046932][ T9453] device ip_vti0 entered promiscuous mode [ 283.070161][ T9453] device ip6_vti0 entered promiscuous mode [ 283.110985][ T9453] device sit0 entered promiscuous mode [ 283.198886][ T9453] device ip6tnl0 entered promiscuous mode [ 283.235501][ T9453] device ip6gre0 entered promiscuous mode [ 283.275336][ T9453] device ip6gretap0 entered promiscuous mode [ 283.331314][ T9453] device bridge0 entered promiscuous mode [ 283.347506][ T9453] device vcan0 entered promiscuous mode [ 284.246201][ T9453] device bond0 entered promiscuous mode [ 284.280410][ T9453] device team0 entered promiscuous mode [ 284.295152][ T9453] device dummy0 entered promiscuous mode [ 284.328615][ T9453] device nlmon0 entered promiscuous mode [ 284.347113][ T9453] device caif0 entered promiscuous mode [ 284.358833][ T9453] device ip6gre1 entered promiscuous mode [ 284.384896][ T9459] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1957'. [ 285.080850][ T9483] loop5: detected capacity change from 0 to 1764 [ 285.377236][ T27] kauditd_printk_skb: 238 callbacks suppressed [ 285.377251][ T27] audit: type=1326 audit(1793097444.434:357): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9493 comm="syz.0.1969" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b7ad9f559 code=0x7ffc0000 [ 285.416595][ T9495] EXT4-fs warning (device sda1): __ext4_ioctl:1253: Setting inode version is not supported with metadata_csum enabled. [ 285.466118][ T27] audit: type=1326 audit(1793097444.474:358): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9493 comm="syz.0.1969" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b7ad9f559 code=0x7ffc0000 [ 285.574064][ T27] audit: type=1326 audit(1793097444.474:359): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9493 comm="syz.0.1969" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b7ad9f559 code=0x7ffc0000 [ 285.616905][ T27] audit: type=1326 audit(1793097444.474:360): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9493 comm="syz.0.1969" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b7ad9f559 code=0x7ffc0000 [ 285.705786][ T27] audit: type=1326 audit(1793097444.474:361): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9493 comm="syz.0.1969" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f6b7ad9f559 code=0x7ffc0000 [ 285.779598][ T27] audit: type=1326 audit(1793097444.474:362): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9493 comm="syz.0.1969" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b7ad9f559 code=0x7ffc0000 [ 285.822436][ T27] audit: type=1326 audit(1793097444.474:363): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9493 comm="syz.0.1969" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b7ad9f559 code=0x7ffc0000 [ 285.964807][ T27] audit: type=1326 audit(1793097444.474:364): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9493 comm="syz.0.1969" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b7ad9f559 code=0x7ffc0000 [ 285.999440][ T27] audit: type=1326 audit(1793097444.474:365): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9493 comm="syz.0.1969" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f6b7ad9f559 code=0x7ffc0000 [ 287.106452][ T27] audit: type=1326 audit(1793097444.474:366): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9493 comm="syz.0.1969" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6b7ad9f559 code=0x7ffc0000 [ 287.955201][ T9552] loop5: detected capacity change from 0 to 512 [ 288.059204][ T9559] tipc: Enabling of bearer rejected, failed to enable media [ 288.120586][ T9552] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 288.155465][ T9552] ext4 filesystem being mounted at /102/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 288.316325][ T9568] loop1: detected capacity change from 0 to 164 [ 288.351597][ T7732] EXT4-fs (loop5): unmounting filesystem. [ 290.506752][ T9610] device ip6gre1 entered promiscuous mode [ 290.518938][ T9614] FAULT_INJECTION: forcing a failure. [ 290.518938][ T9614] name failslab, interval 1, probability 0, space 0, times 0 [ 290.538421][ T9614] CPU: 1 PID: 9614 Comm: syz.1.2008 Not tainted syzkaller #0 [ 290.545870][ T9614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 290.555952][ T9614] Call Trace: [ 290.559257][ T9614] [ 290.562208][ T9614] dump_stack_lvl+0x188/0x24e [ 290.566919][ T9614] ? show_regs_print_info+0x12/0x12 [ 290.572146][ T9614] ? load_image+0x410/0x410 [ 290.576681][ T9614] ? __might_sleep+0xd0/0xd0 [ 290.581312][ T9614] ? __lock_acquire+0x7ea0/0x7ea0 [ 290.586374][ T9614] should_fail_ex+0x390/0x4c0 [ 290.591100][ T9614] should_failslab+0x5/0x20 [ 290.595629][ T9614] slab_pre_alloc_hook+0x59/0x300 [ 290.600686][ T9614] ? security_sk_alloc+0x47/0x130 [ 290.605745][ T9614] __kmem_cache_alloc_node+0x4f/0x270 [ 290.611152][ T9614] ? security_sk_alloc+0x47/0x130 [ 290.616213][ T9614] __kmalloc+0xa3/0x240 [ 290.620392][ T9614] ? sk_prot_alloc+0xe7/0x210 [ 290.625088][ T9614] security_sk_alloc+0x47/0x130 [ 290.629958][ T9614] sk_prot_alloc+0x101/0x210 [ 290.634548][ T9614] ? sk_alloc+0x20/0x330 [ 290.638791][ T9614] sk_alloc+0x36/0x330 [ 290.642862][ T9614] __netlink_create+0x6b/0x2d0 [ 290.647635][ T9614] __netlink_kernel_create+0x144/0x7b0 [ 290.653103][ T9614] ? netlink_set_err+0x3b0/0x3b0 [ 290.658047][ T9614] ? netlink_set_err+0x3b0/0x3b0 [ 290.662986][ T9614] ? genl_pernet_init+0xa4/0x170 [ 290.667922][ T9614] genl_pernet_init+0xb6/0x170 [ 290.672690][ T9614] ? genl_get_cmd+0x8b0/0x8b0 [ 290.677402][ T9614] ? rtnetlink_net_init+0xbd/0x140 [ 290.682527][ T9614] ? genl_pernet_exit+0x60/0x60 [ 290.687383][ T9614] ? genl_rcv+0x40/0x40 [ 290.691536][ T9614] ? rtnetlink_rcv+0x20/0x20 [ 290.696136][ T9614] ops_init+0x360/0x5e0 [ 290.700296][ T9614] setup_net+0x4f2/0xbd0 [ 290.704544][ T9614] ? copy_net_ns+0x5b0/0x5b0 [ 290.709232][ T9614] ? copy_net_ns+0x324/0x5b0 [ 290.713821][ T9614] ? down_read_killable+0x1cc/0x340 [ 290.719022][ T9614] copy_net_ns+0x33e/0x5b0 [ 290.723450][ T9614] create_new_namespaces+0x3ce/0x700 [ 290.728752][ T9614] unshare_nsproxy_namespaces+0x116/0x160 [ 290.734582][ T9614] ksys_unshare+0x4f6/0x8e0 [ 290.739139][ T9614] ? sighand_ctor+0x40/0x40 [ 290.743659][ T9614] ? lock_chain_count+0x20/0x20 [ 290.748537][ T9614] ? syscall_enter_from_user_mode+0x21/0x80 [ 290.754436][ T9614] __x64_sys_unshare+0x34/0x40 [ 290.759230][ T9614] do_syscall_64+0x4c/0xa0 [ 290.763647][ T9614] ? clear_bhb_loop+0x60/0xb0 [ 290.768326][ T9614] ? clear_bhb_loop+0x60/0xb0 [ 290.773002][ T9614] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 290.778925][ T9614] RIP: 0033:0x7f7321b9f559 [ 290.783338][ T9614] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 290.802950][ T9614] RSP: 002b:00007f7322ab8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 [ 290.811365][ T9614] RAX: ffffffffffffffda RBX: 00007f7321e25fa0 RCX: 00007f7321b9f559 [ 290.819334][ T9614] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000060040000 [ 290.827302][ T9614] RBP: 00007f7321c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 290.835271][ T9614] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 290.843240][ T9614] R13: 00007f7321e26038 R14: 00007f7321e25fa0 R15: 00007ffd8a50af28 [ 290.851248][ T9614] [ 292.728877][ T9656] netlink: 124 bytes leftover after parsing attributes in process `syz.1.2023'. [ 293.591456][ T9668] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2027'. [ 293.641110][ T9670] netlink: 1363 bytes leftover after parsing attributes in process `syz.5.2026'. [ 293.934916][ T9684] rxe_eth0 speed is unknown, defaulting to 1000 [ 296.810538][ T9726] loop5: detected capacity change from 0 to 1024 [ 296.846692][ T9726] EXT4-fs (loop5): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 296.908405][ T9726] EXT4-fs (loop5): barriers disabled [ 296.940576][ T9726] JBD2: no valid journal superblock found [ 296.950421][ T9726] EXT4-fs (loop5): error loading journal [ 298.008279][ T9750] loop5: detected capacity change from 0 to 512 [ 298.061399][ T9750] EXT4-fs (loop5): revision level too high, forcing read-only mode [ 298.073949][ T9750] EXT4-fs (loop5): orphan cleanup on readonly fs [ 298.104116][ T9750] __quota_error: 23 callbacks suppressed [ 298.104134][ T9750] Quota error (device loop5): find_block_dqentry: Quota for id 0 referenced but not present [ 298.133771][ T9750] Quota error (device loop5): qtree_read_dquot: Can't read quota structure for id 0 [ 298.173991][ T9750] EXT4-fs error (device loop5): ext4_acquire_dquot:6841: comm syz.5.2054: Failed to acquire dquot type 1 [ 298.253895][ T9750] EXT4-fs error (device loop5): ext4_validate_block_bitmap:438: comm syz.5.2054: bg 0: block 40: padding at end of block bitmap is not set [ 298.283018][ T9750] EXT4-fs error (device loop5) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 298.341290][ T9750] EXT4-fs (loop5): 1 truncate cleaned up [ 298.347659][ T9750] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 298.736929][ T27] audit: type=1326 audit(1793097457.794:390): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9756 comm="syz.1.2056" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7321b9f559 code=0x7ffc0000 [ 298.916394][ T27] audit: type=1326 audit(1793097457.844:391): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9756 comm="syz.1.2056" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7321b9f559 code=0x7ffc0000 [ 298.956291][ T7732] EXT4-fs (loop5): unmounting filesystem. [ 299.141666][ T27] audit: type=1326 audit(1793097457.844:392): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9756 comm="syz.1.2056" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7321b9f559 code=0x7ffc0000 [ 299.240063][ T9767] netlink: 'syz.5.2058': attribute type 1 has an invalid length. [ 299.288790][ T27] audit: type=1326 audit(1793097457.864:393): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9756 comm="syz.1.2056" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f7321b5fd8e code=0x7ffc0000 [ 299.340689][ T27] audit: type=1326 audit(1793097457.864:394): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9756 comm="syz.1.2056" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f7321b5fd8e code=0x7ffc0000 [ 299.365328][ T27] audit: type=1326 audit(1793097457.864:395): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9756 comm="syz.1.2056" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7321b9f559 code=0x7ffc0000 [ 299.530352][ T27] audit: type=1326 audit(1793097457.864:396): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9756 comm="syz.1.2056" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7321b9f559 code=0x7ffc0000 [ 299.670447][ T27] audit: type=1326 audit(1793097457.864:397): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9756 comm="syz.1.2056" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7321b9f559 code=0x7ffc0000 [ 300.077987][ T9789] ip_tables: iptables: counters copy to user failed while replacing table [ 300.374472][ T9810] loop5: detected capacity change from 0 to 164 [ 306.346964][ T9902] loop5: detected capacity change from 0 to 1024 [ 306.391245][ T9902] EXT4-fs: Ignoring removed nobh option [ 306.451247][ T9902] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 306.459833][ T9902] ext4 filesystem being mounted at /121/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 306.538639][ T9911] netlink: 1363 bytes leftover after parsing attributes in process `syz.1.2111'. [ 306.645593][ T7732] EXT4-fs (loop5): unmounting filesystem. [ 306.779292][ T9921] 9pnet_fd: Insufficient options for proto=fd [ 307.840066][ T9933] program syz.5.2121 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 308.263064][ T9941] netlink: 1363 bytes leftover after parsing attributes in process `syz.4.2125'. [ 308.368695][ T9943] loop1: detected capacity change from 0 to 1024 [ 308.385517][ T9943] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 308.518075][ T9943] EXT4-fs (loop1): barriers disabled [ 308.536551][ T9943] JBD2: no valid journal superblock found [ 308.581209][ T9943] EXT4-fs (loop1): error loading journal [ 309.023589][ T34] xs_tcp_setup_socket: connect returned unhandled error -13 [ 309.052106][ T4498] xs_tcp_setup_socket: connect returned unhandled error -13 [ 309.090486][ T4498] xs_tcp_setup_socket: connect returned unhandled error -13 [ 309.278113][ T4447] xs_tcp_setup_socket: connect returned unhandled error -13 [ 309.368706][ T4447] xs_tcp_setup_socket: connect returned unhandled error -13 [ 309.501176][ T4447] xs_tcp_setup_socket: connect returned unhandled error -13 [ 309.547213][ T4447] xs_tcp_setup_socket: connect returned unhandled error -13 [ 309.927910][ T9980] netlink: 1363 bytes leftover after parsing attributes in process `syz.2.2140'. [ 310.236795][ T9995] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2149'. [ 310.246210][ T9998] loop1: detected capacity change from 0 to 1024 [ 310.297791][ T9998] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 310.330061][ T9998] EXT4-fs (loop1): barriers