last executing test programs: 12m18.240465887s ago: executing program 32 (id=12): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000280), 0x28d, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r3, 0x800448f0, &(0x7f0000000000)={0x4, 0xffff, "a46593", 0x5, 0xaa}) 12m11.779815131s ago: executing program 33 (id=25): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(r0, 0xf502, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_HALT_POLL(r1, 0x4068aea3, &(0x7f0000000040)={0xb6, 0x0, 0x100000001}) 11m31.157723292s ago: executing program 34 (id=60): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) syz_mount_image$erofs(&(0x7f00000003c0), &(0x7f0000000880)='./file0\x00', 0x18000c6, &(0x7f0000000000)=ANY=[@ANYRES16=0x0, @ANYRES32, @ANYRES16=0x0, @ANYRES8], 0x0, 0x17d, &(0x7f0000001ac0)="$eJzsmLFP+kAUx7/vyg/yMy6uLg4SxcHSFjUuxLA5mogaNwlUghYx0EGYdPH/cHZwdvOPMM7qYFwY3Uxqej3oQQR10MT4PsPj+7h313evyXcoGIb5szw+vNyvFe+EAWASaaTU/89GXCO0+tfb83Jraj1/OfeUv041robPIwBB8PnnJwDcFAz4Kg+Cwd1p9VuE6OstCCwovQOCqfQeBLaVdkHYVfpA042w3jT3a55rlhteJRRWGOwwOGHIDffXPSNUtP5IW2+1O4clz3Ob3yg+ml+3IJDX+tPfV282ljY/GwK20jkQNpVeRao3m2gk2v2nE/H5xg/fnwULFr9NxP4UXBDmNX9KaP6R9evH2Va7s1irl6pu1T1ynNyKtWRZy05WGlEUx/jff+lPE9r5/0bUJimJk5LvN+0o9nMniu85rpD+J5CZjfLQ+5Mju4nWSe0jqTLGmHKGYRiGYRiGYRiGYRiGYZgvMAOSX0EldIo4GcDZkNVvAQAA///an3MA") mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000380), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x42042, 0x38) syz_mount_image$vfat(&(0x7f0000000300), &(0x7f0000000280)='./file0\x00', 0x0, &(0x7f0000000d80)=ANY=[@ANYBLOB='utf8=0,shortname=lower,rodir,utf8=0,uni_xlate=1,utf8=0,iocharset=koi8-ru,shortname=lower,iocharset=utf8,check=relaxed,shortname=mixed,shortname=win95,showexec,shortname=winnt,shortname=win95,rodir,nonumtail=0,errors=continue,nnonuage=936,nonumtail=0,shortname=winnt,shortname=win95,obj_user=errors=remount-ro,\x00'], 0x1, 0x36b, &(0x7f0000000a00)="$eJzs3U1vG1UXAODTvM1H85I6C4QECHFVNrCxkvAHGqFWQkQChRoVFkhTMgEr0zjyWEGuEHTHlt9RsWSHhPgDWcCeHbtsWHZRdVDsuPloCIvUHgrPI0X3xPce+4zHM7qb0dm//d3drc2yuZn1Yup6iqmImHoYsTiIhi4djlODeCaOux9vNW7/9tqHH3/y3ura2o31lG6u3np7JaV09fWfvvzq+2s/9/7/0Q9Xf5yNvcVP9/9Y+X3vpb2X9x/f+qJdpnaZtju9lKU7nU4vu1PkaaNdbjVT+qDIszJP7e0y756Y3yw6Ozv9lG1vLMzvdPOyTNl2P23l/dTrpF63n7LPs/Z2ajabaWE++DutB+vr2eownjtn3fVJFcQYdLur2cE1PPvUTOtBLQUBALW66P5/5pnu/6fD/n+Sju//+bc62P/PHF6/J9n/AwAAAAAAAAAAAADA8+BhVTWqqmqMxmr0kPDh/zWXx5g9df5P/dVdH+N17MG9uYji293Wbms4DudXN6MdReSxFI14dHBbGBnGN99du7GUBhZj4e43g/xrv0S0/ncyfzkasXh2/vIwPz3Jj4NxOuaP569EI148O3/lzPyZePONY/nNaMSvn0UnitgY3N6O8r9eTumd99dO5c8O1gEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADw39BMI6/GsO/9biviSuwe9u9vHi1YPNkff5j/pL/+UjTi0dn9+ZfO7M9/OV65XO+xAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBI2b+3lRVF3p1UMOr5P3hlZhT8ddal4fL7p6auxARrLop86lm94eOqqsZV6txkT+VFgumI885gdfgrufhnvRAR56yZjYj6v41/YlDXHQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADqc9T0u+5KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAqFPZv7eVFUXeHWNQ9zECAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8T/4MAAD//yeQEY0=") 11m28.484287428s ago: executing program 35 (id=94): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x6, 0x7, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000008010000000000000000a40018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000000000000850000008600000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r3, r1, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x56, &(0x7f0000000380)=ANY=[], 0x0) 11m23.97896188s ago: executing program 36 (id=104): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x3c, &(0x7f0000311ffc)=0x1, 0x4) 11m21.112775985s ago: executing program 37 (id=115): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000fc0), 0x0, 0x0, 0x0}) r4 = mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r0, 0x10000000000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000004a40)={0xc, 0x0, &(0x7f00000049c0)=[@free_buffer={0x40086303, r4}], 0x0, 0x0, 0x0}) 10m7.916303528s ago: executing program 38 (id=249): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) flock(r0, 0x2) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='task\x00') capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x208004, 0x21fffc, 0xc, 0x0, 0x2, 0xfffffffe}) fstat(r1, &(0x7f0000000140)) r2 = syz_clone(0x20100000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(r2, 0x0) 9m15.921350484s ago: executing program 39 (id=332): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x8000}, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) bind$inet6(0xffffffffffffffff, 0x0, 0x0) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = dup(r3) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x100}) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x601c2, 0x0) ftruncate(r5, 0x8800000) r6 = openat$null(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) sendfile(r6, r5, 0x0, 0x558410e9) ioctl$UFFDIO_WRITEPROTECT(0xffffffffffffffff, 0xc018aa06, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1}) socket$inet6(0xa, 0x1, 0x0) 8m3.519643051s ago: executing program 40 (id=600): r0 = syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x10008, &(0x7f0000000080)={[{@nombcache}, {@nogrpid}]}, 0xff, 0x49e, &(0x7f0000000f40)="$eJzs3M9vFFUcAPDvbH/Qyo9WRBQEraCR+KOlBZWDBzSaeNDERA94rG1BZKGG1gRIo8UYPBoS78ajiX+BNy9GPRgTr5p4NCREe6F4qpmdGbpsd0u3tF3pfj7Jdt+bH/ved+a93TcznQmgbQ2kf5KIbRHxe0T0ZdnbFxjI3ubnZsZuzs2MJbGw8PbfSWW5G3MzY8WixXpb88yhUkTpsySOJ0vLnbp46cxouTxxPs8PTZ/9cGjq4qXnTp8dPTVxauLcyLFjR48Mv/jCyPNrEmca1429H0/u2/P6u1ffHDtx9b2fvk2rtXt/Nr86jju6WSegOgbSrfbPQkXtvCebqPu9YHtVOulsYUVoSkdEpLurq9L/+6IjFndeX7z2aUsrB6yr9LdpS+PZswvAJpZEq2sAtEbxQ58e/xavDRp6/C9cfzmiO0/Pz82Mzd+KvzNK+fSudSx/ICJOzP77VfqKZs9DAACsQmVs82y98V8pdlfes2sdO/JrKP0RcX9E7IyIByJiV0Q8GFFZ9qGIeDhbeaFvheUP1OSXjn9K1+rWeY2k47+XqsZ+81Xx52/9HXlueyX+ruTk6fLE4XybHIquLWl+eJkyvn/1ty8azase/6WvtPxiLJhX4FpnzQm68dHp0bXaCNcvR+ztrBd/cutKQNoC9kTE3uY+ekeROP30N/saLXTn+JexBteZFr6OeCrb/7NRE38hWf765FBPlCcODxWtYqmff73yVqPy7yr+NXD9wCNZYnH/1yxR1dDK5YnzU82XceWPzxse06y2/Xcn71T65C/vZ9MujE5Pnx+O6E7eqOSLY7rK9JHFdS+MTvem+WL5tP0fOli//+/M10n3f7qV0ka8PyIejYjH8ro/HhEHIuLgMvH/+MoTHywTfxJJtG7/X44Yr/v9d6v99yfV1+tXkeg488N3ja6Yr2z/H43ZyndtpvL9dwcrreBdbj4AAAC4J5QiYlskpcEsPbAtSqXBwex/+HfFfaXy5NT0MycnPzo3nt0j0B9dpeJMV1/V+dDhZDb/xCw/kp8rLuYfyc8bf9nRW8kPjk2Wx1scO7S7rbf3/yj6f+qvjlbXDlh37teC9lXb/0stqgew8Vby++9YADan2/t/T/qnt1V1ATaW439oX/X6/yc1eeN/2JyW9v8/6zyyDtiMjP+hfen/0L70f2hLzdzOH8cbzeqJiGYeC1DcLLD6pwr0rPgO/3ZJFE+8WM+yeuPSme58SpRaFGlHk41tUyTSHrOxhS4+QwUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBe9l8AAAD//3ow3kU=") fcntl$setown(0xffffffffffffffff, 0x8, 0xffffffffffffffff) fadvise64(r0, 0x40, 0x100000001, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$cgroup_int(r6, &(0x7f00000000c0)=0xa00, 0x12) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r4, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x14, r7, 0x301, 0x800000, 0x25dfdbfb, {0x1c}}, 0x14}, 0x1, 0x0, 0x0, 0x80}, 0x40006) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', 0x0, 0x0, 0x0, 0x3) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) syz_mount_image$fuse(0x0, 0x0, 0x20020, 0x0, 0x1, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x0, 0x0, 0x3e, 0x0, 0x0) syz_mount_image$fuse(0x0, 0x0, 0xa82086, 0x0, 0x31, 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1\x00', 0x200) 7m53.164394768s ago: executing program 41 (id=634): bind$inet(0xffffffffffffffff, &(0x7f0000000280)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(0xffffffffffffffff, &(0x7f0000000900)="2e552f5d9fd8b0d9627c4980f0d1ea2bf8f617a682acd2841acd878bd68344d4f50f83b0c51fa9135a01c95d4a128ec8b12d01010000a44c4505ba9a36f2cf4cc5e8308126d0a2c3b9d24e57c5011376b6263e2a1258eec1eb72bedea3eb5ccf73eb081b4c6d5faa998d7b795c057dd757d14200a8a6dbb3e59df96b77d16753ac4b32b94ffe6b5ee304d0428eb18056657c8c5c71c632be66cb26fe5c9abec7591ef3cb9b2a1133e9fa9bf0de6c378bed7b51cb8a07c343aabfda193349b91a5dc81a658cb61fbbfa51ef95abe03381ee2cb8d41da19ea8b96ec68ce17cf57da60f1d04acaf34a643db8d2d5ad2991f306b42744347a0c9e1fe2136b2b3da49032d3a57df1e236222cf6d6fe396aff8e5fe7fff5baa88789b783c12045e2c904a5d118369fdddc3e6e2f24bdbb26df92ac9bf4751c897a87c0223888e36ad14ba6e4d879ff464cac6f13a3a543e067d922e99c50f2fc6391e9c1c82b7195005eafdbb3374200c134cbd0f11739e8c19dd07140686242fea48caf3a1a93b86f35d77f258a2c9ce24cf321068551a584262d7a74a344e428c77c8af755e72904b0ca8a0bb359fb0", 0xffffff5d, 0x12, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000000)='illinois', 0x8) recvfrom$inet(0xffffffffffffffff, &(0x7f0000000080), 0xffffffffffffffa9, 0xc9100120, 0x0, 0x1500) 7m3.348860992s ago: executing program 42 (id=746): pipe2(&(0x7f00000002c0)={0xffffffffffffffff}, 0x10080) r1 = fanotify_init(0xf00, 0x0) fanotify_mark(r1, 0x41, 0x40000010, r0, 0x0) syz_io_uring_setup(0x7890, &(0x7f0000000540)={0x0, 0xd12b, 0x10000, 0x5, 0x240004f}, &(0x7f0000000040), &(0x7f0000000380), &(0x7f0000000180)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000b80)='./file0\x00', 0x800001, &(0x7f0000000080)={[{@norecovery}, {@quota}]}, 0x3, 0x610, &(0x7f0000000500)="$eJzs3c9vG1UeAPDv2EmaNNUmjVa72z1sI61WrbTbpEnbVYQ4tFdUReWHuMCB0KSlNG2jJghSkJpK5YKEuCCExIkD5b+Ail57ghMHLpxQpQhQuSFhZHsmiRM7P5zEU3U+H8n1zHuevO80+Xpmnt8bB1BYw9V/ShFHImIuiRhIllbquiKtHK6/7vGv712sPpKoVF78eSiStCx7fZI+96cb90bEt98kMVTe2O784q2rU7OzMzfT9dGFa3Oj84u3Tly5NnV55vLM9fH/j0+cOX1mYuxkW/t1e2PRb+fvvvn2wAeTr3zx2e/J2Jc/TCZxNp5LX7h2P/bKcAzX/k+SjVX9E3vdWE7K6d9JpVKpZGVJV74xsX3Z7687Iv4eA1GO1V/eQLz/fK7BAfuqktTfu4EiStrK/769DwTosOw8ILu2X38dXMrlrATohOVz9Q6AjfnfVe8bjN5a38DBx0ms7dZJIqK9nrlGhyLi4YPJu5ceTN6NfeqHA5pbuhMR/2iW/0kt/wejNwZr+V9qyP/qecGF9Lla/kKb7a/vKpb/0Dn1/O/dNP+jRf6/Vn2+Xc/h19tqvXftyht9Dfnf1+4uAQAAAAAAQGHdPxcR/1v5/L9n9fO30sr4n2gy/qc/Is7uQfvD69Y3fv5ferQHzQBNLJ+LeLbp+N9SNvp3sLxmCutgdCeXrszOnIyIv0TE8eg+UF0f26SNEx8Ofdqqbjgd/5c9qu0/TMcCpnE86jrQuM301MLULnYZSC3fifI/m47/TVaO/0mT43/1nWFum20M/efehVZ1W+c/sF8qn0cca3r8X71rRbL5/TlGa+cDo9lZwUb/evejr1q1327+u8UE7N7ynYiDm+f/YLL2fj3zO2/j1GJXpVVdu+f/PclLtbsK9aRl70wtLNwci+hJzperpQ3l4zuPGZ5GWT5k+VLN/+P/Xs3/cpP+v2bn/30RsbTuZye/NM4pzvztj/4fW8Xj/B/yU83/6R0d/3e+MH5v8OtW7W/v+H+6dqw/npbo/4O6T7I07eluKG+Sjl3NqjoeMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8BUoRcSiS0sjKcqk0MhLRHxF/jYOl2RvzC/+9dOOt69PVutr3/5eyb/odqK8n2ff/D65ZH1+3fioiDkfEx+W+2vrIxRuz03nvPAAAAAAAAAAAAAAAAAAAADwh+lvM/6/6qZx3dMC+68o7ACA3TfL/uzziADrP8R+KS/5Dccl/KC75D8Ul/6G4Ns//Vyc6FgjQcY7/UFzyHwAAAAAAniqHj97/PomIpWf6ao+qnrSuO9fIgP1WyjsAIDdu8QPFZegPFJdrfCDZor635UZbbbmZuYu72BgAAAAAAAAAAAAACufYEfP/oajM/4fiMv8fiiub/3805ziAznOND8QWM/mbzv/fcqs1XGgAAAAAAAAAAAAAwK7NL966OjU7O3PTwsttbJWNas49+PYWKpXK7Wr4T0o8e7+QpCPUO9JoNhS+83vas50dzOb6be8nb3yvONCh9yQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKDRnwEAAP//4Fgg0g==") r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000480), r6) sendmsg$IEEE802154_ADD_IFACE(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000004c0)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010029bd7000ffdbdf252100000009001f0070687930000000000a0001007770610900000000200001"], 0x4c}, 0x1, 0x0, 0x0, 0x20008010}, 0x20044050) setsockopt$netlink_NETLINK_PKTINFO(r5, 0x10e, 0x3, 0xffffffffffffffff, 0x38) io_uring_setup(0xc5e, &(0x7f00000000c0)={0x0, 0x64c6, 0x8, 0x1, 0x252}) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) sendmmsg$inet(0xffffffffffffffff, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, 0x0, 0x8, 0x2) prctl$PR_MCE_KILL(0x43, 0x0, 0x2) geteuid() 6m57.411256751s ago: executing program 43 (id=814): mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) openat$cgroup_devices(0xffffffffffffffff, 0x0, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='2', 0x49) unshare(0x60040000) 6m53.033953327s ago: executing program 44 (id=827): r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_ifreq(r0, 0x89a2, 0x0) ioctl$sock_ifreq(r0, 0x89a2, &(0x7f0000000180)={'bridge0\x00', @ifru_ivalue=0xd}) ioctl$sock_ifreq(r0, 0x89a2, &(0x7f00000001c0)={'bridge0\x00', @ifru_flags=0x100}) ioctl$sock_ifreq(r0, 0x89a2, &(0x7f0000000200)={'bridge0\x00', @ifru_ivalue=0xf}) 6m46.961747083s ago: executing program 45 (id=840): r0 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000002440), 0x2000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000002480)=0xe) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xfffffffc}, 0x94) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0xa8002, 0x0) ioctl$EVIOCGPROP(r1, 0x40047438, &(0x7f0000000180)=""/246) writev(r1, &(0x7f0000000440)=[{&(0x7f0000000280)="c021", 0x1700}], 0x1) 6m42.842494986s ago: executing program 46 (id=846): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mydev\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./mydev\x00', &(0x7f0000000080)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mydev/v4l-touch0\x00', 0x2, 0x0) ioctl(r0, 0xc0145608, &(0x7f0000000400)="03000000010000") 6m29.673633506s ago: executing program 47 (id=858): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000021c0), r0) sendmsg$IEEE802154_LIST_IFACE(r0, &(0x7f00000022c0)={0x0, 0x0, &(0x7f0000002280)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="010026bd7000fbdbdf251f000000080002"], 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4010) 5m57.373973136s ago: executing program 48 (id=935): syz_emit_ethernet(0x4a, &(0x7f00000004c0)=ANY=[], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0xffffc000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x41, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x1) socket$inet6_mptcp(0xa, 0x1, 0x106) openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0) socket$kcm(0x1e, 0x5, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900010073797a30000000000900030073797a3000000000140004800800024000000000080001400000000571000000060a010400000008000000000100000008000b4000000000400004803c0001800a0001006d617463680000002c0002800800010065636e000c000300e4edf2b75cc7c0a308000240000000000c000100706b7474797065000900010073797a30"], 0xf0}}, 0x0) 4m8.480687239s ago: executing program 49 (id=1291): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = io_uring_setup(0x46eb, &(0x7f0000000100)={0x0, 0xc469, 0x0, 0x2, 0x296}) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000480)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x2) 3m50.33755613s ago: executing program 50 (id=1350): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0xc, 0x0, 0x7fffffff}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000080), 