last executing test programs: 20.077693175s ago: executing program 4 (id=801): ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000340), 0x2) r2 = memfd_create(&(0x7f0000000540)='y\x105\xfb\xf7u\x83%\x1f\xe09@:r\xc2\xb9x0\x90P\x03\x00\x00\x00\x00\x00\x00\x00\xfe,\x1c\xf1\xdd\xcf]\xac\xbc\t\xbb\xfc\xa4j\x9f\xceX\x8f5=\xaa\xd5\xe9n\xab s\xa5\x00\x8d\tV\t\x91\x18\x06O\xb0=D\xda\xb6F\x1a\xc82\x8b\xc0l\xd0\x89d\xe6\xb7\xd8\x97\xb8\xde\xa3\x89\"%/u\x17\xdam\x8d\x01Lh\x1e^\x9ej\x1c\xc5\xf0\xf6\x92\x05\x9aH\x00\'\xd4\x94d[\v\xfc\xad\x0f\xa8\xc5\xad\x001\x8b%\xaa?\x00\x00\x00\x00\x00\x00\x00\nj\x8c\xef\x90\xc0Z\xfa\x1a\xb3\xf0wVq\xe9d\xf8N\x80\xd1g\xd8e\xc8\x16\xad1\x02\xab\xce3\xb2\xb0\xd1\x11\xf0\xc2Gj+kV', 0x2) ftruncate(r2, 0xffff) fcntl$addseals(r2, 0x409, 0x7) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000003ec0), 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_ADD_NAN_FUNCTION(r4, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20002000}, 0xc, &(0x7f0000000140)={&(0x7f0000001500)=ANY=[], 0xb50}, 0x1, 0x0, 0x0, 0x80}, 0x44000) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r3, 0xc0145401, &(0x7f0000003f00)={0x3, 0x0, 0x9}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, 0x0}, 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, 0x0, 0x0) r5 = syz_open_dev$video(&(0x7f0000000040), 0xa3, 0x0) ioctl$VIDIOC_S_FMT(r5, 0xc0d05605, &(0x7f0000000180)={0x1, @pix_mp={0x0, 0x0, 0x33424752}}) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r6, 0xae03, 0xd0) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000300)={0xdf, 0x0, 0x8000}) 18.825255735s ago: executing program 4 (id=802): syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f0000000000000000850000006d000000850000000800"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r3 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_msfilter(r3, 0x0, 0x29, &(0x7f0000000240)=ANY=[@ANYBLOB="e0000002ac1414aa0100000002"], 0x18) syz_emit_ethernet(0x36, &(0x7f0000001800)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaaaa080045000028006400000402907800000000e000000211009078e00000020000000200000000"], 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) userfaultfd(0x800) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c00f0ffffff180e000a001400000002801687121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001340)=[{&(0x7f0000000040)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010511000b000a000d000000ba8000001201", 0x2e}], 0x1, 0x0, 0x0, 0xc9e}, 0x80) 12.142070219s ago: executing program 4 (id=823): syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000001800ff0f0000000000000000850000006d000000850000000800"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r3 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_msfilter(r3, 0x0, 0x29, &(0x7f0000000240)=ANY=[@ANYBLOB="e0000002ac1414aa0100000002"], 0x18) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0xae71, &(0x7f0000000000)={0xc9}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) userfaultfd(0x800) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)="2e00000010008188040f80ec59acbc0413a1f848100000005e0c00f0ffffff180e000a001400000002801687121f", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001340)=[{&(0x7f0000000040)="2e00000010008188040f46ecdb4cb9cca7480ef410000000e3bd6efb010511000b000a000d000000ba8000001201", 0x2e}], 0x1, 0x0, 0x0, 0xc9e}, 0x80) 11.338926504s ago: executing program 0 (id=824): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x41) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000002100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$video4linux(&(0x7f0000000080), 0xe97, 0x0) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f00000021c0), 0x2000, &(0x7f00000041c0)={&(0x7f0000000080)={0x50, 0x0, 0x0, {0x7, 0x29, 0x7, 0x12510421, 0x0, 0xc, 0x1, 0x56, 0x0, 0x0, 0x2}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000140)='./file0\x00', 0x0) 10.424397106s ago: executing program 1 (id=825): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="500000000206010100000000000000000200000005000400000000000900420073797a3000000000"], 0x50}}, 0x0) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) bind$netlink(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000000), 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, r1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) fanotify_init(0x0, 0x8000) r6 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000004c40), 0x2, 0x0) write$apparmor_current(r6, &(0x7f0000000280)=ANY=[@ANYBLOB="6368616e6765686174203078303030303030303130303030303030315e73633c8dda2482f3c5596368007d212b782b21240028015357555d6559bcf023deb29ecfc273636865641aa222ec5e1643685320205f737711eae985"], 0x3f) openat$rfkill(0xffffffffffffff9c, 0x0, 0x6c8880, 0x0) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r7, 0x8983, &(0x7f00000001c0)={0x0, 'vlan1\x00', {0x1}, 0x7f}) r8 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100), 0x220200, 0x0) r9 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000001c0), 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000240)={r8, r5, 0x0, r9}, 0x10) 10.421337767s ago: executing program 0 (id=826): unshare(0x20000400) r0 = socket(0x2a, 0x2, 0x0) bind$can_raw(r0, &(0x7f0000000040), 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000140)={@fallback, 0xffffffffffffffff, 0x16}, 0x20) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$unix(0x1, 0x1, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) r5 = accept(r4, 0x0, 0x0) sendmmsg$alg(r5, &(0x7f0000000740)=[{0x0, 0x0, &(0x7f00000002c0)=[{0x0}], 0x1, &(0x7f0000000480)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r5, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b500)=""/153, 0x99}], 0x1}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000001500)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xb}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mq={0x7}, @TCA_RATE={0x6, 0x5, {0x5, 0x5}}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000000040)) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x8000, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) 8.360661761s ago: executing program 0 (id=828): r0 = socket$l2tp6(0xa, 0x2, 0x73) sendmmsg$inet6(r0, &(0x7f0000000380), 0x0, 0xfff8) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xfffffffffffffffe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$kcm(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r3, 0x8982, &(0x7f0000000400)={0x0, 'veth1_to_batadv\x00', {0x5}}) fchdir(r3) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r4 = landlock_create_ruleset(0x0, 0x0, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r4, 0x1, &(0x7f0000000280)={0x102}, 0x0) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) syz_genetlink_get_family_id$mptcp(0x0, r1) 7.602341883s ago: executing program 0 (id=830): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r3) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001c80)={&(0x7f0000000300)=@newqdisc={0x68, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x3c, 0x2, [@TCA_TBF_PBURST={0x8, 0x7, 0xb86}, @TCA_TBF_PARMS={0x28, 0x1, {{0xa, 0x2, 0xffff, 0x7, 0xcc, 0x3}, {0x0, 0x1, 0x7, 0x8, 0x7f, 0x9}, 0xa6, 0x7, 0x1bb6}}, @TCA_TBF_BURST={0x8, 0x6, 0x7f}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r6, {}, {0x2, 0xb}, {0xf, 0x4}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x4008000) ioctl$SIOCSIFHWADDR(r3, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 7.543648247s ago: executing program 2 (id=831): r0 = syz_open_dev$vim2m(0x0, 0x9, 0x2) r1 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x200) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) r3 = dup3(r1, r0, 0x80000) ioctl$NBD_DO_IT(r3, 0xab03) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r4, 0xffffffffffffffff, 0x200000000000000) 7.422982267s ago: executing program 4 (id=832): socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r0, 0x5421, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x1, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) setitimer(0x0, &(0x7f00000000c0)={{}, {0x1}}, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), r1) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r2, @ANYBLOB], 0x54}}, 0x4800) 7.335617614s ago: executing program 1 (id=834): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) r0 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) bind$vsock_stream(0xffffffffffffffff, &(0x7f0000000240)={0x28, 0x0, 0x0, @hyper}, 0x10) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) msgsnd(0x0, 0x0, 0x8, 0x800) msgrcv(0x0, &(0x7f0000000080)={0x0, ""/103}, 0x6f, 0x1, 0x3800) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001340)={&(0x7f00000000c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x2, [@int]}}, 0x0, 0x2a}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000040)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x9, 0x0, 0x0, 0x7ffffff, &(0x7f0000000200)={0x1, 0xa, 0x2, 0x200}, 0x10}, 0x94) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f00000001c0)) r2 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x44}, 0x1, 0x0, 0x0, 0x408c9}, 0x0) openat$rfkill(0xffffffffffffff9c, 0x0, 0x180, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x141202, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x4, @loopback, 0x9}, 0x1c) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(0xffffffffffffffff, 0x40106614, 0x0) 7.281530318s ago: executing program 2 (id=835): r0 = syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0xc0c00) io_setup(0x3, 0x0) mknodat(0xffffffffffffffff, 0x0, 0x22f6c0948578f7ce, 0xb1) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x6, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) write(r3, &(0x7f0000000100), 0x0) bind$phonet(0xffffffffffffffff, &(0x7f00000000c0)={0x23, 0x2, 0xd5, 0x57}, 0x10) ioctl$IOC_PR_PREEMPT(r0, 0x40046109, &(0x7f0000000040)={0xd0, 0xfffffffffffffffe, 0xd0ff}) 6.768181679s ago: executing program 1 (id=836): r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000300)={{0x6, @rose, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}, 0x48) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) bind$netrom(r1, 0x0, 0x0) listen(r1, 0x80) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6}]}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 6.696987714s ago: executing program 0 (id=837): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, 0x0, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) socket$inet6(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) pselect6(0x24, &(0x7f00000001c0)={0x0, 0x0, 0x20000000000, 0xfffffffffffffffd, 0x0, 0xffffffffffffffff, 0x1000001000, 0x49}, 0x0, &(0x7f00000002c0)={0x3ff, 0x7, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) syz_usb_disconnect(r0) 6.646562819s ago: executing program 4 (id=838): socket$nl_generic(0x10, 0x3, 0x10) bind$alg(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$netlbl_unlabel(0x0, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) add_key$user(0x0, &(0x7f0000000040)={'syz', 0x2}, &(0x7f00000001c0)="bf", 0x1, 0xfffffffffffffffd) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$KVM_S390_VCPU_FAULT(0xffffffffffffffff, 0x4004ae52, &(0x7f0000000080)=0xfffffffffffffffb) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r2 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/compact_memory\x00', 0x1, 0x0) sendfile(r2, r1, &(0x7f00000000c0)=0x58, 0x5) 6.565214055s ago: executing program 3 (id=839): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x41) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x0, &(0x7f0000002100)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$video4linux(&(0x7f0000000080), 0xe97, 0x0) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f00000021c0), 0x2000, &(0x7f00000041c0)={&(0x7f0000000080)={0x50, 0x0, 0x0, {0x7, 0x29, 0x7, 0x12510421, 0x0, 0xc, 0x1, 0x56, 0x0, 0x0, 0x2}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000140)='./file0\x00', 0x0) 6.564481255s ago: executing program 2 (id=840): syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f0000000780)='./file0\x00', 0x0, &(0x7f00000007c0), 0x1, 0x73a, &(0x7f0000000800)="$eJzs3E9rXOUaAPDnnCZtb5t7Jxfu4uJKqFih9iRN1a6EiOtCoR+ghslJCDnJhMykNjFg68KFIKgI/ulGv4EbRXBT+h0UwZ2CC0FrGheCi8iZzEx1OpOObdKR+vvBmfO875kzz/vMHF7mwLwTwD/W4+VDEjEWERciotLqTyPicDM6GnF193m3tzar21ub1SR2di7eSsrTmn3t10pa++PRPCX+HxE3RyNOvXZ33vr6xuJMUeSrrfZEY2llor6+cXphaWY+n8+XpyYnz559burZZyb3rdY3X/nkpzc+f/HLD88t/fb8radnk5hu1h1ddeyn3fdkNKa7+pcPItkQJcMeAAAAAym/5x+KiJHmt9RKHGpGAAAAwKNk58gOAAAA8MhLYtgjAAAAAA5W+3cAt7c2q+3tYf7+4McXImL8ztri7U7+keYa4oijMRoRx7aTP61MSHZPgwdy9VpE3Jjucf0nrevv/nWvXLdG+u/nRjn/TPea/9LO/BM95p+R9n8nPKD2/Ld91/x3J/+hPvPfhQFzHFk9+VXf/NciHhvplT/p5E/65H9pwPyfjn3zbb9jOx9HnIze+f+Ya4//h5iYWyjy1mPPHCc+e/XUXvUf65c/2bv+lQHr/+761Hy/uaTM/9SJvT//XvnLa+Kt1jjSiHi7tS/b73TlePLm5Ad71T/bp/57ff4fDVj/F69vfD/gUwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKApjYixSNKsE6dplkUcj4j/xbG0qNUbp+Zqa8uz5bGI8RhN5xaKfDIiKrvtpGyfacZ32lNd7bMR8d+IeLfyr2Y7q9aK2WEXDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQMfxiBiLJM0iIo2IXyppmmXDHhUAAACw78aHPQAAAADgwLn/BwAAgEef+38AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgIbhw/ny57WxvbVbL9uzl9bXF2uXTs3l9MVtaq2bV2upKNl+rzRd5Vq0t3ev1ilpt5Vwsr12ZaOT1xkR9fePSUm1tuXFpYWlmPr+Ujz6UqgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPirxppbkmYRkTbjNM2yiH9HxHiMJnMLRT4ZEf+JiK8ro0fK9plhDxoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB9V1/fWJwpinxVIBAIOsGwZyYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIahvr6xOFMU+Wp92CMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABguNIfkogot5OVJ8a6jx5Ofq009xHx8vWL712ZaTRWz5T9P3f6G++3+qeGMX4AAACgW/s+vX0fDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMKj6+sbiTFHkqwcYDLtGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg/vweAAD//4rSy1s=") mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file7\x00', 0x21) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f00000001c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file7'}}, {@volatile}]}) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x4008, &(0x7f0000000440)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) 4.433454355s ago: executing program 0 (id=841): syz_mount_image$ext4(&(0x7f0000000740)='ext4\x00', &(0x7f0000000780)='./file0\x00', 0x0, &(0x7f00000007c0), 0x1, 0x73a, &(0x7f0000000800)="$eJzs3E9rXOUaAPDnnCZtb5t7Jxfu4uJKqFih9iRN1a6EiOtCoR+ghslJCDnJhMykNjFg68KFIKgI/ulGv4EbRXBT+h0UwZ2CC0FrGheCi8iZzEx1OpOObdKR+vvBmfO875kzz/vMHF7mwLwTwD/W4+VDEjEWERciotLqTyPicDM6GnF193m3tzar21ub1SR2di7eSsrTmn3t10pa++PRPCX+HxE3RyNOvXZ33vr6xuJMUeSrrfZEY2llor6+cXphaWY+n8+XpyYnz559burZZyb3rdY3X/nkpzc+f/HLD88t/fb8radnk5hu1h1ddeyn3fdkNKa7+pcPItkQJcMeAAAAAym/5x+KiJHmt9RKHGpGAAAAwKNk58gOAAAA8MhLYtgjAAAAAA5W+3cAt7c2q+3tYf7+4McXImL8ztri7U7+keYa4oijMRoRx7aTP61MSHZPgwdy9VpE3Jjucf0nrevv/nWvXLdG+u/nRjn/TPea/9LO/BM95p+R9n8nPKD2/Ld91/x3J/+hPvPfhQFzHFk9+VXf/NciHhvplT/p5E/65H9pwPyfjn3zbb9jOx9HnIze+f+Ya4//h5iYWyjy1mPPHCc+e/XUXvUf65c/2bv+lQHr/+761Hy/uaTM/9SJvT//XvnLa+Kt1jjSiHi7tS/b73TlePLm5Ad71T/bp/57ff4fDVj/F69vfD/gUwEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKApjYixSNKsE6dplkUcj4j/xbG0qNUbp+Zqa8uz5bGI8RhN5xaKfDIiKrvtpGyfacZ32lNd7bMR8d+IeLfyr2Y7q9aK2WEXDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQMfxiBiLJM0iIo2IXyppmmXDHhUAAACw78aHPQAAAADgwLn/BwAAgEef+38AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgIbhw/ny57WxvbVbL9uzl9bXF2uXTs3l9MVtaq2bV2upKNl+rzRd5Vq0t3ev1ilpt5Vwsr12ZaOT1xkR9fePSUm1tuXFpYWlmPr+Ujz6UqgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPirxppbkmYRkTbjNM2yiH9HxHiMJnMLRT4ZEf+JiK8ro0fK9plhDxoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIB9V1/fWJwpinxVIBAIOsGwZyYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIahvr6xOFMU+Wp92CMBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABguNIfkogot5OVJ8a6jx5Ofq009xHx8vWL712ZaTRWz5T9P3f6G++3+qeGMX4AAACgW/s+vX0fDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMKj6+sbiTFHkqwcYDLtGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg/vweAAD//4rSy1s=") mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file7\x00', 0x21) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f00000001c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file7'}}, {@upperdir={'upperdir', 0x3d, './file7'}}, {@volatile}]}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x40001e0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$caif_seqpacket(0x25, 0x5, 0x1) r4 = syz_io_uring_setup(0x10d, &(0x7f0000000140)={0x0, 0xb6e7, 0x0, 0x3}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_SEND={0x1a, 0x0, 0x0, r3, 0x0, 0x0, 0x0, 0x40, 0x1}) io_uring_enter(r4, 0x47f9, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x4008, &(0x7f0000000440)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}]}) 4.431086426s ago: executing program 1 (id=842): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6(0xa, 0x2, 0x3a) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='numa_maps\x00') read$FUSE(r4, &(0x7f0000004180)={0x2020}, 0x2020) sendmsg$SMC_PNETID_DEL(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=ANY=[@ANYRES16, @ANYBLOB="100027bd7000fbdbdf2503000000140002006261746164765f736c6176655f30000005000400010000000900010073797a31000000001400020070696d367265673100000000000000001400020076657468315f746f5f68737200000000ae9c3ba11568eb780be59fb0f1d2b390766c9506131c0d727f92a8de9944651ef78b136c35f7082cb297bc5280131ca9ab80227331ddda3071104377bfa506493c3f68219cbb12d404eea24ab2173fa0516935e3483b2b07b329ec11d7ab8f98"], 0x64}, 0x1, 0x0, 0x0, 0x20008440}, 0x804) connect$inet6(r3, 0x0, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x3516, 0x0, 0x0, 0x0, 0x0) r5 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000002700)={0x53, 0x0, 0x0, 0x7, @scatter={0x0, 0x0, 0x0}, &(0x7f0000002680), 0x0, 0x1000, 0x0, 0x1, 0x0}) openat$vimc2(0xffffff9c, &(0x7f00000006c0), 0x2, 0x0) sendmsg$unix(r2, &(0x7f00000007c0)={&(0x7f0000000380)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, &(0x7f0000000700)=[@rights={{0x10}}, @rights={{0x10}}, @rights={{0x10}}], 0x30, 0x200488c0}, 0x20040010) syz_emit_vhci(&(0x7f00000002c0)=ANY=[@ANYBLOB], 0xf) 4.410271637s ago: executing program 3 (id=843): socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000003b40)) openat$mice(0xffffffffffffff9c, &(0x7f0000000040), 0x0) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) sched_setaffinity(0x0, 0xffffffffffffff1a, &(0x7f0000000200)=0x400000bce) write$uinput_user_dev(r0, &(0x7f0000000a80)={'syz1\x00', {0x0, 0x0, 0x0, 0x1000}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x45c) ioctl$UI_SET_RELBIT(r0, 0x40045566, 0x8) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x2) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x1) ioctl$UI_DEV_CREATE(r0, 0x5501) 2.984438511s ago: executing program 2 (id=844): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="500000000206010100000000000000000200000005000400000000000900420073797a3000000000"], 0x50}}, 0x0) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) bind$netlink(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000000), 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, r1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) fanotify_init(0x0, 0x8000) r6 = openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000004c40), 0x2, 0x0) write$apparmor_current(r6, &(0x7f0000000280)=ANY=[@ANYBLOB="6368616e6765686174203078303030303030303130303030303030315e73633c8dda2482f3c5596368007d212b782b21240028015357555d6559bcf023deb29ecfc273636865641aa222ec5e1643685320205f737711eae985"], 0x3f) openat$rfkill(0xffffffffffffff9c, 0x0, 0x6c8880, 0x0) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r7, 0x8983, &(0x7f00000001c0)={0x0, 'vlan1\x00', {0x1}, 0x7f}) r8 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100), 0x220200, 0x0) r9 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000001c0), 0x4) bpf$BPF_LINK_UPDATE(0x1d, &(0x7f0000000240)={r8, r5, 0x0, r9}, 0x10) 2.902898788s ago: executing program 3 (id=845): r0 = syz_open_dev$vim2m(0x0, 0x9, 0x2) r1 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x200) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) r3 = dup3(r1, r0, 0x80000) ioctl$NBD_DO_IT(r3, 0xab03) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r4, 0xffffffffffffffff, 0x200000000000000) 2.902301788s ago: executing program 4 (id=846): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount(&(0x7f0000000100)=@md0, &(0x7f0000000040)='.