disabled [ 310.360855][ T9998] JBD2: no valid journal superblock found [ 310.366638][ T9998] EXT4-fs (loop1): error loading journal [ 311.358788][T10022] netlink: 1363 bytes leftover after parsing attributes in process `syz.4.2158'. [ 311.607199][T10031] 9pnet_fd: Insufficient options for proto=fd [ 311.967651][T10048] loop2: detected capacity change from 0 to 1024 [ 312.025933][T10048] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 312.083816][T10048] EXT4-fs (loop2): barriers disabled [ 312.107537][T10048] JBD2: no valid journal superblock found [ 312.135924][T10048] EXT4-fs (loop2): error loading journal [ 314.009888][T10116] loop1: detected capacity change from 0 to 512 [ 314.039616][T10116] EXT4-fs (loop1): mounting ext2 file system using the ext4 subsystem [ 314.102790][T10116] EXT4-fs error (device loop1): ext4_validate_block_bitmap:429: comm syz.1.2199: bg 0: block 4: invalid block bitmap [ 314.140563][T10116] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 314.155916][T10116] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #11: comm syz.1.2199: invalid indirect mapped block 1 (level 1) [ 314.172246][T10116] EXT4-fs (loop1): 1 truncate cleaned up [ 314.177966][T10116] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 314.687145][ T4281] EXT4-fs (loop1): unmounting filesystem. [ 315.253084][T10166] netlink: 'syz.1.2220': attribute type 15 has an invalid length. [ 315.527002][T10179] loop1: detected capacity change from 0 to 512 [ 315.548773][T10179] EXT4-fs: inline encryption not supported [ 315.584070][T10179] EXT4-fs (loop1): warning: checktime reached, running e2fsck is recommended [ 315.605646][T10179] EXT4-fs error (device loop1): ext4_do_update_inode:5279: inode #15: comm syz.1.2226: corrupted inode contents [ 315.635479][T10179] EXT4-fs (loop1): Remounting filesystem read-only [ 315.663241][T10179] EXT4-fs error (device loop1) in ext4_orphan_del:303: Corrupt filesystem [ 315.699681][T10179] EXT4-fs (loop1): Remounting filesystem read-only [ 315.720736][T10179] EXT4-fs error (device loop1): ext4_do_update_inode:5279: inode #15: comm syz.1.2226: corrupted inode contents [ 315.744651][T10179] EXT4-fs (loop1): Remounting filesystem read-only [ 315.751529][T10179] EXT4-fs error (device loop1): ext4_evict_inode:329: inode #15: comm syz.1.2226: mark_inode_dirty error [ 315.763552][T10179] EXT4-fs (loop1): Remounting filesystem read-only [ 315.770739][T10179] EXT4-fs (loop1): 1 orphan inode deleted [ 315.776714][T10179] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 315.817925][ T4281] EXT4-fs (loop1): unmounting filesystem. [ 316.001117][T10196] loop2: detected capacity change from 0 to 512 [ 316.731890][T10233] netlink: 1363 bytes leftover after parsing attributes in process `syz.5.2251'. [ 317.063195][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.069533][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.499309][T10270] netlink: 1363 bytes leftover after parsing attributes in process `syz.2.2267'. [ 318.066480][T10304] netlink: 1363 bytes leftover after parsing attributes in process `syz.0.2284'. [ 319.634569][T10333] rxe_eth0 speed is unknown, defaulting to 1000 [ 320.137149][T10337] loop2: detected capacity change from 0 to 8192 [ 320.179541][T10337] FAT-fs (loop2): error, corrupted directory (invalid entries) [ 320.421747][T10339] netlink: 1363 bytes leftover after parsing attributes in process `syz.1.2299'. [ 320.661978][T10354] loop5: detected capacity change from 0 to 1024 [ 320.686097][T10356] loop1: detected capacity change from 0 to 1024 [ 320.710599][T10354] EXT4-fs (loop5): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 320.758494][T10354] EXT4-fs (loop5): barriers disabled [ 320.772618][T10354] JBD2: no valid journal superblock found [ 320.809730][T10354] EXT4-fs (loop5): error loading journal [ 321.690524][T10373] loop2: detected capacity change from 0 to 512 [ 321.732274][T10373] EXT4-fs: Ignoring removed oldalloc option [ 322.099762][T10373] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 322.704946][ T4280] EXT4-fs (loop2): unmounting filesystem. [ 322.861798][T10390] loop1: detected capacity change from 0 to 512 [ 323.150152][T10403] loop2: detected capacity change from 0 to 1024 [ 323.202798][T10403] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 323.236444][T10403] EXT4-fs (loop2): barriers disabled [ 323.266350][T10403] JBD2: no valid journal superblock found [ 323.284218][T10407] loop5: detected capacity change from 0 to 512 [ 323.288607][T10403] EXT4-fs (loop2): error loading journal [ 323.388312][T10407] EXT4-fs (loop5): mounting ext2 file system using the ext4 subsystem [ 323.509163][T10407] EXT4-fs error (device loop5): ext4_validate_block_bitmap:429: comm syz.5.2325: bg 0: block 4: invalid block bitmap [ 323.643034][T10407] EXT4-fs error (device loop5) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 323.812938][T10407] EXT4-fs error (device loop5): ext4_free_branches:1030: inode #11: comm syz.5.2325: invalid indirect mapped block 1 (level 1) [ 324.031173][T10404] DRBG: could not allocate digest TFM handle: hmac(sha512) [ 324.141378][T10407] EXT4-fs (loop5): 1 truncate cleaned up [ 324.147091][T10407] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 325.136747][ T7732] EXT4-fs (loop5): unmounting filesystem. [ 325.435876][T10445] netem: change failed [ 326.172368][T10471] loop1: detected capacity change from 0 to 128 [ 326.457337][T10471] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 326.558520][T10471] ext4 filesystem being mounted at /450/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 326.721200][ T4281] EXT4-fs (loop1): unmounting filesystem. [ 327.167372][T10497] loop1: detected capacity change from 0 to 1024 [ 327.218514][T10497] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 327.254059][T10497] EXT4-fs (loop1): barriers disabled [ 327.269632][T10497] JBD2: no valid journal superblock found [ 327.323040][T10497] EXT4-fs (loop1): error loading journal [ 328.707552][T10520] 9pnet_fd: Insufficient options for proto=fd [ 329.691834][T10538] FAULT_INJECTION: forcing a failure. [ 329.691834][T10538] name failslab, interval 1, probability 0, space 0, times 0 [ 329.704747][T10538] CPU: 1 PID: 10538 Comm: syz.1.2375 Not tainted syzkaller #0 [ 329.712246][T10538] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 329.722318][T10538] Call Trace: [ 329.725596][T10538] [ 329.728518][T10538] dump_stack_lvl+0x188/0x24e [ 329.733203][T10538] ? show_regs_print_info+0x12/0x12 [ 329.738411][T10538] ? load_image+0x410/0x410 [ 329.742919][T10538] ? __lock_acquire+0x7ea0/0x7ea0 [ 329.747961][T10538] should_fail_ex+0x390/0x4c0 [ 329.752649][T10538] should_failslab+0x5/0x20 [ 329.757152][T10538] slab_pre_alloc_hook+0x59/0x300 [ 329.762175][T10538] ? free_vm_area+0x50/0x50 [ 329.766679][T10538] ? bpf_prog_alloc_no_stats+0xae/0x3a0 [ 329.772230][T10538] __kmem_cache_alloc_node+0x4f/0x270 [ 329.777606][T10538] ? bpf_prog_alloc_no_stats+0xae/0x3a0 [ 329.783157][T10538] kmalloc_trace+0x26/0xe0 [ 329.787570][T10538] bpf_prog_alloc_no_stats+0xae/0x3a0 [ 329.792954][T10538] bpf_prog_alloc+0x1c/0x1b0 [ 329.797551][T10538] bpf_prog_load+0x7d4/0x1530 [ 329.802237][T10538] ? map_freeze+0x390/0x390 [ 329.806740][T10538] ? __might_fault+0xa6/0x120 [ 329.811421][T10538] ? __might_fault+0xa6/0x120 [ 329.816094][T10538] ? __might_fault+0xc2/0x120 [ 329.820794][T10538] ? __might_fault+0xa6/0x120 [ 329.825467][T10538] ? bpf_lsm_bpf+0x5/0x10 [ 329.829823][T10538] ? security_bpf+0x7a/0xa0 [ 329.834338][T10538] __sys_bpf+0x5b8/0x780 [ 329.838588][T10538] ? bpf_link_show_fdinfo+0x380/0x380 [ 329.843975][T10538] ? lock_chain_count+0x20/0x20 [ 329.848832][T10538] __x64_sys_bpf+0x78/0x90 [ 329.853268][T10538] do_syscall_64+0x4c/0xa0 [ 329.857680][T10538] ? clear_bhb_loop+0x60/0xb0 [ 329.862374][T10538] ? clear_bhb_loop+0x60/0xb0 [ 329.867043][T10538] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 329.872942][T10538] RIP: 0033:0x7f7321b9f559 [ 329.877356][T10538] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 329.896963][T10538] RSP: 002b:00007f7322ab8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 329.905373][T10538] RAX: ffffffffffffffda RBX: 00007f7321e25fa0 RCX: 00007f7321b9f559 [ 329.913358][T10538] RDX: 0000000000000057 RSI: 0000200000000e80 RDI: 0000000000000005 [ 329.921322][T10538] RBP: 00007f7321c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 329.929282][T10538] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 329.937246][T10538] R13: 00007f7321e26038 R14: 00007f7321e25fa0 R15: 00007ffd8a50af28 [ 329.945227][T10538] [ 330.073351][T10542] loop2: detected capacity change from 0 to 1024 [ 330.134241][T10542] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 330.167999][T10528] mmap: syz.4.2369 (10528) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 330.206580][T10542] EXT4-fs (loop2): barriers disabled [ 330.222196][T10542] JBD2: no valid journal superblock found [ 330.227964][T10542] EXT4-fs (loop2): error loading journal [ 330.349423][T10555] loop5: detected capacity change from 0 to 164 [ 331.520280][T10575] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 332.506378][T10594] loop5: detected capacity change from 0 to 1024 [ 332.553730][T10594] EXT4-fs (loop5): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 332.575095][T10594] EXT4-fs (loop5): barriers disabled [ 332.611466][T10594] JBD2: no valid journal superblock found [ 332.617247][T10594] EXT4-fs (loop5): error loading journal [ 333.391715][T10616] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2404'. [ 333.774704][T10621] netlink: 1363 bytes leftover after parsing attributes in process `syz.0.2405'. [ 334.076891][T10640] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 334.367903][T10655] loop1: detected capacity change from 0 to 164 [ 334.486095][T10657] netlink: 1363 bytes leftover after parsing attributes in process `syz.5.2422'. [ 335.947405][T10698] netlink: 1363 bytes leftover after parsing attributes in process `syz.1.2438'. [ 338.147866][T10735] netlink: 1363 bytes leftover after parsing attributes in process `syz.0.2453'. [ 339.228331][T10767] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2465'. [ 341.608017][T10823] loop5: detected capacity change from 0 to 128 [ 341.783829][T10826] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2490'. [ 342.185058][T10824] I/O error, dev loop5, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 343.310556][T10862] netlink: 16 bytes leftover after parsing attributes in process `syz.2.2505'. [ 344.140854][T10882] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2512'. [ 344.691359][T10891] netlink: 132 bytes leftover after parsing attributes in process `syz.2.2515'. [ 345.084135][T10904] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2520'. [ 345.715741][T10912] loop1: detected capacity change from 0 to 512 [ 345.746648][T10912] EXT4-fs: Ignoring removed nobh option [ 345.943450][T10912] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 346.022553][T10912] ext4 filesystem being mounted at /486/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 346.543107][T10912] EXT4-fs error (device loop1): ext4_do_update_inode:5279: inode #2: comm syz.1.2524: corrupted inode contents [ 346.619338][T10912] EXT4-fs error (device loop1): ext4_dirty_inode:6166: inode #2: comm syz.1.2524: mark_inode_dirty error [ 346.701352][T10912] EXT4-fs error (device loop1): ext4_do_update_inode:5279: inode #2: comm syz.1.2524: corrupted inode contents [ 346.757260][T10912] EXT4-fs error (device loop1): __ext4_ext_dirty:202: inode #2: comm syz.1.2524: mark_inode_dirty error [ 346.852489][ T4281] EXT4-fs (loop1): unmounting filesystem. [ 346.909841][T10937] loop5: detected capacity change from 0 to 2048 [ 346.985812][T10937] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 347.043082][ T27] kauditd_printk_skb: 5 callbacks suppressed [ 347.043096][ T27] audit: type=1800 audit(1793097506.104:403): pid=10937 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.2533" name="file1" dev="loop5" ino=15 res=0 errno=0 [ 347.479079][T10946] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 347.610006][T10946] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 347.752275][T10946] 8021q: adding VLAN 0 to HW filter on device bond0 [ 347.760393][T10946] 8021q: adding VLAN 0 to HW filter on device team0 [ 347.776766][T10946] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 347.904618][ T7732] EXT4-fs (loop5): unmounting filesystem. [ 348.051027][T10958] bridge0: port 3(macvlan2) entered blocking state [ 348.067992][T10958] bridge0: port 3(macvlan2) entered disabled state [ 350.778074][T11001] loop2: detected capacity change from 0 to 2048 [ 350.831370][T11001] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 350.840098][T11001] ext4 filesystem being mounted at /502/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 350.984071][T10987] device syztnl2 entered promiscuous