0x8100, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', 0x0, 0x4000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r2, &(0x7f0000000000)='3', 0x4e) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xa8}, 0x1, 0x0, 0x0, 0x24040841}, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x4, r0}) 3m36.188944052s ago: executing program 51 (id=1381): r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x1a, &(0x7f00000000c0)=0xfffffffd, 0x4) bind$inet6(r1, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) bind$inet(r0, 0x0, 0x0) syz_emit_ethernet(0x2e, &(0x7f0000001140)={@broadcast, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x20, 0x66, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x1, 0x4e20, 0xc, 0x0, @gue={{0x1, 0x0, 0x0, 0x0, 0x0, @void}}}}}}}, 0x0) 3m35.843111758s ago: executing program 0 (id=1385): prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f00000000c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@func_proto={0x0, 0x0, 0x0, 0xd, 0x2}, @ptr={0x0, 0x0, 0x0, 0x2, 0x2}]}}, &(0x7f00000004c0)=""/222, 0x32, 0xde, 0x1}, 0x28) 3m33.304988927s ago: executing program 0 (id=1390): socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$team(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000840)={0x20, r1, 0x1, 0x70bd28, 0x25dfdbfe, {}, [{{0x8}, {0x4}}]}, 0x20}, 0x1, 0x0, 0x0, 0x4004000}, 0x40040) 3m32.743816434s ago: executing program 52 (id=1390): socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$team(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000840)={0x20, r1, 0x1, 0x70bd28, 0x25dfdbfe, {}, [{{0x8}, {0x4}}]}, 0x20}, 0x1, 0x0, 0x0, 0x4004000}, 0x40040) 3m8.435712272s ago: executing program 7 (id=1437): r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_GET_PROPERTY(r0, 0x80106f53, &(0x7f0000000b80)={0x2a, &(0x7f0000000a00)=[{0x6, '\x00', @st={0x4, [{0x2, @uvalue=0x176}, {0x0, @svalue=0x6}, {0x3, @svalue}, {0x1, @uvalue=0x8}]}}, {0x25, '\x00', @buffer={"4665a5eec8214a1b8c5ba33ac504d8ddc27c77738d7f0bba7525ad9a69b32607", 0x20}, 0x5ff}, {0x42, '\x00', @st={0x4, [{0x0, @svalue=0x8}, {0x3, @uvalue=0x5}, {0x2, @svalue=0x7fffffffffffffff}, {0x2, @svalue=0x8}]}, 0x6}, {0x21, '\x00', @st={0x4, [{0x1, @svalue=0x200}, {0x0, @uvalue=0x8}, {0x1, @svalue=0x8}, {0x3, @svalue=0x80}]}, 0x9}, {0x3e, '\x00', @data=0x2, 0x8}]}) 3m8.088658769s ago: executing program 7 (id=1439): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./sys/bus/platform/devices/PNP0B00:00\x00', 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./sys/bus/platform/drivers/rtc_cmos\x00', 0x0, 0x0) r0 = openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = openat(r0, &(0x7f0000000340)='unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000380)='serial8250\x00', 0xb) 3m7.802791462s ago: executing program 7 (id=1440): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100), 0x2, 0x509, &(0x7f0000000a00)="$eJzs3U1sI1cdAPD/TD7sTdMmhR4ALXQphQWt1k68bVT1QjlVCFVC9MhhGxInimLHUeyUJuwhe+SOxEqc4MSZAxIHpJ64I3GAG5dyQCqwAjVIHIw8tnedDyfRbmzvxr+fNJr3Yfv/3o7mPe9LMi+AsXUjIg4iYjoiPoiIuU550jninfbRet1nD++tHD68t5JEs/n+P5OsvlUWPe9peaHzmfmI+MG7ET9KjgX9U0R9b39zuVIp73SKio3qdrG+t397o7q8Xl4vb5VKS4tLC2/debN0aX19tfqbT69FxO9/9+VP/njwrZ+0mjXbqevtx2Vqd33qUZyWyYj43iCCjcBEpz/TT/LmJ3oTlymNiM9FxGvZ/T8XE9nVPOroZfr2EFsHAAxCszkXzbnePABw1aXZGliSFjprAbORpoVCew3vlZhJK7V649ZabXdrtb1WNh9T6dpGpbzQWSucj6lkbWOyvJilu/lKuXQsfyciXo6In+WuZfnCSq2yOsovPgAwxl44Nv//J9ee/wGAKy7/OJkbZTsAgOHJj7oBAMDQmf8BYPyY/wFg/Dye/z2RAQDGhf//A8D4Mf8DwFj5/nvvtY7mYef516sf7u1u1j68vVqubxaquyuFldrOdmG9VlvPntlTPe/zKrXa9uIbsftRsVGuN4r1vf271druVuNu9lzvu+WpofQKADjLy69+/JckIg7evpYd0fNLAOfO1dcH3TpgkNJRNwAYmYlRNwAYmZO7fQHjwv0P9GzRe7+nOH8icdyDI7l+L0vtGwrPnptffIr1f+C5Zv0fxteTrf/7Lg9XgfU/GF/NZmLPfwAYM9b4geSc+t4f7C80ezIPBtQgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeA7MZkeSFjp7gc9GmhYKES9GxHxMJWsblfJCRLwUEX/OTeVa+cWIsG8QADzP0r8nnf2/bs69Pnu8djr331x2jogf/+L9n3+03GjsLEZMJ/96VN540CkvjaL9AMBZrkdEd57uzuNdnz28t9I9htmmT7/T3ly0Ffewc7RrJmMyO+eztYaZfyedfFvr+8rEJcQ/uB8RXzit/0m2NjLf2fn0ePxW7BeHGj89Ej/N6trn1r/F5y+hLTBuPm6NP++cdv+lcSM7n37/57MR6ul1x7/DE+Nf+mj8m+gz/t24aIw3/vDdE4XNuXbd/YgvTUYcdj+8Z/zpxk/6xH/9gvH/ev0rr/Wra/4y4mac1v/kSKxio7pdrO/t396oLq+X18tbpdLS4tLCW3feLBWzNepid6X6pH+8feulfvFb/Z/pEz9/Tv+/fsH+/+p/H/zwq2fE/+bXTr/+r5wRvzUnfuOC8ZdnfpvvV9eKv9qn/+dd/1sXjP/J3/ZXL/hSAGAI6nv7m8uVSnln0Il08CGyRBJxMITutBO5X//03WHFGmAino1mSDxLiVGPTMCgPb7pR90SAAAAAAAAAAAAAACgn2H8OdGo+wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDV9f8AAAD//8dt1KQ=") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xe, 0x8031, 0xffffffffffffffff, 0x3000) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) request_key(0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x4e, &(0x7f00000000c0)=0xfffffff7, 0x4) sendmmsg$inet6(r1, &(0x7f0000000200)=[{{&(0x7f0000000100)={0xa, 0x4e21, 0xdf, @local, 0x1}, 0x1c, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00\x00\x00\x00\x00)\x00\x00\x002'], 0x28, 0x7ffffff7}}], 0x1, 0x0) dup(0xffffffffffffffff) r2 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(r2, 0xc0385869, 0x0) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$nl_route(r3, 0x0, 0x0) r5 = shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ffa000/0x4000)=nil) shmat(r5, &(0x7f0000000000/0x2000)=nil, 0x5000) shmctl$SHM_LOCK(r5, 0xb) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r4, 0xc400941d, &(0x7f0000000500)={0x0, 0x8, 0x5, 0x1}) 3m6.405558247s ago: executing program 7 (id=1442): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/cpuinfo\x00', 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000123000/0x1000)=nil, 0x1000, 0xf) madvise(&(0x7f0000000000/0x800000)=nil, 0x800002, 0xe) r3 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000180)) socket$inet(0x2, 0x2, 0x0) writev(r2, &(0x7f0000003dc0)=[{&(0x7f0000000b80)='|', 0x1}], 0x1) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000007c0)='./file0\x00', 0x400c84, &(0x7f0000000340), 0xff, 0x789, &(0x7f0000000fc0)="$eJzs3c1rXFUbAPDnTpKmTfu+iSBo3RgQNFA6MTW2CgoVFyJYKOjadphMQ80kUzKT0oSALSK4EVRcCLrpyoUfdefWj63+Fy7EUjUtVlxI5E5m0kkzk07SZCaa3w9u5px77+ScZ879ODPncm8Ae9Zw+icTcTgi3ksiBmvzk4joq6Z6I06urHd7aTGfTkksL7/6W1Jd59bSYj4a3pM6WMs8HBHfvR1xJLO+3PL8wlSuWCzM1vKjlekLo+X5haPnp3OThcnCzPGx8fFjJ54+cXz7Yv3jx4VD199/6YkvT/711kPX3v0+iZNxqLasMY4te35tdjiGa59JX/oRrvHifRe2uyTdrgBbku6aPSt7eRyOweippgCA/7I3I2IZANhjEud/ANhj6r8D3FpazNen7v4i0Vk3XoiI/Svx18c3V5b01sbs9lfHQQduJWtGRpKIGNqG8ocj4pOvX/88nWK7xiEB2nD5SkScHRpef/xP1l2zsFlPbrBsX+11+K75aflGoKEzvkn7P8806/9lVvs/0aT/099k392KZvt/EnF5dcaBbShkAzc+jXiu4dq22w3x1wz11HL/q/b5+pJz54uF9Nj2/4gYib7+ND+2QRkjN/++2WpZY//v9w/e+CwtP329s0bml97+te+ZyFVy9xNzoxtXIh7pbRZ/str+SYv+7+k2y3j52Xc+brUsjT+Ntz6ti7/a/jt3Rli+GvF40/a/c0VbsuH1iaPVzWG0vlE08dVPHw20Kr+x/dMpLb/+XaAT0vYf2Dj+oaTxes3y5sv44ergt62W3Tv+5tv/vuS1arrej7iUq1RmxyL2Ja+sn3/sznsv5R6tpVbWT+Mfeaz5/r/R9p9+JzzbZvy913/9Yuvx76w0/olNtf/mE9duT/W0Kr+99h+vpkZqc9o5/rVbwfv57AAAAAAAAAAAAAAAAAAAAAAAAACgXZmIOBRJJruazmSy2ZVneD8YA5liqVw5cq40NzMR1WdlD0Vfpn6ry8GG+6GO1e6HX88fuyv/VEQ8EBEf9h9I6vdRnOhy7AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQd7DF8/9TP/d3u3YAwI7Z3+0KAAAd5/wPAHuP8z8A7D3tnf97drweAEDn+P4PAHuP8z8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA77PSpU+m0/OfSYj7NT1ycn5sqXTw6UShPZafn8tl8afZCdrJUmiwWsvnS9L3+X7FUujAeM3OXRiuFcmW0PL9wZro0N1M5c346N1k4U+jrSFQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsDnl+YWpXLFYmJXYQmJ5d1Sj+4me2ua0W+rT0USyO6qxzYkuH5gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/iX+CQAA//8vWSHt") lchown(&(0x7f0000000000)='./file0\x00', 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x100080, &(0x7f00000001c0)='%,@&#+\\\x00') write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x9, 0x4, 0x6, 0xfffa}, 0x1d, [0x3, 0xc95a, 0xfffffff3, 0x9, 0x6, 0x2, 0x3, 0x7f, 0x6, 0x4d, 0x39cc191a, 0x5c, 0x9, 0x80005, 0x2, 0x0, 0x6, 0x3, 0x0, 0x2ab, 0x4, 0x7, 0x4, 0x3c5b, 0x1, 0xb, 0x9, 0x1, 0x1f461e2c, 0x7, 0xe661, 0x7fff, 0xb, 0x3, 0x7fff, 0x4c74, 0x80000000, 0x800242, 0xfffffffe, 0x10000e, 0x40, 0x71, 0x2, 0x406, 0x3, 0x2, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x3, 0x80092a3, 0x4, 0x1, 0x20000000, 0x82, 0x0, 0x7, 0x6, 0x8, 0x4, 0x1, 0x40], [0x193, 0xffff, 0x12f, 0x2ea9c1f6, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x1, 0x5, 0x1000, 0xfffffffc, 0x43, 0x100, 0x7, 0x5, 0x2f, 0xe, 0x312, 0x1, 0x0, 0xfffffffe, 0x8, 0x4, 0x8000, 0x9, 0x6, 0x5, 0x6, 0x4, 0xfb, 0x1, 0x8000, 0x5f31, 0xbcf5, 0x1, 0x2, 0x5, 0x8000, 0x4, 0x9, 0x8, 0x9, 0x6, 0xb, 0xa, 0x1, 0x9, 0x9, 0x2, 0x7f, 0x9, 0x1, 0x3, 0x9, 0x1, 0x7, 0x3, 0x8, 0x48c93690, 0x42, 0x400004], [0x6, 0x6, 0x80000001, 0x2, 0xff, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x7, 0xb, 0x4, 0x5, 0x1005, 0xfffffffe, 0x1f0, 0xfffffffd, 0xfffffffe, 0x86, 0x1, 0x9, 0x3e7, 0x9, 0x5, 0x2, 0x2, 0x800, 0x8, 0x5, 0x8001, 0x7, 0x38, 0x80800003, 0x200, 0x80, 0xfffffffe, 0xcc52, 0xc, 0xfff, 0xa2, 0x7, 0x53cf697b, 0xfffffff9, 0x6, 0xac8, 0xbf, 0x10002, 0x403, 0x7ff, 0x3, 0x0, 0x1, 0xffff, 0x0, 0x6, 0x1c, 0x120000, 0x3ff, 0x6, 0xaaed, 0x4, 0xff], [0x9, 0xbb31, 0x3, 0x8, 0x5, 0x1, 0x6, 0x5, 0x0, 0xd2, 0x2, 0x1ff, 0x3, 0x7, 0x5, 0x1003, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xe620, 0x2, 0x1, 0x0, 0x2, 0x14c, 0x60a7, 0x6, 0x4, 0xffffffff, 0x80000000, 0xc5a, 0x8, 0xc8, 0xee1, 0x0, 0xffff, 0x3, 0x400007f, 0x100, 0x9602, 0x4, 0x2, 0xffff, 0x6, 0x1, 0x10080, 0x6, 0x5, 0x30b1d693, 0x5a2b, 0xc, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x7, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) close_range(0xffffffffffffffff, r0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r1, &(0x7f0000000100)={0x18}) mkdir(&(0x7f0000000000)='my_tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_tracefs\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='my_tracefs/events/task/task_rename/filter\x00', 0x101, 0x0) syz_usb_connect$uac3(0x5, 0x80, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x3020, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x50, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x24, 0x30, 0x23}, {{{0x9, 0x4, 0x1, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0xb}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x10, 0x5, {0xa, 0x25, 0x25, 0x3ff, 0x5, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x74, 0x1, 0x0, {0xa, 0x25, 0x25, 0x7fffffff, 0xff, 0xbe1}}}}}}}}]}}, 0x0) writev(r4, &(0x7f00000000c0)=[{&(0x7f0000000140)='0', 0x1}, {&(0x7f0000000080)='|', 0x1}], 0x2) syz_open_dev$usbfs(&(0x7f0000000080), 0x77, 0x101301) 3m2.443514283s ago: executing program 7 (id=1450): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100), 0x2, 0x509, &(0x7f0000000a00)="$eJzs3U1sI1cdAPD/TD7sTdMmhR4ALXQphQWt1k68bVT1QjlVCFVC9MhhGxInimLHUeyUJuwhe+SOxEqc4MSZAxIHpJ64I3GAG5dyQCqwAjVIHIw8tnedDyfRbmzvxr+fNJr3Yfv/3o7mPe9LMi+AsXUjIg4iYjoiPoiIuU550jninfbRet1nD++tHD68t5JEs/n+P5OsvlUWPe9peaHzmfmI+MG7ET9KjgX9U0R9b39zuVIp73SKio3qdrG+t397o7q8Xl4vb5VKS4tLC2/debN0aX19tfqbT69FxO9/9+VP/njwrZ+0mjXbqevtx2Vqd33qUZyWyYj43iCCjcBEpz/TT/LmJ3oTlymNiM9FxGvZ/T8XE9nVPOroZfr2EFsHAAxCszkXzbnePABw1aXZGliSFjprAbORpoVCew3vlZhJK7V649ZabXdrtb1WNh9T6dpGpbzQWSucj6lkbWOyvJilu/lKuXQsfyciXo6In+WuZfnCSq2yOsovPgAwxl44Nv//J9ee/wGAKy7/OJkbZTsAgOHJj7oBAMDQmf8BYPyY/wFg/Dye/z2RAQDGhf//A8D4Mf8DwFj5/nvvtY7mYef516sf7u1u1j68vVqubxaquyuFldrOdmG9VlvPntlTPe/zKrXa9uIbsftRsVGuN4r1vf271druVuNu9lzvu+WpofQKADjLy69+/JckIg7evpYd0fNLAOfO1dcH3TpgkNJRNwAYmYlRNwAYmZO7fQHjwv0P9GzRe7+nOH8icdyDI7l+L0vtGwrPnptffIr1f+C5Zv0fxteTrf/7Lg9XgfU/GF/NZmLPfwAYM9b4geSc+t4f7C80ezIPBtQgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeA7MZkeSFjp7gc9GmhYKES9GxHxMJWsblfJCRLwUEX/OTeVa+cWIsG8QADzP0r8nnf2/bs69Pnu8djr331x2jogf/+L9n3+03GjsLEZMJ/96VN540CkvjaL9AMBZrkdEd57uzuNdnz28t9I9htmmT7/T3ly0Ffewc7RrJmMyO+eztYaZfyedfFvr+8rEJcQ/uB8RXzit/0m2NjLf2fn0ePxW7BeHGj89Ej/N6trn1r/F5y+hLTBuPm6NP++cdv+lcSM7n37/57MR6ul1x7/DE+Nf+mj8m+gz/t24aIw3/vDdE4XNuXbd/YgvTUYcdj+8Z/zpxk/6xH/9gvH/ev0rr/Wra/4y4mac1v/kSKxio7pdrO/t396oLq+X18tbpdLS4tLCW3feLBWzNepid6X6pH+8feulfvFb/Z/pEz9/Tv+/fsH+/+p/H/zwq2fE/+bXTr/+r5wRvzUnfuOC8ZdnfpvvV9eKv9qn/+dd/1sXjP/J3/ZXL/hSAGAI6nv7m8uVSnln0Il08CGyRBJxMITutBO5X//03WHFGmAino1mSDxLiVGPTMCgPb7pR90SAAAAAAAAAAAAAACgn2H8OdGo+wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDV9f8AAAD//8dt1KQ=") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xe, 0x8031, 0xffffffffffffffff, 0x3000) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) request_key(0x0, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r1, 0x29, 0x4e, &(0x7f00000000c0)=0xfffffff7, 0x4) sendmmsg$inet6(r1, &(0x7f0000000200)=[{{&(0x7f0000000100)={0xa, 0x4e21, 0xdf, @local, 0x1}, 0x1c, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00\x00\x00\x00\x00)\x00\x00\x002'], 0x28, 0x7ffffff7}}], 0x1, 0x0) dup(0xffffffffffffffff) r2 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(r2, 0xc0385869, 0x0) r4 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$nl_route(r3, 0x0, 0x0) r5 = shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ffa000/0x4000)=nil) shmat(r5, &(0x7f0000000000/0x2000)=nil, 0x5000) shmctl$SHM_LOCK(r5, 0xb) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r4, 0xc400941d, &(0x7f0000000500)={0x0, 0x8, 0x5, 0x1}) 2m56.32489908s ago: executing program 7 (id=1458): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./debug\x00', 0x1ff) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fstat(0xffffffffffffffff, 0x0) madvise(&(0x7f00005cf000/0x3000)=nil, 0x3000, 0x16) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/mass_storage.