\x00', &(0x7f0000000300)='nfsd\x00', 0x2004041, 0x0) 2.767635868s ago: executing program 1 (id=847): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) r0 = syz_open_dev$MSR(&(0x7f0000000340), 0x0, 0x0) bind$vsock_stream(0xffffffffffffffff, &(0x7f0000000240)={0x28, 0x0, 0x0, @hyper}, 0x10) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) msgsnd(0x0, 0x0, 0x8, 0x800) msgrcv(0x0, &(0x7f0000000080)={0x0, ""/103}, 0x6f, 0x1, 0x3800) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001340)={&(0x7f00000000c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x2, [@int]}}, 0x0, 0x2a}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x11, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000040)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x9, 0x0, 0x0, 0x7ffffff, &(0x7f0000000200)={0x1, 0xa, 0x2, 0x200}, 0x10}, 0x94) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f00000001c0)) r2 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x44}, 0x1, 0x0, 0x0, 0x408c9}, 0x0) openat$rfkill(0xffffffffffffff9c, 0x0, 0x180, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x141202, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x4, @loopback, 0x9}, 0x1c) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(0xffffffffffffffff, 0x40106614, 0x0) 1.617481281s ago: executing program 3 (id=848): socket$inet_udp(0x2, 0x2, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$int_in(r0, 0x5421, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x1, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) setitimer(0x0, &(0x7f00000000c0)={{}, {0x1}}, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140), r1) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000003000000400001802c0004001400010002000000ac1414aa0000"], 0x54}}, 0x4800) 1.583258803s ago: executing program 2 (id=849): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='rdma.current\x00', 0x275a, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x1, 0x5, 0x0, 0x8040040000000001}) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r2, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.313239305s ago: executing program 3 (id=850): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r3) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001c80)={&(0x7f0000000300)=@newqdisc={0x68, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x3c, 0x2, [@TCA_TBF_PBURST={0x8, 0x7, 0xb86}, @TCA_TBF_PARMS={0x28, 0x1, {{0xa, 0x2, 0xffff, 0x7, 0xcc, 0x3}, {0x0, 0x1, 0x7, 0x8, 0x7f, 0x9}, 0xa6, 0x7, 0x1bb6}}, @TCA_TBF_BURST={0x8, 0x6, 0x7f}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r6, {}, {0x2, 0xb}, {0xf, 0x4}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x4008000) ioctl$SIOCSIFHWADDR(r3, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 1.255788249s ago: executing program 1 (id=851): bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(0xffffffffffffffff, 0x4) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'bond0\x00'}) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000200)) setsockopt$TIPC_CONN_TIMEOUT(0xffffffffffffffff, 0x10f, 0x82, 0x0, 0x0) socket(0x2, 0x3, 0xff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, r2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000740)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a70000000060a0b0400000000000000000200000044000480400001800a0001006d6174636800000030000280080002400000000118000300d67a854a7a4124a91520800000000000000030000a0001006f776e65720000000900010073797a30000000000900020073797a32"], 0x98}, 0x1, 0x0, 0x0, 0x4000000}, 0x4044010) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) 1.023387898s ago: executing program 2 (id=852): r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r0, &(0x7f0000000300)={{0x6, @rose, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}, 0x48) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) bind$netrom(r1, 0x0, 0x0) listen(r1, 0x80) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6}]}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) 0s ago: executing program 3 (id=853): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6(0xa, 0x2, 0x3a) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000240)='numa_maps\x00') read$FUSE(r4, &(0x7f0000004180)={0x2020}, 0x2020) sendmsg$SMC_PNETID_DEL(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=ANY=[@ANYRES16, @ANYBLOB="100027bd7000fbdbdf2503000000140002006261746164765f736c6176655f30000005000400010000000900010073797a31000000001400020070696d367265673100000000000000001400020076657468315f746f5f68737200000000ae9c3ba11568eb780be59fb0f1d2b390766c9506131c0d727f92a8de9944651ef78b136c35f7082cb297bc5280131ca9ab"], 0x64}, 0x1, 0x0, 0x0, 0x20008440}, 0x804) connect$inet6(r3, 0x0, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x0, 0x0, 0x0) io_uring_enter(0xffffffffffffffff, 0x3516, 0x0, 0x0, 0x0, 0x0) r5 = syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x0) ioctl$SG_IO(r5, 0x2285, &(0x7f0000002700)={0x53, 0x0, 0x0, 0x7, @scatter={0x0, 0x0, 0x0}, &(0x7f0000002680), 0x0, 0x1000, 0x0, 0x1, 0x0}) openat$vimc2(0xffffff9c, &(0x7f00000006c0), 0x2, 0x0) sendmsg$unix(r2, &(0x7f00000007c0)={&(0x7f0000000380)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, &(0x7f0000000700)=[@rights={{0x10}}, @rights={{0x10}}], 0x20, 0x200488c0}, 0x20040010) syz_emit_vhci(&(0x7f00000002c0)=ANY=[@ANYBLOB], 0xf) kernel console output (not intermixed with test programs): n_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 61.456949][ T4267] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 61.467040][ T4267] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 61.477770][ T4267] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 61.488765][ T4267] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 61.497557][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 61.505603][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 61.514854][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 61.547093][ T4267] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 61.564063][ T4267] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 61.579065][ T4267] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 61.590059][ T4267] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 61.615645][ T4267] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 61.630165][ T4267] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 61.643241][ T4267] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 61.646946][ T4375] loop2: detected capacity change from 0 to 2048 [ 61.659120][ T4267] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 61.671701][ T4267] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 61.682917][ T4267] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.692527][ T4267] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.702115][ T4267] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.712407][ T4267] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 61.738289][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 61.760356][ T4344] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 61.771618][ T4375] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 61.805319][ T4375] ext4 filesystem being mounted at /0/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 61.825911][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 61.883857][ T4344] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 61.891865][ T4344] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 61.911833][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 61.960679][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 61.987430][ T4375] overlayfs: failed to resolve './file7': -2 [ 62.006116][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 62.489844][ T4385] overlayfs: failed to verify upper (/file0, ino=12, err=-28) [ 62.497578][ T4385] overlayfs: failed to verify index dir 'upper' xattr [ 62.504394][ T4385] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 62.656929][ T4344] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 62.757781][ T4344] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 62.772092][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 62.796383][ T4276] EXT4-fs (loop2): unmounting filesystem. [ 62.818154][ T4364] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 62.849920][ T4364] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 62.884083][ T4281] Bluetooth: hci2: command 0x0419 tx timeout [ 62.890142][ T4281] Bluetooth: hci1: command 0x0419 tx timeout [ 62.896311][ T4270] Bluetooth: hci0: command 0x0419 tx timeout [ 62.902936][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 63.043406][ T4275] Bluetooth: hci3: command 0x0419 tx timeout [ 63.060104][ T4275] Bluetooth: hci4: command 0x0419 tx timeout [ 63.062784][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 63.083690][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 63.093683][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 63.102371][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 63.111931][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 63.127128][ T0] NOHZ tick-stop error: local softirq work is pending, handler #28a!!! [ 63.136450][ T0] NOHZ tick-stop error: local softirq work is pending, handler #38a!!! [ 63.145283][ T37] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 63.168628][ T37] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 63.180776][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 63.334034][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 63.363857][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 63.444769][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 64.061660][ T26] audit: type=1804 audit(1756050975.841:2): pid=4395 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1" name="/newroot/0/file1" dev="fuse" ino=1 res=1 errno=0 [ 64.341572][ T26] audit: type=1800 audit(1756050975.881:3): pid=4395 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1" name="/" dev="fuse" ino=1 res=0 errno=0 [ 64.646281][ T26] audit: type=1804 audit(1756050975.981:4): pid=4395 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.1" name="/newroot/0/file1" dev="fuse" ino=1 res=1 errno=0 [ 64.667016][ T26] audit: type=1800 audit(1756050976.001:5): pid=4395 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1" name="/" dev="fuse" ino=1 res=0 errno=0 [ 64.689311][ T4410] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 64.765761][ T4410] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 64.840757][ T4364] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 64.899283][ T4413] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 65.059351][ T4419] device syzkaller0 entered promiscuous mode [ 65.061904][ T4421] Bluetooth: MGMT ver 1.22 [ 65.091302][ T4419] tipc: Started in network mode [ 65.098344][ T4419] tipc: Node identity f285cb4e44fc, cluster identity 4711 [ 65.109548][ T4419] tipc: Enabled bearer , priority 0 [ 65.136726][ T4419] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 65.181948][ T4419] tipc: Resetting bearer [ 65.206306][ T4418] tipc: Resetting bearer [ 65.281862][ T4418] tipc: Disabling bearer [ 65.513816][ T3653] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 65.706956][ T3653] usb 4-1: config index 0 descriptor too short (expected 39, got 27) [ 65.734236][ T3653] usb 4-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 65.886198][ T4440] loop2: detected capacity change from 0 to 32768 [ 65.896232][ T3653] usb 4-1: config 0 interface 0 has no altsetting 0 [ 65.909123][ T4440] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop2 scanned by syz.2.16 (4440) [ 65.937813][ T4440] BTRFS info (device loop2): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 65.948124][ T4440] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 65.956890][ T4440] BTRFS info (device loop2): using free space tree [ 65.967547][ T3653] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 65.981392][ T3653] usb 4-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 65.998491][ T3653] usb 4-1: Product: syz [ 66.014631][ T3653] usb 4-1: Manufacturer: syz [ 66.022224][ T3653] usb 4-1: SerialNumber: syz [ 66.044993][ T3653] usb 4-1: config 0 descriptor?? [ 66.062098][ T3653] hub 4-1:0.0: bad descriptor, ignoring hub [ 66.076660][ T3653] hub: probe of 4-1:0.0 failed with error -5 [ 66.711807][ T3653] usb 4-1: selecting invalid altsetting 0 [ 67.243905][ T3653] usb 4-1: reset high-speed USB device number 2 using dummy_hcd [ 67.257206][ T3653] usb 4-1: device reset changed ep0 maxpacket size! [ 67.278644][ T3653] usb 4-1: USB disconnect, device number 2 [ 67.463456][ T4440] BTRFS info (device loop2): enabling ssd optimizations [ 67.686714][ T4469] Zero length message leads to an empty skb [ 67.699553][ T3653] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 67.728878][ T4469] input: syz1 as /devices/virtual/input/input5 [ 67.889433][ T26] audit: type=1800 audit(1756050979.621:6): pid=4472 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.16" name="file1" dev="loop2" ino=260 res=0 errno=0 [ 68.473745][ T3653] usb 4-1: Using ep0 maxpacket: 8 [ 68.529593][ T4276] BTRFS info (device loop2): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 68.555255][ T3653] usb 4-1: device descriptor read/all, error -71 [ 69.252981][ T4484] input: syz1 as /devices/virtual/input/input6 [ 69.755814][ T4258] udevd[4258]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 70.412431][ T4498] loop1: detected capacity change from 0 to 2048 [ 71.257754][ T1267] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.265046][ T1267] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.452384][ T4498] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 72.191022][ T4498] ext4 filesystem being mounted at /5/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 73.390129][ T4523] overlayfs: failed to create directory ./bus/index (errno: 28); mounting read-only [ 73.399825][ T4523] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 73.880053][ T4522] loop4: detected capacity change from 0 to 2048 [ 74.169550][ T4525] loop3: detected capacity change from 0 to 32768 [ 74.189994][ T4527] loop2: detected capacity change from 0 to 32768 [ 74.203901][ T4525] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop3 scanned by syz.3.30 (4525) [ 74.219009][ T4527] BTRFS warning: duplicate device /dev/loop2 devid 1 generation 8 scanned by syz.2.32 (4527) [ 74.231293][ T4525] BTRFS info (device loop3): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 74.241641][ T4525] BTRFS info (device loop3): using sha256 (sha256-avx2) checksum algorithm [ 74.250421][ T4525] BTRFS info (device loop3): using free space tree [ 74.257753][ T4279] EXT4-fs (loop1): unmounting filesystem. [ 74.360115][ T4522] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 74.412894][ T4522] ext4 filesystem being mounted at /4/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 74.541261][ T4542] overlayfs: conflicting lowerdir path [ 74.773460][ T4522] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 74.823791][ T4511] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 75.538566][ T4511] usb 1-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 75.830607][ T4525] BTRFS info (device loop3): enabling ssd optimizations [ 76.025206][ T4511] usb 1-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 76.068014][ T4511] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 76.092276][ T4511] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 76.285158][ T26] audit: type=1800 audit(1756050988.041:7): pid=4562 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.30" name="file1" dev="loop3" ino=260 res=0 errno=0 [ 76.897035][ T3044] cfg80211: failed to load regulatory.db [ 76.903887][ T4511] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 76.925697][ T4511] usb 1-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 76.934839][ T4511] usb 1-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 76.942877][ T4511] usb 1-1: Product: syz [ 77.074468][ T4267] EXT4-fs (loop4): unmounting filesystem. [ 77.080994][ T4273] BTRFS info (device loop3): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 77.093860][ T4511] usb 1-1: Manufacturer: syz [ 77.114577][ T4511] cdc_wdm 1-1:1.0: skipping garbage [ 77.119807][ T4511] cdc_wdm 1-1:1.0: skipping garbage [ 77.129319][ T4511] cdc_wdm 1-1:1.0: cdc-wdm0: USB WDM device [ 77.135940][ T4511] cdc_wdm 1-1:1.0: Unknown control protocol [ 77.540937][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 77.547745][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 77.554706][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 77.561322][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 77.594813][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 77.601466][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 77.609658][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 77.616274][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 77.622606][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 77.629206][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 77.681275][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 77.687931][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 77.696837][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 77.703464][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 77.712589][ C0] cdc_wdm 1-1:1.0: nonzero urb status received: -71 [ 77.719207][ C0] cdc_wdm 1-1:1.0: wdm_int_callback - 0 bytes [ 77.726041][ T4577] usb 1-1: USB disconnect, device number 2 [ 77.742458][ T4584] input: syz1 as /devices/virtual/input/input7 [ 77.780551][ T4581] IPv6: ADDRCONF(NETDEV_CHANGE): bpq0: link becomes ready [ 79.886795][ T4602] input: syz1 as /devices/virtual/input/input8 [ 83.846908][ T4615] input: syz1 as /devices/virtual/input/input9 [ 83.932633][ T4623] loop1: detected capacity change from 0 to 2048 [ 83.970781][ T26] audit: type=1326 audit(1756050995.751:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=4628 comm="syz.0.50" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd012d8ebe9 code=0x0 [ 84.089182][ T4623] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 84.144069][ T4623] ext4 filesystem being mounted at /10/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 84.230996][ T4637] XFS (nullb0): Invalid superblock magic number [ 84.242826][ T4623] overlayfs: Failed to create volatile/dirty file. [ 85.008477][ T4652] input: syz1 as /devices/virtual/input/input10 [ 85.368096][ T4650] tipc: Started in network mode [ 85.368114][ T4650] tipc: Node identity ac1414aa, cluster identity 4711 [ 85.368834][ T4650] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 85.368902][ T4650] tipc: Enabled bearer , priority 10 [ 85.504686][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 85.643822][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 85.745245][ T4659] overlayfs: failed to set xattr on upper [ 85.783851][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 85.799697][ T4659] overlayfs: ...falling back to index=off,metacopy=off. [ 85.924515][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 86.063874][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 86.203760][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 86.289782][ T4672] loop3: detected capacity change from 0 to 2048 [ 86.343805][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 86.360527][ T4672] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 86.413948][ T4672] ext4 filesystem being mounted at /11/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 86.484565][ T4386] tipc: Node number set to 2886997162 [ 86.511887][ T4672] overlayfs: Failed to create volatile/dirty file. [ 86.586775][ T4679] kvm: pic: non byte write [ 86.593773][ T4679] kvm: pic: non byte read [ 86.623835][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 86.893839][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 87.187020][ T4687] overlayfs: failed to set xattr on upper [ 87.192798][ T4687] overlayfs: ...falling back to index=off,metacopy=off. [ 87.616164][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 87.695664][ T4279] EXT4-fs (loop1): unmounting filesystem. [ 87.912210][ T4698] capability: warning: `syz.2.68' uses 32-bit capabilities (legacy support in use) [ 88.243917][ T4275] Bluetooth: hci0: command 0x0c20 tx timeout [ 88.646497][ T4725] loop3: detected capacity change from 0 to 256 [ 88.655392][ T4725] ======================================================= [ 88.655392][ T4725] WARNING: The mand mount option has been deprecated and [ 88.655392][ T4725] and is ignored by this kernel. Remove the mand [ 88.655392][ T4725] option from the mount to silence this warning. [ 88.655392][ T4725] ======================================================= [ 88.716586][ T4725] FAT-fs (loop3): Directory bread(block 64) failed [ 88.724256][ T4725] FAT-fs (loop3): Directory bread(block 65) failed [ 88.731710][ T4725] FAT-fs (loop3): Directory bread(block 66) failed [ 88.738869][ T4725] FAT-fs (loop3): Directory bread(block 67) failed [ 88.746022][ T4725] FAT-fs (loop3): Directory bread(block 68) failed [ 88.753043][ T4725] FAT-fs (loop3): Directory bread(block 69) failed [ 88.760550][ T4725] FAT-fs (loop3): Directory bread(block 70) failed [ 88.768450][ T4725] FAT-fs (loop3): Directory bread(block 71) failed [ 88.775575][ T4725] FAT-fs (loop3): Directory bread(block 72) failed [ 88.782475][ T4725] FAT-fs (loop3): Directory bread(block 73) failed [ 89.054300][ T4731] FAT-fs (loop3): error, invalid access to FAT (entry 0x00006c61) [ 89.352961][ T4731] syz.3.76 (4731) used greatest stack depth: 20768 bytes left [ 89.470559][ T26] audit: type=1800 audit(1756051000.831:9): pid=4731 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.76" name="cpu.stat" dev="loop3" ino=1048596 res=0 errno=0 [ 89.900811][ C1] vcan0: j1939_tp_rxtimer: 0xffff88805486d000: rx timeout, send abort [ 89.911588][ C1] vcan0: j1939_xtp_rx_abort_one: 0xffff88805486d000: 0x2f000: (3) A timeout occurred and this is the connection abort to close the session. [ 90.039996][ T26] audit: type=1400 audit(1756051001.821:10): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=4732 comm="syz.0.80" [ 90.643765][ C0] net_ratelimit: 3 callbacks suppressed [ 90.643782][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 91.531152][ T4744] syz.3.82 uses obsolete (PF_INET,SOCK_PACKET) [ 91.685668][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 91.796749][ T4750] tipc: Enabling of bearer rejected, already enabled [ 92.723774][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 93.295390][ T4780] tipc: Started in network mode [ 93.312685][ T4780] tipc: Node identity ac1414aa, cluster identity 4711 [ 93.324922][ T4780] tipc: Enabled bearer , priority 10 [ 93.773774][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 94.444957][ T22] tipc: Node number set to 2886997162 [ 94.814716][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 95.843756][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 96.883771][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 97.923763][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 98.230521][ T26] audit: type=1400 audit(1756051010.011:11): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=4833 comm="syz.2.114" [ 98.963770][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 100.003869][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 100.512635][ T4854] loop3: detected capacity change from 0 to 256 [ 100.753136][ T4854] FAT-fs (loop3): Directory bread(block 64) failed [ 100.760105][ T4854] FAT-fs (loop3): Directory bread(block 65) failed [ 100.767501][ T4854] FAT-fs (loop3): Directory bread(block 66) failed [ 100.774315][ T4854] FAT-fs (loop3): Directory bread(block 67) failed [ 100.781014][ T4854] FAT-fs (loop3): Directory bread(block 68) failed [ 100.787768][ T4854] FAT-fs (loop3): Directory bread(block 69) failed [ 100.794525][ T4854] FAT-fs (loop3): Directory bread(block 70) failed [ 100.801283][ T4854] FAT-fs (loop3): Directory bread(block 71) failed [ 100.808028][ T4854] FAT-fs (loop3): Directory bread(block 72) failed [ 100.815256][ T4854] FAT-fs (loop3): Directory bread(block 73) failed [ 100.854818][ T4854] FAT-fs (loop3): error, invalid access to FAT (entry 0x00006c61) [ 100.862785][ T26] audit: type=1800 audit(1756051012.641:12): pid=4854 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.120" name="cpu.stat" dev="loop3" ino=1048597 res=0 errno=0 [ 101.053777][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 101.120976][ T4862] tipc: Started in network mode [ 101.152803][ T4862] tipc: Node identity ac1414aa, cluster identity 4711 [ 101.220642][ T4862] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 101.258359][ T4862] tipc: Enabled bearer , priority 10 [ 101.353761][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 101.413284][ T4871] loop4: detected capacity change from 0 to 128 [ 101.493790][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 101.633760][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 101.773864][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 101.913769][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 102.033323][ T4878] loop1: detected capacity change from 0 to 4096 [ 102.053883][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 102.083771][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 102.193814][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 102.397515][ T4883] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 103.175354][ T3044] tipc: Node number set to 2886997162 [ 106.210557][ T4878] syz.1.127 (4878) used greatest stack depth: 19568 bytes left [ 106.243799][ C1] net_ratelimit: 6 callbacks suppressed [ 106.243814][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 106.243834][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 106.455555][ T4907] loop2: detected capacity change from 0 to 32768 [ 106.469036][ T4907] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop2 scanned by syz.2.135 (4907) [ 106.484371][ T4907] BTRFS info (device loop2): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 106.494897][ T4907] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 106.503568][ T4907] BTRFS info (device loop2): using free space tree [ 106.543782][ T4907] BTRFS info (device loop2): enabling ssd optimizations [ 107.072218][ T26] audit: type=1800 audit(1756051018.641:13): pid=4932 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.135" name="file1" dev="loop2" ino=260 res=0 errno=0 [ 108.020896][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 108.039268][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 108.366849][ T4276] BTRFS info (device loop2): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 108.930476][ T4461] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 10 /dev/loop2 scanned by udevd (4461) [ 109.043827][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 109.043870][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 109.172779][ T4958] device syzkaller0 entered promiscuous mode [ 109.222357][ T4958] tipc: Enabled bearer , priority 0 [ 109.245157][ T4958] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 109.314608][ T4958] tipc: Resetting bearer [ 109.368028][ T4957] tipc: Resetting bearer [ 109.413046][ T4957] tipc: Disabling bearer [ 109.797471][ T26] audit: type=1400 audit(1756051021.581:14): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=4965 comm="syz.1.150" [ 110.083818][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 111.123769][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 111.123812][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 112.071223][ T4990] loop3: detected capacity change from 0 to 256 [ 112.163770][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 112.163965][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 112.187662][ T4990] FAT-fs (loop3): Directory bread(block 64) failed [ 112.213767][ T4990] FAT-fs (loop3): Directory bread(block 65) failed [ 112.230613][ T4990] FAT-fs (loop3): Directory bread(block 66) failed [ 112.253729][ T4990] FAT-fs (loop3): Directory bread(block 67) failed [ 112.260385][ T4990] FAT-fs (loop3): Directory bread(block 68) failed [ 112.287284][ T4990] FAT-fs (loop3): Directory bread(block 69) failed [ 112.304176][ T4990] FAT-fs (loop3): Directory bread(block 70) failed [ 112.314210][ T4990] FAT-fs (loop3): Directory bread(block 71) failed [ 112.320865][ T4990] FAT-fs (loop3): Directory bread(block 72) failed [ 112.343935][ T4990] FAT-fs (loop3): Directory bread(block 73) failed [ 112.391840][ T4990] FAT-fs (loop3): error, invalid access to FAT (entry 0x00006c61) [ 112.399882][ T26] audit: type=1800 audit(1756051024.171:15): pid=4990 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.158" name="cpu.stat" dev="loop3" ino=1048599 res=0 errno=0 [ 112.937806][ T5005] device syzkaller0 entered promiscuous mode [ 112.959803][ T5005] tipc: Enabled bearer , priority 0 [ 112.976982][ T5005] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 113.056231][ T5011] tipc: Resetting bearer [ 113.092415][ T5004] tipc: Resetting bearer [ 113.152402][ T5004] tipc: Disabling bearer [ 113.203771][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 113.203821][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 114.243764][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 114.243792][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 115.283767][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 115.283808][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 115.324830][ T26] audit: type=1400 audit(1756051027.111:16): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=5031 comm="syz.2.176" [ 115.701336][ T5052] tipc: Enabling of bearer rejected, already enabled [ 115.873391][ T5056] device syzkaller0 entered promiscuous mode [ 115.893153][ T5056] tipc: Enabled bearer , priority 0 [ 115.913227][ T5056] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 116.013363][ T5059] tipc: Resetting bearer [ 116.061757][ T5055] tipc: Resetting bearer [ 116.154985][ T5063] loop1: detected capacity change from 0 to 256 [ 116.162106][ T5055] tipc: Disabling bearer [ 116.219874][ T5063] FAT-fs (loop1): Directory bread(block 64) failed [ 116.233512][ T5063] FAT-fs (loop1): Directory bread(block 65) failed [ 116.284980][ T5063] FAT-fs (loop1): Directory bread(block 66) failed [ 116.291722][ T5063] FAT-fs (loop1): Directory bread(block 67) failed [ 116.319177][ T5063] FAT-fs (loop1): Directory bread(block 68) failed [ 116.326487][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 116.333750][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 116.382735][ T5063] FAT-fs (loop1): Directory bread(block 69) failed [ 116.401538][ T5063] FAT-fs (loop1): Directory bread(block 70) failed [ 116.422567][ T5063] FAT-fs (loop1): Directory bread(block 71) failed [ 116.439830][ T5063] FAT-fs (loop1): Directory bread(block 72) failed [ 116.453491][ T5063] FAT-fs (loop1): Directory bread(block 73) failed [ 116.721143][ T26] audit: type=1800 audit(1756051028.501:17): pid=5063 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.186" name="cpu.stat" dev="loop1" ino=1048600 res=0 errno=0 [ 116.721415][ T5063] FAT-fs (loop1): error, invalid access to FAT (entry 0x00006c61) [ 117.363789][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 117.373772][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 118.318899][ T5077] tipc: Enabling of bearer rejected, already enabled [ 118.403774][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 118.483860][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 118.672144][ T5089] loop2: detected capacity change from 0 to 2048 [ 118.872447][ T5089] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 118.908244][ T5089] ext4 filesystem being mounted at /50/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 118.969845][ T5089] overlayfs: Failed to create volatile/dirty file. [ 119.235979][ T5102] device syzkaller0 entered promiscuous mode [ 119.257824][ T5102] tipc: Started in network mode [ 119.283008][ T5102] tipc: Node identity daa376f6daf5, cluster identity 4711 [ 119.303523][ T5102] tipc: Enabled bearer , priority 0 [ 119.327082][ T5104] loop4: detected capacity change from 0 to 256 [ 119.350324][ T5102] tipc: Resetting bearer [ 119.374021][ T5101] tipc: Resetting bearer [ 119.438230][ T5104] FAT-fs (loop4): Directory bread(block 64) failed [ 119.443894][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 119.444937][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 119.476140][ T5101] tipc: Disabling bearer [ 119.511206][ T26] audit: type=1400 audit(1756051031.291:18): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=5096 comm="syz.0.199" [ 119.523961][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 119.549690][ T5104] FAT-fs (loop4): Directory bread(block 65) failed [ 119.568628][ T5104] FAT-fs (loop4): Directory bread(block 66) failed [ 119.612296][ T5104] FAT-fs (loop4): Directory bread(block 67) failed [ 119.648080][ T5104] FAT-fs (loop4): Directory bread(block 68) failed [ 119.674659][ T5104] FAT-fs (loop4): Directory bread(block 69) failed [ 119.704475][ T5104] FAT-fs (loop4): Directory bread(block 70) failed [ 119.732382][ T5104] FAT-fs (loop4): Directory bread(block 71) failed [ 119.760543][ T5104] FAT-fs (loop4): Directory bread(block 72) failed [ 119.789071][ T5104] FAT-fs (loop4): Directory bread(block 73) failed [ 119.798492][ T5116] tipc: Enabling of bearer rejected, already enabled [ 120.195769][ T5127] FAT-fs (loop4): error, invalid access to FAT (entry 0x00006c61) [ 120.203766][ T26] audit: type=1800 audit(1756051031.981:19): pid=5127 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.202" name="cpu.stat" dev="loop4" ino=1048601 res=0 errno=0 [ 120.288217][ T5126] overlayfs: failed to set xattr on upper [ 120.309007][ T5126] overlayfs: ...falling back to index=off,metacopy=off. [ 120.484939][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 120.485452][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 120.563981][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 121.210405][ T5146] device syzkaller0 entered promiscuous mode [ 121.239016][ T5146] tipc: Enabled bearer , priority 0 [ 121.279173][ T5146] tipc: Resetting bearer [ 121.311535][ T5144] tipc: Resetting bearer [ 121.372654][ T5144] tipc: Disabling bearer [ 121.891268][ T4276] EXT4-fs (loop2): unmounting filesystem. [ 122.425672][ T5173] kvm [5172]: vcpu0, guest rIP: 0x9131 disabled perfctr wrmsr: 0xc1 data 0x1 [ 122.449668][ T5173] kvm [5172]: vcpu0, guest rIP: 0x9131 disabled perfctr wrmsr: 0xc2 data 0x1 [ 122.472065][ T5173] kvm [5172]: vcpu0, guest rIP: 0x9131 ignored wrmsr: 0x11e data 0xbe702112 [ 122.498422][ T5173] kvm [5172]: vcpu0, guest rIP: 0x9131 disabled perfctr wrmsr: 0x186 data 0x1 [ 122.519307][ T5173] kvm [5172]: vcpu0, guest rIP: 0x9131 disabled perfctr wrmsr: 0x187 data 0x1 [ 122.558463][ T5173] kvm [5172]: vcpu0, guest rIP: 0x9131 vmx_set_msr: BTF|LBR in IA32_DEBUGCTLMSR 0x1, nop [ 122.563791][ C1] net_ratelimit: 3 callbacks suppressed [ 122.563804][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 122.568570][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 122.643936][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 122.728681][ T5180] kvm: pic: non byte write [ 122.733337][ T5180] kvm: pic: non byte read [ 123.019664][ T26] audit: type=1326 audit(1756051034.801:20): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5186 comm="syz.3.229" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb516d8ebe9 code=0x0 [ 123.061142][ T5192] device syzkaller0 entered promiscuous mode [ 123.089317][ T5192] tipc: Enabled bearer , priority 0 [ 123.114115][ T5192] tipc: Resetting bearer [ 123.138599][ T5191] tipc: Resetting bearer [ 123.205180][ T5191] tipc: Disabling bearer [ 123.360100][ T26] audit: type=1804 audit(1756051035.141:21): pid=5198 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.235" name="/newroot/52/file1" dev="fuse" ino=1 res=1 errno=0 [ 123.422578][ T26] audit: type=1800 audit(1756051035.141:22): pid=5198 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.235" name="/" dev="fuse" ino=1 res=0 errno=0 [ 123.474708][ T26] audit: type=1804 audit(1756051035.141:23): pid=5198 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.235" name="/newroot/52/file1" dev="fuse" ino=1 res=1 errno=0 [ 123.521804][ T26] audit: type=1800 audit(1756051035.141:24): pid=5198 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.235" name="/" dev="fuse" ino=1 res=0 errno=0 [ 123.603788][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 123.603852][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 123.684780][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 123.734633][ T26] audit: type=1400 audit(1756051035.521:25): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=5193 comm="syz.0.234" [ 