mode [ 351.086278][T10995] bridge0: port 3(macvlan2) entered blocking state [ 351.122903][T10995] bridge0: port 3(macvlan2) entered disabled state [ 351.555042][T11001] EXT4-fs error (device loop2): ext4_validate_block_bitmap:438: comm syz.2.2558: bg 0: block 345: padding at end of block bitmap is not set [ 351.632033][T11001] EXT4-fs error (device loop2) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 351.928531][ T4280] EXT4-fs (loop2): unmounting filesystem. [ 352.970494][T11041] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 352.977937][T11041] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 352.994573][T11041] 8021q: adding VLAN 0 to HW filter on device bond0 [ 353.006801][T11041] 8021q: adding VLAN 0 to HW filter on device team0 [ 353.022494][T11041] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 353.057007][T11045] bridge0: port 3(macvlan3) entered blocking state [ 353.079878][T11045] bridge0: port 3(macvlan3) entered disabled state [ 353.257679][T11051] loop2: detected capacity change from 0 to 256 [ 354.068382][T11079] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 354.101098][T11079] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 354.121964][T11079] 8021q: adding VLAN 0 to HW filter on device bond0 [ 354.145946][T11079] 8021q: adding VLAN 0 to HW filter on device team0 [ 354.170703][T11079] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 355.319281][T11109] loop1: detected capacity change from 0 to 1024 [ 355.349361][T11109] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 355.374173][T11109] EXT4-fs (loop1): barriers disabled [ 355.379529][T11109] JBD2: no valid journal superblock found [ 355.403453][T11109] EXT4-fs (loop1): error loading journal [ 356.326650][T11122] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 356.375488][T11122] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 356.393628][T11122] 8021q: adding VLAN 0 to HW filter on device bond0 [ 356.409375][T11122] 8021q: adding VLAN 0 to HW filter on device team0 [ 356.436930][T11122] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 356.637753][T11139] process 'syz.0.2615' launched './file0' with NULL argv: empty string added [ 357.247245][ T27] audit: type=1326 audit(1793097516.304:404): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11127 comm="syz.1.2612" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7321b9f559 code=0x7fc00000 [ 357.685631][T11163] loop1: detected capacity change from 0 to 512 [ 357.801491][T11163] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 357.840366][T11163] ext4 filesystem being mounted at /505/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 357.928117][T11163] EXT4-fs error (device loop1): ext4_add_entry:2488: inode #12: comm syz.1.2625: Directory hole found for htree leaf block 0 [ 357.982684][T11163] EXT4-fs (loop1): Remounting filesystem read-only [ 358.053369][ T4281] EXT4-fs (loop1): unmounting filesystem. [ 358.171182][T11188] FAULT_INJECTION: forcing a failure. [ 358.171182][T11188] name failslab, interval 1, probability 0, space 0, times 0 [ 358.191861][T11188] CPU: 1 PID: 11188 Comm: syz.1.2630 Not tainted syzkaller #0 [ 358.199385][T11188] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 358.209467][T11188] Call Trace: [ 358.212862][T11188] [ 358.215938][T11188] dump_stack_lvl+0x188/0x24e [ 358.220780][T11188] ? show_regs_print_info+0x12/0x12 [ 358.226054][T11188] ? load_image+0x410/0x410 [ 358.230615][T11188] ? __might_sleep+0xd0/0xd0 [ 358.235479][T11188] ? __lock_acquire+0x7ea0/0x7ea0 [ 358.240566][T11188] should_fail_ex+0x390/0x4c0 [ 358.245381][T11188] should_failslab+0x5/0x20 [ 358.249979][T11188] slab_pre_alloc_hook+0x59/0x300 [ 358.255120][T11188] ? tomoyo_encode+0x28a/0x550 [ 358.259973][T11188] __kmem_cache_alloc_node+0x4f/0x270 [ 358.265377][T11188] ? tomoyo_encode+0x28a/0x550 [ 358.270169][T11188] __kmalloc+0xa3/0x240 [ 358.274352][T11188] tomoyo_encode+0x28a/0x550 [ 358.278977][T11188] tomoyo_realpath_from_path+0x578/0x5c0 [ 358.284653][T11188] tomoyo_check_open_permission+0x212/0x440 [ 358.290578][T11188] ? tomoyo_check_open_permission+0x1bf/0x440 [ 358.296676][T11188] ? tomoyo_check_path_number_acl+0x280/0x280 [ 358.302778][T11188] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 358.308765][T11188] ? __lock_acquire+0x7ea0/0x7ea0 [ 358.313808][T11188] ? __lock_acquire+0x7ea0/0x7ea0 [ 358.318857][T11188] ? __rwlock_init+0x140/0x140 [ 358.323613][T11188] ? tomoyo_file_open+0xe9/0x170 [ 358.328558][T11188] security_file_open+0x5e/0xa0 [ 358.333510][T11188] do_dentry_open+0x2fd/0x10b0 [ 358.338357][T11188] ? memcpy+0x3c/0x60 [ 358.342402][T11188] path_openat+0x2674/0x2f10 [ 358.347091][T11188] ? kasan_set_track+0x60/0x70 [ 358.351874][T11188] ? verify_lock_unused+0x140/0x140 [ 358.357101][T11188] ? do_sys_openat2+0xdd/0x4f0 [ 358.361871][T11188] ? do_filp_open+0x420/0x420 [ 358.366554][T11188] do_filp_open+0x1ee/0x420 [ 358.371074][T11188] ? vfs_tmpfile+0x470/0x470 [ 358.375692][T11188] ? _raw_spin_unlock+0x24/0x40 [ 358.380620][T11188] ? alloc_fd+0x590/0x640 [ 358.384977][T11188] do_sys_openat2+0x14b/0x4f0 [ 358.389652][T11188] ? do_sys_open+0xe0/0xe0 [ 358.394068][T11188] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 358.400069][T11188] ? lock_chain_count+0x20/0x20 [ 358.404965][T11188] __x64_sys_openat+0x135/0x160 [ 358.409847][T11188] do_syscall_64+0x4c/0xa0 [ 358.414274][T11188] ? clear_bhb_loop+0x60/0xb0 [ 358.418966][T11188] ? clear_bhb_loop+0x60/0xb0 [ 358.423659][T11188] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 358.429575][T11188] RIP: 0033:0x7f7321b9f559 [ 358.434066][T11188] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 358.453731][T11188] RSP: 002b:00007f7322ab8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 358.462251][T11188] RAX: ffffffffffffffda RBX: 00007f7321e25fa0 RCX: 00007f7321b9f559 [ 358.470254][T11188] RDX: 0000000000000000 RSI: 0000200000000140 RDI: ffffffffffffff9c [ 358.478242][T11188] RBP: 00007f7321c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 358.486213][T11188] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 358.494183][T11188] R13: 00007f7321e26038 R14: 00007f7321e25fa0 R15: 00007ffd8a50af28 [ 358.502160][T11188] [ 358.585432][T11200] loop5: detected capacity change from 0 to 128 [ 359.193897][T11188] ERROR: Out of memory at tomoyo_realpath_from_path. [ 359.374203][T11208] loop2: detected capacity change from 0 to 512 [ 359.495004][T11208] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 359.534082][T11208] ext4 filesystem being mounted at /520/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 359.594146][T11222] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2641'. [ 359.600329][T11217] loop5: detected capacity change from 0 to 2048 [ 359.690984][T11227] netlink: 108 bytes leftover after parsing attributes in process `syz.1.2643'. [ 359.700857][T11217] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 359.740021][T11217] ext4 filesystem being mounted at /234/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 359.794674][ T7732] EXT4-fs (loop5): unmounting filesystem. [ 359.815676][ T4280] EXT4-fs (loop2): unmounting filesystem. [ 359.999525][T11241] usb usb8: usbfs: process 11241 (syz.1.2649) did not claim interface 0 before use [ 360.775967][T11249] loop2: detected capacity change from 0 to 128 [ 361.099434][T11261] netlink: 108 bytes leftover after parsing attributes in process `syz.1.2656'. [ 361.317922][T11276] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2663'. [ 361.979265][T11282] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2660'. [ 362.612600][T11298] netlink: 108 bytes leftover after parsing attributes in process `syz.4.2671'. [ 362.915722][T11312] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2678'. [ 363.058526][T11320] device syzkaller0 entered promiscuous mode [ 363.082571][T11320] tipc: Started in network mode [ 363.103253][T11320] tipc: Node identity a221cafda2eb, cluster identity 4711 [ 363.121860][T11320] tipc: Enabled bearer , priority 0 [ 363.144328][T11320] tipc: Resetting bearer [ 363.164020][T11319] tipc: Resetting bearer [ 363.216384][T11319] tipc: Disabling bearer [ 363.876813][T11352] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2692'. [ 363.909284][T11348] loop5: detected capacity change from 0 to 512 [ 364.143615][T11357] FAULT_INJECTION: forcing a failure. [ 364.143615][T11357] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 364.200358][T11357] CPU: 1 PID: 11357 Comm: syz.1.2696 Not tainted syzkaller #0 [ 364.207878][T11357] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 364.217961][T11357] Call Trace: [ 364.221466][T11357] [ 364.224423][T11357] dump_stack_lvl+0x188/0x24e [ 364.229135][T11357] ? show_regs_print_info+0x12/0x12 [ 364.234366][T11357] ? load_image+0x410/0x410 [ 364.239167][T11357] ? __lock_acquire+0x7ea0/0x7ea0 [ 364.244213][T11357] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 364.250200][T11357] ? __lock_acquire+0x7ea0/0x7ea0 [ 364.255232][T11357] should_fail_ex+0x390/0x4c0 [ 364.259911][T11357] prepare_alloc_pages+0x1e1/0x5b0 [ 364.265108][T11357] __alloc_pages+0x130/0x4f0 [ 364.269707][T11357] ? zone_statistics+0x170/0x170 [ 364.274649][T11357] ? free_zapped_rcu+0x1f0/0x1f0 [ 364.279590][T11357] __get_free_pages+0x8/0x30 [ 364.284184][T11357] pgd_alloc+0x1e/0x1d0 [ 364.288404][T11357] mm_init+0x53f/0x940 [ 364.292555][T11357] copy_mm+0x1c5/0x1680 [ 364.296727][T11357] ? copy_signal+0x640/0x640 [ 364.301325][T11357] ? lockdep_softirqs_off+0x430/0x430 [ 364.306704][T11357] ? __lock_acquire+0x7ea0/0x7ea0 [ 364.311734][T11357] ? __raw_spin_lock_init+0x41/0x100 [ 364.317014][T11357] ? __init_rwsem+0x11e/0x160 [ 364.321690][T11357] ? copy_signal+0x51f/0x640 [ 364.326280][T11357] copy_process+0x1952/0x4070 [ 364.330996][T11357] ? copy_process+0x974/0x4070 [ 364.335843][T11357] ? preempt_schedule_thunk+0x16/0x18 [ 364.341283][T11357] ? idle_dummy+0x10/0x10 [ 364.345616][T11357] ? wake_up_q+0x8c/0xc0 [ 364.349926][T11357] kernel_clone+0x24b/0x900 [ 364.354437][T11357] ? futex_wake_mark+0x150/0x150 [ 364.359452][T11357] ? create_io_thread+0x170/0x170 [ 364.364484][T11357] ? do_futex+0x2e2/0x320 [ 364.368815][T11357] __x64_sys_clone+0x1a7/0x220 [ 364.373577][T11357] ? __ia32_sys_vfork+0x140/0x140 [ 364.378600][T11357] ? lock_chain_count+0x20/0x20 [ 364.383455][T11357] ? lockdep_hardirqs_on+0x94/0x140 [ 364.388671][T11357] do_syscall_64+0x4c/0xa0 [ 364.393081][T11357] ? clear_bhb_loop+0x60/0xb0 [ 364.397752][T11357] ? clear_bhb_loop+0x60/0xb0 [ 364.402431][T11357] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 364.408326][T11357] RIP: 0033:0x7f7321b9f559 [ 364.412752][T11357] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 364.432399][T11357] RSP: 002b:00007f7322ab7fd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 [ 364.440817][T11357] RAX: ffffffffffffffda RBX: 00007f7321e25fa0 RCX: 00007f7321b9f559 [ 364.448786][T11357] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000f8024000 [ 364.456755][T11357] RBP: 00007f7321c36b20 R08: 0000000000000000 R09: 0000000000000000 [ 364.464720][T11357] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 364.472687][T11357] R13: 00007f7321e26038 R14: 00007f7321e25fa0 R15: 00007ffd8a50af28 [ 364.480696][T11357] [ 365.636292][ T128] kernel write not supported for file /uhid (pid: 128 comm: kworker/1:2) [ 369.297338][T11446] netlink: 108 bytes leftover after parsing attributes in process `syz.2.2734'. [ 369.391596][T11449] loop1: detected capacity change from 0 to 512 [ 369.451429][T11449] EXT4-fs (loop1): encrypted files will use data=ordered instead of data journaling mode [ 369.563688][T11449] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c118, mo2=0002] [ 369.600739][T11449] System zones: 1-12 [ 369.621330][T11449] EXT4-fs error (device loop1): ext4_orphan_get:1435: comm syz.1.2735: bad orphan inode 131072 [ 369.725316][T11449] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 369.950094][ T4281] EXT4-fs (loop1): unmounting filesystem. [ 370.694505][T11473] ieee802154 phy0 wpan0: encryption failed: -22 [ 370.725976][T11477] netlink: 16 bytes leftover after parsing attributes in process `syz.1.2747'. [ 370.872629][ T27] audit: type=1326 audit(1793097529.934:405): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11480 comm="syz.5.2751" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f72ea59f559 code=0x7ffc0000 [ 370.956853][ T27] audit: type=1326 audit(1793097529.964:406): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11480 comm="syz.5.2751" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f72ea59f559 code=0x7ffc0000 [ 371.054883][ T27] audit: type=1326 audit(1793097529.964:407): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11480 comm="syz.5.2751" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f72ea59f559 code=0x7ffc0000 [ 371.110282][ T27] audit: type=1326 audit(1793097529.974:408): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11480 