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/mass_storage.0/lun.1\x00', 0x1ff) 2m55.601088334s ago: executing program 53 (id=1458): mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./debug\x00', 0x1ff) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fstat(0xffffffffffffffff, 0x0) madvise(&(0x7f00005cf000/0x3000)=nil, 0x3000, 0x16) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config/usb_gadget/g1/functions/mass_storage.0\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/mass_storage.0/lun.1\x00', 0x1ff) 2m11.424932083s ago: executing program 9 (id=1616): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYRES32=0x0, @ANYBLOB="431f07000b02000008000a00", @ANYRES32=r1, @ANYBLOB="08000500", @ANYRES32=r1, @ANYBLOB="1c0012800b0001006970766c616e"], 0x4c}, 0x1, 0x0, 0x0, 0x2004d808}, 0x40050) syz_emit_ethernet(0x4a, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb86dd"], 0x0) 2m10.081256526s ago: executing program 9 (id=1620): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8d}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) fsopen(&(0x7f0000000100)='cgroup2\x00', 0x0) r2 = open(0x0, 0x80140, 0x0) r3 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r3, 0x0, 0x0) listen(r3, 0x5) accept4$unix(r3, 0x0, 0x0, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f0000000600)="5f0efc3e1792a50972d2eb21bdff9ca4ac804c2847fe7bf05ddc63ff512d4074687760a5fbd1fc97772c6f5027dcea15b6658de3b024a6ea22baafb445bf8427c8055d00", 0xffffff3d, 0x0, 0x0, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000001080)={0x200000, 0x200000}) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x14, 0x1b, 0xa01, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) bind$bt_hci(r4, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) 2m9.384266009s ago: executing program 9 (id=1626): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, 0x0, 0x0) sendmmsg$inet(r1, &(0x7f0000000500)=[{{&(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10, 0x0}}], 0x1, 0x4000800) recvfrom(r1, 0x0, 0x0, 0x2100, 0x0, 0x0) r2 = fcntl$dupfd(r1, 0x406, r0) ioctl$SIOCGSTAMP(r2, 0x8906, &(0x7f0000000200)) 2m8.050809781s ago: executing program 9 (id=1629): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/cpuinfo\x00', 0x0, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f066bbeeb, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000123000/0x1000)=nil, 0x1000, 0xf) madvise(&(0x7f0000000000/0x800000)=nil, 0x800002, 0xe) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r2, &(0x7f0000000180)) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) writev(r2, &(0x7f0000003dc0)=[{&(0x7f0000000b80)='|', 0x1}], 0x1) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f00000007c0)='./file0\x00', 0x400c84, &(0x7f0000000340), 0xff, 0x789, &(0x7f0000000fc0)="$eJzs3c1rXFUbAPDnTpKmTfu+iSBo3RgQNFA6MTW2CgoVFyJYKOjadphMQ80kUzKT0oSALSK4EVRcCLrpyoUfdefWj63+Fy7EUjUtVlxI5E5m0kkzk07SZCaa3w9u5px77+ScZ879ODPncm8Ae9Zw+icTcTgi3ksiBmvzk4joq6Z6I06urHd7aTGfTkksL7/6W1Jd59bSYj4a3pM6WMs8HBHfvR1xJLO+3PL8wlSuWCzM1vKjlekLo+X5haPnp3OThcnCzPGx8fFjJ54+cXz7Yv3jx4VD199/6YkvT/711kPX3v0+iZNxqLasMY4te35tdjiGa59JX/oRrvHifRe2uyTdrgBbku6aPSt7eRyOweippgCA/7I3I2IZANhjEud/ANhj6r8D3FpazNen7v4i0Vk3XoiI/Svx18c3V5b01sbs9lfHQQduJWtGRpKIGNqG8ocj4pOvX/88nWK7xiEB2nD5SkScHRpef/xP1l2zsFlPbrBsX+11+K75aflGoKEzvkn7P8806/9lVvs/0aT/099k392KZvt/EnF5dcaBbShkAzc+jXiu4dq22w3x1wz11HL/q/b5+pJz54uF9Nj2/4gYib7+ND+2QRkjN/++2WpZY//v9w/e+CwtP329s0bml97+te+ZyFVy9xNzoxtXIh7pbRZ/str+SYv+7+k2y3j52Xc+brUsjT+Ntz6ti7/a/jt3Rli+GvF40/a/c0VbsuH1iaPVzWG0vlE08dVPHw20Kr+x/dMpLb/+XaAT0vYf2Dj+oaTxes3y5sv44ergt62W3Tv+5tv/vuS1arrej7iUq1RmxyL2Ja+sn3/sznsv5R6tpVbWT+Mfeaz5/r/R9p9+JzzbZvy913/9Yuvx76w0/olNtf/mE9duT/W0Kr+99h+vpkZqc9o5/rVbwfv57AAAAAAAAAAAAAAAAAAAAAAAAACgXZmIOBRJJruazmSy2ZVneD8YA5liqVw5cq40NzMR1WdlD0Vfpn6ry8GG+6GO1e6HX88fuyv/VEQ8EBEf9h9I6vdRnOhy7AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQd7DF8/9TP/d3u3YAwI7Z3+0KAAAd5/wPAHuP8z8A7D3tnf97drweAEDn+P4PAHuP8z8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA77PSpU+m0/OfSYj7NT1ycn5sqXTw6UShPZafn8tl8afZCdrJUmiwWsvnS9L3+X7FUujAeM3OXRiuFcmW0PL9wZro0N1M5c346N1k4U+jrSFQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsDnl+YWpXLFYmJXYQmJ5d1Sj+4me2ua0W+rT0USyO6qxzYkuH5gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/iX+CQAA//8vWSHt") lchown(&(0x7f0000000000)='./file0\x00', 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x100080, &(0x7f00000001c0)='%,@&#+\\\x00') write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x9, 0x4, 0x6, 0xfffa}, 0x1d, [0x3, 0xc95a, 0xfffffff3, 0x9, 0x6, 0x2, 0x3, 0x7f, 0x6, 0x4d, 0x39cc191a, 0x5c, 0x9, 0x80005, 0x2, 0x0, 0x6, 0x3, 0x0, 0x2ab, 0x4, 0x7, 0x4, 0x3c5b, 0x1, 0xb, 0x9, 0x1, 0x1f461e2c, 0x7, 0xe661, 0x7fff, 0xb, 0x3, 0x7fff, 0x4c74, 0x80000000, 0x800242, 0xfffffffe, 0x10000e, 0x40, 0x71, 0x2, 0x406, 0x3, 0x2, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x3, 0x80092a3, 0x4, 0x1, 0x20000000, 0x82, 0x0, 0x7, 0x6, 0x8, 0x4, 0x1, 0x40], [0x193, 0xffff, 0x12f, 0x2ea9c1f6, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x1, 0x5, 0x1000, 0xfffffffc, 0x43, 0x100, 0x7, 0x5, 0x2f, 0xe, 0x312, 0x1, 0x0, 0xfffffffe, 0x8, 0x4, 0x8000, 0x9, 0x6, 0x5, 0x6, 0x4, 0xfb, 0x1, 0x8000, 0x5f31, 0xbcf5, 0x1, 0x2, 0x5, 0x8000, 0x4, 0x9, 0x8, 0x9, 0x6, 0xb, 0xa, 0x1, 0x9, 0x9, 0x2, 0x7f, 0x9, 0x1, 0x3, 0x9, 0x1, 0x7, 0x3, 0x8, 0x48c93690, 0x42, 0x400004], [0x6, 0x6, 0x80000001, 0x2, 0xff, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x7, 0xb, 0x4, 0x5, 0x1005, 0xfffffffe, 0x1f0, 0xfffffffd, 0xfffffffe, 0x86, 0x1, 0x9, 0x3e7, 0x9, 0x5, 0x2, 0x2, 0x800, 0x8, 0x5, 0x8001, 0x7, 0x38, 0x80800003, 0x200, 0x80, 0xfffffffe, 0xcc52, 0xc, 0xfff, 0xa2, 0x7, 0x53cf697b, 0xfffffff9, 0x6, 0xac8, 0xbf, 0x10002, 0x403, 0x7ff, 0x3, 0x0, 0x1, 0xffff, 0x0, 0x6, 0x1c, 0x120000, 0x3ff, 0x6, 0xaaed, 0x4, 0xff], [0x9, 0xbb31, 0x3, 0x8, 0x5, 0x1, 0x6, 0x5, 0x0, 0xd2, 0x2, 0x1ff, 0x3, 0x7, 0x5, 0x1003, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xe620, 0x2, 0x1, 0x0, 0x2, 0x14c, 0x60a7, 0x6, 0x4, 0xffffffff, 0x80000000, 0xc5a, 0x8, 0xc8, 0xee1, 0x0, 0xffff, 0x3, 0x400007f, 0x100, 0x9602, 0x4, 0x2, 0xffff, 0x6, 0x1, 0x10080, 0x6, 0x5, 0x30b1d693, 0x5a2b, 0xc, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x7, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) close_range(0xffffffffffffffff, r0, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r1, &(0x7f0000000100)={0x18}) mkdir(&(0x7f0000000000)='my_tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_tracefs\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000400)='my_tracefs/events/task/task_rename/filter\x00', 0x101, 0x0) syz_usb_connect$uac3(0x5, 0x80, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x40, 0xe41, 0x3020, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x50, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x24, 0x30, 0x23}, {{{0x9, 0x4, 0x1, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0xb}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x10, 0x5, {0xa, 0x25, 0x25, 0x3ff, 0x5, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x74, 0x1, 0x0, {0xa, 0x25, 0x25, 0x7fffffff, 0xff, 0xbe1}}}}}}}}]}}, 0x0) writev(r4, &(0x7f00000000c0)=[{&(0x7f0000000140)='0', 0x1}, {&(0x7f0000000080)='|', 0x1}], 0x2) syz_open_dev$usbfs(&(0x7f0000000080), 0x77, 0x101301) 2m7.759075185s ago: executing program 6 (id=1631): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) socket$alg(0x26, 0x5, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) ioctl$FS_IOC_ENABLE_VERITY(0xffffffffffffffff, 0x40806685, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(0xffffffffffffffff, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x4e21, 0x2, @local, 0x8ac2d78a}}, 0x0, 0x0, 0x43, 0x0, "ee8b0e650926a96ecc136e7fb980e989db9e8bf9b9312948f6651a8de213eb94cd46e19d9c65a018444a131f4da58ae36556dd38ea6c029607462029add09240005c6776267513308a3d40aa1c788df6"}, 0xd8) 2m7.404875541s ago: executing program 6 (id=1635): setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) recvmmsg(0xffffffffffffffff, &(0x7f0000004e40)=[{{0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000001440)=""/103, 0x67}, {0x0}, {&(0x7f0000001540)=""/131, 0x83}], 0x3, &(0x7f00000017c0)=""/16, 0x10}, 0x68}, {{0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f0000001a00)=""/158, 0x9e}], 0x1}, 0x5}, {{0x0, 0x0, 0x0}, 0x5}], 0x3, 0x0, 0x0) 2m7.112735015s ago: executing program 6 (id=1638): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000000100), 0x2, 0x509, &(0x7f0000000a00)="$eJzs3U1sI1cdAPD/TD7sTdMmhR4ALXQphQWt1k68bVT1QjlVCFVC9MhhGxInimLHUeyUJuwhe+SOxEqc4MSZAxIHpJ64I3GAG5dyQCqwAjVIHIw8tnedDyfRbmzvxr+fNJr3Yfv/3o7mPe9LMi+AsXUjIg4iYjoiPoiIuU550jninfbRet1nD++tHD68t5JEs/n+P5OsvlUWPe9peaHzmfmI+MG7ET9KjgX9U0R9b39zuVIp73SKio3qdrG+t397o7q8Xl4vb5VKS4tLC2/debN0aX19tfqbT69FxO9/9+VP/njwrZ+0mjXbqevtx2Vqd33qUZyWyYj43iCCjcBEpz/TT/LmJ3oTlymNiM9FxGvZ/T8XE9nVPOroZfr2EFsHAAxCszkXzbnePABw1aXZGliSFjprAbORpoVCew3vlZhJK7V649ZabXdrtb1WNh9T6dpGpbzQWSucj6lkbWOyvJilu/lKuXQsfyciXo6In+WuZfnCSq2yOsovPgAwxl44Nv//J9ee/wGAKy7/OJkbZTsAgOHJj7oBAMDQmf8BYPyY/wFg/Dye/z2RAQDGhf//A8D4Mf8DwFj5/nvvtY7mYef516sf7u1u1j68vVqubxaquyuFldrOdmG9VlvPntlTPe/zKrXa9uIbsftRsVGuN4r1vf271druVuNu9lzvu+WpofQKADjLy69+/JckIg7evpYd0fNLAOfO1dcH3TpgkNJRNwAYmYlRNwAYmZO7fQHjwv0P9GzRe7+nOH8icdyDI7l+L0vtGwrPnptffIr1f+C5Zv0fxteTrf/7Lg9XgfU/GF/NZmLPfwAYM9b4geSc+t4f7C80ezIPBtQgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAeA7MZkeSFjp7gc9GmhYKES9GxHxMJWsblfJCRLwUEX/OTeVa+cWIsG8QADzP0r8nnf2/bs69Pnu8djr331x2jogf/+L9n3+03GjsLEZMJ/96VN540CkvjaL9AMBZrkdEd57uzuNdnz28t9I9htmmT7/T3ly0Ffewc7RrJmMyO+eztYaZfyedfFvr+8rEJcQ/uB8RXzit/0m2NjLf2fn0ePxW7BeHGj89Ej/N6trn1r/F5y+hLTBuPm6NP++cdv+lcSM7n37/57MR6ul1x7/DE+Nf+mj8m+gz/t24aIw3/vDdE4XNuXbd/YgvTUYcdj+8Z/zpxk/6xH/9gvH/ev0rr/Wra/4y4mac1v/kSKxio7pdrO/t396oLq+X18tbpdLS4tLCW3feLBWzNepid6X6pH+8feulfvFb/Z/pEz9/Tv+/fsH+/+p/H/zwq2fE/+bXTr/+r5wRvzUnfuOC8ZdnfpvvV9eKv9qn/+dd/1sXjP/J3/ZXL/hSAGAI6nv7m8uVSnln0Il08CGyRBJxMITutBO5X//03WHFGmAino1mSDxLiVGPTMCgPb7pR90SAAAAAAAAAAAAAACgn2H8OdGo+wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDV9f8AAAD//8dt1KQ=") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xe, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) request_key(0x0, 0x0, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4e, &(0x7f00000000c0)=0xfffffff7, 0x4) sendmmsg$inet6(r2, &(0x7f0000000200)=[{{&(0x7f0000000100)={0xa, 0x4e21, 0xdf, @local, 0x1}, 0x1c, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00\x00\x00\x00\x00)\x00\x00\x002'], 0x28, 0x7ffffff7}}], 0x1, 0x0) dup(0xffffffffffffffff) r3 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$XFS_IOC_PATH_TO_HANDLE(r3, 0xc0385869, 0x0) r5 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$nl_route(r4, 0x0, 0x0) r6 = shmget$private(0x0, 0x4000, 0x0, &(0x7f0000ffa000/0x4000)=nil) shmat(r6, &(0x7f0000000000/0x2000)=nil, 0x5000) shmctl$SHM_LOCK(r6, 0xb) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r5, 0xc400941d, &(0x7f0000000500)={0x0, 0x8, 0x5, 0x1}) 2m4.22493217s ago: executing program 9 (id=1656): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="431f07000b02000008000a00", @ANYRES32=r1, @ANYBLOB="08000500", @ANYRES32=r1, @ANYBLOB="1c0012800b0001006970766c616e"], 0x4c}, 0x1, 0x0, 0x0, 0x2004d808}, 0x40050) syz_emit_ethernet(0x4a, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb86dd"], 0x0) 2m3.836307779s ago: executing program 9 (id=1658): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) 2m2.850033525s ago: executing program 54 (id=1658): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000240)='proc\x00', 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) 2m2.821490976s ago: executing program 6 (id=1661): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file2\x00', 0x8, &(0x7f0000000080)={[{@nodioread_nolock}, {@sb={'sb', 0x3d, 0x1}}]}, 0x4, 0x523, &(0x7f00000018c0)="$eJzs3cFvG1kZAPBvnLhJs+mmC3sABGxZFgqq6iTubrTqhfYCQlUlRMWJQxsSN4pi11Hsiib0kB65V6ISJ+A/4MYBqScO3LjBjUs5IBWoQA0SB6MZT1I3sZNAnbiJfz9pMvPeTP29F/e953mR5wUwtC5ExGZEnImIOxExlecn+RbX2lt63csXDxe2XjxcSKLVuvX3JDuf5kXHv0m9k7/meER8/zsRP0r2xm2sb6zMV6uVtTw93aytTjfWNy4vF/Kc8tzs3MynVz4p962uH9R+/fzbyzd+8NvffOnZHza/+ZO0WJM/PZed66xHP7WrXozJjrzRiLhxFMEGZDT//8PJk7a2z0TEh1n7n4qR7N0EAE6zVmsqWlOdaQDgtEvv/ycjKZTyuYDJKBRKpfYc3vsxUajWG81LU/X79xYjm8M6H8XC3eVqZSafKzwfxSRNz2bHr9Ll19KPK1ci4r2IeDx2NjtfWqhXFwf5wQcAhtg7u8b/f421x/9OxUEVDgA4OuODLgAAcOyM/wAwfIz/ADB8/ofx37cDAeCUcP8PAMPH+A8Aw+fA8f/R8ZQDADgW37t5M91aW+3nX28/qfvyYqWxUqrdXygt1NdWS0v1+lK1UlpotQ56vWq9vjr78U6ysb5xu1a/f695e7k2v1S5XfEsAQAYvPc+ePqndNDfvHo226JjLQdjNZxuhUEXABiYkUEXABgY3+eB4XWIe3zTAHDKdVmity2fIEh6XfDE4q9wUl38vPl/GFZvMv9v7gBOtv9v/v9bfS8HcPyM4TC8Wq3Emv8AMGTM8QM9//6f6/mIkCf9LwsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACcFJPZlhRK2Vrgm+nPQqkUcS4izkcxubtcrcxExLsR8cex4lianh10oQGAN1T4a5Kv/3Vx6qPJ3WfPJP8ey/YR8eOf3/rZg/lmc202zf/HTn7zSZp/trlWPjOICgAAna7tzcrG73K+77iRf/ni4cL2dpxFfH69vbhoGncr39pnRmM0249HMSIm/pnk6bb088pIH+JvPoqIz23XfzwedESYzOZA2iuf7o6fxj7X9/idv//d8Quv1beQnUv3xex38dnYVTjgQE+vt/vJvO2lTTxvf4W4kO27t//xrId6c2n/lzbXrT39X2Gn/xvZEz/J2vyFnfT+JXn+8e++uyezNdU+9yjiC6Pd4ic78ZPu/W/xo0PW8c9f/PKHvc61fhFxsWv9t1ekrmXd7HSztjrdWN+4vFybX6osVe6Vy3OzczOfXvmkPJ3NUbd//r5bjL9dvfRur/hp/Sd6xB/fv/7xtUPW/5f/ufPDr+wT/xtf7f7+v79P/HRM/Poh489PXOu5fHcaf7FH/Q94/+PSIeM/+8vG4iEvBQCOQWN9Y2W+Wq2sHXCQftY86BoHhz9I7+3fgmJkB7EZ0a8XzCYlIqLrNekn6rejykd1kAws+q/6/YKD7pmAo/aq0Q+6JAAAAAAAAAAAAAAAQC+N9Y2Vse7f1urbwaDrCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwOn13wAAAP//KHnENg==") syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x193042, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x101042, 0x49) mount$overlay(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000b80), 0x0, &(0x7f0000000240)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0/file1\x00', 0x42, 0x1ff) 2m0.994202552s ago: executing program 6 (id=1665): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x54}, 0x1, 0x0, 0x0, 0x34040017}, 0x80) 1m57.202925019s ago: executing program 6 (id=1677): ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(0xffffffffffffffff, 0xf502, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) mlock2(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) pipe2$9p(0x0, 0x80800) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e24, @multicast2}, 0x6, 0x0, 0x3}}, 0x26) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000280)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0xffff, 0x2, 0x0, {0xa, 0x0, 0xfffffffe, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x400}}}, 0x32) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @broadcast}, 0x2, 0x9800, 0x3}}, 0x2e) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) ioctl$PPPIOCATTCHAN(r5, 0x40047438, &(0x7f0000000500)=0x2) ioctl$PPPIOCBRIDGECHAN(r5, 0x40047435, 0x0) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r6, 0x40047438, &(0x7f0000000040)) 1m56.561692539s ago: executing program 55 (id=1677): ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(0xffffffffffffffff, 0xf502, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) mlock2(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) pipe2$9p(0x0, 0x80800) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e24, @multicast2}, 0x6, 0x0, 0x3}}, 0x26) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000280)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0xffff, 0x2, 0x0, {0xa, 0x0, 0xfffffffe, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x400}}}, 