124.643764][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 124.643779][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 124.723898][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 125.248007][ T5234] device syzkaller0 entered promiscuous mode [ 125.257237][ T5234] tipc: Enabled bearer , priority 0 [ 125.272737][ T5234] tipc: Resetting bearer [ 125.314947][ T5233] tipc: Resetting bearer [ 125.517769][ T5233] tipc: Disabling bearer [ 125.538580][ T5237] loop1: detected capacity change from 0 to 256 [ 125.683761][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 125.835867][ T5237] FAT-fs (loop1): Directory bread(block 64) failed [ 125.912798][ T5237] FAT-fs (loop1): Directory bread(block 65) failed [ 125.919635][ T5237] FAT-fs (loop1): Directory bread(block 66) failed [ 125.926307][ T5237] FAT-fs (loop1): Directory bread(block 67) failed [ 125.933585][ T5237] FAT-fs (loop1): Directory bread(block 68) failed [ 125.940423][ T5237] FAT-fs (loop1): Directory bread(block 69) failed [ 125.947447][ T5237] FAT-fs (loop1): Directory bread(block 70) failed [ 125.955020][ T5237] FAT-fs (loop1): Directory bread(block 71) failed [ 125.961708][ T5237] FAT-fs (loop1): Directory bread(block 72) failed [ 125.969752][ T5237] FAT-fs (loop1): Directory bread(block 73) failed [ 126.317138][ T26] audit: type=1800 audit(1756051038.101:26): pid=5247 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.246" name="cpu.stat" dev="loop1" ino=1048602 res=0 errno=0 [ 126.317475][ T5247] FAT-fs (loop1): error, invalid access to FAT (entry 0x00006c61) [ 126.337236][ C0] vkms_vblank_simulate: vblank timer overrun [ 127.763777][ C0] net_ratelimit: 3 callbacks suppressed [ 127.763793][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 127.862690][ T5265] tipc: Enabling of bearer rejected, already enabled [ 127.901854][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 127.909039][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 128.804378][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 128.963958][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 128.971079][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 129.363184][ T5280] device syzkaller0 entered promiscuous mode [ 129.833526][ T5285] tipc: Enabled bearer , priority 0 [ 129.844397][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 129.966701][ T5279] tipc: Resetting bearer [ 130.003772][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 130.010794][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 130.075284][ T5279] tipc: Disabling bearer [ 130.526918][ T5311] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 130.534198][ T5311] tipc: Enabled bearer , priority 10 [ 130.628616][ T26] audit: type=1400 audit(1756051042.411:27): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=5294 comm="syz.0.266" [ 131.643779][ T4577] tipc: Node number set to 5666550 [ 132.645477][ T1267] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.651933][ T1267] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.883218][ T5342] device syzkaller0 entered promiscuous mode [ 132.892995][ T5342] tipc: Enabled bearer , priority 0 [ 132.950799][ T5342] tipc: Resetting bearer [ 132.963757][ C0] net_ratelimit: 17 callbacks suppressed [ 132.963779][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 132.994982][ T5341] tipc: Resetting bearer [ 133.044823][ T5341] tipc: Disabling bearer [ 133.160861][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 133.167917][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 133.603778][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 134.003819][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 134.163736][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 134.243783][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 134.653768][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 135.043817][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 135.203801][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 135.480435][ T5380] input: syz1 as /devices/virtual/input/input11 [ 136.222771][ T26] audit: type=1400 audit(1756051048.001:28): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=5371 comm="syz.4.289" [ 136.738949][ T5406] device syzkaller0 entered promiscuous mode [ 136.751470][ T5406] tipc: Enabled bearer , priority 0 [ 136.796656][ T5406] tipc: Resetting bearer [ 136.826701][ T5405] tipc: Resetting bearer [ 136.883013][ T5405] tipc: Disabling bearer [ 136.901753][ T5408] tipc: Enabled bearer , priority 10 [ 137.122299][ T5414] loop1: detected capacity change from 0 to 2048 [ 137.184787][ T5414] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 137.200763][ T5414] ext4 filesystem being mounted at /57/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 137.233231][ T5414] overlayfs: failed to create directory ./bus/index (errno: 28); mounting read-only [ 137.258410][ T5414] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 137.390777][ T4279] EXT4-fs (loop1): unmounting filesystem. [ 137.554429][ T7] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 137.771699][ T7] usb 1-1: config index 0 descriptor too short (expected 39, got 27) [ 138.323739][ C1] net_ratelimit: 18 callbacks suppressed [ 138.323757][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 138.393507][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 138.404061][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 138.422691][ T5428] loop1: detected capacity change from 0 to 32768 [ 138.444845][ T7] usb 1-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 138.472220][ T5428] BTRFS error: device /dev/loop1 already registered with a higher generation, found 8 expect 10 [ 138.489152][ T4321] tipc: Node number set to 3061435214 [ 138.604852][ T4475] I/O error, dev loop1, sector 32640 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 138.615237][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 138.620864][ T7] usb 1-1: config 0 interface 0 has no altsetting 0 [ 138.645517][ T7] usb 1-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 138.689305][ T7] usb 1-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 138.803765][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 138.874016][ T7] usb 1-1: Product: syz [ 138.878240][ T7] usb 1-1: Manufacturer: syz [ 138.882829][ T7] usb 1-1: SerialNumber: syz [ 138.893817][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 139.014675][ T7] usb 1-1: config 0 descriptor?? [ 139.034454][ T7] hub 1-1:0.0: bad descriptor, ignoring hub [ 139.040652][ T7] hub: probe of 1-1:0.0 failed with error -5 [ 139.059957][ T7] usb 1-1: selecting invalid altsetting 0 [ 139.373762][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 139.423787][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 139.443786][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 139.453756][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 139.632184][ T7] usb 1-1: USB disconnect, device number 3 [ 139.766555][ T5443] input: syz1 as /devices/virtual/input/input12 [ 139.924854][ T5447] tipc: Enabling of bearer rejected, already enabled [ 140.004145][ T5451] input: syz1 as /devices/virtual/input/input13 [ 140.092959][ T5454] device syzkaller0 entered promiscuous mode [ 140.107531][ T5454] tipc: Enabled bearer , priority 0 [ 140.129491][ T5454] tipc: Resetting bearer [ 140.140305][ T5453] tipc: Resetting bearer [ 140.161382][ T5453] tipc: Disabling bearer [ 140.431268][ T5457] loop1: detected capacity change from 0 to 32768 [ 140.439434][ T7] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 140.447792][ T5457] BTRFS error: device /dev/loop1 already registered with a higher generation, found 8 expect 10 [ 140.673886][ T7] usb 1-1: Using ep0 maxpacket: 8 [ 142.385041][ T7] usb 1-1: device descriptor read/all, error -71 [ 142.651432][ T4461] BTRFS error: device /dev/loop1 already registered with a higher generation, found 8 expect 10 [ 143.835436][ C1] net_ratelimit: 15 callbacks suppressed [ 143.835452][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 143.848155][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 143.855142][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 144.003775][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 144.203457][ T5491] loop2: detected capacity change from 0 to 256 [ 144.243830][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 144.359085][ T5491] FAT-fs (loop2): Directory bread(block 64) failed [ 144.403897][ T5491] FAT-fs (loop2): Directory bread(block 65) failed [ 144.411301][ T5491] FAT-fs (loop2): Directory bread(block 66) failed [ 144.438139][ T5491] FAT-fs (loop2): Directory bread(block 67) failed [ 144.446551][ T5491] FAT-fs (loop2): Directory bread(block 68) failed [ 144.552463][ T5491] FAT-fs (loop2): Directory bread(block 69) failed [ 144.860536][ T5491] FAT-fs (loop2): Directory bread(block 70) failed [ 144.883960][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 144.890989][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 144.897993][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 145.043496][ T5491] FAT-fs (loop2): Directory bread(block 71) failed [ 145.043788][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 145.050596][ T5491] FAT-fs (loop2): Directory bread(block 72) failed [ 145.063501][ T5491] FAT-fs (loop2): Directory bread(block 73) failed [ 145.220261][ T5479] loop4: detected capacity change from 0 to 32768 [ 145.283838][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 145.324981][ T5479] BTRFS error: device /dev/loop4 already registered with a higher generation, found 8 expect 10 [ 145.585998][ T5503] FAT-fs (loop2): error, invalid access to FAT (entry 0x00006c61) [ 145.657796][ T4475] BTRFS error: device /dev/loop4 already registered with a higher generation, found 8 expect 10 [ 145.697089][ T26] audit: type=1800 audit(1756051057.371:29): pid=5503 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.321" name="cpu.stat" dev="loop2" ino=1048603 res=0 errno=0 [ 146.092487][ T5506] tipc: Enabling of bearer rejected, already enabled [ 146.334523][ T5512] input: syz1 as /devices/virtual/input/input14 [ 146.953729][ T5518] device syzkaller0 entered promiscuous mode [ 147.033904][ T5518] tipc: Enabled bearer , priority 0 [ 147.088536][ T5518] tipc: Resetting bearer [ 147.110430][ T5517] tipc: Resetting bearer [ 147.175353][ T5517] tipc: Disabling bearer [ 147.545074][ T5538] loop0: detected capacity change from 0 to 2048 [ 148.150012][ T5549] tipc: Enabling of bearer rejected, already enabled [ 148.430970][ T5538] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 148.454039][ T5538] ext4 filesystem being mounted at /61/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 148.557235][ T5538] overlayfs: failed to resolve './file7': -2 [ 148.583131][ T5538] overlayfs: failed to verify upper (/file0, ino=12, err=-28) [ 148.636504][ T5538] overlayfs: failed to verify index dir 'upper' xattr [ 148.679618][ T5538] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 149.203817][ C0] net_ratelimit: 15 callbacks suppressed [ 149.203833][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 149.363828][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 149.370908][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 149.377915][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 149.413509][ T5568] block device autoloading is deprecated and will be removed. [ 149.443939][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 149.472901][ T4266] EXT4-fs (loop0): unmounting filesystem. [ 149.834464][ T5576] loop0: detected capacity change from 0 to 32768 [ 149.843346][ T5576] BTRFS error: device /dev/loop0 already registered with a higher generation, found 8 expect 10 [ 149.900349][ T5581] device syzkaller0 entered promiscuous mode [ 149.979427][ T5581] tipc: Enabled bearer , priority 0 [ 150.065466][ T5581] tipc: Resetting bearer [ 150.132040][ T5580] tipc: Resetting bearer [ 150.243823][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 150.413773][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 150.420849][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 150.427904][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 150.483833][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 150.796924][ T5580] tipc: Disabling bearer [ 150.914293][ T4475] BTRFS error: device /dev/loop0 already registered with a higher generation, found 8 expect 10 [ 151.460976][ T5609] loop1: detected capacity change from 0 to 256 [ 151.645857][ T5609] FAT-fs (loop1): Directory bread(block 64) failed [ 151.683859][ T5609] FAT-fs (loop1): Directory bread(block 65) failed [ 151.690542][ T5609] FAT-fs (loop1): Directory bread(block 66) failed [ 151.736559][ T5609] FAT-fs (loop1): Directory bread(block 67) failed [ 151.777950][ T5609] FAT-fs (loop1): Directory bread(block 68) failed [ 151.809323][ T5609] FAT-fs (loop1): Directory bread(block 69) failed [ 151.834058][ T5609] FAT-fs (loop1): Directory bread(block 70) failed [ 151.856661][ T5609] FAT-fs (loop1): Directory bread(block 71) failed [ 151.884211][ T5616] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 151.893964][ T5609] FAT-fs (loop1): Directory bread(block 72) failed [ 151.900552][ T5609] FAT-fs (loop1): Directory bread(block 73) failed [ 152.317180][ T26] audit: type=1800 audit(1756051064.101:30): pid=5625 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.350" name="cpu.stat" dev="loop1" ino=1048604 res=0 errno=0 [ 152.318084][ T5625] FAT-fs (loop1): error, invalid access to FAT (entry 0x00006c61) [ 152.463154][ T5627] loop3: detected capacity change from 0 to 2048 [ 152.542138][ T5627] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 152.592131][ T5627] ext4 filesystem being mounted at /78/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 152.946936][ T5627] overlayfs: failed to resolve './file7': -2 [ 152.982224][ T5627] overlayfs: failed to verify upper (/file0, ino=12, err=-28) [ 153.013949][ T5627] overlayfs: failed to verify index dir 'upper' xattr [ 153.028981][ T5627] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 153.070736][ T5635] input: syz1 as /devices/virtual/input/input15 [ 153.194302][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 153.300280][ T5639] input: syz1 as /devices/virtual/input/input16 [ 153.478419][ T5643] tipc: Enabling of bearer rejected, already enabled [ 154.403808][ C0] net_ratelimit: 15 callbacks suppressed [ 154.403826][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 154.563852][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 154.570921][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 154.577932][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 154.987256][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 155.383912][ T5670] loop3: detected capacity change from 0 to 2048 [ 155.443778][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 155.613759][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 155.620851][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 155.627846][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 156.142715][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 156.184765][ T5670] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 156.259535][ T5670] ext4 filesystem being mounted at /82/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 156.280598][ T5677] input: syz1 as /devices/virtual/input/input17 [ 156.321818][ T5670] overlayfs: failed to resolve './file7': -2 [ 156.332493][ T5679] binder: 5678:5679 unknown command 0 [ 156.334542][ T5670] overlayfs: failed to verify upper (/file0, ino=12, err=-28) [ 156.346622][ T5670] overlayfs: failed to verify index dir 'upper' xattr [ 156.355543][ T5670] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 156.366668][ T5679] binder: 5678:5679 ioctl c0306201 200000000080 returned -22 [ 156.422690][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 156.459987][ T5679] binder: BINDER_SET_CONTEXT_MGR already set [ 156.539174][ T5679] binder: 5678:5679 ioctl 4018620d 200000000040 returned -16 [ 156.633207][ T5688] input: syz1 as /devices/virtual/input/input18 [ 156.872721][ T5690] loop2: detected capacity change from 0 to 32768 [ 157.100618][ T5690] BTRFS info (device loop2): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 157.112219][ T5690] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 157.121173][ T5690] BTRFS info (device loop2): using free space tree [ 157.829567][ T5690] BTRFS info (device loop2): enabling ssd optimizations [ 158.253795][ T26] audit: type=1800 audit(1756051070.001:31): pid=5727 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.378" name="file1" dev="loop2" ino=260 res=0 errno=0 [ 159.387234][ T4276] BTRFS info (device loop2): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 159.403570][ T5683] syz.1.374 (5683): drop_caches: 2 [ 159.763949][ C0] net_ratelimit: 15 callbacks suppressed [ 159.763965][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 159.933915][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 159.940950][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 159.947947][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 160.403850][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 160.412668][ T5737] input: syz1 as /devices/virtual/input/input19 [ 160.562720][ T5739] tipc: Enabling of bearer rejected, already enabled [ 160.646163][ T4475] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 10 /dev/loop2 scanned by udevd (4475) [ 160.804060][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 160.963804][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 160.970813][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 160.977877][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 161.363852][ T4582] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 161.444135][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 161.712825][ T4582] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 161.858871][ T4582] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 161.880919][ T4582] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 161.900172][ T4582] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 161.932216][ T4582] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 161.953230][ T4582] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 162.085582][ T4582] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 162.098502][ T4582] usb 4-1: Product: syz [ 162.102749][ T4582] usb 4-1: Manufacturer: syz [ 163.145601][ T5764] sched: RT throttling activated [ 163.195817][ T4582] cdc_wdm 4-1:1.0: skipping garbage [ 163.211283][ T4582] cdc_wdm 4-1:1.0: skipping garbage [ 163.229444][ T4582] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 163.235849][ T4582] cdc_wdm 4-1:1.0: Unknown control protocol [ 164.110681][ T5788] loop4: detected capacity change from 0 to 256 [ 164.183240][ T5788] FAT-fs (loop4): Directory bread(block 64) failed [ 164.209278][ T5788] FAT-fs (loop4): Directory bread(block 65) failed [ 164.235297][ T5788] FAT-fs (loop4): Directory bread(block 66) failed [ 164.254501][ T5788] FAT-fs (loop4): Directory