comm="syz.5.2751" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=91 compat=0 ip=0x7f72ea59f559 code=0x7ffc0000 [ 371.170670][T11496] FAULT_INJECTION: forcing a failure. [ 371.170670][T11496] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 371.200621][ T27] audit: type=1326 audit(1793097529.974:409): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11480 comm="syz.5.2751" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f72ea59f559 code=0x7ffc0000 [ 371.244066][T11496] CPU: 1 PID: 11496 Comm: syz.5.2755 Not tainted syzkaller #0 [ 371.251605][T11496] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 371.261683][T11496] Call Trace: [ 371.264970][T11496] [ 371.267919][T11496] dump_stack_lvl+0x188/0x24e [ 371.272633][T11496] ? show_regs_print_info+0x12/0x12 [ 371.277857][T11496] ? load_image+0x410/0x410 [ 371.282395][T11496] ? __lock_acquire+0x7ea0/0x7ea0 [ 371.287454][T11496] should_fail_ex+0x390/0x4c0 [ 371.292174][T11496] _copy_to_user+0x2c/0x130 [ 371.296792][T11496] sctp_getsockopt_peeloff_flags+0x1ce/0x230 [ 371.302896][T11496] ? sctp_getsockopt_peeloff+0x220/0x220 [ 371.308578][T11496] sctp_getsockopt+0x59c/0x8a0 [ 371.313455][T11496] ? sock_recv_errqueue+0x590/0x590 [ 371.318739][T11496] __sys_getsockopt+0x1b0/0x230 [ 371.323642][T11496] __x64_sys_getsockopt+0xb1/0xc0 [ 371.328789][T11496] do_syscall_64+0x4c/0xa0 [ 371.333232][T11496] ? clear_bhb_loop+0x60/0xb0 [ 371.337931][T11496] ? clear_bhb_loop+0x60/0xb0 [ 371.342611][T11496] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 371.348522][T11496] RIP: 0033:0x7f72ea59f559 [ 371.352966][T11496] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 371.372582][T11496] RSP: 002b:00007f72eb53b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 371.381028][T11496] RAX: ffffffffffffffda RBX: 00007f72ea826090 RCX: 00007f72ea59f559 [ 371.389000][T11496] RDX: 000000000000007a RSI: 0000000000000084 RDI: 0000000000000003 [ 371.397059][T11496] RBP: 00007f72ea636b20 R08: 0000200000000540 R09: 0000000000000000 [ 371.405030][T11496] R10: 0000200000000480 R11: 0000000000000246 R12: 0000000000000000 [ 371.413018][T11496] R13: 00007f72ea826128 R14: 00007f72ea826090 R15: 00007ffe53850458 [ 371.421001][T11496] [ 371.496590][ T27] audit: type=1326 audit(1793097529.974:410): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11480 comm="syz.5.2751" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f72ea59f559 code=0x7ffc0000 [ 371.577369][ T27] audit: type=1326 audit(1793097529.974:411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11480 comm="syz.5.2751" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f72ea59f559 code=0x7ffc0000 [ 371.634001][ T27] audit: type=1326 audit(1793097529.974:412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11480 comm="syz.5.2751" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f72ea59f559 code=0x7ffc0000 [ 371.758335][T11510] device syzkaller0 entered promiscuous mode [ 371.875896][T11512] loop1: detected capacity change from 0 to 512 [ 371.990029][T11512] EXT4-fs error (device loop1): ext4_orphan_get:1435: comm syz.1.2761: bad orphan inode 15 [ 372.010669][T11512] ext4_test_bit(bit=14, block=5) = 0 [ 372.020734][T11512] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 372.156576][T11516] ip_tables: iptables: counters copy to user failed while replacing table [ 372.229462][ T4281] EXT4-fs (loop1): unmounting filesystem. [ 372.389422][T11519] loop1: detected capacity change from 0 to 1024 [ 372.477706][T11519] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 372.516407][T11519] EXT4-fs (loop1): barriers disabled [ 372.566125][T11519] JBD2: no valid journal superblock found [ 372.610318][T11519] EXT4-fs (loop1): error loading journal [ 373.601335][T11563] loop1: detected capacity change from 0 to 128 [ 373.641422][T11563] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 373.670387][T11563] ext4 filesystem being mounted at /540/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 375.057000][ T4281] EXT4-fs (loop1): unmounting filesystem. [ 375.077244][T11579] netlink: 108 bytes leftover after parsing attributes in process `syz.5.2778'. [ 375.410005][T11597] loop1: detected capacity change from 0 to 512 [ 375.488353][T11597] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 375.512767][T11597] ext4 filesystem being mounted at /542/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 375.887024][ T4281] EXT4-fs (loop1): unmounting filesystem. [ 376.240920][T11631] device syzkaller0 entered promiscuous mode [ 376.281411][T11631] tipc: Started in network mode [ 376.286343][T11631] tipc: Node identity c6ab56e97367, cluster identity 4711 [ 376.352235][T11631] tipc: Enabled bearer , priority 0 [ 376.480876][T11631] tipc: Resetting bearer [ 376.537232][T11630] tipc: Resetting bearer [ 376.607935][T11630] tipc: Disabling bearer [ 377.892397][T11660] program syz.2.2805 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 378.511548][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.518292][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.814499][T11673] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2812'. [ 378.841652][T11676] FAULT_INJECTION: forcing a failure. [ 378.841652][T11676] name failslab, interval 1, probability 0, space 0, times 0 [ 378.871058][T11676] CPU: 0 PID: 11676 Comm: syz.2.2809 Not tainted syzkaller #0 [ 378.878577][T11676] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 378.888654][T11676] Call Trace: [ 378.891955][T11676] [ 378.894902][T11676] dump_stack_lvl+0x188/0x24e [ 378.899635][T11676] ? show_regs_print_info+0x12/0x12 [ 378.904850][T11676] ? load_image+0x410/0x410 [ 378.909371][T11676] ? __might_sleep+0xd0/0xd0 [ 378.913960][T11676] ? __lock_acquire+0x7ea0/0x7ea0 [ 378.918988][T11676] should_fail_ex+0x390/0x4c0 [ 378.923670][T11676] should_failslab+0x5/0x20 [ 378.928168][T11676] slab_pre_alloc_hook+0x59/0x300 [ 378.933192][T11676] ? security_cred_alloc_blank+0x42/0x120 [ 378.939002][T11676] __kmem_cache_alloc_node+0x4f/0x270 [ 378.944422][T11676] ? security_cred_alloc_blank+0x42/0x120 [ 378.950141][T11676] __kmalloc+0xa3/0x240 [ 378.954301][T11676] security_cred_alloc_blank+0x42/0x120 [ 378.959845][T11676] cred_alloc_blank+0x83/0xd0 [ 378.964602][T11676] keyctl_session_to_parent+0x3e/0xa00 [ 378.970069][T11676] __se_sys_keyctl+0x4f9/0x870 [ 378.974834][T11676] ? __x64_sys_keyctl+0xc0/0xc0 [ 378.979772][T11676] ? do_futex+0x310/0x320 [ 378.984108][T11676] ? __ia32_sys_get_robust_list+0x100/0x100 [ 378.990009][T11676] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 378.995997][T11676] ? lock_chain_count+0x20/0x20 [ 379.000883][T11676] ? lockdep_hardirqs_on+0x94/0x140 [ 379.006077][T11676] ? __x64_sys_keyctl+0x1c/0xc0 [ 379.010932][T11676] do_syscall_64+0x4c/0xa0 [ 379.015349][T11676] ? clear_bhb_loop+0x60/0xb0 [ 379.020018][T11676] ? clear_bhb_loop+0x60/0xb0 [ 379.024690][T11676] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 379.030584][T11676] RIP: 0033:0x7f701a59f559 [ 379.034996][T11676] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 379.054598][T11676] RSP: 002b:00007f701b4f3028 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 379.063015][T11676] RAX: ffffffffffffffda RBX: 00007f701a825fa0 RCX: 00007f701a59f559 [ 379.071003][T11676] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000012 [ 379.078992][T11676] RBP: 00007f701a636b20 R08: 0000000000000000 R09: 0000000000000000 [ 379.086975][T11676] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 379.094948][T11676] R13: 00007f701a826038 R14: 00007f701a825fa0 R15: 00007ffedf5b2898 [ 379.102935][T11676] [ 380.105944][T11689] device syzkaller0 entered promiscuous mode [ 380.235503][T11689] tipc: Started in network mode [ 380.251400][T11689] tipc: Node identity 96045522e168, cluster identity 4711 [ 380.258811][T11689] tipc: Enabled bearer , priority 0 [ 380.332163][T11687] tipc: Resetting bearer [ 380.634402][T11687] tipc: Disabling bearer [ 381.504371][T11713] loop1: detected capacity change from 0 to 1024 [ 381.528386][T11713] EXT4-fs (loop1): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 381.539520][T11713] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (38281!=20869) [ 381.558914][T11713] EXT4-fs error (device loop1): ext4_ext_check_inode:520: inode #3: comm syz.1.2823: pblk 82 bad header/extent: invalid extent entries - magic f30a, entries 2, max 4(4), depth 0(0) [ 381.588550][T11713] EXT4-fs (loop1): no journal found [ 381.593922][T11713] EXT4-fs (loop1): can't get journal size [ 381.680365][T11713] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 382.698010][T11726] loop2: detected capacity change from 0 to 1024 [ 382.728726][T11725] loop5: detected capacity change from 0 to 128 [ 382.800530][T11726] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 382.851917][T11725] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 382.900519][T11725] ext4 filesystem being mounted at /274/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 382.911655][T11726] EXT4-fs (loop2): barriers disabled [ 382.916975][T11726] JBD2: no valid journal superblock found [ 382.984011][T11726] EXT4-fs (loop2): error loading journal [ 383.205542][ T7732] EXT4-fs (loop5): unmounting filesystem. [ 383.301299][ T4281] EXT4-fs (loop1): unmounting filesystem. [ 383.666434][ T4282] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 383.680012][ T4282] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 383.690070][ T4282] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 383.698612][ T4289] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 383.707376][ T4289] Bluetooth: hci5: unexpected cc 0x0c25 length: 249 > 3 [ 383.714972][ T4289] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 384.029780][T11738] rxe_eth0 speed is unknown, defaulting to 1000 [ 384.212051][T11748] device syzkaller0 entered promiscuous mode [ 384.269422][T11748] tipc: Enabled bearer , priority 0 [ 384.303672][T11747] tipc: Resetting bearer [ 384.351584][T11747] tipc: Disabling bearer [ 384.403994][T11750] loop2: detected capacity change from 0 to 8192 [ 384.476325][T11746] xt_hashlimit: size too large, truncated to 1048576 [ 384.488663][ T27] audit: type=1804 audit(1793097543.544:413): pid=11750 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.2838" name="/newroot/561/bus/bus" dev="loop2" ino=1048833 res=1 errno=0 [ 384.603674][ T27] audit: type=1800 audit(1793097543.564:414): pid=11750 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.2838" name="bus" dev="loop2" ino=1048833 res=0 errno=0 [ 384.972521][T11762] netlink: 'syz.2.2841': attribute type 10 has an invalid length. [ 385.004316][T11762] device dummy0 left promiscuous mode [ 385.483584][T11762] device dummy0 entered promiscuous mode [ 385.500076][T11762] team0: Port device dummy0 added [ 385.604676][T11738] chnl_net:caif_netlink_parms(): no params data found [ 385.696147][T11762] syz.2.2841 (11762) used greatest stack depth: 20656 bytes left [ 385.780447][ T4277] Bluetooth: hci5: command 0x0409 tx timeout [ 385.858245][T11773] netlink: 20 bytes leftover after parsing attributes in process `syz.2.2844'. [ 386.289501][T11738] bridge0: port 1(bridge_slave_0) entered blocking state [ 386.407122][T11738] bridge0: port 1(bridge_slave_0) entered disabled state [ 386.608334][T11738] device bridge_slave_0 entered promiscuous mode [ 386.647007][T11738] bridge0: port 2(bridge_slave_1) entered blocking state [ 386.685805][T11738] bridge0: port 2(bridge_slave_1) entered disabled state [ 386.731045][T11738] device bridge_slave_1 entered promiscuous mode [ 386.862414][T11738] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 386.922695][T11738] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 387.058044][T11786] tipc: Enabling of bearer rejected, failed to enable media [ 387.111241][T11738] team0: Port device team_slave_0 added [ 387.163266][T11738] team0: Port device team_slave_1 added [ 387.269482][T11738] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 387.285139][T11738] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 387.440397][T11738] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 387.521534][T11738] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 387.528523][T11738] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 387.698610][T11738] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 387.894882][ T4289] Bluetooth: hci5: command 0x041b tx timeout [ 387.946512][T11738] device hsr_slave_0 entered promiscuous mode [ 388.042569][T11738] device hsr_slave_1 entered promiscuous mode [ 388.129024][T11738] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 388.215273][T11738] Cannot create hsr debugfs directory [ 388.282119][T11799] netlink: 'syz.1.2853': attribute type 10 has an invalid length. [ 388.312667][T11799] device dummy0 left promiscuous mode [ 388.633876][T11799] team0: Device dummy0 failed to register rx_handler [ 389.905613][T11809] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2855'. [ 