0x32) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e21, @broadcast}, 0x2, 0x9800, 0x3}}, 0x2e) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) ioctl$PPPIOCATTCHAN(r5, 0x40047438, &(0x7f0000000500)=0x2) ioctl$PPPIOCBRIDGECHAN(r5, 0x40047435, 0x0) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl(r6, 0x40047438, &(0x7f0000000040)) 1m28.348682601s ago: executing program 5 (id=1757): mkdirat(0xffffffffffffff9c, &(0x7f00000003c0)='./myconfig/usb_gadget/g1/functions/uac2.usb0\x00', 0x1ff) setns(0xc9, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'syzkaller0\x00', 0x1}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x10f) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1}) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCUDMATCHLEN(r2, 0x89e7, &(0x7f0000000140)={0x1d}) bind$x25(r2, &(0x7f0000000100), 0x12) listen(r2, 0x1) ioctl$sock_inet_SIOCSIFPFLAGS(r2, 0x8934, &(0x7f0000000180)={'vlan1\x00'}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0x1, 0x0) write$tun(r3, &(0x7f0000000200)={@val={0x0, 0x6004}, @void, @x25={0x0, 0x6f, 0x1f, "357fa1dacc4d6fdc3f574256c1785fee0701fe1ea661f5b145c647e9de6ee72ccd3d2a48661827cd15f570fc15503bc0b7c0ec2aff47a6e520f986fe32468eab8833d8940fc13965ededf472ba80d9c19d18b04bae8534513fab1875d7f71cd8285c85d2bf7fef5c50cd2a5685a1047631ab6e4ba234c98e1cf908d619144e54c151794b81168cfe"}}, 0x8f) write$tun(r0, &(0x7f00000003c0)=ANY=[@ANYBLOB="000008050000010b"], 0x88) 1m25.892621006s ago: executing program 5 (id=1765): openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0x44) fanotify_init(0x2, 0x1000) syz_mount_image$fuse(0x0, 0x0, 0x1860, 0x0, 0x1, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0x82000, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x20004, r0, 0x2}) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = getpid() syz_pidfd_open(r2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000003b00000008000300", @ANYBLOB="1f003300d00000000802110000010802110000005050505050500000", @ANYRES8=r3], 0x3c}, 0x1, 0x0, 0x0, 0xc881}, 0x10) 1m25.208848708s ago: executing program 5 (id=1769): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) fspick(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) epoll_create1(0x0) socket(0x28, 0x5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ed) r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f00000002c0)=0x2, 0x4) setsockopt(r0, 0x84, 0x7d, &(0x7f0000000300)="0000000001000000", 0x8) bind(r0, &(0x7f00000003c0)=@in={0x2, 0x4e20, @loopback}, 0x80) connect(r0, &(0x7f0000000400)=@in={0x2, 0x4e20, @loopback}, 0x10) sendto(r0, &(0x7f0000000500)='\x00', 0x2710, 0x0, 0x0, 0x0) 1m21.32125416s ago: executing program 5 (id=1778): syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), 0xffffffffffffffff) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_FEATURES_SET(r0, 0x0, 0x24048000) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r1, r1) setpgid(0x0, r1) openat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x22801, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) 1m20.190930833s ago: executing program 5 (id=1782): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) pipe2(&(0x7f0000000040), 0x800) syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0xc3b1, 0x800, 0x1, 0x82, 0x0, 0x0}, &(0x7f0000000180), &(0x7f0000000140), &(0x7f0000000100)) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/resync_start\x00', 0x1, 0x0) write(r0, &(0x7f0000000540)='none\n', 0x5) 1m18.7608766s ago: executing program 5 (id=1789): syz_open_procfs(0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1d0000000700000008a58ac3", @ANYRES32, @ANYRES32=0x0], 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000001c0)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) 1m18.237640735s ago: executing program 56 (id=1789): syz_open_procfs(0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1d0000000700000008a58ac3", @ANYRES32, @ANYRES32=0x0], 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000001c0)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) 56.540675831s ago: executing program 1 (id=1870): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000100)) r1 = syz_open_pts(r0, 0x8000) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x1) ioctl(0xffffffffffffffff, 0x8914, &(0x7f0000000400)="736c300000000000000000000000000001") 53.630180558s ago: executing program 1 (id=1878): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/drivers/usbip-host/match_busid\x00', 0x1, 0x0) write(r0, &(0x7f0000000140), 0x0) 53.132413771s ago: executing program 1 (id=1880): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1c0) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000540)='./config/usb_gadget/g1/os_desc/qw_sign\x00', 0x1, 0x0) write(r0, &(0x7f0000000580), 0x0) 51.760313956s ago: executing program 1 (id=1886): r0 = syz_open_procfs(0x0, &(0x7f0000000580)='smaps_rollup\x00') lseek(r0, 0x39, 0x0) 51.365555534s ago: executing program 1 (id=1888): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xffe0}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001040)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r2, {0x0, 0xd}, {0xffff, 0xb}, {0xffff, 0xffe0}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8, 0x5, 0x4}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x404c8f0}, 0x4890) r3 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r3, &(0x7f00000005c0)="bad330fbc93f8b8a040000ea0756a85d86dd", 0x12, 0x4041, &(0x7f00000001c0)={0x11, 0x8100, r2, 0x1, 0xd8, 0x6, @multicast}, 0x14) 50.194839598s ago: executing program 1 (id=1892): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/dynamic_debug/control\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./tracing\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./tracing/instances/inst1\x00', 0x1ff) 35.078152297s ago: executing program 57 (id=1892): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='./debug/dynamic_debug/control\x00', 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./tracing\x00', &(0x7f00000000c0)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./tracing/instances/inst1\x00', 0x1ff) 7.861745272s ago: executing program 3 (id=2047): bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) pwrite64(0xffffffffffffffff, &(0x7f0000000000)=':', 0x1, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) 7.624259033s ago: executing program 3 (id=2049): r0 = io_uring_setup(0x3c92, &(0x7f0000000100)={0x0, 0x3, 0x0, 0xffffffff, 0x2}) r1 = socket$inet(0xa, 0x801, 0x84) connect$inet(r1, &(0x7f0000000340)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r1, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = accept4(r1, 0x0, 0x0, 0x0) sendto$inet(r5, &(0x7f00000004c0)="ddbe6b0d863b713ad5db38484cddee0aa41f65210fecff70ef0300004000000000bd8a00002000008754f7fd9763633b1e85f1a932c74037fe103e20623953979b1f4b2187d4bb0b2fa57e7dcf8083338c77aef3d0c6fef3c4fff70c894202c624aabe60ff07826f13cc9cb4859a1b5a3372cadc9e305042a26ac7d1358109fb8e8bdadc7173609059492047a3ae29e590e09ab027844bf6bc1016c259c7495e61f624721421b22e7054662ae3c515487849dca269e9b2ac92900fa090ed12f2414703cc6d9cddb4c5dfdf32c0d6144cabeb97e1be92a918bd4a48fc0c6f510936acf2961fb61f4c35ca8a0da4f6175f3efe2ac448bd753e6f71abbf761415e7b87c828cdaa62b10d541a9a6f5152a4ac72d8eb2d53e7d362b1543188da18b85d5f7e0cb5401d53342d5a0147a8d7362e14ba90a059f1c9c9ff474c86bcfb59120b026e56e8d411ef0fa6a96e9f47f6e3edd3166149bb36d529cae9061c61f3e2fa0897cc7a621b08ebb807d7bdc7c69889be4297bbf2de43163a96f00b604a79801e1503262d502c6b942ad6c7772cfa0eb9def8b6cd3c4b2a549e2f18a24c644fed5783907f5aab36c1dc2f17d01c61ba02691b66358a99cfc0dd790f2b5cb29361b8b9e3c4ecfcfc2f6db2541a8369f0c14d83688812197c4446bb0fd9837d3fe0af478673dae63a3717ad06a6a9812399610b1ee16c1146a7bf1d197506cb6", 0x201, 0x90, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000140), &(0x7f0000000240)=""/69, 0xfffffffffffffe00, 0x0) 6.173456071s ago: executing program 3 (id=2050): openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0x44) fanotify_init(0x2, 0x1000) syz_mount_image$fuse(0x0, 0x0, 0x1860, 0x0, 0x1, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0x82000, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x20004, r0, 0x2}) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = getpid() syz_pidfd_open(r2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYRES16=r4, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r5, @ANYBLOB="1f003300d00000000802110000010802110000005050505050500000", @ANYRES8=r3], 0x3c}, 0x1, 0x0, 0x0, 0xc881}, 0x10) 5.98282992s ago: executing program 3 (id=2051): sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}], [], 0x2f}) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000180)='map_files\x00') getdents64(r3, &(0x7f0000001e80)=""/4118, 0x1016) 4.620677414s ago: executing program 8 (id=2056): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0x70, 0x30, 0x9, 0x0, 0x0, {}, [{0x5c, 0x1, [@m_bpf={0x58, 0x1, 0x0, 0x0, {{0x8}, {0x30, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0xc, 0x4, [{}]}, @TCA_ACT_BPF_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x70}}, 0x0) pipe2(&(0x7f0000000040), 0x800) syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0xc3b1, 0x800, 0x1, 0x82, 0x0, 0x0}, &(0x7f0000000180), &(0x7f0000000140), &(0x7f0000000100)) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/resync_start\x00', 0x1, 0x0) write(r0, &(0x7f0000000540)='none\n', 0x5) 4.247613181s ago: executing program 8 (id=2057): mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys\x00', 0x1ab) mount(0x0, 0x0, &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/fcloop/ctl/del_target_port\x00', 0x1, 0x0) write(r0, &(0x7f0000000600)='wwnn=0', 0x6) 3.948607625s ago: executing program 4 (id=2060): openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0x44) fanotify_init(0x2, 0x1000) syz_mount_image$fuse(0x0, 0x0, 0x1860, 0x0, 0x1, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0x82000, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x20004, r0, 0x2}) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = getpid() syz_pidfd_open(r2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYRES16=r4, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r5, @ANYBLOB="1f003300d00000000802110000010802110000005050505050500000", @ANYRES8=r3], 0x3c}, 0x1, 0x0, 0x0, 0xc881}, 0x10) 3.8419695s ago: executing program 2 (id=2061): socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d00200700", @ANYRES32=r1, @ANYBLOB="00000000100000001c001a80", @ANYRES16=r2, @ANYRES32=r2], 0x44}}, 0x2040800) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008804}, 0x20040040) 3.832002781s ago: executing program 8 (id=2062): syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000080)='./file1\x00', 0x10, &(0x7f0000000000)={[{@min_batch_time={'min_batch_time', 0x3d, 0x1cc4}}]}, 0x5, 0x7eb, &(0x7f00000004c0)="$eJzs3c9rXFsdAPDvnUx+mLYmgmDrKiBooGRiamwVXFRciGChoGvbYTINNZNMyUxKEwK1iOBG0OJC0E3XVevOrT+2+i/oRkRaqqbltbzFI487P5KZZCad9E1m3ms+H7jJOffHnPO9P849yT3cCeDUmkl/ZCIuRMTPk4ipxvwkIkZrqWzE1fp6r3a2C+mUxO7u9/6X1NZ5ubNdiJZtYnIyzjQy5yPiLz+JuJg5XG5lc2slXyoV1xv5+erqnfnK5tbc7dX8cnG5uHZ5YXHx0pWvXhnvX6zv/X3r7LNffPtLv7/6/o8/9+Rnf03iapxtLGuNo19mYqa+T2I03YVtvtXvwoYsGXYFeCvppTlSv8rjQkxlY6z3bbMnWTEA4MTcj4hdAOCUSdz/AeCUaf4f4OXOdiGddu8P9/8Rg/b8mxExUY+/+XyzviTbeGY3UXsOOvkyaXvekUTEdB/Kn4mI3/zxB79Npzih55AAnfzoQUTcnJ5ptv/77U9yaMxCXe8DMr7cTBwxOGDmQF77B4Pzp7T/87X9/t/+9ZfZ6/9Eh/7PeIdr923MRPuIk8PXf+ZpH4rpKu3/fWN0f2zbq5b4G6ZHGrlztT7faHLrdqmYtm2fjojZGB1P8wudP742vGz2xQcv2ua2RNza//v/wx8+TstPf++vkXmaPdDkLuWr+X7Ennr+IOLz2U7xJ3vHP+nS/73eYxnf+fpPf91tWRp/Gm9zao//5EeV7T6K+GJ0jr8paYxPbB6GtvGJl+drp8N886To4A//+tVkt/Jbj386peXX/xY4199Au0iP/+TR8U8nreM1K8cv42+Ppv4ce+NJ23WPv6nz+T+WfL+Wbl5K9/LV6vpCxFjy3cPzL+1v28w310/jn/1C5+v/qPM/jeVmj/Fnn/33d92W7cXfnHEo/oaJHgs7pjT+pWMd/46J9E/hLovypSevVka6ld/b8V9MEyOzjTm9tH9da5ovlcZa1nnrHQcAAAAAAAAAAAAAAAAAAAAAAAAAx5CpvaQ0yeT20plMLhe17/D+bExmSuVK9eKt8sbaUv1lptMxOh4RtVddTrW8D3Wh8T78Zv7SgfxXIuIzEfHL8U/V8rlCubQ07OABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAoOFMl+//T/1nvP779VBrCACciIk3rvGiOJCKAAAD8+b7f0SMn3w9AIDB6en+DwC8U9z/AeD0mcgMuwYAwKBNRGSHXQcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADeadevXUun3dc724U0v3R3c2OlfHduqVhZya1uFHKF8vqd3HK5vFwq5grl1ZZN/9Hp80rl8p3FWNu4N18tVqrzlc2tG6vljbXqjdur+eXijeLowCIDAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgN5VNrdW8qVScb2ReDwZ0T5nQImRRoX6+clzZwcdxSASu1P1PfVxqU/fExMH5/x77p/nj9rq4aHTWOIjJ4bZKgEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB8cnwYAAD//0ldFl4=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x109342, 0x0) setgroups(0x1, &(0x7f0000000100)=[0x0]) fallocate(r0, 0x0, 0x3f, 0x8000c62) 3.622517051s ago: executing program 4 (id=2063): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() fremovexattr(0xffffffffffffffff, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000180)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000380)=0x6) bind(0xffffffffffffffff, 0x0, 0x0) getsockopt$TIPC_IMPORTANCE(0xffffffffffffffff, 0x10f, 0x7f, 0x0, 0x0) setns(0xc9, 0x0) socket$kcm(0x2, 0x3, 0x106) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x98, 0x130, 0x1c8, 0x2f8, 0x0, 0x98, 0x130, 0x260, 0x2f8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x0, 0x3}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB], 0x14}}, 0x44014) 2.448843975s ago: executing program 4 (id=2064): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x40002, 0x0) write(r0, &(0x7f0000000000)='3', 0x4e) ioctl$NILFS_IOCTL_GET_SUINFO(r0, 0x80186e84, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) 2.436186306s ago: executing program 2 (id=2065): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000100)) r1 = syz_open_pts(r0, 0x8000) ioctl$TIOCSETD(r1, 0x5423, 0x0) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000803)=0xc0) 2.161972259s ago: executing program 8 (id=2066): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0x70, 0x30, 0x9, 0x0, 0x0, {}, [{0x5c, 0x1, [@m_bpf={0x58, 0x1, 0x0, 0x0, {{0x8}, {0x30, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0xc, 0x4, [{}]}, @TCA_ACT_BPF_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x70}}, 0x0) pipe2(&(0x7f0000000040), 0x800) syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0xc3b1, 0x800, 0x1, 0x82, 0x0, 0x0}, &(0x7f0000000180), &(0x7f0000000140), &(0x7f0000000100)) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/resync_start\x00', 