bread(block 67) failed [ 164.283883][ T5788] FAT-fs (loop4): Directory bread(block 68) failed [ 164.295193][ T5790] loop0: detected capacity change from 0 to 2048 [ 164.302149][ T5788] FAT-fs (loop4): Directory bread(block 69) failed [ 164.328483][ T5788] FAT-fs (loop4): Directory bread(block 70) failed [ 164.358782][ T5788] FAT-fs (loop4): Directory bread(block 71) failed [ 164.394939][ T5788] FAT-fs (loop4): Directory bread(block 72) failed [ 164.401700][ T5788] FAT-fs (loop4): Directory bread(block 73) failed [ 164.405651][ T5790] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 164.442192][ T5790] ext4 filesystem being mounted at /74/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 164.454398][ T4576] usb 4-1: USB disconnect, device number 5 [ 164.665350][ T5790] overlayfs: Failed to create volatile/dirty file. [ 165.123047][ T5790] overlayfs: failed to set xattr on upper [ 165.128869][ T5790] overlayfs: ...falling back to index=off,metacopy=off. [ 165.244200][ C1] net_ratelimit: 15 callbacks suppressed [ 165.244217][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 165.256889][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 165.263889][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 165.284110][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 165.291132][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 165.524784][ T5810] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 166.323894][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 166.329644][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 166.330870][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 166.337724][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 166.478573][ T5815] FAT-fs (loop4): error, invalid access to FAT (entry 0x00006c61) [ 166.637574][ T26] audit: type=1800 audit(1756051078.261:32): pid=5815 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.401" name="cpu.stat" dev="loop4" ino=1048605 res=0 errno=0 [ 166.819737][ T4266] EXT4-fs (loop0): unmounting filesystem. [ 167.106924][ T5830] set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 167.722462][ T4582] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 167.762376][ T5839] tipc: Enabling of bearer rejected, already enabled [ 167.941052][ T4582] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 167.983834][ T4582] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 168.090223][ T4582] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 168.107822][ T5842] input: syz1 as /devices/virtual/input/input20 [ 168.140480][ T4582] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 168.162110][ T4582] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 168.195586][ T4582] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 168.234866][ T4582] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 168.280361][ T4582] usb 2-1: Product: syz [ 168.306966][ T4582] usb 2-1: Manufacturer: syz [ 168.553497][ T4582] cdc_wdm 2-1:1.0: skipping garbage [ 168.653826][ T26] audit: type=1400 audit(1756051080.371:33): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=5846 comm="syz.2.419" [ 169.326504][ T4582] cdc_wdm 2-1:1.0: skipping garbage [ 169.658003][ T4582] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 169.681762][ T4582] cdc_wdm 2-1:1.0: Unknown control protocol [ 169.739971][ T4582] usb 2-1: USB disconnect, device number 2 [ 170.483765][ C1] net_ratelimit: 15 callbacks suppressed [ 170.483782][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 170.483847][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 170.489564][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 170.510150][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 170.855282][ T5867] device syzkaller0 entered promiscuous mode [ 170.902647][ T5867] tipc: Enabled bearer , priority 0 [ 170.924831][ T5867] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 170.976257][ T5866] tipc: Resetting bearer [ 171.109243][ T5866] tipc: Disabling bearer [ 171.523744][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 171.523743][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 171.523849][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 171.530704][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 171.551402][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 172.563766][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 172.654684][ T26] audit: type=1326 audit(1756051084.441:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5881 comm="syz.0.427" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd012d8ebe9 code=0x0 [ 172.676239][ C1] vkms_vblank_simulate: vblank timer overrun [ 172.862419][ T5894] input: syz1 as /devices/virtual/input/input22 [ 174.632923][ T5914] device syzkaller0 entered promiscuous mode [ 174.660496][ T5914] tipc: Enabled bearer , priority 0 [ 174.683250][ T5914] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 174.740812][ T5913] tipc: Resetting bearer [ 174.804839][ T5913] tipc: Disabling bearer [ 175.683763][ C1] net_ratelimit: 12 callbacks suppressed [ 175.683779][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 175.683823][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 175.689543][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 175.696442][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 175.703242][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 176.180498][ T5929] input: syz1 as /devices/virtual/input/input23 [ 176.723778][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 176.730816][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 176.733752][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 176.737761][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 176.744765][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 177.705259][ T5940] tipc: Enabling of bearer rejected, already enabled [ 179.081534][ T5957] input: syz1 as /devices/virtual/input/input24 [ 179.850252][ T26] audit: type=1400 audit(1756051091.621:35): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=5961 comm="syz.4.451" [ 180.883773][ C1] net_ratelimit: 15 callbacks suppressed [ 180.883790][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 180.896456][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 180.903349][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 181.094321][ T4270] Bluetooth: hci4: command 0x0406 tx timeout [ 181.145004][ T4281] Bluetooth: hci0: command 0x0406 tx timeout [ 181.151045][ T4281] Bluetooth: hci1: command 0x0406 tx timeout [ 181.157859][ T4275] Bluetooth: hci2: command 0x0406 tx timeout [ 181.157876][ T4282] Bluetooth: hci3: command 0x0406 tx timeout [ 181.171768][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 181.178726][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 181.714678][ T5981] tipc: Enabling of bearer rejected, already enabled [ 181.923835][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 181.930893][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 181.937871][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 181.964388][ T4321] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 182.230166][ T4321] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 182.243777][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 182.249104][ T4321] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 182.250787][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 182.278322][ T4321] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 182.303075][ T4321] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 182.323775][ T4321] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 182.337928][ T4321] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 182.347360][ T4321] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 182.356128][ T4321] usb 3-1: Product: syz [ 182.360422][ T4321] usb 3-1: Manufacturer: syz [ 182.374173][ T4321] cdc_wdm 3-1:1.0: skipping garbage [ 182.379409][ T4321] cdc_wdm 3-1:1.0: skipping garbage [ 182.389715][ T4321] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 182.416300][ T4321] cdc_wdm 3-1:1.0: Unknown control protocol [ 182.578307][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 182.584968][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 182.591499][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 182.598112][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 182.621328][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 182.627981][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 182.638928][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 182.645561][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 182.652068][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 182.658687][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 182.673367][ C1] cdc_wdm 3-1:1.0: nonzero urb status received: -71 [ 182.680001][ C1] cdc_wdm 3-1:1.0: wdm_int_callback - 0 bytes [ 182.686520][ T4321] usb 3-1: USB disconnect, device number 2 [ 182.712434][ T5997] loop4: detected capacity change from 0 to 2048 [ 182.863517][ T5997] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 182.893849][ T5997] ext4 filesystem being mounted at /84/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 182.926394][ T5999] loop1: detected capacity change from 0 to 2048 [ 183.007067][ T5997] overlayfs: Failed to create volatile/dirty file. [ 183.029879][ T5999] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 183.066464][ T5999] ext4 filesystem being mounted at /91/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 183.199631][ T5999] overlayfs: Failed to create volatile/dirty file. [ 183.503202][ T6008] overlayfs: failed to set xattr on upper [ 183.509062][ T6008] overlayfs: ...falling back to index=off,metacopy=off. [ 184.141962][ T4279] EXT4-fs (loop1): unmounting filesystem. [ 184.479344][ T6020] overlayfs: failed to set xattr on upper [ 184.485148][ T6020] overlayfs: ...falling back to index=off,metacopy=off. [ 185.355245][ T4267] EXT4-fs (loop4): unmounting filesystem. [ 186.026308][ T6032] tipc: Enabling of bearer rejected, already enabled [ 186.083812][ C1] net_ratelimit: 15 callbacks suppressed [ 186.083825][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 186.096454][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 186.103362][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 186.403759][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 186.410769][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 186.461707][ T6043] netlink: 'syz.0.472': attribute type 10 has an invalid length. [ 186.617962][ T6043] batman_adv: batadv0: Adding interface: team0 [ 186.628674][ T6043] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 187.029998][ T6043] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active [ 187.133828][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 187.140873][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 187.147857][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 187.444245][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 187.451290][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 187.928210][ T6057] loop4: detected capacity change from 0 to 2048 [ 188.029563][ T6057] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 188.050662][ T6057] ext4 filesystem being mounted at /88/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 188.141630][ T6057] overlayfs: Failed to create volatile/dirty file. [ 188.450851][ T6064] overlayfs: failed to set xattr on upper [ 188.456664][ T6064] overlayfs: ...falling back to index=off,metacopy=off. [ 188.886310][ T6068] device syzkaller0 entered promiscuous mode [ 188.918433][ T6068] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 189.117667][ T6071] loop0: detected capacity change from 0 to 2048 [ 189.251491][ T6071] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 189.306447][ T6071] ext4 filesystem being mounted at /92/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 189.428586][ T6071] overlayfs: conflicting lowerdir path [ 189.463234][ T6078] overlayfs: workdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 189.513602][ T4267] EXT4-fs (loop4): unmounting filesystem. [ 189.702936][ T4266] EXT4-fs (loop0): unmounting filesystem. [ 190.531027][ T6087] tipc: Enabling of bearer rejected, already enabled [ 191.283757][ C1] net_ratelimit: 15 callbacks suppressed [ 191.283775][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 191.296515][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 191.303464][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 191.603836][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 191.610998][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 191.836475][ T6102] input: syz1 as /devices/virtual/input/input25 [ 192.190338][ T6112] input: syz1 as /devices/virtual/input/input26 [ 192.323865][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 192.330877][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 192.337864][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 192.408418][ T6113] device syzkaller0 entered promiscuous mode [ 192.436862][ T6113] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 192.637814][ T6116] loop3: detected capacity change from 0 to 32768 [ 192.643791][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 192.651242][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 192.661356][ T6116] BTRFS error: device /dev/loop3 already registered with a higher generation, found 8 expect 10 [ 194.090645][ T1267] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.099310][ T1267] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.311241][ T6127] loop1: detected capacity change from 0 to 2048 [ 195.394996][ T4475] BTRFS error: device /dev/loop3 already registered with a higher generation, found 8 expect 10 [ 195.435814][ T6127] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 195.462104][ T6127] ext4 filesystem being mounted at /97/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 195.642044][ T6127] overlayfs: conflicting lowerdir path [ 195.683238][ T6134] overlayfs: overlay with incompat feature 'volatile' cannot be mounted [ 195.736721][ T4279] EXT4-fs (loop1): unmounting filesystem. [ 195.851046][ T6136] syz.1.502 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 195.865177][ T6136] tipc: Enabling of bearer rejected, already enabled [ 196.342415][ T6146] input: syz1 as /devices/virtual/input/input27 [ 196.483781][ C1] net_ratelimit: 15 callbacks suppressed [ 196.483801][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 196.496480][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 196.503439][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 196.803792][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 196.810792][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 197.533762][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 197.540759][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 197.547685][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 197.843771][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 197.850760][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 198.695724][ T26] audit: type=1400 audit(1756051110.481:36): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=6163 comm="syz.2.510" [ 198.961666][ T6168] loop3: detected capacity change from 0 to 2048 [ 199.106782][ T6168] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 199.132383][ T6168] ext4 filesystem being mounted at /111/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 200.225007][ T6168] overlayfs: Failed to create volatile/dirty file. [ 200.277258][ T6180] tipc: Enabling of bearer rejected, already enabled [ 200.307455][ T6177] loop1: detected capacity change from 0 to 2048 [ 200.424648][ T6177] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 200.471635][ T6177] ext4 filesystem being mounted at /100/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 200.575729][ T26] audit: type=1326 audit(1756051112.311:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6186 comm="syz.4.517" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd96f98ebe9 code=0x0 [ 201.834761][ C1] net_ratelimit: 13 callbacks suppressed [ 201.834777][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 201.847397][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 201.854296][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 201.861668][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 201.868651][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 201.888309][ T6177] overlayfs: failed to resolve './file7': -2 [ 201.918400][ T6177] overlayfs: failed to verify upper (/file0, ino=12, err=-28) [ 201.939575][ T6177] overlayfs: failed to verify index dir 'upper' xattr [ 201.946829][ T6177] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 202.883784][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 202.883846][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 202.890749][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 202.897653][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 202.904477][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 203.000849][ T4279] EXT4-fs (loop1): unmounting filesystem. [ 203.007185][ T6193] netlink: 'syz.0.518': attribute type 10 has an invalid length. [ 203.015303][ T6193] netlink: 2 bytes leftover after parsing attributes in process `syz.0.518'. [ 203.024181][ T6193] device team0 entered promiscuous mode [ 203.029707][ T6193] device team_slave_0 entered promiscuous mode [ 203.035986][ T6193] device team_slave_1 entered promiscuous mode [ 203.043008][ T6193] 8021q: adding VLAN 0 to HW filter on device team0 [ 203.049752][ T6193] batman_adv: batadv0: Interface activated: team0 [ 203.056238][ T6193] batman_adv: batadv0: Interface deactivated: team0 [ 203.062819][ T6193] batman_adv: batadv0: Removing interface: team0 [ 203.082077][ T6193] bridge0: port 3(team0) entered blocking state [ 203.088498][ T6193] bridge0: port 3(team0) entered disabled state [ 203.095949][ T6193] bridge0: port 3(team0) entered blocking state [ 203.102367][ T6193] bridge0: port 3(team0) entered forwarding state [ 204.138747][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 204.887402][ T6214] loop4: detected capacity change from 0 to 2048 [ 205.035182][ T6214] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 205.051278][ T6214] ext4 filesystem being mounted at /97/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 205.103085][ T6214] overlayfs: missing 'lowerdir' [ 205.391469][ T6227] overlayfs: failed to create directory ./bus/index (errno: 28); mounting read-only [ 205.400987][ T6227] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 206.555938][ T4267] EXT4-fs (loop4): unmounting filesystem. [ 206.671549][ T6233] tipc: Enabling of bearer rejected, already enabled [ 206.923970][ T26] audit: type=1400 audit(1756051118.701:38): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=6234 comm="syz.4.527" [ 207.053769][ C1] net_ratelimit: 14 callbacks suppressed [ 207.053783][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 