390.020778][ T4277] Bluetooth: hci5: command 0x040f tx timeout [ 390.431176][T11818] tipc: Enabling of bearer rejected, failed to enable media [ 390.690541][T11822] netlink: 260 bytes leftover after parsing attributes in process `syz.1.2862'. [ 391.419289][T11836] netlink: 'syz.4.2865': attribute type 10 has an invalid length. [ 391.440251][T11836] device dummy0 left promiscuous mode [ 391.494002][T11836] device dummy0 entered promiscuous mode [ 391.502012][T11836] team0: Port device dummy0 added [ 391.696122][T11738] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 391.738560][T11738] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 391.758029][T11738] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 391.788287][T11738] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 391.793047][T11845] loop1: detected capacity change from 0 to 1024 [ 391.838569][T11845] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 391.876778][T11845] EXT4-fs (loop1): barriers disabled [ 391.900322][T11845] JBD2: no valid journal superblock found [ 391.906130][T11845] EXT4-fs (loop1): error loading journal [ 392.271393][T11849] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2870'. [ 392.340701][ T4277] Bluetooth: hci5: command 0x0419 tx timeout [ 392.964509][T11738] 8021q: adding VLAN 0 to HW filter on device bond0 [ 392.979603][ T8301] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 393.015771][ T8301] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 393.027798][T11738] 8021q: adding VLAN 0 to HW filter on device team0 [ 393.039094][ T8301] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 393.048984][ T8301] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 393.057648][ T8301] bridge0: port 1(bridge_slave_0) entered blocking state [ 393.064809][ T8301] bridge0: port 1(bridge_slave_0) entered forwarding state [ 393.074539][ T8301] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 393.104603][ T8301] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 393.138306][ T8301] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 393.169838][ T8301] bridge0: port 2(bridge_slave_1) entered blocking state [ 393.177065][ T8301] bridge0: port 2(bridge_slave_1) entered forwarding state [ 393.228426][ T4498] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 393.258099][ T4498] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 393.283298][ T4498] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 393.304655][ T4498] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 393.349795][ T4498] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 393.368288][ T4498] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 393.406847][ T4498] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 393.426100][ T4498] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 393.461244][ T4498] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 393.491090][ T4498] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 393.509920][ T4498] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 393.530739][T11738] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 395.127447][ T4445] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 395.145332][ T4445] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 395.187423][T11738] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 395.295573][ T8301] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 395.321313][ T8301] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 395.395516][T11896] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2887'. [ 395.443993][T11738] device veth0_vlan entered promiscuous mode [ 395.502276][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 395.511888][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 395.559501][T11738] device veth1_vlan entered promiscuous mode [ 395.600881][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 395.618814][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 395.661507][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 395.780783][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 395.809468][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 395.845636][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 395.889475][T11738] device veth0_macvtap entered promiscuous mode [ 395.957465][T11738] device veth1_macvtap entered promiscuous mode [ 396.070918][T11738] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 396.090921][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 396.141898][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 396.155229][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 396.172647][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 396.213658][T11738] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 396.230795][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 396.249891][ T34] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 396.314049][T11738] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 396.353555][T11738] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 396.383923][T11738] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 396.411339][T11738] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 396.453027][T11906] device syzkaller0 entered promiscuous mode [ 396.651608][ T58] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 396.668600][ T58] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 396.689036][ T58] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 396.752250][ T58] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 396.768121][ T58] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 396.798272][ T4445] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 397.108545][T11929] loop0: detected capacity change from 0 to 1024 [ 397.146068][T11929] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 397.180725][T11929] EXT4-fs (loop0): barriers disabled [ 397.190325][T11929] JBD2: no valid journal superblock found [ 397.196096][T11929] EXT4-fs (loop0): error loading journal [ 397.237229][T11932] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2899'. [ 397.298880][T11932] bridge0: port 3(batadv1) entered blocking state [ 397.316994][T11932] bridge0: port 3(batadv1) entered disabled state [ 397.356596][T11932] device batadv1 entered promiscuous mode [ 397.451552][T11936] MPTCP: kernel_bind error, err=-99 [ 397.760713][T11944] device syzkaller0 entered promiscuous mode [ 397.796933][ T47] batman_adv: batadv1: No IGMP Querier present - multicast optimizations disabled [ 397.807157][ T47] batman_adv: batadv1: No MLD Querier present - multicast optimizations disabled [ 397.822163][T11946] loop5: detected capacity change from 0 to 512 [ 399.844146][T11995] loop0: detected capacity change from 0 to 164 [ 400.708813][T12004] llcp: llcp_sock_recvmsg: Recv datagram failed state 4 -512 0 [ 400.898681][T12017] device syzkaller0 entered promiscuous mode [ 402.612401][T12067] device syzkaller0 entered promiscuous mode [ 402.631413][T12069] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2943'. [ 402.837022][ T4289] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 402.848885][ T4289] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 402.857754][ T4289] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 402.896890][ T4289] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 402.911149][ T4289] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 402.918447][ T4289] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 402.989795][T12076] rxe_eth0 speed is unknown, defaulting to 1000 [ 403.048236][T12081] Bluetooth: MGMT ver 1.22 [ 403.054373][T12081] Bluetooth: hci0: add_remote_oob_data: invalid len of 70 bytes [ 403.578901][T12105] device syzkaller0 entered promiscuous mode [ 403.802364][T12113] device syzkaller0 entered promiscuous mode [ 403.934645][T12076] chnl_net:caif_netlink_parms(): no params data found [ 404.175483][T12076] bridge0: port 1(bridge_slave_0) entered blocking state [ 404.215490][T12076] bridge0: port 1(bridge_slave_0) entered disabled state [ 404.246989][T12076] device bridge_slave_0 entered promiscuous mode [ 404.274229][T12076] bridge0: port 2(bridge_slave_1) entered blocking state [ 404.299244][T12076] bridge0: port 2(bridge_slave_1) entered disabled state [ 404.318122][T12076] device bridge_slave_1 entered promiscuous mode [ 404.379557][T12076] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 404.402241][T12076] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 404.457336][T12140] loop5: detected capacity change from 0 to 1024 [ 404.472282][T12076] team0: Port device team_slave_0 added [ 404.515685][T12076] team0: Port device team_slave_1 added [ 404.521887][T12140] EXT4-fs (loop5): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 404.542682][T12140] EXT4-fs (loop5): barriers disabled [ 404.548086][T12140] JBD2: no valid journal superblock found [ 404.560317][T12140] EXT4-fs (loop5): error loading journal [ 404.573577][T12076] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 404.577771][T12144] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2971'. [ 404.683779][T12076] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 404.747833][T12076] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 404.771114][T12076] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 404.778147][T12076] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 404.826497][T12076] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 404.873056][T12076] device hsr_slave_0 entered promiscuous mode [ 404.880994][T12076] device hsr_slave_1 entered promiscuous mode [ 404.888731][T12076] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 404.896593][T12076] Cannot create hsr debugfs directory [ 404.980397][ T4277] Bluetooth: hci0: command 0x0409 tx timeout [ 405.038584][T12155] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2975'. [ 405.659929][T12171] netlink: 108 bytes leftover after parsing attributes in process `syz.0.2982'. [ 405.663228][T12076] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 405.712494][T12076] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 405.743066][T12076] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 405.767714][T12076] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 405.800105][T12173] device syzkaller0 entered promiscuous mode [ 406.381035][T12076] 8021q: adding VLAN 0 to HW filter on device bond0 [ 406.434336][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 406.471755][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 406.496752][T12076] 8021q: adding VLAN 0 to HW filter on device team0 [ 406.517162][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 406.568483][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 406.589100][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 406.596305][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 406.656357][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 406.680071][ T4498] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 406.705203][ T4498] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 406.739822][ T4498] bridge0: port 2(bridge_slave_1) entered blocking state [ 406.747011][ T4498] bridge0: port 2(bridge_slave_1) entered forwarding state [ 406.817222][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 406.868496][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 406.892188][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 406.933806][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 406.981922][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 407.026642][T12223] device syzkaller0 entered promiscuous mode [ 407.048707][ T4498] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 407.070337][ T4277] Bluetooth: hci0: command 0x041b tx timeout [ 407.071058][ T4498] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 407.099593][ T4498] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 407.109148][ T4498] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 407.122440][T12076] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 407.137742][T12228] loop2: detected capacity change from 0 to 1024 [ 407.165378][T12076] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 407.185289][T12228] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 407.201812][T12224] device syzkaller0 entered promiscuous mode [ 407.215795][T12228] EXT4-fs (loop2): barriers disabled [ 407.228127][T12228] JBD2: no valid journal superblock found [ 407.247358][T12228] EXT4-fs (loop2): error loading journal [ 407.371812][ T4498] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 407.391004][ T4498] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 408.204682][ T4498] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 408.223701][ T4498] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 408.257930][T12076] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 408.352601][T12268] device syzkaller1 entered promiscuous mode [ 