0x1, 0x0) write(r0, &(0x7f0000000540)='none\n', 0x5) 1.849875174s ago: executing program 3 (id=2067): r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) sendmmsg(r0, &(0x7f00000030c0)=[{{0x0, 0x0, &(0x7f0000000400)=[{0x0}], 0x1}}], 0x1, 0x9200000000000000) recvmmsg(r0, &(0x7f0000004e40)=[{{0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000001440)=""/103, 0x67}, {0x0}, {&(0x7f0000001540)=""/131, 0x83}], 0x3, &(0x7f00000017c0)=""/16, 0x10}, 0x68}, {{0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f0000001a00)=""/158, 0x9e}], 0x1}, 0x5}, {{0x0, 0x0, 0x0}, 0x5}], 0x3, 0x0, 0x0) 1.849000934s ago: executing program 2 (id=2068): syz_mount_image$vfat(&(0x7f0000000400), &(0x7f0000000280)='./file1\x00', 0x2008000, &(0x7f0000000080)=ANY=[@ANYBLOB="6e6f6e756d7461696c2c6e66732c73686f72746e616d653d6c6f7765722c757466383d312c64656275672c696f636861727365743d757466382c73686f72746e616d653d6d697865642c757466383d312c00484516000000000008f5bddce4dd4ad9b4299e3cfd39e40b09796bc6c28a04d64121f1ceacae77292c757fc5ec73fc8a21512cba5ec36234ecc40ff450aa9d1c5bd5a22e36b52b0ac6605435e566ffe6b2b4e33677f2783865970ed0c3d88006bc7850f5e90dbcdf0ad2d8fe234bfe9f55ec0301465d438694716093761c3a8cf0eff738a55d8aaeb923b27e5fd13c000000"], 0x1, 0x2c1, &(0x7f0000000700)="$eJzs3MFrE08UwPH3a9ImTWmTH4igoD70opeljX+ABmlBDCi1KepB2NqNhqxJ2Q2RiNhcxKt/R/HoTVBvnnoRL969FUHw0oO40t2sTWoa05o0sf1+oMws815nsrsJbwOZjVsvHhbzrpE3KzISVxkRqcumSGqr1/Bfox3x+2PSrC4XJr59OnXz9p1rmWx2dl51LrNwMa2qU2fePHry8uy7ysTiq6nXMVlP3d34mv68fnz9xMaPhQcFVwuulsoVNXWpXK6YS7alywW3aKjesC3TtbRQci2nZTxvl1dWamqWlicTK47lumqWalq0alopa8WpqXnfLJTUMAydTMjRFu0iJrc2P29mdh32Ij1dEXov1no43i7GcTL19oO5tX6tCwAADK/O9X9Q6+9e/2cXg7bH9b8I9X+f1FuO/lD/41BwnIyZaLx/W1H/AwAAAAAAAAAAAAAAAAAAAADwL9j0vKTnecmwDf9iIhIXkfB40OtEf+zz+l8a0HLRY00/3IuL2M+ruWouaIPxTF4KYosl05KU7/790BD0565mZ6fVN9r4l1v5q9VcxN+bwM8Ppdrln/5/JshXebuVV23kj0qief60JOVY+/nT2/nhdgir1dyYnD/XlG9IUj7ck7LYsuzf19v5T2dUr1zP7ph/3I/bTTe7awAAAAAAMCwM/SXV+vwb7P1o+AFx+X08yN/D9wM7nq+jcpKHaAAAAAAADoRbe1w0bdty9tGJichfpB/WTkQGMvv7qEiHmMsicuBnQ0Tqg7kWcQnPhu4n/Yt0PJk7O14XMVERGZZbtJvOoD+ZAAAAAPTadtG/h6SPz/q4IgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAjp5u9wML44veqrTsbxcOdEhvmi5y4C8QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGCI/AwAA//+/PxhW") syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x8, 0x0, 0x0, 0x0, 0x0) 1.7164552s ago: executing program 0 (id=1943): r0 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x28000, 0x0) ioctl$FBIOPUT_VSCREENINFO(r0, 0x4601, &(0x7f0000000100)={0x400, 0x300, 0x550, 0x40, 0x100, 0x0, 0x4, 0x2, {0x0, 0x9}, {0x350, 0x20002, 0xffffffff}, {0xf4ef, 0x300}, {0x4, 0x4000002, 0x7fe}, 0x1, 0x100, 0x0, 0xd614, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}) 1.48907379s ago: executing program 8 (id=2069): mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x404, &(0x7f0000000680)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000001dc0)={0x50, 0x0, r1, {0x7, 0x2b, 0x0, 0x2f419842, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x2}}, 0x50) statx(0xffffffffffffff9c, &(0x7f0000000640)='./file0/file1\x00', 0x1000, 0x10, 0x0) syz_fuse_handle_req(r0, &(0x7f0000004200)="aa8e9df36226466e888b39901e75023156b5530e75c1e203314842ea78a6048cdec3383c60dcd8fa24f6928f6e02ab1090989c59ae38dceda05af132af4546a298837c63ea70975feb0919d7f7766791d530b90d522b23c58776ac7a4035383c5a0dd90d8b766c96816631f1742a0da0ce6ddd053a05966f6b6ec22dd28a0a2636d07696a307496b0b0d8bb370227dca3c96838e556681409be388f1dfbf500f1aee82b374f4473aecbdb77cf567fece7f8ec733fa91aa92a186f9768d16d0257ef826959fb3a73e4976a019bde8a82e9bb0a0443cbb1ab2c6e8f8748489948710294efb79d70edec2271491bc1cddc9c9d2713cc3063761f2bea07f5577bbe5224302ef23adcc96cb5ecee406c7977c97d7000000006e28198954bba79006fd58b2a2b43047e7f3ead143ccb6b27043d7a7512e9d3bad0138554f4b465ab6d1cec9b40cb301ac6491ee7fcdc0588e53eb2510471de91e3e73c98f0a3cc9929eac63f477a1208a80f8c75d0a1d9edb895d675d036a1863dddea98b18c846ac253b2470324b21eaaa6e69389b91bcd470995cd6835c6fac80d5ca41b66562c910f893124cf0f20dc65d90aa0f9cd1a7c88f755aaf33875d7639ae1b7413834636de57f44302b723646257ee7456bdfee10f2eaf0c05f2cf01a115ed8ac2908827af3d85da2f1bcf53d87ee830dc5e98fcfc1a22e547ce57508f606945a7599d8e1cc0268987cb7b3d00a6bfacea7bd05430255bc8b473a071b83695783944ef856fc89906e0b44a13166309bc8cc1dbae68399e1e8e4a2ea265c1a104dd862563cdaeee2b37e72fbda323cc72360b6d4fad2fd2409397f90422bbe6e9068aaf38e18918736e6357a6caac59ae803ffbe853ff716a388423bbc93bb2d6b1222bb94c96a3bddf421288d47039fa1b73573dbed87e1f6b280f8b045f9be8e0d85f6cf416bfc0f3f4ce988aefa2382cccf39e40b2a1657814b7953d0a0aea45d50d02d66982e5269f1ededd6a9f8f9e212314a4bb5c2f4898278fd3a585c1ff60e435b186c552134e5ddb0f2cc95dac405bc4bd32ccda41b05c6a376070c8ef2d6eb3ea7fce97da8f09440d47dc5faca6271d1ce4f4201b315d1cc3fa1d4cc2baa14e4c57bafb7b5bb2e9e859505360e1738a36100dd6c2fb6610fc0ed88e452148ecd8b73517f69c28f0c979525d21ba4fef353eebb2326f48217c44a322e9f1f08f92af1ff5ee5f2dc563f1a0edb09d0646105be0c46ddc8b71301e68013e863d539af5b3a2b11f770d8c0c086988216602619ec440f98d434add23bc7f54d145260773e53121188ca179832d5c406f2b4a91045edca91232416219fade02bf6ba002352943850294b05d9a142889205e6b69336cecfe8a7cfc88688368d54b475f3915eea851334395f80b41177ed4d17d91880a22c1c0cf33a550e32fbf76505458d07ebccc4e77bafae1700c9997f6fe28452f011e370642f228bbf0e2f3dc05741127f6d73e96c073b26e730ac19cb17dfc63c0ed4b5d53ffd6e312e3e80822c8bbea3cf2914f3f8ee53fb4edde1d4507fa9d7de54eecb75132befab6bf486cb05bc8727dadac49c83bf08d9eb94621b42241f9eb8fd1e6fbf969d932a023760faa62c178b7f0a1d43adbf5c21a35a58d381442ecdfc2dcce2d11e5efae8433b14fc9fc28294ae76eaa95f38ac121f255d9b478c81a1caf5c606c34e6efa80dd3aa77cc4001b9fceebcc77a1efea7bf9f749f62c7a8bd5deb0f70c54ab5daab010cf14b2f1012516dc1639edb2d890638b73559d060be47f594f322efdd40c5945148fe1690585923488910fcb3159006f935f7d184e4b4c404ccb6e2a799cc67aa2b56a13c16e3ad92b85a12060881c1d140708ffece6965f9746ed4eef74d37424e760f4b266c80c93390523eadc65494962bed4efc86a0fead2fe25c9108c5d591770cee92f9ff2d916ba0dedc6551a47ce3a4dbc97043e588b3483f0793786fe9f32f1b79ba3f4c4ccabba52a59861c8024bcdfc8ecb0acc821160b060d5dc24f0ade14d08b56218a32a03f9eba729c02fc6b714bc72b11cc7fe47b51b3a174cfa2d8f5df80a0fd4d1dd2ed36b868b46ee5a8cc72e91b57bd05005b5142b5531650813fb5496af379f9e7b1b73c49c64dead9725af0742a41b770205390791de856715c0138ca22f134911a28d2caf22ef21049d1ba721d278bcf675317c5303cbaf96535414fd92c55d741120200d49729e01e399e4c30fa8da659654196af7991a3d294c775a610f242a56c88d542641036de7eccbd64f9f306a3920596d350637a6409f667110b46c6d85ab94df4d7b0af12318522ba1e745e7de45176789a53213b9b3d23b2599275e4f1858fdb2fd63f8c6f7990235e2fb3c4c8f215715973b60b1e56d1f061b6ff33510d08fa403559cbcc21bd141b41f1e9ab4e163a0f80a918ba13031c483931a9dcdb790ad77fbdf5634662cb75e79d986e4724f64c80203600df7ac9950330431b83777bd968a86be5698b13c37513235ac89a0a1dcb799112a86a2d96b1708e0c5e983756d8243927fc7d42be6ff4c946c0763a9745897726f38b65920363b7c32051bf9e770ab1ec140ff11fc639f36fa760afcfd6ba2f609df8cb0949f26119895b69c8ffd0836a01da1e407ba08f37a1144674f5a71b3499ffcccb21e75f19cdfb33c7eded5fa5c264784a78edc5f6de17da15317a66fea522b6e92a52efa5013797212d816c3229c7dd523e2165f9f042c3b3b16e608a1d87ab9c46c2b291bf547e1f4312913b16e39a714c24ebc5cb4f4f80bb20ce4efdf2921db45b7389fef98bd0e8aa40be16758b0d7755ab631b27c5d49225e84fea63e3f031c665851ef4ed18628b26445da2cad4741800cf72a401ad79a7462657068e0f2ee65eeb86da66890247cb45b31d3ad06ea7500eac5be65528c55bf190b0ec27673b67b36117344097a0dbb9db47a2b5144218002d14cbb98629c2ed35db5cdcf93994e3e3d1a1673ff60ec0d9bae1217ba6f39ae4ac4c9e5a19f85634f3091150c4724aaabe3bd1445cfa33fac93b86c5871ca168a728899e2e0062a596fba22b962764420f1268bb8ae0a894559c488cfce6b71aa8478964d2eef5086b2cee891ca031b6543bb7ba55006621f1d80e17abcba9f9d05fc5e61c6c4a890aba4b205f5570e7866ec4de380420c4758de63ff0f7b1acb0521e45cd9bc54df1a4614c04c524f43e86f58757eddb645bbc56a63de5bb560f56a31796dc344d58e2ff2d3fe5228d87c0439e6353943c92160fb847a172eea37ad0c22de5d1e7cd66730218832c87b73366131e29a1545b26d4c500a9afd75864b460cea1ba33a5dca6e5585e9c78a8ee3361f20e2b79489ed2ef1c935d7deeef6de0d009b72a0751929209b351331c0225c29341f5d476b278061a0a33c1e455815bbb83eebf5f5c3fe97c4b3df32846a094501a157196b6c1db1e05cec4f2dee823ebea7da05f5ee63aee1670128471465ae83defcf26aba78f18544146fcc9305ed5899965edbcf9f677c499a52d984db346c12faf02553338e6553488c29c9f3f4537a9437b5eb7382f95f9e844d27fa0b1ffc48d2b44e383b1fdb567b7f23863e8e10b6210f8031859cea410d52f99b5a8d2f218e7c92e231904b171dc077c636db15087cfb0ca6a2cd09f6b7973627a03ebfb4772daddc8ad7c9e534d8bc58cfc6d1305374b589a2a85c8a3c471c7408712ff5cfd7a50bee627d0417a5667dba71866320857cdb84e071a37e477f1b5ac16bdd464d8bf3ae31860ad19722bea1d85d1a5c09e1ab36dcd6c4bf524ed2137745e3562147081027d7852bee1ccc9563e4ff0ce72affa7002e9a066591ddf31abc4388281d98d2d88fa1c5f22cb60523e72e3d838fc6b0163fe0082ce0d8d59098363a174818113182d40cdb6367cb4a867c5aaa480c95f4a98439a2b58291fedcbfedfc3ebb41fe6b0a12fce36518ea6082fb919cdff23e3b40aa26eac8d634e03fc3a1e0fafe402c875709b15b622f35bfdd233ea8d7989ec38dfa1e5b5688d76c615b5efba62dd7d50be97b92f16c838edecd426e18dd270ddda42121d7ad8d26ec28df29580e6dcd7f968885d1cbc5f573efda890a408b45701bdf5cb2e3c54f8481710145ac1f5bdb1b53a1e9a7efd8a3ad7dad7bd0fa017e080854913beda2ccc95631a5c1da5c5afaa84bcc3f1a7041208fac9e09ef52140f142bed882b8988ea062cc8ecd7fd78fd33aeee8e8d5cc891514e3407fbb171e84e45fa14713e995513e16763424e356032ac81047c8e2bfe05dfecc510b55866d4a8696c91afd7b6b809fcf2e0f8a21834f43149d8e2b5dc5fddacb8ff9341376281e8f7d762fdb61a8e6536529b0d4d3cd8217fdb4f0b8341587737da7f50dbe4e5b7851a25d52066bd0e3ad11aed47ee02bec11d0f125cdee1f505cc5c1223d386b2fda556331cf57d8df433927cf12a5fbff853be266c5a64b6424f7b106931d312f0fd447206d21c1945579915e7e21627c7fc423a813823ce5fa2c6f3114303d0995c5706418a088535c62eda2a60c82b727c31177252f8ea025c16a3676ea0ccec24ea57e68c7e0f1b0e06f78a8ccead63eb4c0ef5c59b1d3a805644f8089e604a5bd3aa4494ff7fca02dd5894a6f02e572edd487af04ace3e37f19074325613d6f7d2af73062607b45a3c9365337a1c5e6bae9702a65f0a1b9ce75e43f6381efd9d610ad37532b62c6ab5957ded77a5d01604f67d7ccaa495266ab7fe161268b9a6156643ab6289fa0be75ac433a0204df164c02d3d0cb1b7bf0acd92ca8ff19b710b0b511820d0500fdf58f598fc611380a0f7dffce7bbc934edc967ba0094a0281750176748a4e2c99684c1c4a40258b0da77a0bfb9a4b808d5932443389f0f346dad998cee519624aeb07ea4446064282b1448bfa2e5ac3393d30b5c3865a8995869f69bab0747cfcbbd2bfd407c82e198da326f36be9a508e12d6d73fb262b37fcd7ff70b372c966b7198a9f2364012ff8127f200c079cb70d550f9483c1bf9fba69ebc961c989a82fc38cffe853e4738f33f1fa42fe7167e4bb79110f237d7e4989d2f6f4bd21905e491e2d4b6ac5a66025c11a93ab1eddcade3c3e78c270eaf6a0a6ed43df6e35bcaea9aa716d547d2136c2388379abf645e3f7cad1cc1fdc92b882729ff92b0612302970bd9ca7e36d76b2eb4d9dfe35116bb7771e448867e57026e622e1e54422b064fdb707fef339aa16fde808f622a7269b77c292c7e85fade6dcde475c2f61d71370209bc0e46ba7c7b71e41df246d283f5574205ca6b4819c63d97193eb084fd6b0c20b956cfc4b45b51fd46b2e034ff0f003179c7539fbc4e888c0633767604ed0f07beb4fe00f5a3b56ad9f3997cb49c7a8b92a719411b20874686a8a5ab462914baa85d016df99796a868af3dfa6ad98ceaaa18af2f2fad2ebf3dee1df8c8863e84ed83d6da5e283ca9cc385e0ded20531f127ff4aa974b91634d8f367154d3e23ebb04571a5a453d1265e873d00d40be7e1eb7e74529822b4c81d742c981a988fb786084cbd1e721358c7a1ea5293aa609773b890a5c9de4d1349588def4232d41fa5d7cfbc3dd130754891c304118a895268555874613e9c89c66bceea609e7ca1a914ea327db1f85a3809098e801289d8ab71997c2ad5bd1f3fd4b3c6b80667ac2b6b23b35018206dbf708284f0e0fac58d0b6d72c0d0034b6ed37b1f9931158f2443f045f65e33084ebc6aac93d8c0e3c1c52878dd3f54b9f88a40821090cdeb3bdbb61f0be16338a2a7ba0f77e9ecd5400b6f809a49eee78346c69e7ab560fcc32f2d19e665bb91fbc00e4c00838a1385d5156d1696f694027a9e6a7ef66933202012caca81c1b3ebe64976a9d000e28a6aae5d6f061c5acf8e4bca00bc5ecc547ab1664cdb2125300130a5a92abc0d36cf911fb3123034e925ea097fde14253dd3de52bf5c8a6bf01436c92dbbf5450a9b7775a981b09eab05406dae83f8ddcf898b1bace4b8487f0b4ec5b5316a9b7e3bcd6da41caa23604b3932ff3daf31bb19e74c687773bb54503f6b3ed74aef1410dc4a9a72fa05b1e120e682a7e7f9b8c7b6836fa9d8f96d16fa17975bc3dd7784f0d621d5a69038b0947d1cb47381c82c6df030fc8033dd66b380d884b12991ef5d5283e552f723aaf791bf3af581423c57b536b91e5a158695b68f7eccfd72fd2af1016e261ec863215d1df0fe756366e56fa86c4495cd9a45e83227af93a5b431c5d33fea2b3d469aab08f57b85b3a14a47d7da8ca74dae34f963cf660057466dac3937ce00060f8db8099178944aa37474a37eaef3b9ca04bd0eb1d03c25887d530cd690625f5829830851a6a58a7b411bc87aa70f26e80514799664e35c44db243d61add5bcaba3695e45e9f1a3cbf8ebdfb87571c44b9dcddc5fd422e94cbeb02bb58abd14e140829e12f7f0c7e3cc1a1bcae8429775e531710bfa504e103b17c20c329f653c015ab514fd6cf162b96d871930de99413e148fa58c1ff262a997c6ed1bc008912c6b864031dc95b5a3ad6aa3521167a62fe771baff828cafaf178539048d2e91a62ee7a50df04062422150347774db320fb535ddd4c03a8cdfc3affd253c200e1d5678ff12eb6f5bd43da636778cd2f8551295f4cbbc902322e491c5c10fee144daeaec4cc2a2f855f5312f4c8cac1155c8d3b93a5fe6a60118a0a9912b16d583582b478e4f05c375247d4cd897c49a8cfd2540833311039d9b121e5d5779d71b206d0d862b95e0eab28005f86ddd6ec514d931a521fc035eaacfd10ec5f97af541cabf08512f6c79e7e0db5217bd14aab6d3e9458018c3e59769bcb689347d7e394b469e9c9d9da2be8fc7a54b1aab301b68c1faf7ba7bfd05b8a313c902ad3733e523fd64739d9af110e39a96f1048fd6a43d13045ec71ff3d1f64a904f3878cb18f58b3b84942331ec05d3372a328a83e8aab828574313964f6f6c5af246faf2c69a95e9ceca77c0fbf303103a2d38ef6da2929a3dbccae5823f82d9a37c989154c8a760df8e7d8589daf1fd69683cadd2c7ac13e285a7661c23913912ee272797e3a0808654fd0b9f74f2fe04cb34167aa630b8aa58efc2586bef8c7c2e354d7c8d08de7d25a80b08bae8d2326d16a15d537d8baffcbbae460ce608ded63a45bdf0caf9dc335aa8d2aac03a62a9c6c62ce7c2caa9a731baa549d1880d3facdb4bee43ae27ccd5a22f143da8e7b4deb5c2a194d450eb5ff6949a950115d4e1d60fc75115346a0aaaf1400a301dcc8a04f9d2762c093f88adac799f6bd5150ca9c7d3ac1f728b88b1b0807a7407ad9b8febd89a801c9845af62bf2fc98aea4835d52871774e72b9fc07d26d55ef163833fd2f5c951ff963f43fcdaf03995cf3f14360b05be587e7a19fb760a944166b1fbd04c0d02bda8ff5d92a23c4e683db1b2823a6b02a16a7bc7963aaeeec43d97a85752fa439544127fb71d8b4fee6a09b966bc4e7be67acca35bfe4acabf18f6e9cc938c1e0af43e11754cbe7b37738019d9a162083f5f1fcdd9299921a349f1e0ee840b19fed4c0b5273d5e71ff5f1f20dbb36c89e1edbbef78de1a6229a2cd22bcf2164a1b567f7c08c6ba78ff2e53bc348dd2ab53b9deffc9cf8726feaf9cb07b4f94d189314da8c0005f3bb031e44c402339588832779790e814c707fdbe0830d53b4d35812f27e7709bee185d6d6d67a65382dcf56d567180a4a74cb05b0f7d0202bf33b88729f2bab7003264a2d67ea93d022baea74d7ca54a0081923a82e56750f22f58bc997ea57afe1bce18405383055745f0c6bfbbc514df76107b3c5d04bfe033dace72bd5bead25e736a0052b6efe7eb1153d1afe9202e227d60e4e38f5f294894d2ef9b89998194492e427442a18506