207.066404][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 207.073341][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 207.374017][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 207.381076][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 207.652050][ T6239] XFS (nullb0): Invalid superblock magic number [ 207.715068][ T26] audit: type=1326 audit(1756051119.501:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6246 comm="syz.3.531" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb516d8ebe9 code=0x0 [ 207.736645][ C0] vkms_vblank_simulate: vblank timer overrun [ 208.083762][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 208.090831][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 208.097858][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 208.121902][ T6260] block nbd2: shutting down sockets [ 208.403920][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 208.411096][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 208.639333][ T6265] tipc: Enabled bearer , priority 0 [ 208.675191][ T6265] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 208.696783][ T6265] tipc: Resetting bearer [ 208.811837][ T6264] tipc: Disabling bearer [ 211.141208][ T26] audit: type=1400 audit(1756051122.921:40): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=6280 comm="syz.1.543" [ 212.446172][ T6304] block nbd0: shutting down sockets [ 212.643776][ C1] net_ratelimit: 15 callbacks suppressed [ 212.643789][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 212.653976][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 212.656411][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 212.663238][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 212.670002][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 213.358429][ T6308] netlink: 'syz.4.541': attribute type 10 has an invalid length. [ 213.378688][ T6310] loop3: detected capacity change from 0 to 2048 [ 213.386172][ T6308] netlink: 2 bytes leftover after parsing attributes in process `syz.4.541'. [ 213.415692][ T6308] device team0 entered promiscuous mode [ 213.433896][ T6308] device team_slave_0 entered promiscuous mode [ 213.441251][ T6308] device team_slave_1 entered promiscuous mode [ 213.450574][ T6308] bridge0: port 3(team0) entered blocking state [ 213.460927][ T6308] bridge0: port 3(team0) entered disabled state [ 213.512481][ T6308] bridge0: port 3(team0) entered blocking state [ 213.519796][ T6308] bridge0: port 3(team0) entered forwarding state [ 213.544856][ T6310] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 213.579565][ T6310] ext4 filesystem being mounted at /119/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 213.683731][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 213.683942][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 213.690711][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 213.697562][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 213.704412][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 213.938520][ T6310] overlayfs: Failed to create volatile/dirty file. [ 214.055745][ T6316] tipc: Enabled bearer , priority 0 [ 214.074425][ T6316] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 214.109822][ T6316] tipc: Resetting bearer [ 214.326246][ T6322] overlayfs: failed to set xattr on upper [ 214.332177][ T6322] overlayfs: ...falling back to index=off,metacopy=off. [ 215.655305][ T6314] tipc: Disabling bearer [ 215.928427][ T6323] input: syz1 as /devices/virtual/input/input28 [ 216.120776][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 216.357895][ T6329] input: syz1 as /devices/virtual/input/input29 [ 217.026333][ T26] audit: type=1400 audit(1756051128.801:41): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=6331 comm="syz.0.557" [ 217.750621][ T6342] input: syz1 as /devices/virtual/input/input31 [ 217.843716][ C1] net_ratelimit: 14 callbacks suppressed [ 217.843731][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 217.843798][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 217.849460][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 217.856378][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 217.863169][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 217.995517][ T6345] loop2: detected capacity change from 0 to 32768 [ 218.074374][ T6347] block nbd0: shutting down sockets [ 218.882963][ T6345] BTRFS info (device loop2): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 218.893223][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 218.893346][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 218.893483][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 218.893790][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 218.893903][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 218.928312][ T6345] BTRFS info (device loop2): using sha256 (sha256-avx2) checksum algorithm [ 218.936987][ T6345] BTRFS info (device loop2): using free space tree [ 219.219158][ T26] audit: type=1326 audit(1756051131.001:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6375 comm="syz.3.568" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb516d8ebe9 code=0x0 [ 219.234911][ T6374] tipc: Enabled bearer , priority 0 [ 219.427796][ T6345] BTRFS info (device loop2): enabling ssd optimizations [ 219.823488][ T6383] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 219.856947][ T6390] tipc: Resetting bearer [ 220.371446][ T26] audit: type=1800 audit(1756051131.711:43): pid=6393 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.560" name="file1" dev="loop2" ino=260 res=0 errno=0 [ 220.473908][ T6367] tipc: Disabling bearer [ 220.535546][ T4276] BTRFS info (device loop2): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 221.688979][ T6402] input: syz1 as /devices/virtual/input/input32 [ 221.790395][ T6408] input: syz1 as /devices/virtual/input/input33 [ 222.088145][ T6413] input: syz1 as /devices/virtual/input/input34 [ 223.123799][ C0] net_ratelimit: 15 callbacks suppressed [ 223.123817][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 223.136541][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 223.603756][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 223.610796][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 223.617837][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 224.163820][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 224.170888][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 224.336519][ T6428] input: syz1 as /devices/virtual/input/input35 [ 224.444745][ T6430] loop3: detected capacity change from 0 to 2048 [ 224.588169][ T6430] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 224.598270][ T6430] ext4 filesystem being mounted at /125/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 224.643739][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 224.650885][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 224.658101][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 224.820361][ T6430] overlayfs: failed to resolve './bus': -2 [ 224.888853][ T6435] overlayfs: failed to resolve './bus': -2 [ 225.265248][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 225.292148][ T6443] tipc: Enabled bearer , priority 0 [ 225.301083][ T6443] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 225.333330][ T6443] tipc: Resetting bearer [ 225.773761][ T6442] tipc: Disabling bearer [ 225.868691][ T6448] input: syz1 as /devices/virtual/input/input36 [ 226.129360][ T6455] loop4: detected capacity change from 0 to 32768 [ 226.141312][ T6455] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop4 scanned by syz.4.588 (6455) [ 226.161611][ T6455] BTRFS info (device loop4): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 226.171957][ T6455] BTRFS info (device loop4): using sha256 (sha256-avx2) checksum algorithm [ 226.180658][ T6455] BTRFS info (device loop4): using free space tree [ 226.283869][ T4576] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 226.518870][ T4576] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 226.609770][ T4576] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 226.827326][ T4576] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 226.839955][ T6455] BTRFS info (device loop4): enabling ssd optimizations [ 227.109076][ T4576] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 227.109713][ T4576] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 227.131143][ T4576] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 227.131174][ T4576] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 227.132979][ T4576] usb 2-1: Product: syz [ 227.338792][ T4576] usb 2-1: Manufacturer: syz [ 227.350011][ T4576] cdc_wdm 2-1:1.0: skipping garbage [ 227.355454][ T4576] cdc_wdm 2-1:1.0: skipping garbage [ 227.361725][ T4576] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 227.368031][ T4576] cdc_wdm 2-1:1.0: Unknown control protocol [ 227.388967][ T6460] input: syz1 as /devices/virtual/input/input37 [ 228.003716][ T26] audit: type=1800 audit(1756051139.271:44): pid=6486 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.588" name="file1" dev="loop4" ino=260 res=0 errno=0 [ 228.065044][ C0] cdc_wdm 2-1:1.0: nonzero urb status received: -71 [ 228.065690][ T4937] usb 2-1: USB disconnect, device number 3 [ 228.071677][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - 0 bytes [ 228.071700][ C0] cdc_wdm 2-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 228.187381][ T4267] BTRFS info (device loop4): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d [ 228.327981][ C0] net_ratelimit: 15 callbacks suppressed [ 228.327999][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 228.340703][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 228.349865][ T6492] loop3: detected capacity change from 0 to 2048 [ 228.387428][ T4475] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 10 /dev/loop4 scanned by udevd (4475) [ 228.575784][ T6492] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 228.635843][ T6492] ext4 filesystem being mounted at /128/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 228.845285][ T6492] overlayfs: Failed to create volatile/dirty file. [ 229.043762][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 229.050937][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 229.058170][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 229.240210][ T6510] overlayfs: failed to set xattr on upper [ 229.246117][ T6510] overlayfs: ...falling back to index=off,metacopy=off. [ 229.363782][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 229.370855][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 230.083774][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 230.091002][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 230.098125][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 230.482406][ T6515] tipc: Enabled bearer , priority 0 [ 230.490463][ T6515] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 230.728864][ T6518] tipc: Resetting bearer [ 230.809284][ T6514] tipc: Disabling bearer [ 231.469778][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 232.141759][ T6545] input: syz1 as /devices/virtual/input/input38 [ 233.523753][ C0] net_ratelimit: 15 callbacks suppressed [ 233.523777][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 233.536508][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 234.171899][ T6563] input: syz1 as /devices/virtual/input/input39 [ 234.243873][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 234.250889][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 234.251696][ T6559] tipc: Enabled bearer , priority 0 [ 234.257882][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 234.447776][ T6559] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 234.469709][ T4475] udevd[4475]: setting owner of /dev/input/mouse1 to uid=0, gid=104 failed: No such file or directory [ 234.509471][ T6559] tipc: Resetting bearer [ 234.553234][ T6555] tipc: Disabling bearer [ 234.564221][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 234.571443][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 235.283895][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 235.290883][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 235.297887][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 235.983437][ T6586] input: syz1 as /devices/virtual/input/input40 [ 236.214743][ T6590] loop3: detected capacity change from 0 to 32768 [ 236.234668][ T6590] BTRFS error: device /dev/loop3 already registered with a higher generation, found 8 expect 10 [ 238.067188][ T6607] tipc: Enabled bearer , priority 0 [ 238.080573][ T6607] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 238.127473][ T6610] input: syz1 as /devices/virtual/input/input41 [ 238.200724][ T6611] tipc: Resetting bearer [ 238.238183][ T4475] BTRFS error: device /dev/loop3 already registered with a higher generation, found 8 expect 10 [ 238.723827][ C0] net_ratelimit: 15 callbacks suppressed [ 238.723846][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 238.736653][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 239.154505][ T6604] tipc: Disabling bearer [ 239.443758][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 239.450803][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 239.457805][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 239.763801][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 239.770877][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 240.483813][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 240.490860][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 240.497800][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 242.575437][ T6658] input: syz1 as /devices/virtual/input/input42 [ 243.774918][ T6675] tipc: Enabled bearer , priority 0 [ 243.784294][ T6675] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 243.801037][ T6675] tipc: Resetting bearer [ 243.822545][ T6666] tipc: Disabling bearer [ 244.254146][ C0] net_ratelimit: 15 callbacks suppressed [ 244.254164][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 244.266818][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 244.723757][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 244.730895][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 244.737897][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 245.283903][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 245.290962][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 245.763767][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 245.770808][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 245.777852][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 246.102253][ T6700] input: syz1 as /devices/virtual/input/input43 [ 246.699933][ T26] audit: type=1326 audit(1756051158.481:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6711 comm="syz.1.664" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5e76f8ebe9 code=0x0 [ 246.940804][ T6719] netlink: 'syz.3.661': attribute type 10 has an invalid length. [ 247.190657][ T6719] batman_adv: batadv0: Adding interface: team0 [ 247.267514][ T6719] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 247.292798][ C1] vkms_vblank_simulate: vblank timer overrun [ 247.367461][ T6719] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active [ 248.119573][ T6726] netlink: 'syz.3.661': attribute type 10 has an invalid length. [ 248.170663][ T6726] netlink: 2 bytes leftover after parsing attributes in process `syz.3.661'. [ 249.295296][ T6726] device team0 entered promiscuous mode [ 249.303188][ T6726] device team_slave_0 entered promiscuous mode [ 249.443795][ C0] net_ratelimit: 15 callbacks suppressed [ 249.443814][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 249.456669][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 249.923757][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 249.930915][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 249.938044][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 250.146545][ T6726] device team_slave_1 entered promiscuous mode [ 250.179963][ T6726] 8021q: adding VLAN 0 to HW filter on device team0 [ 250.226233][ T6726] batman_adv: batadv0: Interface activated: team0 [ 250.233571][ T6726] batman_adv: batadv0: Interface deactivated: team0 [ 250.241300][ T6726] batman_adv: batadv0: Removing interface: team0 [ 250.283305][ T6726] bridge0: port 3(team0) entered blocking state [ 250.320223][ T6726] bridge0: port 3(team0) entered disabled state [ 250.483760][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 250.484917][ T6726] bridge0: port 3(team0) entered blocking state [ 250.490832][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 250.496982][ T6726] bridge0: port 3(team0) entered forwarding state [ 250.963755][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 250.970746][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 250.977746][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 251.757734][ T6757] netlink: 'syz.4.675': attribute type 10 has an invalid length. [ 251.800283][ T6757] bridge0: port 3(team0) entered disabled state [ 251.851086][ T6757] device team0 left promiscuous mode [ 251.857976][ T6757] device team_slave_0 left promiscuous mode [ 251.865115][ T6757] device team_slave_1 left promiscuous mode [ 251.875509][ T6757] bridge0: port 3(team0) entered disabled state [ 251.911862][ T6757] batman_adv: batadv0: Adding interface: team0 [ 251.918726][ T6757] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 251.944004][ C1] vkms_vblank_simulate: vblank timer overrun [ 251.951381][ T6757] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active [ 251.968222][ T6760] netlink: 'syz.4.675': attribute type 10 has an invalid length. [ 251.976684][ T6760] netlink: 2 bytes leftover after parsing attributes in process `syz.4.675'. [ 252.015595][ T6760] device team0 entered promiscuous mode [ 252.045331][ T6760] device team_slave_0 entered promiscuous mode [ 252.078674][ T6760] device team_slave_1 entered promiscuous mode [ 252.153084][ T6760] 8021q: adding VLAN 0 to HW filter on device team0 [ 252.351625][ T6760] batman_adv: batadv0: Interface activated: team0 [ 252.943737][ T6760] batman_adv: batadv0: Interface deactivated: team0 [ 252.994513][ T6760] batman_adv: batadv0: Removing interface: team0 [ 253.028846][ T6760] bridge0: port 3(team0) entered blocking state [ 253.069746][ T6760] bridge0: port 3(team0) entered disabled state [ 253.106405][ T6760] bridge0: port 3(team0) entered blocking state [ 253.112788][ T6760] bridge0: port 3(team0) entered forwarding state [ 253.428157][ T6776] loop3: detected capacity change from 0 to 2048 [ 253.447363][ T6780] tipc: Enabled bearer , priority 0 [ 253.471311][ T6780] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 253.562442][ T6780] tipc: Resetting bearer [ 253.575050][ T6776] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 253.583897][ T6776] ext4 filesystem being mounted at /137/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 253.658213][ T6779] tipc: Disabling bearer [ 253.731252][ T6787] overlayfs: failed to create directory ./bus/index (errno: 28); mounting read-only [ 253.778071][ T6787] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 254.085982][ T6791] input: syz1 as /devices/virtual/input/input44 [ 254.255150][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 254.697268][ C0] net_ratelimit: 15 callbacks suppressed [ 254.697300][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 254.710405][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 255.123999][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 255.131064][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 255.138105][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 255.527213][ T1267] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.533551][ T1267] ieee802154 phy1 wpan1: encryption failed: -22 [ 255.773788][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 255.780838][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 256.164015][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 256.171188][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 256.178339][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 257.190653][ T26] audit: type=1326 audit(1756051168.971:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6810 comm="syz.4.690" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd96f98ebe9 code=0x0 [ 258.395816][ T6833] loop1: detected capacity change from 0 to 2048 [ 258.514272][ T6834] tipc: Enabled bearer , priority 0 [ 258.535528][ T6834] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 258.677520][ T6833] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 258.694628][ T6833] ext4 filesystem being mounted at /140/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 258.708917][ T6834] tipc: Resetting bearer [ 259.001067][ T6830] tipc: Disabling bearer [ 259.567530][ T6847] overlayfs: failed to create directory ./bus/index (errno: 28); mounting read-only [ 259.673882][ T6847] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 259.923772][ C0] net_ratelimit: 15 callbacks suppressed [ 259.923787][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 259.936527][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 259.986307][ T4279] EXT4-fs (loop1): unmounting filesystem. [ 260.163977][ T26] audit: type=1400 audit(1756051171.851:47): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=6851 comm="syz.3.701" [ 260.323849][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 260.330909][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 260.337973][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 260.963840][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 260.970941][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 261.060600][ T4282] block nbd1: Receive control failed (result -32) [ 261.131095][ T4475] block nbd1: shutting down sockets [ 261.237327][ T26] audit: type=1326 audit(1756051173.021:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6872 comm="syz.2.707" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f524cb8ebe9 code=0x0 [ 261.363824][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 261.370833][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 261.377822][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 263.721461][ T6902] tipc: Enabling of bearer rejected, failed to enable media [ 263.893345][ T6906] loop2: detected capacity change from 0 to 2048 [ 263.980832][ T6906] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 263.990323][ T6906] ext4 filesystem being mounted at /153/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 264.028212][ T4282] block nbd0: Receive control failed (result -32) [ 264.034128][ T6914] block nbd0: shutting down sockets [ 264.044973][ T6906] overlayfs: missing 'lowerdir' [ 264.091709][ T6906] overlayfs: failed to create directory ./bus/index (errno: 28); mounting read-only [ 264.124479][ T6906] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 264.527845][ T4276] EXT4-fs (loop2): unmounting filesystem. [ 264.755050][ T6928] input: syz1 as /devices/virtual/input/input45 [ 265.123993][ C0] net_ratelimit: 15 callbacks suppressed [ 265.124010][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 265.136780][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 265.513999][ T26] audit: type=1326 audit(1756051177.071:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6934 comm="syz.2.722" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f524cb8ebe9 code=0x0 [ 265.523771][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 265.542654][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 265.549675][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 266.163830][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 266.171228][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 266.563760][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 266.570798][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 266.577828][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 267.912191][ T4282] block nbd2: Receive control failed (result -32) [ 267.921968][ T6958] block nbd2: shutting down sockets [ 268.224189][ T6968] tipc: Enabling of bearer rejected, failed to enable media [ 268.253160][ T6969] loop3: detected capacity change from 0 to 2048 [ 268.370558][ T6969] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 268.420546][ T6969] ext4 filesystem being mounted at /149/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 268.519172][ T6969] overlayfs: missing 'lowerdir' [ 268.577946][ T6969] overlayfs: failed to create directory ./bus/index (errno: 28); mounting read-only [ 268.644253][ T6969] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 268.772328][ T6985] loop1: detected capacity change from 0 to 256 [ 268.850374][ T26] audit: type=1326 audit(1756051180.631:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6984 comm="syz.0.738" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd012d8ebe9 code=0x0 [ 268.914928][ T6985] FAT-fs (loop1): Directory bread(block 64) failed [ 268.921532][ T6985] FAT-fs (loop1): Directory bread(block 65) failed [ 268.949347][ T4273] EXT4-fs (loop3): unmounting filesystem. [ 268.957508][ T6985] FAT-fs (loop1): Directory bread(block 66) failed [ 268.997765][ T6985] FAT-fs (loop1): Directory bread(block 67) failed [ 269.018740][ T6985] FAT-fs (loop1): Directory bread(block 68) failed [ 269.059657][ T6985] FAT-fs (loop1): Directory bread(block 69) failed [ 269.152173][ T6985] FAT-fs (loop1): Directory bread(block 70) failed [ 269.256103][ T6985] FAT-fs (loop1): Directory bread(block 71) failed [ 269.357229][ T6985] FAT-fs (loop1): Directory bread(block 72) failed [ 269.450675][ T6985] FAT-fs (loop1): Directory bread(block 73) failed [ 270.323784][ C0] net_ratelimit: 15 callbacks suppressed [ 270.323804][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 270.336547][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 271.363776][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 271.370805][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 271.439428][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 271.446511][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 271.453445][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 272.403991][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 272.411323][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 272.493847][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 272.529947][ T14] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 272.686972][ T4282] block nbd4: Receive control failed (result -32) [ 272.696275][ T7010] block nbd4: shutting down sockets [ 272.775133][ T14] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 272.815654][ T14] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 272.856283][ T14] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 272.882563][ T14] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 272.901860][ T7022] tipc: Enabling of bearer rejected, failed to enable media [ 272.910750][ T14] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 272.950318][ T14] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 272.976427][ T14] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 272.977689][ T7024] loop2: detected capacity change from 0 to 2048 [ 273.001275][ T14] usb 4-1: Product: syz [ 273.011125][ T14] usb 4-1: Manufacturer: syz [ 273.034540][ T7024] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 273.053199][ T14] cdc_wdm 4-1:1.0: skipping garbage [ 273.059732][ T14] cdc_wdm 4-1:1.0: skipping garbage [ 273.063978][ T7024] ext4 filesystem being mounted at /162/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 273.079393][ T14] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 273.094907][ T14] cdc_wdm 4-1:1.0: Unknown control protocol [ 273.262250][ T7024] overlayfs: missing 'lowerdir' [ 273.273094][ T14] usb 4-1: USB disconnect, device number 6 [ 273.296501][ T7024] overlayfs: failed to create directory ./bus/index (errno: 28); mounting read-only [ 273.362570][ T7024] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 273.812992][ T4276] EXT4-fs (loop2): unmounting filesystem. [ 275.523765][ C0] net_ratelimit: 12 callbacks suppressed [ 275.523780][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 275.536415][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 275.613800][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 275.620792][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 275.627750][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 275.637007][ T4282] block nbd1: Receive control failed (result -32) [ 275.645513][ T7059] block nbd1: shutting down sockets [ 276.758528][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 276.765584][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 276.772510][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 277.025795][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 277.032744][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 278.170686][ T7085] tipc: Enabling of bearer rejected, failed to enable media [ 278.356442][ T4576] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 278.555661][ T4576] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 278.576846][ T4576] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 278.604403][ T4576] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 278.623462][ T4576] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 278.675065][ T4576] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 278.693294][ T4576] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 278.762181][ T4576] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 278.791017][ T4576] usb 2-1: Product: syz [ 278.799467][ T4576] usb 2-1: Manufacturer: syz [ 278.810314][ T4576] cdc_wdm 2-1:1.0: skipping garbage [ 278.816171][ T4576] cdc_wdm 2-1:1.0: skipping garbage [ 278.851006][ T4576] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 278.862323][ T4576] cdc_wdm 2-1:1.0: Unknown control protocol [ 278.926761][ T7102] input: syz1 as /devices/virtual/input/input46 [ 279.017849][ T4576] usb 2-1: USB disconnect, device number 4 [ 280.059361][ T7111] loop4: detected capacity change from 0 to 2048 [ 280.170720][ T7111] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 280.181669][ T7111] ext4 filesystem being mounted at /146/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 280.655094][ T7111] overlayfs: Failed to create volatile/dirty file. [ 280.883988][ C1] net_ratelimit: 15 callbacks suppressed [ 280.884005][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 280.905491][ T7120] overlayfs: missing 'lowerdir' [ 280.974702][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 280.981652][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 281.204099][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 281.211437][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 281.923906][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 282.003818][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 282.010765][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 282.334098][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 282.341041][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 282.376313][ T4267] EXT4-fs (loop4): unmounting filesystem. [ 283.772378][ T7144] tipc: Enabling of bearer rejected, failed to enable media [ 284.270288][ T7156] input: syz1 as /devices/virtual/input/input47 [ 286.403834][ C0] net_ratelimit: 13 callbacks suppressed [ 286.403853][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 286.416843][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 286.722653][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 286.729721][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 286.736761][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 286.818741][ T7170] input: syz1 as /devices/virtual/input/input48 [ 287.443784][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 287.450831][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 288.483781][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 288.490873][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 288.525810][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 290.323031][ T7210] IPv6: ADDRCONF(NETDEV_CHANGE): bpq0: link becomes ready [ 291.364817][ T7220] tipc: Enabling of bearer rejected, failed to enable media [ 292.163812][ C1] net_ratelimit: 12 callbacks suppressed [ 292.163832][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 292.176577][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 292.183618][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 292.243813][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 292.250851][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 293.203822][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 293.210802][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 293.217744][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 293.356832][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 293.363887][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 293.747742][ T7249] netlink: 'syz.4.802': attribute type 10 has an invalid length. [ 293.796805][ T7249] bridge0: port 3(team0) entered disabled state [ 293.867295][ T7249] device team0 left promiscuous mode [ 293.988576][ T7249] device team_slave_0 left promiscuous mode [ 294.025657][ T7249] device team_slave_1 left promiscuous mode [ 294.037057][ T7249] bridge0: port 3(team0) entered disabled state [ 294.129215][ T7249] batman_adv: batadv0: Adding interface: team0 [ 294.129345][ T7249] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 294.129391][ T7249] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active [ 294.138068][ T7256] netlink: 'syz.4.802': attribute type 10 has an invalid length. [ 294.138164][ T7256] netlink: 2 bytes leftover after parsing attributes in process `syz.4.802'. [ 294.146356][ T7256] device team0 entered promiscuous mode [ 294.146372][ T7256] device team_slave_0 entered promiscuous mode [ 294.147687][ T7256] device team_slave_1 entered promiscuous mode [ 294.178984][ T7256] 8021q: adding VLAN 0 to HW filter on device team0 [ 294.589088][ T7264] netlink: 40 bytes leftover after parsing attributes in process `syz.0.810'. [ 294.838462][ T26] audit: type=1400 audit(1756051206.621:51): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=7262 comm="syz.0.810" [ 295.770214][ T7256] batman_adv: batadv0: Interface activated: team0 [ 296.962716][ T7256] batman_adv: batadv0: Interface deactivated: team0 [ 296.970839][ T7256] batman_adv: batadv0: Removing interface: team0 [ 296.980958][ T7256] bridge0: port 3(team0) entered blocking state [ 296.989766][ T7256] bridge0: port 3(team0) entered disabled state [ 297.146982][ T7256] bridge0: port 3(team0) entered blocking state [ 297.153294][ T7256] bridge0: port 3(team0) entered forwarding state [ 297.258345][ T7274] netlink: 'syz.1.809': attribute type 10 has an invalid length. [ 297.348528][ T7274] batman_adv: batadv0: Adding interface: team0 [ 297.357781][ T7274] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 297.860801][ C0] net_ratelimit: 15 callbacks suppressed [ 297.860814][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 297.898528][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 297.923924][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 297.930914][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 297.937845][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 298.318949][ T7274] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active [ 298.448218][ T7279] netlink: 'syz.1.809': attribute type 10 has an invalid length. [ 298.510976][ T7279] netlink: 2 bytes leftover after parsing attributes in process `syz.1.809'. [ 298.596664][ T7279] device team0 entered promiscuous mode [ 298.629178][ T7279] device team_slave_0 entered promiscuous mode [ 298.668555][ T7279] device team_slave_1 entered promiscuous mode [ 298.721334][ T7279] 8021q: adding VLAN 0 to HW filter on device team0 [ 298.759089][ T7279] batman_adv: batadv0: Interface activated: team0 [ 298.794321][ T7279] batman_adv: batadv0: Interface deactivated: team0 [ 298.835220][ T7279] batman_adv: batadv0: Removing interface: team0 [ 298.851445][ T7279] bridge0: port 3(team0) entered blocking state [ 298.882909][ T7279] bridge0: port 3(team0) entered disabled state [ 298.883771][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 298.931823][ T7279] bridge0: port 3(team0) entered blocking state [ 298.938211][ T7279] bridge0: port 3(team0) entered forwarding state [ 298.963867][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 298.963901][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 298.977813][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 298.984815][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 299.196569][ T7293] block nbd0: shutting down sockets [ 299.554001][ T7301] loop3: detected capacity change from 0 to 256 [ 300.017596][ T7301] FAT-fs (loop3): Directory bread(block 64) failed [ 300.038956][ T7301] FAT-fs (loop3): Directory bread(block 65) failed [ 300.064031][ T7301] FAT-fs (loop3): Directory bread(block 66) failed [ 300.070597][ T7301] FAT-fs (loop3): Directory bread(block 67) failed [ 300.140609][ T7301] FAT-fs (loop3): Directory bread(block 68) failed [ 300.180400][ T7301] FAT-fs (loop3): Directory bread(block 69) failed [ 300.203857][ T7301] FAT-fs (loop3): Directory bread(block 70) failed [ 300.210424][ T7301] FAT-fs (loop3): Directory bread(block 71) failed [ 300.238859][ T7306] netlink: 'syz.4.823': attribute type 10 has an invalid length. [ 300.255203][ T7301] FAT-fs (loop3): Directory bread(block 72) failed [ 300.275811][ T7301] FAT-fs (loop3): Directory bread(block 73) failed [ 300.283495][ T7306] bridge0: port 3(team0) entered disabled state [ 300.295223][ T7308] fuse: Bad value for 'fd' [ 300.333288][ T7306] device team0 left promiscuous mode [ 300.431043][ T7306] device team_slave_0 left promiscuous mode [ 300.440350][ T7306] device team_slave_1 left promiscuous mode [ 300.451380][ T7306] bridge0: port 