408.954983][T12290] device syzkaller0 entered promiscuous mode [ 409.148480][ T4277] Bluetooth: hci0: command 0x040f tx timeout [ 409.471307][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 409.513214][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 409.522100][T12308] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3024'. [ 409.531373][T12308] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3024'. [ 409.553676][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 409.563132][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 409.575022][T12076] device veth0_vlan entered promiscuous mode [ 409.591740][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 409.640897][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 409.665305][T12076] device veth1_vlan entered promiscuous mode [ 409.800845][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 409.819137][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 409.870608][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 409.900074][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 409.932982][T12076] device veth0_macvtap entered promiscuous mode [ 409.944434][T12326] loop1: detected capacity change from 0 to 1024 [ 409.963402][T12076] device veth1_macvtap entered promiscuous mode [ 410.019203][T12326] EXT4-fs (loop1): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 410.033180][T12076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 410.062815][T12326] EXT4-fs (loop1): barriers disabled [ 410.076942][T12076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 410.088119][T12326] JBD2: no valid journal superblock found [ 410.117012][T12076] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 410.119548][T12326] EXT4-fs (loop1): error loading journal [ 410.142407][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 410.247563][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 410.281339][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 410.317045][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 410.330019][T12076] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 410.356185][T12076] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 410.410503][T12076] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 411.230335][ T4277] Bluetooth: hci0: command 0x0419 tx timeout [ 411.886142][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 411.905665][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 411.946826][T12076] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 411.986662][T12076] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 412.012228][T12076] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 412.051541][T12076] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 412.341102][ T9] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 412.362900][ T9] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 412.393574][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 412.425452][ T4446] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 412.455271][ T4446] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 412.473052][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 412.602634][T12357] netlink: 1363 bytes leftover after parsing attributes in process `syz.4.2933'. [ 412.953338][T12368] device bridge0 entered promiscuous mode [ 413.609723][T12377] loop0: detected capacity change from 0 to 1024 [ 413.637148][T12377] EXT4-fs (loop0): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 413.648229][T12377] EXT4-fs (loop0): ext4_check_descriptors: Checksum for group 0 failed (38281!=20869) [ 413.666308][T12377] EXT4-fs error (device loop0): ext4_ext_check_inode:520: inode #3: comm syz.0.3046: pblk 82 bad header/extent: invalid extent entries - magic f30a, entries 2, max 4(4), depth 0(0) [ 413.692313][T12377] EXT4-fs (loop0): no journal found [ 413.697700][T12377] EXT4-fs (loop0): can't get journal size [ 413.888924][T12377] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: writeback. [ 414.971244][ T4289] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 414.991185][ T4282] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 414.999711][ T4282] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 415.013405][ T4289] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 415.021684][ T4282] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 415.029770][ T4289] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 415.131648][T12394] device syzkaller1 entered promiscuous mode [ 415.176759][T12392] rxe_eth0 speed is unknown, defaulting to 1000 [ 415.194543][T11738] EXT4-fs (loop0): unmounting filesystem. [ 415.996728][T12405] loop2: detected capacity change from 0 to 164 [ 416.757960][ T4445] tipc: Left network mode [ 417.060505][ T4277] Bluetooth: hci2: command 0x0409 tx timeout [ 419.141924][ T4277] Bluetooth: hci2: command 0x041b tx timeout [ 419.924595][T12392] chnl_net:caif_netlink_parms(): no params data found [ 419.975339][T12450] tipc: Enabling of bearer rejected, failed to enable media [ 420.114344][T12464] device vlan0 entered promiscuous mode [ 420.148276][T12468] loop2: detected capacity change from 0 to 1024 [ 420.200849][T12468] EXT4-fs (loop2): ext4_check_descriptors: Checksum for group 0 failed (38034!=20869) [ 420.247764][T12468] EXT4-fs (loop2): barriers disabled [ 420.290273][T12468] JBD2: no valid journal superblock found [ 420.296101][T12468] EXT4-fs (loop2): error loading journal [ 420.640684][T12392] bridge0: port 1(bridge_slave_0) entered blocking state [ 420.655520][T12392] bridge0: port 1(bridge_slave_0) entered disabled state [ 420.682266][T12392] device bridge_slave_0 entered promiscuous mode [ 420.801923][T12392] bridge0: port 2(bridge_slave_1) entered blocking state [ 420.814928][T12392] bridge0: port 2(bridge_slave_1) entered disabled state [ 420.846872][T12392] device bridge_slave_1 entered promiscuous mode [ 420.979467][T12392] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 421.107499][T12392] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 421.230274][ T4277] Bluetooth: hci2: command 0x040f tx timeout [ 421.336102][T12392] team0: Port device team_slave_0 added [ 421.403301][T12392] team0: Port device team_slave_1 added [ 421.517346][T12507] device syzkaller0 entered promiscuous mode [ 421.723399][T12392] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 421.747630][T12392] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 421.846794][T12392] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 423.300597][ T4277] Bluetooth: hci2: command 0x0419 tx timeout [ 424.122270][T12392] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 424.134089][T12392] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 424.162853][T12392] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 424.430933][T12392] device hsr_slave_0 entered promiscuous mode [ 424.448363][T12392] device hsr_slave_1 entered promiscuous mode [ 424.477745][T12392] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 424.497970][T12392] Cannot create hsr debugfs directory [ 424.528483][T12554] netlink: 1363 bytes leftover after parsing attributes in process `syz.0.3084'. [ 424.582033][ T4445] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 424.612220][ T4445] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 424.636305][ T4445] device batadv1 left promiscuous mode [ 424.657780][ T4445] bridge0: port 3(batadv1) entered disabled state [ 424.696683][ T4445] bridge0: port 2(bridge_slave_1) entered disabled state [ 424.731806][ T4445] bridge0: port 1(bridge_slave_0) entered disabled state [ 425.814286][ T4445] team0 (unregistering): Port device team_slave_1 removed [ 425.872177][ T4445] team0 (unregistering): Port device team_slave_0 removed [ 425.914654][ T4445] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 425.958752][ T4445] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 426.268958][ T4445] bond0 (unregistering): Released all slaves [ 427.952078][T12636] batman_adv: batadv0: Adding interface: syzkaller0 [ 427.973895][T12636] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 428.142248][T12636] batman_adv: batadv0: Interface activated: syzkaller0 [ 428.249489][T12647] tipc: Started in network mode [ 428.292309][T12647] tipc: Node identity 761d0daed743, cluster identity 4711 [ 428.376570][T12647] tipc: Enabled bearer , priority 0 [ 428.433143][T12635] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 428.546374][T12635] batman_adv: batadv0: Removing interface: syzkaller0 [ 428.869652][T12392] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 428.926289][T12392] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 428.970653][T12645] tipc: Disabling bearer [ 428.989446][T12392] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 429.029281][T12392] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 429.276830][T12392] 8021q: adding VLAN 0 to HW filter on device bond0 [ 429.341643][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 429.350761][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 429.392264][T12392] 8021q: adding VLAN 0 to HW filter on device team0 [ 429.485869][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 429.509285][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 429.552222][ T4545] bridge0: port 1(bridge_slave_0) entered blocking state [ 429.559373][ T4545] bridge0: port 1(bridge_slave_0) entered forwarding state [ 429.592266][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 429.610059][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 429.641842][ T4545] bridge0: port 2(bridge_slave_1) entered blocking state [ 429.649023][ T4545] bridge0: port 2(bridge_slave_1) entered forwarding state [ 429.671158][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 429.680538][ T4545] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 429.714713][T12679] device vlan0 entered promiscuous mode [ 429.726610][T12678] netlink: 108 bytes leftover after parsing attributes in process `syz.2.3112'. [ 429.758819][T12679] team0: Port device vlan0 added [ 429.785247][T12671] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 429.811843][T12671] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 429.819442][T12671] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 429.829013][T12671] device bridge_slave_0 left promiscuous mode [ 429.836238][T12671] bridge0: port 1(bridge_slave_0) entered disabled state [ 429.855305][T12671] device bridge_slave_1 left promiscuous mode [ 429.861848][T12671] bridge0: port 2(bridge_slave_1) entered disabled state [ 429.873086][T12671] bond0: (slave bond_slave_0): Releasing backup interface [ 429.889352][T12671] bond0: (slave bond_slave_1): Releasing backup interface [ 429.929631][T12671] team0: Port device team_slave_0 removed [ 429.956744][T12671] team0: Port device team_slave_1 removed [ 429.968852][T12671] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 429.986557][T12671] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 429.999072][T12671] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 430.007403][T12671] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 430.036712][T12671] team0: Port device vlan0 removed [ 430.057329][T12676] team0: Mode changed to "loadbalance" [ 430.069495][ T4445] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 430.089156][ T4445] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 430.120086][ T4445] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 430.186750][ T4445] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 430.207150][ T4445] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 430.229608][T12683] netlink: 36 bytes leftover after parsing attributes in process `syz.0.3113'. [ 430.249645][T12679] tipc: Enabled bearer , priority 0 [ 430.279572][ T4445] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 430.292407][ T4445] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 430.308835][ T4445] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 430.318330][ T4445] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 430.327554][ T4445] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 430.343138][T12392] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 430.365388][T12695] netlink: 1363 bytes leftover after parsing attributes in process `syz.5.3115'. [ 430.547246][T12703] tipc: Enabled bearer , priority 0 [ 430.587981][T12702] tipc: Disabling bearer [ 430.707707][T12710] batman_adv: batadv0: Adding interface: syzkaller0 [ 430.730427][T12710] batman_adv: batadv0: The MTU of interface syzkaller0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 430.816685][T12710] batman_adv: batadv0: Interface activated: syzkaller0 [ 430.875832][T12709] batman_adv: batadv0: Interface deactivated: syzkaller0 [ 430.971437][T12709] batman_adv: batadv0: Removing interface: syzkaller0 [ 431.116306][ T4515] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 431.128806][ T4515] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 