e24ddcc1952354fe0250ad949be08a63b6c0e206ecbac70415c36f1bf78d7068ce8eb804561eab2540c6c984e63d1217de1242ae70a5dd457d7a96f24ad9e8a59c060a2a95e9e04a6a4429f40d47d2770e9d3ece295d748aa30a7bbd2aec570733be7855c3a789d71d94b3c86ccdd3cca3ddcb35a969e8c2d5b17ded6ab8b81b90a4206ac2ff163c04ba9886b5ec6138db5eb6ffc19201f66a1057858e564960de679b2996bb93c8d2b440fde169d1fbb5886fe673639c514c2eb8bca75f79abbb73c4a125e5f4d7d4ccd5c9fc85cedc9fe6f2b2b75ec384fa6ecec37579a70bd29b4c9893badb36e1b33cf61b07ee7d2a5550ac9f23b5fe629297efe94eb8a8c2adce65a61ddae84544fe8f81455e2d053fdf7efde38b92b0b4d3e7ff9d81f5de7d571cb4db7e059cbe1ac2153b22b57b4d45d58fa50d152efa2d85d262238ce4816e40f93b65f53b6646297f69e3dde4ae7c57e9112054cb831eca5716863196db7667674b00be7c83f900c944ea2bc8e8e6b6b335a6e9f63e6f6635f6afc0889355aa4f0b928b90f76e6f03b5d40e9a0cace6243aff4590c0ef255860401b16da288687e890b1921b8ba63860df7aad86279c89d16cc4ad1ef4633639f203724c1958fb3b6a990f555e8df8f494fbdae25b353c14fe524541347c1d7f61c349f55773575fab73df09ebd1c635ad5f93fc8e075093ec3fd8b832e5331e329c2578d1f6f7a0a44838e578fe40db7d11645c2c73e0a438a80085988294d98a4ef4c5faa593dd5a9b0dec12d8a6dfd15cc4503bb2078739f26f9c10d0b1fc2634094cfd2ff6bec88a7513debde5fcabb85fd31df8d97bcfaf247edb89cb056fc52bc06f117a3e1022a57817b9abe1793cf279e163212f501681eb9ef08e39adb9ba80ec3cd45f5ae7afc0c256a3470e8ed3ca41c5502c510f0526eab848ec5a7115a53741cf05846989b9b5fc6d2ad74fb855a852e3fc7234bb0ed8b6937167133925dbeb4313a9895860e761300a0695e03e81c2c1e3fe3f4b8c42c946b010259ffa4c1d345350020cddc8e9697fb83c22fff5190558551584368e7a270f958bc72e2624c3e45bbef318b5134f0419e725945e445993f2f176f0a21f5dba86398529fe5159d57c0d75d64f950763b52935e778b20356615409dcb088514eeba3f811e9ce6ce2bd1ba6ac932bd79f7a518959f99d52acbc2a1d0c02c70b9ea46d662d39c315b36315f4220e5dce293275050a3e6df506d0c1d7786017572cd758ba4995963fa034ecd49cadb42bb1ee280600557ce2e17488e1dd4595b8c7d4f20f420a3a01b6228d764c5069222cc93e2091fd2053f05a50eda7840c13f45c6e2a2fbc0f9de4baefb7b40ea1fb7e9d30fb1fdb8f20eafca0c7c8c61c57dfcb8e2836e8d0ce546e8e37b9fc467e1bbeab314be171573398e0c2fb032049a99acf174a857c019609e83010dda8da078a4311efcaaff62fa908dde87cec4d41078c343eec5a80c42d0146d57e9a14f2b5611be05e3b665728c14ea9536d146926fe1e8d5acf12afca415ef5ad77bdfead7ea087183962592296d3d892c64a0a3b9fc95b50f03df7f4f50f950b43a289af09ca92a01a684e5c649b8da4a3365878273a00afd14b4fa2ddaeea5007f728899ba9f5fc9d1d7893a489e56c5fb152e5f775042f4b3bab6cea9cbf9a2b91647fe3c62d3ae4b5d065460b51d51b6e91f2f4fe90a3775e6312ffc805612fee8c314ee70c92de3feefb3cda56a59ddba83757b0e85cb0ee7ad1ac608a1e6a64656d9f586afc38fd1f6474b521724532d88cd351688db077dc9d229a78f8704b21f85324bf9c697874cac5f709c6701a421ac368edda0ec3a0b90268c449acf753d7e8cab501ae3d7e04788e899ec54a2517545b68fd928fb659349e1692bdeccca648fd13a7602868c44e77ed6fd587538a74adc6acdb1ebd1816af88ece2ca64f2603428a0aa842fe86be6b2b568fd29c23433c9e3f9f0e45bd13beb22ac06eb82ae0eb2b3b328aca4abba5e72a155e2cc82ac92c4697fdb9439511c1144fe2ba36f516fa181f7f8d58af69f87a6c936d1e561fff0509819e65a681aaea445a106f8ff3dfd987e2e24e977281cb85cc5e5eb987da2d17e73dacfd9880bd14ecad13d5705643f926303b389a61fd63139577de263a5fdef1facdac0068a9471fc17ac654e88e0a0d12c8aca1e850b64a88f2382e0cf3a4e3363827a06abc1eeb87216e3447dfbf8c04080ca2fe1a08cc2e2001eb386cf02ac0d3b328bcf1de009d048a03cd955c628971c30a137dc66879cbe938390a8f63251f55e559549dd11969b637876a20bc7c6f5fe2b753923d2f0269f2082206eb2312f40654cc95bb38add159104495018a5aa7b8f5836162de9a03b6981c662f2ee02a168d530a002616c09c4cc26c2a2726711e3e25b4e3acb6dcba25fde78ecede51f01e22a2f79409c77011a599ff57d81e70dbde5fcbdc841f9af0e49e8200cd2d3c73013e0e5608ee1951ac04a111864b545e7bc2434c2474286519feaff4da07324d1b13bb16d1daa1d485bcd5466b82c9622f92664f1153d08c6e644b3d0f5902b4d749895f7763015bf0e2849703ed920a3866a260f22fe40f46c76ca6ca10ae8994505fa613a6b1aec84ee6620c25ca4d002f56ddd21b12eed5132634a3194281283fe5fdac07d2fec091dc0f748fe25c6b08cf8d4ff893e863a43c4c92fba47d86c8dfbbabbdca0cec09f732bc0b8df2a97ee7208e64512249300aa4c44c10d4c4503bd76e7b4e2c9aa2e274166ef103d5c832a760f33b5a0eae4dab922f0fec5adbf409bff956b4ce40e6157d498d46ae053f1ad73655bfb0a3dfac6b96c09bac4d07e6bd7f3ac6337f58cccc631466985f6ad680d21a5fe9a9bde4b6980c689e6e8c7a413b6e3084997c089443ffaca9be80c96ce1d9b6de074b4aecfd2db3b679a2d5cf0523aa14414699d481eace4aa397d818ff4d3e73d82031849c7e4f1f1503b636728637f87cf7a7df5472abfcb7e5d77439e1018dba49a41e1c8e63942fe0d1a426f390e8e225fee14501a34762b8d835ca14d6a3a3d8042724ea9e6b568fe0eb84306397ffa8345935e9be8642e6ffbd96e636fd16cacae5d4b88fd0aa0bfbba8221f68eabc98c67de6f9eab2cca07b096b458bbfdc7f1da0bb845a1a6e19c6da87a958acb1aad0b74d6537e97fb0673a20178cbb963f909839e49ec593ddcfc3046aa54c22e3a54148c440d1f2ba1fa7417572c629e48e6d2e07760a87581971d1edccc03c0e465d4d6321d820b3346fb516c1813585a6a8462124f91428a90ed037f40cd6f23596dc90c03825636e55a061838964213c70104ec0c5909a0c62240e93314f9b67ce8fafa115251282a6ee7a036a861d1af11919dbfa7ceb7b2260e66be6300a536e78ebdf60a6f022574b35205341f3557e409d8ecc0c2304b372605c9284aebe1b92f13051db78210df83873b0496625507cf8e1ee5e90aa66f45be75e388d6e0a021b8af3787ee06cd710719b4d06ca5ba5f87de812a660f939584ea880d3c71bc58135e612431850180ee39b707bd98aff26d2c5e4396b43daefd82b2ec1004978637b8d389cc415d628fea6f66f28664f9409448e68a2d48a0a00", 0x2000, &(0x7f0000000f40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540)={0x90, 0x0, 0x7, {0x5, 0x4, 0xdc, 0x8, 0x3, 0x1, {0x6, 0x634, 0xfffffffffffffff8, 0x8, 0x3, 0x79, 0xfffffffe, 0x8000000a, 0x1, 0xc000, 0x4, r2, r3, 0x7, 0x5}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r0, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x90, 0x0, 0xffffffffffffffff, {0x5, 0x4, 0x0, 0x7fffffff, 0xfffffffd, 0x6, {0x2, 0x8000000000000000, 0x8, 0x100000000000, 0x2000000000000db4, 0x85, 0x8, 0x6, 0x200c, 0xa000, 0xe44, r2, r3, 0x40fe, 0x81}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="1584fa6b9d"], &(0x7f0000000340)=""/142, 0x1a, 0x8e, 0x1}, 0x28) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0/file1\x00', 0x880cc2, 0x20) 1.446280453s ago: executing program 0 (id=2070): mkdirat(0xffffffffffffff9c, &(0x7f0000000500)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x9, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') openat(0xffffffffffffff9c, 0x0, 0x40042, 0x1) 1.424646163s ago: executing program 4 (id=2071): mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys\x00', 0x1ab) mount(0x0, 0x0, &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/fcloop/ctl/del_target_port\x00', 0x1, 0x0) write(r0, &(0x7f0000000600)='wwnn=0', 0x6) 1.397876064s ago: executing program 2 (id=2072): openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0x44) fanotify_init(0x2, 0x1000) syz_mount_image$fuse(0x0, 0x0, 0x1860, 0x0, 0x1, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) r1 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0x82000, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000000100)={0x20004, r0, 0x2}) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = getpid() syz_pidfd_open(r2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES16=r4, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r5, @ANYBLOB="1f003300d00000000802110000010802110000005050505050500000", @ANYRES8=r3], 0x3c}, 0x1, 0x0, 0x0, 0xc881}, 0x10) 1.166519946s ago: executing program 4 (id=2073): r0 = socket(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e21, 0x10000002, @ipv4={'\x00', '\xff\xff', @empty}, 0x800100}, 0x1c) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newneigh={0x2c, 0x1c, 0x605, 0x0, 0x0, {0x1c, 0x0, 0x0, 0x1, 0x80}, [@NDA_DST_IPV4={0x8, 0x1, @rand_addr=0x64010101}, @NDA_FLAGS_EXT={0x8, 0xf, 0x1}]}, 0x2c}}, 0x0) 1.120032848s ago: executing program 0 (id=2074): socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00', 0x0}) r2 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000001300a7cc4a372eaf541d0020070000", @ANYRES32=r1, @ANYBLOB="00000000100000001c001a80", @ANYRES16=r2, @ANYRES32=r2], 0x44}}, 0x2040800) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008804}, 0x20040040) 1.112269058s ago: executing program 2 (id=2075): syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xd, 0x8, &(0x7f0000001340)=ANY=[@ANYBLOB="beaa00000000000079a008000000000018070000", @ANYRES32, @ANYBLOB="0000000000000000bf030000000000008500000047000000b70000000000000095"], &(0x7f0000000480)='syzkaller\x00', 0xe, 0x0, 0x0, 0x41000}, 0x94) r1 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r1, 0xc01064bd, &(0x7f0000000080)={0xffffffffffffffff, 0x60}) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) setsockopt$RXRPC_SECURITY_KEY(0xffffffffffffffff, 0x110, 0x1, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount$bind(&(0x7f0000000100)='./file0\x00', &(0x7f00000000c0)='./file0\x00', &(0x7f0000000280), 0x1800807, 0x0) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) ptrace$getregset(0x4205, r4, 0x402, &(0x7f0000000240)={&(0x7f0000000180)=""/108, 0x12}) r5 = fsopen(&(0x7f00000001c0)='binder\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) 912.832677ms ago: executing program 4 (id=2076): sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000001c0)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000001400000008000200fc00000018000180140002006e65"], 0x5c}, 0x1, 0x0, 0x0, 0x40800}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8890}, 0x20004450) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="38000000070a010100000006000000000a0040010900010073797a3100"], 0x38}, 0x1, 0x0, 0x0, 0x20040850}, 0x44054) 792.370243ms ago: executing program 0 (id=2077): sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}], [], 0x2f}) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000180)='map_files\x00') getdents64(r3, &(0x7f0000001e80)=""/4118, 0x1016) 788.134833ms ago: executing program 3 (id=2078): r0 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r0, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24) listen(r0, 0x5) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x18, 0x110, 0x1, "12"}, {0x10, 0x110, 0xe}], 0x28}, 0x0) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[], 0x28}, 0x0) 9.01249ms ago: executing program 2 (id=2079): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0x70, 0x30, 0x9, 0x0, 0x0, {}, [{0x5c, 0x1, [@m_bpf={0x58, 0x1, 0x0, 0x0, {{0x8}, {0x30, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x7}, @TCA_ACT_BPF_OPS={0xc, 0x4, [{}]}, @TCA_ACT_BPF_PARMS={0x18}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x70}}, 0x0) pipe2(&(0x7f0000000040), 0x800) syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0xc3b1, 0x800, 0x1, 0x82, 0x0, 0x0}, &(0x7f0000000180), &(0x7f0000000140), &(0x7f0000000100)) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/block/md0/md/resync_start\x00', 0x1, 0x0) write(r0, &(0x7f0000000540)='none\n', 0x5) 0s ago: executing program 8 (id=2080): ioctl$FBIOPUT_VSCREENINFO(0xffffffffffffffff, 0x4601, &(0x7f0000000100)={0x400, 0x300, 0x550, 0x40, 0x100, 0x0, 0x4, 0x2, {0x0, 0x9}, {0x350, 0x20002, 0xffffffff}, {0xf4ef, 0x300}, {0x4, 0x4000002, 0x7fe}, 0x1, 0x100, 0x0, 0xd614, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}) kernel console output (not intermixed with test programs): (1700000469.790:56): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11544 comm="syz.4.1676" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f500879e159 code=0x7ffc0000 [ 714.636674][ T27] audit: type=1326 audit(1700000469.790:57): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11544 comm="syz.4.1676" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f500879e159 code=0x7ffc0000 [ 714.734345][ T27] audit: type=1326 audit(1700000469.790:58): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11544 comm="syz.4.1676" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f500879e159 code=0x7ffc0000 [ 714.787401][T11555] FAULT_INJECTION: forcing a failure. [ 714.787401][T11555] name fail_futex, interval 1, probability 0, space 0, times 0 [ 714.814074][ T27] audit: type=1326 audit(1700000469.790:59): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11544 comm="syz.4.1676" exe="/root/ci2-linux-6-1-kasan/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f500879e159 code=0x7ffc0000 [ 714.868284][ T4274] Bluetooth: hci0: command 0x041b tx timeout [ 714.881055][T11555] CPU: 1 PID: 11555 Comm: syz.8.1679 Not tainted syzkaller #0 [ 714.888695][T11555] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 714.898906][T11555] Call Trace: [ 714.902218][T11555] [ 714.905266][T11555] dump_stack_lvl+0x188/0x24e [ 714.909993][T11555] ? show_regs_print_info+0x12/0x12 [ 714.915243][T11555] ? load_image+0x410/0x410 [ 714.919804][T11555] ? mark_lock+0x94/0x320 [ 714.924184][T11555] should_fail_ex+0x390/0x4c0 [ 714.928913][T11555] get_futex_key+0x1b1/0x1000 [ 714.933625][T11555] ? futex_setup_timer+0xc0/0xc0 [ 714.938599][T11555] ? verify_lock_unused+0x140/0x140 [ 714.943862][T11555] futex_wake+0x123/0x4f0 [ 714.948244][T11555] ? futex_wake_mark+0x150/0x150 [ 714.953259][T11555] do_futex+0x2e2/0x320 [ 714.957454][T11555] ? __ia32_sys_get_robust_list+0x100/0x100 [ 714.963395][T11555] __se_sys_futex+0x381/0x410 [ 714.968119][T11555] ? __x64_sys_futex+0xf0/0xf0 [ 714.972934][T11555] ? __x64_sys_futex+0x1d/0xf0 [ 714.977738][T11555] do_syscall_64+0x4c/0xa0 [ 714.982213][T11555] ? clear_bhb_loop+0x60/0xb0 [ 714.986936][T11555] ? clear_bhb_loop+0x60/0xb0 [ 714.991653][T11555] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 714.997590][T11555] RIP: 0033:0x7fe942d9e159 [ 715.002048][T11555] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 715.021697][T11555] RSP: 002b:00007fe943d230e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 715.030151][T11555] RAX: ffffffffffffffda RBX: 00007fe943025fa8 RCX: 00007fe942d9e159 [ 715.038163][T11555] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe943025fac [ 715.046181][T11555] RBP: 00007fe943025fa0 R08: 002df9af6c0130c9 R09: 0000000000000000 [ 715.054208][T11555] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 715.062231][T11555] R13: 00007fe943026038 R14: 00007fffabc9aba0 R15: 00007fffabc9ac88 [ 715.070264][T11555] [ 715.228891][T11532] bond1 (unregistering): (slave gretap1): Releasing active interface [ 715.260677][T11532] bond1 (unregistering): Released all slaves [ 715.302675][T11492] bridge0: port 2(bridge_slave_1) entered blocking state [ 715.318487][T11492] bridge0: port 2(bridge_slave_1) entered disabled state [ 715.335920][T11492] device bridge_slave_1 entered promiscuous