3(team0) entered disabled state [ 301.006387][ T7306] batman_adv: batadv0: Adding interface: team0 [ 301.040340][ T7306] batman_adv: batadv0: The MTU of interface team0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 301.072720][ T7312] FAT-fs (loop3): error, invalid access to FAT (entry 0x00006c61) [ 301.081305][ T26] audit: type=1800 audit(1756051212.851:52): pid=7312 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.820" name="cpu.stat" dev="loop3" ino=1048654 res=0 errno=0 [ 301.387795][ T7306] batman_adv: batadv0: Not using interface team0 (retrying later): interface not active [ 301.816459][ T7319] loop2: detected capacity change from 0 to 2048 [ 301.821694][ T7309] netlink: 'syz.4.823': attribute type 10 has an invalid length. [ 301.915672][ T7319] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 301.920663][ T7309] netlink: 2 bytes leftover after parsing attributes in process `syz.4.823'. [ 301.990336][ T7309] device team0 entered promiscuous mode [ 302.017949][ T7309] device team_slave_0 entered promiscuous mode [ 302.051010][ T7309] device team_slave_1 entered promiscuous mode [ 302.070470][ T7309] 8021q: adding VLAN 0 to HW filter on device team0 [ 302.077658][ T7309] batman_adv: batadv0: Interface activated: team0 [ 302.087063][ T7309] batman_adv: batadv0: Interface deactivated: team0 [ 302.093997][ T7309] batman_adv: batadv0: Removing interface: team0 [ 302.102997][ T7319] ext4 filesystem being mounted at /176/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 302.106142][ T7320] netlink: 40 bytes leftover after parsing attributes in process `syz.1.825'. [ 302.124536][ T7309] bridge0: port 3(team0) entered blocking state [ 302.131214][ T7309] bridge0: port 3(team0) entered disabled state [ 302.145298][ T7309] bridge0: port 3(team0) entered blocking state [ 302.151684][ T7309] bridge0: port 3(team0) entered forwarding state [ 302.242318][ T7319] overlayfs: Failed to create volatile/dirty file. [ 302.320648][ T26] audit: type=1400 audit(1756051214.101:53): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=7313 comm="syz.1.825" [ 302.548576][ T7327] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 302.557518][ T7327] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 303.123758][ C0] net_ratelimit: 15 callbacks suppressed [ 303.123774][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 303.123874][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 303.129592][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 303.136356][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 303.156975][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 303.364499][ T4276] EXT4-fs (loop2): unmounting filesystem. [ 304.025587][ T7334] device syzkaller0 entered promiscuous mode [ 304.052691][ T7334] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 304.095656][ T7336] block nbd2: shutting down sockets [ 304.163806][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 304.163878][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 304.170821][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 304.177643][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 304.901628][ T26] audit: type=1326 audit(1756051216.681:54): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7347 comm="syz.1.836" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5e76f8ebe9 code=0x0 [ 305.156335][ T7358] fuse: Bad value for 'fd' [ 305.203755][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 305.281539][ T7355] loop2: detected capacity change from 0 to 2048 [ 305.630317][ T7355] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 305.645750][ T7355] ext4 filesystem being mounted at /180/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 307.072176][ T7364] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 307.134678][ T7365] overlayfs: failed to create directory ./bus/index (errno: 28); mounting read-only [ 307.151657][ T7364] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 307.187843][ T7365] overlayfs: try deleting index dir or mounting with '-o index=off' to disable inodes index. [ 307.243834][ T7364] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 307.293899][ T7367] loop0: detected capacity change from 0 to 2048 [ 307.346853][ T7372] input: syz1 as /devices/virtual/input/input49 [ 308.323783][ C0] net_ratelimit: 13 callbacks suppressed [ 308.323803][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 308.336588][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 308.481897][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 308.488895][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 308.495861][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 308.581118][ T7367] EXT4-fs (loop0): mounted filesystem without journal. Quota mode: none. [ 308.600603][ T7367] ext4 filesystem being mounted at /166/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 308.761842][ T4276] EXT4-fs (loop2): unmounting filesystem. [ 308.794981][ T7381] block nbd3: shutting down sockets [ 308.935320][ T7367] overlayfs: Failed to create volatile/dirty file. [ 309.059024][ T7389] netlink: 40 bytes leftover after parsing attributes in process `syz.2.844'. [ 309.187579][ T7386] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 309.196720][ T7386] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 309.363779][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 309.370851][ C0] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 309.378152][ T26] audit: type=1400 audit(1756051221.051:55): apparmor="DENIED" operation="change_hat" info="unconfined can not change_hat" error=-1 profile="unconfined" pid=7388 comm="syz.2.844" [ 309.781444][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 309.788416][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 309.795394][ C1] IPVS: dh: UDP 224.0.0.2:0 - no destination available [ 310.065919][ T7398] netlink: 16 bytes leftover after parsing attributes in process `syz.3.848'. [ 311.278264][ T26] audit: type=1326 audit(1756051223.061:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7409 comm="syz.2.852" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f524cb8ebe9 code=0x0 [ 311.845939][ C0] ================================================================== [ 311.854050][ C0] BUG: KASAN: use-after-free in rose_timer_expiry+0x470/0x490 [ 311.861553][ C0] Read of size 2 at addr ffff888075a45c2a by task syz.3.853/7420 [ 311.869277][ C0] [ 311.871607][ C0] CPU: 0 PID: 7420 Comm: syz.3.853 Not tainted 6.1.148-syzkaller #0 [ 311.879565][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 311.889610][ C0] Call Trace: [ 311.892873][ C0] [ 311.895704][ C0] dump_stack_lvl+0x168/0x22e [ 311.900375][ C0] ? __lock_acquire+0x7c50/0x7c50 [ 311.905390][ C0] ? show_regs_print_info+0x12/0x12 [ 311.910576][ C0] ? load_image+0x3b0/0x3b0 [ 311.915078][ C0] ? _raw_spin_lock_irqsave+0xb0/0xf0 [ 311.920449][ C0] ? __virt_addr_valid+0x188/0x540 [ 311.925549][ C0] ? __virt_addr_valid+0x465/0x540 [ 311.930646][ C0] ? rose_timer_expiry+0x470/0x490 [ 311.935749][ C0] print_report+0xa8/0x210 [ 311.940155][ C0] kasan_report+0x10b/0x140 [ 311.944647][ C0] ? rose_timer_expiry+0x470/0x490 [ 311.949750][ C0] rose_timer_expiry+0x470/0x490 [ 311.954674][ C0] call_timer_fn+0x1a0/0x670 [ 311.959247][ C0] ? rose_start_t1timer+0xd0/0xd0 [ 311.964258][ C0] ? call_timer_fn+0xc1/0x670 [ 311.968917][ C0] ? __run_timers+0x7c0/0x7c0 [ 311.973577][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 311.978763][ C0] ? lockdep_hardirqs_on+0x94/0x140 [ 311.983948][ C0] ? rose_start_t1timer+0xd0/0xd0 [ 311.988963][ C0] __run_timers+0x525/0x7c0 [ 311.993451][ C0] ? detach_timer+0x350/0x350 [ 311.998115][ C0] ? lock_chain_count+0x20/0x20 [ 312.003040][ C0] run_timer_softirq+0x63/0xf0 [ 312.007797][ C0] handle_softirqs+0x2a1/0x920 [ 312.012552][ C0] ? __irq_exit_rcu+0x12f/0x220 [ 312.017438][ C0] ? do_softirq+0x200/0x200 [ 312.021941][ C0] ? irqtime_account_irq+0xb2/0x1b0 [ 312.027135][ C0] __irq_exit_rcu+0x12f/0x220 [ 312.031807][ C0] ? irq_exit_rcu+0x20/0x20 [ 312.036308][ C0] irq_exit_rcu+0x5/0x20 [ 312.040544][ C0] sysvec_apic_timer_interrupt+0xa0/0xc0 [ 312.046175][ C0] [ 312.049093][ C0] [ 312.052014][ C0] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 312.058000][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0xa5/0x100 [ 312.064494][ C0] Code: 74 05 e8 fe b0 66 f7 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f6 44 24 21 02 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 86 3c 37 f7 65 8b 05 d7 05 e2 75 85 c0 74 3c 48 c7 04 24 0e 36 [ 312.084106][ C0] RSP: 0018:ffffc90003c675a0 EFLAGS: 00000206 [ 312.090188][ C0] RAX: b93b4d5a9058d100 RBX: 0000000000000a06 RCX: b93b4d5a9058d100 [ 312.098402][ C0] RDX: dffffc0000000000 RSI: ffffffff8a8c0420 RDI: 0000000000000001 [ 312.106356][ C0] RBP: ffffc90003c67630 R08: dffffc0000000000 R09: fffffbfff215bc5d [ 312.114310][ C0] R10: fffffbfff215bc5d R11: 1ffffffff215bc5c R12: dffffc0000000000 [ 312.122266][ C0] R13: 0000000000000000 R14: ffff888058bc16c0 R15: 1ffff9200078ceb4 [ 312.130242][ C0] ? _raw_spin_unlock+0x40/0x40 [ 312.135100][ C0] ? __wake_up_common+0x2a4/0x4e0 [ 312.140119][ C0] __wake_up_sync_key+0x11b/0x180 [ 312.145147][ C0] ? __wake_up_locked_key_bookmark+0x20/0x20 [ 312.151136][ C0] ? sock_load_diag_module+0x130/0x130 [ 312.156592][ C0] __unix_dgram_recvmsg+0x498/0xd70 [ 312.161815][ C0] ? unix_unhash+0x10/0x10 [ 312.166226][ C0] ? lockdep_hardirqs_on+0x94/0x140 [ 312.171413][ C0] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 312.177561][ C0] ? mark_lock+0x94/0x320 [ 312.181882][ C0] ? unix_dgram_recvmsg+0xa9/0xd0 [ 312.186911][ C0] ? unix_dgram_sendmsg+0x16c0/0x16c0 [ 312.192277][ C0] ____sys_recvmsg+0x292/0x580 [ 312.197033][ C0] ? __sys_recvmsg_sock+0x40/0x40 [ 312.202051][ C0] ? import_iovec+0x6f/0xa0 [ 312.206562][ C0] ___sys_recvmsg+0x1b2/0x510 [ 312.211255][ C0] ? __sys_recvmsg+0x270/0x270 [ 312.216026][ C0] ? __lock_acquire+0x7c50/0x7c50 [ 312.221044][ C0] ? __might_fault+0x98/0x120 [ 312.225728][ C0] ? __might_fault+0xc2/0x120 [ 312.230407][ C0] ? __might_fault+0xa6/0x120 [ 312.235077][ C0] do_recvmmsg+0x359/0x7d0 [ 312.239486][ C0] ? __sys_recvmmsg+0x280/0x280 [ 312.244324][ C0] ? do_futex+0x2e2/0x320 [ 312.248647][ C0] ? __se_sys_futex+0x14a/0x440 [ 312.253487][ C0] __x64_sys_recvmmsg+0x18d/0x240 [ 312.258501][ C0] ? do_recvmmsg+0x7d0/0x7d0 [ 312.263078][ C0] ? lockdep_hardirqs_on+0x94/0x140 [ 312.268273][ C0] do_syscall_64+0x4c/0xa0 [ 312.272675][ C0] ? clear_bhb_loop+0x60/0xb0 [ 312.277338][ C0] ? clear_bhb_loop+0x60/0xb0 [ 312.281998][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 312.287879][ C0] RIP: 0033:0x7fb516d8ebe9 [ 312.292287][ C0] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 312.311876][ C0] RSP: 002b:00007fb517b26038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 312.320277][ C0] RAX: ffffffffffffffda RBX: 00007fb516fb6090 RCX: 00007fb516d8ebe9 [ 312.328238][ C0] RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000003 [ 312.336194][ C0] RBP: 00007fb516e11e19 R08: 0000000000000000 R09: 0000000000000000 [ 312.344148][ C0] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 312.352101][ C0] R13: 00007fb516fb6128 R14: 00007fb516fb6090 R15: 00007fff964013b8 [ 312.360064][ C0] [ 312.363067][ C0] [ 312.365374][ C0] The buggy address belongs to the physical page: [ 312.371771][ C0] page:ffffea0001d69140 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x75a45 [ 312.381921][ C0] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 312.389034][ C0] raw: 00fff00000000000 0000000000000000 ffffffff00000201 0000000000000000 [ 312.397608][ C0] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 [ 312.406175][ C0] page dumped because: kasan: bad access detected [ 312.412577][ C0] page_owner tracks the page as freed [ 312.417939][ C0] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 4322, tgid 4322 (kworker/0:5), ts 61783392222, free_ts 308633556595 [ 312.440062][ C0] post_alloc_hook+0x173/0x1a0 [ 312.444818][ C0] get_page_from_freelist+0x1a26/0x1ac0 [ 312.450347][ C0] __alloc_pages+0x1df/0x4e0 [ 312.454919][ C0] alloc_slab_page+0x5d/0x160 [ 312.459578][ C0] new_slab+0x87/0x2c0 [ 312.463630][ C0] ___slab_alloc+0xbc6/0x1220 [ 312.468293][ C0] __kmem_cache_alloc_node+0x1a0/0x260 [ 312.473732][ C0] __kmalloc_node_track_caller+0x9e/0x230 [ 312.479437][ C0] __alloc_skb+0x22a/0x7e0 [ 312.483837][ C0] ndisc_alloc_skb+0xa6/0x450 [ 312.488502][ C0] ndisc_send_rs+0x2a2/0x610 [ 312.493077][ C0] addrconf_dad_completed+0x792/0xcf0 [ 312.498432][ C0] addrconf_dad_work+0xc3e/0x14d0 [ 312.503442][ C0] process_one_work+0x898/0x1160 [ 312.508361][ C0] worker_thread+0xaa2/0x1250 [ 312.513018][ C0] kthread+0x29d/0x330 [ 312.517073][ C0] page last free stack trace: [ 312.521723][ C0] free_unref_page_prepare+0x8b4/0x9a0 [ 312.527167][ C0] free_unref_page+0x2e/0x3f0 [ 312.531828][ C0] qlist_free_all+0x76/0xe0 [ 312.536319][ C0] kasan_quarantine_reduce+0x144/0x160 [ 312.541763][ C0] __kasan_slab_alloc+0x1e/0x80 [ 312.546604][ C0] slab_post_alloc_hook+0x4b/0x480 [ 312.551695][ C0] kmem_cache_alloc+0x123/0x2f0 [ 312.556525][ C0] getname_flags+0xb7/0x500 [ 312.561020][ C0] do_sys_openat2+0xcf/0x490 [ 312.565594][ C0] __x64_sys_openat+0x135/0x160 [ 312.570429][ C0] do_syscall_64+0x4c/0xa0 [ 312.574827][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 312.580707][ C0] [ 312.583012][ C0] Memory state around the buggy address: [ 312.588623][ C0] ffff888075a45b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 312.596665][ C0] ffff888075a45b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 312.604704][ C0] >ffff888075a45c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 312.612748][ C0] ^ [ 312.618099][ C0] ffff888075a45c80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 312.626139][ C0] ffff888075a45d00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff [ 312.634179][ C0] ================================================================== [ 312.642497][ C0] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 312.649696][ C0] CPU: 0 PID: 7420 Comm: syz.3.853 Not tainted 6.1.148-syzkaller #0 [ 312.657684][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 312.667753][ C0] Call Trace: [ 312.671049][ C0] [ 312.673896][ C0] dump_stack_lvl+0x168/0x22e [ 312.678594][ C0] ? memcpy+0x3c/0x60 [ 312.682601][ C0] ? show_regs_print_info+0x12/0x12 [ 312.687815][ C0] ? load_image+0x3b0/0x3b0 [ 312.692337][ C0] panic+0x2c9/0x710 [ 312.696243][ C0] ? asm_common_interrupt+0x22/0x40 [ 312.701463][ C0] ? bpf_jit_dump+0xd0/0xd0 [ 312.705983][ C0] ? _raw_spin_unlock_irqrestore+0xa5/0x100 [ 312.711909][ C0] ? _raw_spin_unlock_irqrestore+0xaa/0x100 [ 312.717786][ C0] ? _raw_spin_unlock+0x40/0x40 [ 312.722625][ C0] check_panic_on_warn+0x80/0xa0 [ 312.727545][ C0] ? rose_timer_expiry+0x470/0x490 [ 312.732648][ C0] end_report+0x66/0x110 [ 312.736921][ C0] kasan_report+0x118/0x140 [ 312.741411][ C0] ? rose_timer_expiry+0x470/0x490 [ 312.746535][ C0] rose_timer_expiry+0x470/0x490 [ 312.751488][ C0] call_timer_fn+0x1a0/0x670 [ 312.756107][ C0] ? rose_start_t1timer+0xd0/0xd0 [ 312.761155][ C0] ? call_timer_fn+0xc1/0x670 [ 312.765812][ C0] ? __run_timers+0x7c0/0x7c0 [ 312.770470][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 312.775654][ C0] ? lockdep_hardirqs_on+0x94/0x140 [ 312.780847][ C0] ? rose_start_t1timer+0xd0/0xd0 [ 312.785876][ C0] __run_timers+0x525/0x7c0 [ 312.790360][ C0] ? detach_timer+0x350/0x350 [ 312.795018][ C0] ? lock_chain_count+0x20/0x20 [ 312.799875][ C0] run_timer_softirq+0x63/0xf0 [ 312.804654][ C0] handle_softirqs+0x2a1/0x920 [ 312.809431][ C0] ? __irq_exit_rcu+0x12f/0x220 [ 312.814306][ C0] ? do_softirq+0x200/0x200 [ 312.818821][ C0] ? irqtime_account_irq+0xb2/0x1b0 [ 312.824005][ C0] __irq_exit_rcu+0x12f/0x220 [ 312.828665][ C0] ? irq_exit_rcu+0x20/0x20 [ 312.833155][ C0] irq_exit_rcu+0x5/0x20 [ 312.837379][ C0] sysvec_apic_timer_interrupt+0xa0/0xc0 [ 312.842993][ C0] [ 312.845912][ C0] [ 312.848838][ C0] asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 312.854803][ C0] RIP: 0010:_raw_spin_unlock_irqrestore+0xa5/0x100 [ 312.861285][ C0] Code: 74 05 e8 fe b0 66 f7 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f6 44 24 21 02 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 86 3c 37 f7 65 8b 05 d7 05 e2 75 85 c0 74 3c 48 c7 04 24 0e 36 [ 312.880873][ C0] RSP: 0018:ffffc90003c675a0 EFLAGS: 00000206 [ 312.886924][ C0] RAX: b93b4d5a9058d100 RBX: 0000000000000a06 RCX: b93b4d5a9058d100 [ 312.894882][ C0] RDX: dffffc0000000000 RSI: ffffffff8a8c0420 RDI: 0000000000000001 [ 312.902835][ C0] RBP: ffffc90003c67630 R08: dffffc0000000000 R09: fffffbfff215bc5d [ 312.910814][ C0] R10: fffffbfff215bc5d R11: 1ffffffff215bc5c R12: dffffc0000000000 [ 312.918800][ C0] R13: 0000000000000000 R14: ffff888058bc16c0 R15: 1ffff9200078ceb4 [ 312.926768][ C0] ? _raw_spin_unlock+0x40/0x40 [ 312.931615][ C0] ? __wake_up_common+0x2a4/0x4e0 [ 312.936642][ C0] __wake_up_sync_key+0x11b/0x180 [ 312.941669][ C0] ? __wake_up_locked_key_bookmark+0x20/0x20 [ 312.947632][ C0] ? sock_load_diag_module+0x130/0x130 [ 312.953069][ C0] __unix_dgram_recvmsg+0x498/0xd70 [ 312.958250][ C0] ? unix_unhash+0x10/0x10 [ 312.962645][ C0] ? lockdep_hardirqs_on+0x94/0x140 [ 312.967821][ C0] ? asm_sysvec_apic_timer_interrupt+0x16/0x20 [ 312.973956][ C0] ? mark_lock+0x94/0x320 [ 312.978278][ C0] ? unix_dgram_recvmsg+0xa9/0xd0 [ 312.983292][ C0] ? unix_dgram_sendmsg+0x16c0/0x16c0 [ 312.988654][ C0] ____sys_recvmsg+0x292/0x580 [ 312.993405][ C0] ? __sys_recvmsg_sock+0x40/0x40 [ 312.998416][ C0] ? import_iovec+0x6f/0xa0 [ 313.002903][ C0] ___sys_recvmsg+0x1b2/0x510 [ 313.007562][ C0] ? __sys_recvmsg+0x270/0x270 [ 313.012309][ C0] ? __lock_acquire+0x7c50/0x7c50 [ 313.017316][ C0] ? __might_fault+0x98/0x120 [ 313.021974][ C0] ? __might_fault+0xc2/0x120 [ 313.026630][ C0] ? __might_fault+0xa6/0x120 [ 313.031284][ C0] do_recvmmsg+0x359/0x7d0 [ 313.035681][ C0] ? __sys_recvmmsg+0x280/0x280 [ 313.040512][ C0] ? do_futex+0x2e2/0x320 [ 313.044826][ C0] ? __se_sys_futex+0x14a/0x440 [ 313.049655][ C0] __x64_sys_recvmmsg+0x18d/0x240 [ 313.054666][ C0] ? do_recvmmsg+0x7d0/0x7d0 [ 313.059233][ C0] ? lockdep_hardirqs_on+0x94/0x140 [ 313.064408][ C0] do_syscall_64+0x4c/0xa0 [ 313.068801][ C0] ? clear_bhb_loop+0x60/0xb0 [ 313.073453][ C0] ? clear_bhb_loop+0x60/0xb0 [ 313.078104][ C0] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 313.083976][ C0] RIP: 0033:0x7fb516d8ebe9 [ 313.088370][ C0] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 313.107957][ C0] RSP: 002b:00007fb517b26038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 313.116353][ C0] RAX: ffffffffffffffda RBX: 00007fb516fb6090 RCX: 00007fb516d8ebe9 [ 313.124304][ C0] RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000003 [ 313.132250][ C0] RBP: 00007fb516e11e19 R08: 0000000000000000 R09: 0000000000000000 [ 313.140200][ C0] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 313.148151][ C0] R13: 00007fb516fb6128 R14: 00007fb516fb6090 R15: 00007fff964013b8 [ 313.156105][ C0] [ 313.159353][ C0] Kernel Offset: disabled [ 313.163664][ C0] Rebooting in 86400 seconds..