431.163990][T12392] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 431.202391][T12733] netlink: 36 bytes leftover after parsing attributes in process `syz.4.3126'. [ 431.243712][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 431.258174][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 431.279333][T12736] device syzkaller0 entered promiscuous mode [ 431.375197][ T4447] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 431.387866][ T4447] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 431.485923][ T4447] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 431.511219][ T4447] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 431.535394][T12392] device veth0_vlan entered promiscuous mode [ 431.599151][T12392] device veth1_vlan entered promiscuous mode [ 431.618111][T12746] Cannot find set identified by id 0 to match [ 431.697547][ T7] tipc: Node number set to 2707295662 [ 431.726226][ T4445] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 431.742566][ T4445] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 431.751912][ T4445] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 431.793008][ T4445] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 431.829902][T12392] device veth0_macvtap entered promiscuous mode [ 431.855297][T12751] tipc: Enabled bearer , priority 0 [ 431.869744][T12392] device veth1_macvtap entered promiscuous mode [ 431.909243][T12747] tipc: Disabling bearer [ 431.932689][T12756] netlink: 84 bytes leftover after parsing attributes in process `syz.2.3134'. [ 431.944807][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 431.978836][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 432.015493][T12392] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 432.049751][T12392] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 432.092403][T12392] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 432.110045][T12760] device syzkaller0 entered promiscuous mode [ 432.156485][ T4445] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 432.199727][ T4445] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 432.232507][T12392] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 432.250323][T12392] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 432.278246][T12392] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 432.368008][T12762] device syzkaller0 entered promiscuous mode [ 432.477652][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 432.505486][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 432.547942][T12392] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 432.576759][T12392] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 432.616716][T12392] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 432.658914][T12392] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 432.834898][T12796] netlink: 108 bytes leftover after parsing attributes in process `syz.0.3143'. [ 433.489192][T12815] loop5: detected capacity change from 0 to 1024 [ 433.521198][T12815] EXT4-fs (loop5): ext4_check_descriptors: Block bitmap for group 0 overlaps block group descriptors [ 433.532332][T12815] EXT4-fs (loop5): ext4_check_descriptors: Checksum for group 0 failed (38281!=20869) [ 433.564341][T12815] EXT4-fs error (device loop5): ext4_ext_check_inode:520: inode #3: comm syz.5.3146: pblk 82 bad header/extent: invalid extent entries - magic f30a, entries 2, max 4(4), depth 0(0) [ 433.597657][T12815] EXT4-fs (loop5): no journal found [ 433.603005][T12815] EXT4-fs (loop5): can't get journal size [ 433.707956][T12815] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 436.531492][ T7732] EXT4-fs (loop5): unmounting filesystem. [ 436.680868][ T4447] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 436.688772][ T4447] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 436.763087][ T4498] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 436.787781][T12837] device syzkaller0 entered promiscuous mode [ 436.822119][ T4498] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 436.850526][ T4498] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 436.900025][T12846] xt_cluster: you have exceeded the maximum number of cluster nodes (2048 > 32) [ 437.560395][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 437.771326][T12848] tipc: Started in network mode [ 437.776255][T12848] tipc: Node identity 02f2d076616, cluster identity 4711 [ 437.802077][T12848] tipc: Enabled bearer , priority 0 [ 437.857706][T12855] tipc: Resetting bearer [ 437.971126][T12870] netlink: 108 bytes leftover after parsing attributes in process `syz.4.3156'. [ 437.992998][T12873] netlink: 'syz.1.3044': attribute type 1 has an invalid length. [ 438.051226][T12847] tipc: Disabling bearer [ 438.217246][T12883] device syzkaller0 entered promiscuous mode [ 438.463153][T12887] device syzkaller0 entered promiscuous mode [ 439.109258][ T4282] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 439.124495][ T4282] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 439.135358][ T4282] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 439.144622][ T4282] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 439.163479][ T4282] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 439.171074][ T4282] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 439.971158][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.977872][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.670239][ T4282] Bluetooth: hci2: command 0x0405 tx timeout [ 441.225683][ T4277] Bluetooth: hci3: command 0x0409 tx timeout [ 442.311428][T12908] rxe_eth0 speed is unknown, defaulting to 1000 [ 442.433214][T12949] device syzkaller0 entered promiscuous mode [ 442.906309][T12966] tipc: Enabled bearer , priority 0 [ 443.302515][T12965] tipc: Disabling bearer [ 443.441356][ T4282] Bluetooth: hci3: command 0x041b tx timeout [ 443.471861][T12974] device lo left promiscuous mode [ 443.678355][T12984] netlink: 108 bytes leftover after parsing attributes in process `syz.5.3187'. [ 443.738942][ T4545] tipc: Left network mode [ 443.942418][T12981] device syzkaller0 entered promiscuous mode [ 444.128161][T12908] chnl_net:caif_netlink_parms(): no params data found [ 445.461149][ T4282] Bluetooth: hci3: command 0x040f tx timeout [ 446.463573][T13038] netlink: 108 bytes leftover after parsing attributes in process `syz.4.3198'. [ 446.537639][T12908] bridge0: port 1(bridge_slave_0) entered blocking state [ 446.551638][T12908] bridge0: port 1(bridge_slave_0) entered disabled state [ 446.584299][T12908] device bridge_slave_0 entered promiscuous mode [ 446.681385][T12908] bridge0: port 2(bridge_slave_1) entered blocking state [ 446.699825][T12908] bridge0: port 2(bridge_slave_1) entered disabled state [ 446.718548][T12908] device bridge_slave_1 entered promiscuous mode [ 446.817463][T12908] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 446.851487][T12908] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 446.884863][T13056] ip_tables: iptables: counters copy to user failed while replacing table [ 446.963797][T12908] team0: Port device team_slave_0 added [ 447.027092][T12908] team0: Port device team_slave_1 added [ 447.308440][T13060] device syzkaller0 entered promiscuous mode [ 447.343468][T12908] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 447.367752][T12908] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 447.616143][ T4282] Bluetooth: hci3: command 0x0419 tx timeout [ 448.107833][T12908] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 448.255972][T13073] netlink: 'syz.5.3207': attribute type 2 has an invalid length. [ 450.026610][T13106] netlink: 88 bytes leftover after parsing attributes in process `syz.5.3215'. [ 451.975368][T12908] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 451.982523][T12908] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 452.009077][T12908] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 452.204251][T12908] device hsr_slave_0 entered promiscuous mode [ 452.244826][T12908] device hsr_slave_1 entered promiscuous mode [ 452.311247][T12908] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 452.319251][T12908] Cannot create hsr debugfs directory [ 452.360118][ T4545] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 452.370880][T13122] ip_tables: iptables: counters copy to user failed while replacing table [ 452.401105][ T4545] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 452.421633][ T4545] bridge0: port 2(bridge_slave_1) entered disabled state [ 452.434065][T13122] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3219'. [ 452.451172][ T4545] bridge0: port 1(bridge_slave_0) entered disabled state [ 452.732261][T13141] netlink: 88 bytes leftover after parsing attributes in process `syz.4.3225'. [ 453.683567][ T4545] team0 (unregistering): Port device team_slave_1 removed [ 453.729567][ T4545] team0 (unregistering): Port device team_slave_0 removed [ 453.773529][ T4545] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 453.817516][ T4545] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 454.092858][ T4545] device dummy0 left promiscuous mode [ 454.099105][ T4545] team0 (unregistering): Port device dummy0 removed [ 454.151840][ T4545] bond0 (unregistering): Released all slaves [ 456.573904][T13204] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3238'. [ 456.623315][T13204] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 456.632876][T13204] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 456.641890][T13204] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 456.650866][T13204] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 456.713300][T13220] netlink: 'syz.0.3240': attribute type 2 has an invalid length. [ 456.722310][T13206] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3238'. [ 456.801215][T13206] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3238'. [ 457.068004][T13226] device syzkaller0 entered promiscuous mode [ 457.273010][T13239] loop1: detected capacity change from 0 to 164 [ 459.803768][T13241] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 460.036098][T12908] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 460.095357][T12908] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 460.128876][T12908] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 460.172453][T12908] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 460.221988][T13295] device syzkaller0 entered promiscuous mode [ 460.408240][T13307] netlink: 104 bytes leftover after parsing attributes in process `syz.5.3260'. [ 460.563087][T12908] 8021q: adding VLAN 0 to HW filter on device bond0 [ 460.607319][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 460.624346][ T47] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 460.627550][T13315] loop4: detected capacity change from 0 to 164 [ 460.636043][T12908] 8021q: adding VLAN 0 to HW filter on device team0 [ 460.700511][ T4447] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 460.724285][ T4447] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 460.740989][ T4447] bridge0: port 1(bridge_slave_0) entered blocking state [ 460.748101][ T4447] bridge0: port 1(bridge_slave_0) entered forwarding state [ 460.828182][ T4447] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 460.838421][ T4447] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 460.847367][ T4447] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 460.858552][ T4447] bridge0: port 2(bridge_slave_1) entered blocking state [ 460.865741][ T4447] bridge0: port 2(bridge_slave_1) entered forwarding state [ 460.875679][ T4447] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 460.907662][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 460.917444][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 460.929551][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 460.960872][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 460.977953][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 460.997424][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 461.009605][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 461.028745][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 461.064967][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 461.074122][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 461.086993][T12908] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 461.354436][T13332] netdevsim netdevsim1 netdevsim0: set [1, 1] type 2 family 0 port 19999 - 0 [ 461.364800][T13332] netdevsim netdevsim1 netdevsim1: set [1, 1] type 2 family 0 port 19999 - 0 [ 461.374300][T13332] netdevsim netdevsim1 netdevsim2: set [1, 1] type 2 family 0 port 19999 - 0 [ 461.383856][T13332] netdevsim netdevsim1 netdevsim3: set [1, 1] type 2 family 0 port 19999 - 0 [ 461.395319][T13332] device geneve2 entered promiscuous mode [ 461.557115][T12908] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 461.573283][ T8301] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 461.595418][ T8301] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 461.669015][ T8301] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 461.685236][ T8301] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 461.757174][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 461.766149][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 461.775465][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 461.785413][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 461.799608][T12908] device veth0_vlan entered promiscuous mode [ 461.815734][T12908] device veth1_vlan entered promiscuous mode [ 461.892629][ T4447] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 461.901212][ T4447] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 461.909397][ T4447] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 461.918510][ T4447] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 461.935642][T12908] device veth0_macvtap entered promiscuous mode [ 461.953489][T12908] device veth1_macvtap entered promiscuous mode [ 461.975752][T12908] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 461.987010][T12908] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 461.999537][T12908] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 462.017989][T12908] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 462.031055][T12908] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 462.039045][ T8301] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 462.054300][ T8301] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 462.073243][ T4545] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 462.081462][ T4545] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 462.095188][ T4545] bridge0: port 2(bridge_slave_1) entered disabled state [ 462.104299][ T4545] bridge0: port 1(bridge_slave_0) entered disabled state [ 462.591260][ T4545] team0 (unregistering): Port device team_slave_1 removed [ 462.639750][ T4545] team0 (unregistering): Port device team_slave_0 removed [ 462.688871][ T4545] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 462.730314][ T4545] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 463.049668][ T4545] bond0 (unregistering): Released all slaves [ 463.110869][T12908] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 463.121523][T12908] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 463.131467][T12908] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 463.142038][T12908] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 463.155753][T12908] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 463.167184][T12908] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 463.176081][T12908] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 463.188962][T12908] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 463.197768][T12908] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 463.208407][ T8301] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 463.217713][ T8301] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 463.333368][T13302] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 463.447495][ T4447] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 463.486589][ T4447] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 463.516950][ T4446] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 463.571359][ T47] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 463.579259][ T47] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 463.582928][T13352] netlink: 108 bytes leftover after parsing attributes in process `syz.4.3272'. [ 463.676880][ T4445] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 463.884364][T13367] bond0: (slave bond_slave_0): Slave does not support ipsec offload [ 463.884769][T13363] loop4: detected capacity change from 0 to 164 [ 464.898082][T13378] device syzkaller0 entered promiscuous mode [ 465.091508][T13396] ip_tables: iptables: counters copy to user failed while replacing table [ 465.215069][T13401] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. [ 465.305558][T13405] device syzkaller0 entered promiscuous mode [ 465.713771][T13424] device syzkaller0 entered promiscuous mode [ 466.132247][T13444] device syzkaller0 entered promiscuous mode [ 468.790394][T13430] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 469.085972][T13470] device syzkaller0 entered promiscuous mode [ 469.195190][T13480] netlink: 'syz.5.3319': attribute type 1 has an invalid length. [ 469.396766][T13477] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3316'. [ 469.437673][T13477] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 469.446588][T13477] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 469.455349][T13477] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 469.464276][T13477] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 469.490816][T13495] ksmbd: Daemon and kernel module version mismatch. ksmbd: 124, kernel module: 1. User-space ksmbd should terminate. [ 469.563889][T13478] netlink: 'syz.4.3318': attribute type 12 has an invalid length. [ 469.810738][T13505] tipc: Enabled bearer , priority 0 [ 469.857478][T13505] tipc: Resetting bearer [ 469.999859][T13503] tipc: Disabling bearer [ 470.141522][T13493] device syzkaller0 entered promiscuous mode [ 472.586494][T13528] tipc: Enabling of bearer rejected, failed to enable media [ 472.899855][T13576] netlink: 'syz.4.3338': attribute type 1 has an invalid length. [ 472.922074][T13576] netlink: 'syz.4.3338': attribute type 2 has an invalid length. [ 472.957253][T13579] device syzkaller0 entered promiscuous mode [ 473.003828][T13579] [ 473.006198][T13579] ============================================ [ 473.012353][T13579] WARNING: possible recursive locking detected [ 473.018566][T13579] syzkaller #0 Not tainted [ 473.022989][T13579] -------------------------------------------- [ 473.029145][T13579] syz.5.3339/13579 is trying to acquire lock: [ 473.035253][T13579] ffff8880569a0108 (&sch->root_lock_key#858){+...}-{2:2}, at: __dev_queue_xmit+0xe46/0x3810 [ 473.045415][T13579] [ 473.045415][T13579] but task is already holding lock: [ 473.052761][T13579] ffff8880569a0108 (&sch->root_lock_key#858){+...}-{2:2}, at: __dev_queue_xmit+0xe46/0x3810 [ 473.062851][T13579] [ 473.062851][T13579] other info that might help us debug this: [ 473.070928][T13579] Possible unsafe locking scenario: [ 473.070928][T13579] [ 473.078388][T13579] CPU0 [ 473.081680][T13579] ---- [ 473.084966][T13579] lock(&sch->root_lock_key#858); [ 473.090145][T13579] lock(&sch->root_lock_key#858); [ 473.095281][T13579] [ 473.095281][T13579] *** DEADLOCK *** [ 473.095281][T13579] [ 473.103424][T13579] May be due to missing lock nesting notation [ 473.103424][T13579] [ 473.111728][T13579] 3 locks held by syz.5.3339/13579: [ 473.116911][T13579] #0: ffffffff8db2d900 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x281/0x3810 [ 473.126829][T13579] #1: ffff8880569a0108 (&sch->root_lock_key#858){+...}-{2:2}, at: __dev_queue_xmit+0xe46/0x3810 [ 473.137349][T13579] #2: ffffffff8db2d900 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x281/0x3810 [ 473.147262][T13579] [ 473.147262][T13579] stack backtrace: [ 473.153135][T13579] CPU: 0 PID: 13579 Comm: syz.5.3339 Not tainted syzkaller #0 [ 473.160583][T13579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 [ 473.170653][T13579] Call Trace: [ 473.173925][T13579] [ 473.176848][T13579] dump_stack_lvl+0x188/0x24e [ 473.181525][T13579] ? show_regs_print_info+0x12/0x12 [ 473.186719][T13579] ? print_deadlock_bug+0x435/0x5d0 [ 473.191929][T13579] __lock_acquire+0x690e/0x7ea0 [ 473.196781][T13579] ? add_lock_to_list+0x191/0x280 [ 473.201805][T13579] ? verify_lock_unused+0x140/0x140 [ 473.206993][T13579] ? verify_lock_unused+0x140/0x140 [ 473.212179][T13579] ? __lock_acquire+0x36d9/0x7ea0 [ 473.217201][T13579] ? is_bpf_text_address+0x28b/0x2a0 [ 473.222552][T13579] lock_acquire+0x1bc/0x4a0 [ 473.227067][T13579] ? __dev_queue_xmit+0xe46/0x3810 [ 473.232200][T13579] ? read_lock_is_recursive+0x10/0x10 [ 473.237578][T13579] ? rcu_lockdep_current_cpu_online+0x33/0x120 [ 473.243848][T13579] ? rcu_read_lock_bh_held+0x76/0xf0 [ 473.249163][T13579] ? rcu_read_lock_held+0x40/0x40 [ 473.254212][T13579] _raw_spin_lock+0x2a/0x40 [ 473.258736][T13579] ? __dev_queue_xmit+0xe46/0x3810 [ 473.263930][T13579] __dev_queue_xmit+0xe46/0x3810 [ 473.268980][T13579] ? __dev_queue_xmit+0x281/0x3810 [ 473.274108][T13579] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 473.280119][T13579] ? __lock_acquire+0x7ea0/0x7ea0 [ 473.285154][T13579] ? netdev_core_pick_tx+0x360/0x360 [ 473.290525][T13579] ? _raw_spin_unlock_irqrestore+0x82/0x120 [ 473.296421][T13579] ? lockdep_hardirqs_on+0x94/0x140 [ 473.301615][T13579] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 473.307506][T13579] ? _raw_spin_unlock+0x40/0x40 [ 473.312349][T13579] ? stack_trace_save+0xa6/0xf0 [ 473.317281][T13579] ? stack_trace_snprint+0xe0/0xe0 [ 473.322407][T13579] ? tcf_mirred_offload_act_setup+0xb00/0xb00 [ 473.328521][T13579] sch_frag_xmit_hook+0x2a4/0x11c0 [ 473.333674][T13579] ? kasan_set_track+0x60/0x70 [ 473.338439][T13579] ? kasan_set_track+0x4b/0x70 [ 473.343195][T13579] ? slab_post_alloc_hook+0x4b/0x490 [ 473.348475][T13579] ? kmem_cache_alloc+0x18b/0x2f0 [ 473.353489][T13579] ? skb_clone+0x1e7/0x370 [ 473.357901][T13579] ? tcf_mirred_act+0x563/0x1640 [ 473.362827][T13579] ? tcf_action_exec+0x174/0x590 [ 473.367774][T13579] ? basic_classify+0x1ae/0x2c0 [ 473.372682][T13579] ? tcf_classify+0x33e/0xbf0 [ 473.377353][T13579] ? qfq_enqueue+0x31c/0x12c0 [ 473.382083][T13579] ? dev_qdisc_enqueue+0x4c/0x2b0 [ 473.387101][T13579] ? __dev_queue_xmit+0x1031/0x3810 [ 473.392286][T13579] ? packet_sendmsg+0x3a9e/0x4c30 [ 473.397354][T13579] ? ____sys_sendmsg+0x5ed/0x9a0 [ 473.402302][T13579] ? mq_dump_class_stats+0x490/0x490 [ 473.407589][T13579] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 473.413672][T13579] ? __copy_skb_header+0x3ba/0x4f0 [ 473.418790][T13579] ? memcpy+0x3c/0x60 [ 473.422774][T13579] ? __copy_skb_header+0x3ba/0x4f0 [ 473.427915][T13579] ? __skb_clone+0x446/0x6c0 [ 473.432505][T13579] ? skb_clone+0x21b/0x370 [ 473.436912][T13579] ? tcf_mirred_act+0x552/0x1640 [ 473.441842][T13579] tcf_mirred_act+0xb1c/0x1640 [ 473.446603][T13579] tcf_action_exec+0x174/0x590 [ 473.451359][T13579] basic_classify+0x1ae/0x2c0 [ 473.456031][T13579] tcf_classify+0x33e/0xbf0 [ 473.460535][T13579] qfq_enqueue+0x31c/0x12c0 [ 473.465053][T13579] ? sch_tree_lock+0x1b0/0x1b0 [ 473.469833][T13579] ? do_raw_spin_lock+0x128/0x2f0 [ 473.474863][T13579] ? __rwlock_init+0x140/0x140 [ 473.479621][T13579] dev_qdisc_enqueue+0x4c/0x2b0 [ 473.484473][T13579] __dev_queue_xmit+0x1031/0x3810 [ 473.489576][T13579] ? __dev_queue_xmit+0x281/0x3810 [ 473.494675][T13579] ? _copy_from_iter+0x5df/0x1130 [ 473.499696][T13579] ? netdev_core_pick_tx+0x360/0x360 [ 473.504969][T13579] ? virtio_net_hdr_to_skb+0x938/0x12b0 [ 473.510507][T13579] ? packet_extra_vlan_len_allowed+0x200/0x200 [ 473.516652][T13579] ? dev_get_by_index+0x1e/0x2d0 [ 473.521586][T13579] ? skb_put+0x10e/0x200 [ 473.525833][T13579] packet_sendmsg+0x3a9e/0x4c30 [ 473.530688][T13579] ? verify_lock_unused+0x140/0x140 [ 473.535883][T13579] ? aa_sk_perm+0x81f/0x950 [ 473.540491][T13579] ? aa_af_perm+0x340/0x340 [ 473.544985][T13579] ? packet_getsockopt+0x980/0x980 [ 473.550108][T13579] ? apparmor_socket_sendmsg+0x8a/0x330 [ 473.555658][T13579] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 473.561003][T13579] ? security_socket_sendmsg+0x7c/0xa0 [ 473.566457][T13579] ? packet_getsockopt+0x980/0x980 [ 473.571558][T13579] ____sys_sendmsg+0x5ed/0x9a0 [ 473.576329][T13579] ? __sys_sendmsg_sock+0x30/0x30 [ 473.581347][T13579] ? __import_iovec+0x306/0x510 [ 473.586195][T13579] ? import_iovec+0x6f/0xa0 [ 473.590695][T13579] ___sys_sendmsg+0x2a2/0x360 [ 473.595371][T13579] ? __sys_sendmsg+0x2a0/0x2a0 [ 473.600146][T13579] __se_sys_sendmsg+0x1c3/0x2b0 [ 473.604989][T13579] ? __x64_sys_sendmsg+0x80/0x80 [ 473.609926][T13579] ? lockdep_hardirqs_on+0x94/0x140 [ 473.615121][T13579] do_syscall_64+0x4c/0xa0 [ 473.619525][T13579] ? clear_bhb_loop+0x60/0xb0 [ 473.624193][T13579] ? clear_bhb_loop+0x60/0xb0 [ 473.628881][T13579] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 473.634769][T13579] RIP: 0033:0x7f72ea59f559 [ 473.639192][T13579] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 473.658790][T13579] RSP: 002b:00007f72eb55c028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 473.667204][T13579] RAX: ffffffffffffffda RBX: 00007f72ea825fa0 RCX: 00007f72ea59f559 [ 473.675163][T13579] RDX: 0000000000004005 RSI: 00002000000004c0 RDI: 0000000000000006 [ 473.683126][T13579] RBP: 00007f72ea636b20 R08: 0000000000000000 R09: 0000000000000000 [ 473.691089][T13579] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 473.699048][T13579] R13: 00007f72ea826038 R14: 00007f72ea825fa0 R15: 00007ffe53850458 [ 473.707032][T13579] [ 473.786472][T13594] dccp_invalid_packet: P.Data Offset(4) too small