mode [ 715.394445][T11554] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1680'. [ 715.424458][T11560] loop8: detected capacity change from 0 to 512 [ 715.478948][T11560] EXT4-fs (loop8): feature flags set on rev 0 fs, running e2fsck is recommended [ 715.517206][T11492] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 715.534398][T11560] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=42c018, mo2=0002] [ 715.559390][T11560] EXT4-fs (loop8): orphan cleanup on readonly fs [ 715.567870][T11492] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 715.610754][T11560] EXT4-fs error (device loop8): ext4_mb_mark_diskspace_used:3861: comm syz.8.1681: Allocating blocks 41-42 which overlap fs metadata [ 715.639894][ T4289] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 715.651028][ T4289] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 715.659095][ T4289] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 715.667631][ T4289] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 715.675452][ T4289] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 715.682772][ T4289] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 715.725242][T11560] Quota error (device loop8): write_blk: dquota write failed [ 715.732847][T11560] EXT4-fs error (device loop8): ext4_acquire_dquot:6841: comm syz.8.1681: Failed to acquire dquot type 0 [ 715.815953][T11560] EXT4-fs error (device loop8): mb_free_blocks:1839: group 0, inode 12: block 14:freeing already freed block (bit 14); block bitmap corrupt. [ 715.878260][T11560] EXT4-fs error (device loop8): ext4_do_update_inode:5279: inode #12: comm syz.8.1681: corrupted inode contents [ 715.897629][T11560] EXT4-fs error (device loop8): ext4_dirty_inode:6166: inode #12: comm syz.8.1681: mark_inode_dirty error [ 715.939738][T11560] EXT4-fs error (device loop8): ext4_do_update_inode:5279: inode #12: comm syz.8.1681: corrupted inode contents [ 715.968829][T11560] EXT4-fs error (device loop8): __ext4_ext_dirty:202: inode #12: comm syz.8.1681: mark_inode_dirty error [ 716.010962][T11560] EXT4-fs error (device loop8): ext4_do_update_inode:5279: inode #12: comm syz.8.1681: corrupted inode contents [ 716.036787][T11560] EXT4-fs error (device loop8) in ext4_orphan_del:303: Corrupt filesystem [ 716.063157][T11492] team0: Port device team_slave_0 added [ 716.217086][T11570] device syzkaller0 entered promiscuous mode [ 716.253200][T11560] EXT4-fs error (device loop8): ext4_do_update_inode:5279: inode #12: comm syz.8.1681: corrupted inode contents [ 716.291600][T11560] EXT4-fs error (device loop8): ext4_truncate:4325: inode #12: comm syz.8.1681: mark_inode_dirty error [ 716.435123][T11492] team0: Port device team_slave_1 added [ 716.450418][T11560] EXT4-fs error (device loop8) in ext4_process_orphan:345: Corrupt filesystem [ 716.582421][T11560] EXT4-fs (loop8): 1 truncate cleaned up [ 716.711357][T11560] EXT4-fs (loop8): pa ffff888054a7f380: logic 1, phys. 41, len 23 [ 716.719732][T11560] EXT4-fs error (device loop8): ext4_mb_release_inode_pa:4894: group 0, free 22, pa_free 23 [ 716.941680][ T4289] Bluetooth: hci0: command 0x040f tx timeout [ 716.964499][T11560] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: writeback. [ 717.032536][T11492] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 717.084990][T11492] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 717.123962][T11492] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 717.164632][T11492] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 717.252766][T11492] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 717.377014][T11492] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 717.739011][ T4289] Bluetooth: hci2: command 0x0409 tx timeout [ 718.049125][T10795] EXT4-fs (loop8): unmounting filesystem. [ 718.353328][T11594] FAULT_INJECTION: forcing a failure. [ 718.353328][T11594] name fail_futex, interval 1, probability 0, space 0, times 0 [ 718.438242][T11595] loop2: detected capacity change from 0 to 256 [ 718.453087][T11594] CPU: 1 PID: 11594 Comm: syz.4.1689 Not tainted syzkaller #0 [ 718.460617][T11594] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 718.470703][T11594] Call Trace: [ 718.474020][T11594] [ 718.476995][T11594] dump_stack_lvl+0x188/0x24e [ 718.481713][T11594] ? show_regs_print_info+0x12/0x12 [ 718.486959][T11594] ? load_image+0x410/0x410 [ 718.491525][T11594] ? mark_lock+0x94/0x320 [ 718.495993][T11594] should_fail_ex+0x390/0x4c0 [ 718.500757][T11594] get_futex_key+0x1b1/0x1000 [ 718.505482][T11594] ? futex_setup_timer+0xc0/0xc0 [ 718.510464][T11594] ? verify_lock_unused+0x140/0x140 [ 718.515741][T11594] futex_wake+0x123/0x4f0 [ 718.520117][T11594] ? futex_wake_mark+0x150/0x150 [ 718.525111][T11594] do_futex+0x2e2/0x320 [ 718.529344][T11594] ? __ia32_sys_get_robust_list+0x100/0x100 [ 718.535298][T11594] __se_sys_futex+0x381/0x410 [ 718.540042][T11594] ? __x64_sys_futex+0xf0/0xf0 [ 718.544838][T11594] ? __x64_sys_futex+0x1d/0xf0 [ 718.549638][T11594] do_syscall_64+0x4c/0xa0 [ 718.554087][T11594] ? clear_bhb_loop+0x60/0xb0 [ 718.558804][T11594] ? clear_bhb_loop+0x60/0xb0 [ 718.563520][T11594] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 718.569460][T11594] RIP: 0033:0x7f500879e159 [ 718.573941][T11594] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 718.593587][T11594] RSP: 002b:00007f50095a70e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 718.602035][T11594] RAX: ffffffffffffffda RBX: 00007f5008a25fa8 RCX: 00007f500879e159 [ 718.610048][T11594] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f5008a25fac [ 718.618056][T11594] RBP: 00007f5008a25fa0 R08: 00145be4adc4afc4 R09: 0000000000000000 [ 718.626080][T11594] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 718.634107][T11594] R13: 00007f5008a26038 R14: 00007fff93137ab0 R15: 00007fff93137b98 [ 718.642151][T11594] [ 719.027944][ T4289] Bluetooth: hci0: command 0x0419 tx timeout [ 719.249728][T11492] device hsr_slave_0 entered promiscuous mode [ 719.380523][T11492] device hsr_slave_1 entered promiscuous mode [ 719.400311][T11492] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 719.461104][T11492] Cannot create hsr debugfs directory [ 719.502447][T11603] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1691'. [ 720.454866][ T4274] Bluetooth: hci2: command 0x041b tx timeout [ 721.555948][T10322] device hsr_slave_0 left promiscuous mode [ 721.619920][T10322] device hsr_slave_1 left promiscuous mode [ 721.684377][T10322] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 721.733961][T10322] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 721.762597][T10322] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 721.797839][T10322] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 721.845789][T11634] loop4: detected capacity change from 0 to 512 [ 721.853322][T10322] device bridge_slave_0 left promiscuous mode [ 721.868192][T10322] bridge0: port 1(bridge_slave_0) entered disabled state [ 721.987967][T11634] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 721.999117][T10322] device veth1_macvtap left promiscuous mode [ 722.005287][T10322] device veth1_vlan left promiscuous mode [ 722.041869][T10322] device veth0_vlan left promiscuous mode [ 722.217031][T10423] EXT4-fs (loop4): unmounting filesystem. [ 722.253336][T11642] loop2: detected capacity change from 0 to 2048 [ 722.356874][T11644] FAULT_INJECTION: forcing a failure. [ 722.356874][T11644] name fail_futex, interval 1, probability 0, space 0, times 0 [ 722.392007][T11644] CPU: 1 PID: 11644 Comm: syz.4.1699 Not tainted syzkaller #0 [ 722.399576][T11644] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 722.409677][T11644] Call Trace: [ 722.413004][T11644] [ 722.415974][T11644] dump_stack_lvl+0x188/0x24e [ 722.420714][T11644] ? release_firmware_map_entry+0x187/0x187 [ 722.426680][T11644] ? show_regs_print_info+0x12/0x12 [ 722.431929][T11644] ? load_image+0x410/0x410 [ 722.436493][T11644] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 722.442536][T11644] ? mark_lock+0x94/0x320 [ 722.446926][T11644] should_fail_ex+0x390/0x4c0 [ 722.451680][T11644] get_futex_key+0x1b1/0x1000 [ 722.456414][T11644] ? try_to_wake_up+0x6c1/0x10b0 [ 722.461402][T11644] ? futex_setup_timer+0xc0/0xc0 [ 722.466379][T11644] ? verify_lock_unused+0x140/0x140 [ 722.471648][T11644] futex_wake+0x123/0x4f0 [ 722.476051][T11644] ? futex_wake_mark+0x150/0x150 [ 722.481061][T11644] do_futex+0x2e2/0x320 [ 722.485258][T11644] ? __ia32_sys_get_robust_list+0x100/0x100 [ 722.491208][T11644] __se_sys_futex+0x381/0x410 [ 722.495959][T11644] ? __x64_sys_futex+0xf0/0xf0 [ 722.500771][T11644] ? __x64_sys_futex+0x1d/0xf0 [ 722.505580][T11644] do_syscall_64+0x4c/0xa0 [ 722.510050][T11644] ? clear_bhb_loop+0x60/0xb0 [ 722.514786][T11644] ? clear_bhb_loop+0x60/0xb0 [ 722.519511][T11644] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 722.525470][T11644] RIP: 0033:0x7f500879e159 [ 722.529935][T11644] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 722.549640][T11644] RSP: 002b:00007f50095a70e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 722.558121][T11644] RAX: ffffffffffffffda RBX: 00007f5008a25fa8 RCX: 00007f500879e159 [ 722.566141][T11644] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f5008a25fac [ 722.574161][T11644] RBP: 00007f5008a25fa0 R08: 00145fccf840f4d1 R09: 0000000000000000 [ 722.582184][T11644] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 722.590212][T11644] R13: 00007f5008a26038 R14: 00007fff93137ab0 R15: 00007fff93137b98 [ 722.598260][T11644] [ 722.606618][ T4274] Bluetooth: hci2: command 0x040f tx timeout [ 723.357320][T10322] team0 (unregistering): Port device team_slave_1 removed [ 723.410938][T10322] team0 (unregistering): Port device team_slave_0 removed [ 723.473005][T10322] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 723.546860][T10322] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 723.966218][T10322] bond0 (unregistering): Released all slaves [ 724.436962][T11563] chnl_net:caif_netlink_parms(): no params data found [ 724.623613][ T4274] Bluetooth: hci2: command 0x0419 tx timeout [ 725.411343][T11563] bridge0: port 1(bridge_slave_0) entered blocking state [ 725.465646][T11563] bridge0: port 1(bridge_slave_0) entered disabled state [ 725.513447][T11563] device bridge_slave_0 entered promiscuous mode [ 725.581726][T11563] bridge0: port 2(bridge_slave_1) entered blocking state [ 725.597575][T11563] bridge0: port 2(bridge_slave_1) entered disabled state [ 725.626718][T11563] device bridge_slave_1 entered promiscuous mode [ 725.735199][T11667] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1703'. [ 725.779239][T11563] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 725.855333][T11563] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 726.050162][T11563] team0: Port device team_slave_0 added [ 726.100681][T11563] team0: Port device team_slave_1 added [ 726.196984][T11563] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 726.212892][T11563] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 726.287162][T11563] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 726.352884][T11563] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 726.363366][T11563] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 726.477511][T11563] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 726.747025][ T4338] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 726.848024][T11492] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 726.860587][T11685] loop8: detected capacity change from 0 to 256 [ 726.870864][T11492] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 726.918166][T11563] device hsr_slave_0 entered promiscuous mode [ 726.943193][T11563] device hsr_slave_1 entered promiscuous mode [ 726.979825][T11563] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 726.998921][T11563] Cannot create hsr debugfs directory [ 727.004886][T11492] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 727.126287][ T4338] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 727.218955][T11492] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 727.349674][ T4338] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 727.368337][T11691] FAULT_INJECTION: forcing a failure. [ 727.368337][T11691] name fail_futex, interval 1, probability 0, space 0, times 0 [ 727.412297][T11691] CPU: 0 PID: 11691 Comm: syz.8.1708 Not tainted syzkaller #0 [ 727.419844][T11691] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 727.430026][T11691] Call Trace: [ 727.433348][T11691] [ 727.436336][T11691] dump_stack_lvl+0x188/0x24e [ 727.441070][T11691] ? show_regs_print_info+0x12/0x12 [ 727.446410][T11691] ? load_image+0x410/0x410 [ 727.450983][T11691] ? mark_lock+0x94/0x320 [ 727.455393][T11691] should_fail_ex+0x390/0x4c0 [ 727.460123][T11691] get_futex_key+0x1b1/0x1000 [ 727.464853][T11691] ? futex_setup_timer+0xc0/0xc0 [ 727.469836][T11691] ? verify_lock_unused+0x140/0x140 [ 727.475101][T11691] futex_wake+0x123/0x4f0 [ 727.479483][T11691] ? futex_wake_mark+0x150/0x150 [ 727.484475][T11691] do_futex+0x2e2/0x320 [ 727.488692][T11691] ? __ia32_sys_get_robust_list+0x100/0x100 [ 727.494639][T11691] __se_sys_futex+0x381/0x410 [ 727.499354][T11691] ? __x64_sys_futex+0xf0/0xf0 [ 727.504176][T11691] ? __x64_sys_futex+0x1d/0xf0 [ 727.508981][T11691] do_syscall_64+0x4c/0xa0 [ 727.513450][T11691] ? clear_bhb_loop+0x60/0xb0 [ 727.518164][T11691] ? clear_bhb_loop+0x60/0xb0 [ 727.522900][T11691] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 727.528863][T11691] RIP: 0033:0x7fe942d9e159 [ 727.533317][T11691] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 727.553058][T11691] RSP: 002b:00007fe943d230e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 727.561524][T11691] RAX: ffffffffffffffda RBX: 00007fe943025fa8 RCX: 00007fe942d9e159 [ 727.569544][T11691] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe943025fac [ 727.577559][T11691] RBP: 00007fe943025fa0 R08: 001595e1554789ed R09: 0000000000000000 [ 727.585578][T11691] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 727.593602][T11691] R13: 00007fe943026038 R14: 00007fffabc9aba0 R15: 00007fffabc9ac88 [ 727.601652][T11691] [ 728.003952][T11492] 8021q: adding VLAN 0 to HW filter on device bond0 [ 728.257628][T11492] 8021q: adding VLAN 0 to HW filter on device team0 [ 728.280419][ T5591] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 728.294634][ T5591] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 728.488214][T10322] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 728.498834][T10322] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 728.518285][T10322] bridge0: port 1(bridge_slave_0) entered blocking state [ 728.525459][T10322] bridge0: port 1(bridge_slave_0) entered forwarding state [ 728.544255][ T4289] Bluetooth: hci5: command 0x0406 tx timeout [ 728.978318][T10322] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 728.996772][T10322] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 729.378653][T10322] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 729.622855][T10322] bridge0: port 2(bridge_slave_1) entered blocking state [ 729.630194][T10322] bridge0: port 2(bridge_slave_1) entered forwarding state [ 730.031630][T11724] loop8: detected capacity change from 0 to 256 [ 730.119903][T10322] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 730.145081][T10322] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 730.184443][T10322] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 730.209869][T11719] loop2: detected capacity change from 0 to 8192 [ 730.228658][T10322] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 730.258164][T10322] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 730.293985][T11718] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1714'. [ 730.410892][T11727] FAULT_INJECTION: forcing a failure. [ 730.410892][T11727] name fail_futex, interval 1, probability 0, space 0, times 0 [ 730.482976][T11727] CPU: 1 PID: 11727 Comm: syz.8.1717 Not tainted syzkaller #0 [ 730.490589][T11727] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 730.500681][T11727] Call Trace: [ 730.504000][T11727] [ 730.506959][T11727] dump_stack_lvl+0x188/0x24e [ 730.511680][T11727] ? show_regs_print_info+0x12/0x12 [ 730.516942][T11727] ? load_image+0x410/0x410 [ 730.521488][T11727] ? mark_lock+0x94/0x320 [ 730.525878][T11727] should_fail_ex+0x390/0x4c0 [ 730.530624][T11727] get_futex_key+0x1b1/0x1000 [ 730.535342][T11727] ? futex_setup_timer+0xc0/0xc0 [ 730.540330][T11727] ? verify_lock_unused+0x140/0x140 [ 730.545587][T11727] futex_wake+0x123/0x4f0 [ 730.549984][T11727] ? futex_wake_mark+0x150/0x150 [ 730.554976][T11727] do_futex+0x2e2/0x320 [ 730.559176][T11727] ? __ia32_sys_get_robust_list+0x100/0x100 [ 730.565105][T11727] __se_sys_futex+0x381/0x410 [ 730.569825][T11727] ? __x64_sys_futex+0xf0/0xf0 [ 730.574612][T11727] ? __x64_sys_futex+0x1d/0xf0 [ 730.579399][T11727] do_syscall_64+0x4c/0xa0 [ 730.583845][T11727] ? clear_bhb_loop+0x60/0xb0 [ 730.588564][T11727] ? clear_bhb_loop+0x60/0xb0 [ 730.593272][T11727] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 730.599197][T11727] RIP: 0033:0x7fe942d9e159 [ 730.603650][T11727] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 730.623294][T11727] RSP: 002b:00007fe943d230e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 730.631754][T11727] RAX: ffffffffffffffda RBX: 00007fe943025fa8 RCX: 00007fe942d9e159 [ 730.639743][T11727] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe943025fac [ 730.647746][T11727] RBP: 00007fe943025fa0 R08: 0017fb338d0dd599 R09: 0000000000000000 [ 730.655734][T11727] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 730.663740][T11727] R13: 00007fe943026038 R14: 00007fffabc9aba0 R15: 00007fffabc9ac88 [ 730.671747][T11727] [ 730.732950][T11728] syz.2.1715: attempt to access beyond end of device [ 730.732950][T11728] loop2: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 730.746629][T11728] Buffer I/O error on dev loop2, logical block 57847, async page read [ 730.755627][T11728] syz.2.1715: attempt to access beyond end of device [ 730.755627][T11728] loop2: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 730.769212][T11728] Buffer I/O error on dev loop2, logical block 57847, async page read [ 730.778899][ T27] kauditd_printk_skb: 1 callbacks suppressed [ 730.778987][ T27] audit: type=1800 audit(1700000486.451:60): pid=11728 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.1715" name="file2" dev="loop2" ino=1048797 res=0 errno=0 [ 730.805765][T11728] syz.2.1715: attempt to access beyond end of device [ 730.805765][T11728] loop2: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 730.820468][T11728] Buffer I/O error on dev loop2, logical block 57847, async page read [ 730.829580][T11728] syz.2.1715: attempt to access beyond end of device [ 730.829580][T11728] loop2: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 730.843066][T11728] Buffer I/O error on dev loop2, logical block 57847, async page read [ 730.879773][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 730.906427][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 730.941586][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 730.956452][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 731.020939][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 731.045518][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 731.415244][T11492] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 732.541921][T11754] loop8: detected capacity change from 0 to 512 [ 732.573670][T11563] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 732.631529][T11754] EXT4-fs error (device loop8): ext4_orphan_get:1409: inode #15: comm syz.8.1724: inode has both inline data and extents flags [ 732.679353][T11754] EXT4-fs error (device loop8): ext4_orphan_get:1414: comm syz.8.1724: couldn't read orphan inode 15 (err -117) [ 732.726005][T11563] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 732.729958][T11754] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: none. [ 732.760261][T11563] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 733.854294][T11770] netlink: 16 bytes leftover after parsing attributes in process `syz.8.1724'. [ 733.869269][T11563] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 733.897960][T11767] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1726'. [ 734.133349][T11492] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 734.172459][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 734.201290][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 734.237020][T11778] FAULT_INJECTION: forcing a failure. [ 734.237020][T11778] name fail_futex, interval 1, probability 0, space 0, times 0 [ 734.257118][T11778] CPU: 1 PID: 11778 Comm: syz.2.1727 Not tainted syzkaller #0 [ 734.264643][T11778] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 734.274739][T11778] Call Trace: [ 734.278063][T11778] [ 734.281028][T11778] dump_stack_lvl+0x188/0x24e [ 734.285748][T11778] ? show_regs_print_info+0x12/0x12 [ 734.290997][T11778] ? load_image+0x410/0x410 [ 734.295573][T11778] ? mark_lock+0x94/0x320 [ 734.299963][T11778] should_fail_ex+0x390/0x4c0 [ 734.304700][T11778] get_futex_key+0x1b1/0x1000 [ 734.309433][T11778] ? futex_setup_timer+0xc0/0xc0 [ 734.314418][T11778] ? verify_lock_unused+0x140/0x140 [ 734.319680][T11778] futex_wake+0x123/0x4f0 [ 734.324063][T11778] ? futex_wake_mark+0x150/0x150 [ 734.329039][T11778] do_futex+0x2e2/0x320 [ 734.333226][T11778] ? __ia32_sys_get_robust_list+0x100/0x100 [ 734.339142][T11778] __se_sys_futex+0x381/0x410 [ 734.343848][T11778] ? __x64_sys_futex+0xf0/0xf0 [ 734.348643][T11778] ? __x64_sys_futex+0x1d/0xf0 [ 734.353438][T11778] do_syscall_64+0x4c/0xa0 [ 734.357877][T11778] ? clear_bhb_loop+0x60/0xb0 [ 734.362577][T11778] ? clear_bhb_loop+0x60/0xb0 [ 734.367277][T11778] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 734.373242][T11778] RIP: 0033:0x7f3716d9e159 [ 734.377683][T11778] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 734.397314][T11778] RSP: 002b:00007f3717d480e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 734.405854][T11778] RAX: ffffffffffffffda RBX: 00007f3717025fa8 RCX: 00007f3716d9e159 [ 734.413859][T11778] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f3717025fac [ 734.421860][T11778] RBP: 00007f3717025fa0 R08: 000ddcf2d467b5cf R09: 0000000000000000 [ 734.429873][T11778] R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 [ 734.437865][T11778] R13: 00007f3717026038 R14: 00007ffd472a5a10 R15: 00007ffd472a5af8 [ 734.445871][T11778] [ 735.161547][T11563] 8021q: adding VLAN 0 to HW filter on device bond0 [ 735.272070][ T4338] device hsr_slave_0 left promiscuous mode [ 735.288696][ T4338] device hsr_slave_1 left promiscuous mode [ 735.308214][ T4338] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 735.322608][ T4338] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 735.357748][ T4338] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 735.365340][ T4338] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 735.397950][ T4338] device bridge_slave_1 left promiscuous mode [ 735.404255][ T4338] bridge0: port 2(bridge_slave_1) entered disabled state [ 735.434240][ T4338] device bridge_slave_0 left promiscuous mode [ 735.450522][ T4338] bridge0: port 1(bridge_slave_0) entered disabled state [ 735.537414][ T4338] device veth1_macvtap left promiscuous mode [ 735.543580][ T4338] device veth1_vlan left promiscuous mode [ 735.560231][ T4338] device veth0_vlan left promiscuous mode [ 735.974390][T10795] EXT4-fs (loop8): unmounting filesystem. [ 737.507549][ T4338] team0 (unregistering): Port device team_slave_1 removed [ 737.603244][ T4338] team0 (unregistering): Port device team_slave_0 removed [ 737.701905][ T4338] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 737.760590][ T4338] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 738.327129][ T4338] bond0 (unregistering): Released all slaves [ 738.446513][T11563] 8021q: adding VLAN 0 to HW filter on device team0 [ 738.517191][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 738.537364][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 738.597258][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 738.618161][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 738.678311][ T4328] bridge0: port 1(bridge_slave_0) entered blocking state [ 738.685502][ T4328] bridge0: port 1(bridge_slave_0) entered forwarding state [ 738.761142][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 738.795338][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 738.847653][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 738.877272][ T4328] bridge0: port 2(bridge_slave_1) entered blocking state [ 738.884442][ T4328] bridge0: port 2(bridge_slave_1) entered forwarding state [ 738.929451][T11823] netlink: 32 bytes leftover after parsing attributes in process `syz.4.1736'. [ 738.960065][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 739.023859][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 739.059603][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 739.146913][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 739.186043][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 739.229130][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 739.244687][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 739.297174][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 739.306013][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 739.345268][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 739.374368][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 739.408664][T11563] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 739.438848][T11563] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 739.477219][T11492] device veth0_vlan entered promiscuous mode [ 739.511097][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 739.526347][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 739.568910][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 739.604031][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 739.651762][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 739.684379][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 739.733335][T11492] device veth1_vlan entered promiscuous mode [ 739.978666][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 740.025098][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 740.199129][T11492] device veth0_macvtap entered promiscuous mode [ 740.361497][T11492] device veth1_macvtap entered promiscuous mode [ 740.467122][T11492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 740.489599][T11492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 740.606426][T11492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 740.660566][T11492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 740.683405][T11492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 740.694648][T11492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 740.706724][T11492] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 740.720959][ T4338] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 740.729780][ T4338] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 740.738073][ T4338] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 740.776406][ T4338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 740.809101][T11492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 740.856642][T11492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 740.882529][T11492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 740.924974][T11492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 740.967123][T11492] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 740.989183][T11492] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 741.008609][T11492] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 741.038099][T11863] netlink: 32 bytes leftover after parsing attributes in process `syz.8.1746'. [ 741.076108][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 741.094233][ T4535] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 741.137279][T11492] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 741.157821][T11492] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 741.177471][T11492] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 741.186240][T11492] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 741.232290][T11868] device syzkaller0 entered promiscuous mode [ 741.294172][ T4338] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 741.314101][ T4338] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 741.463784][T11563] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 741.563925][ T4338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 741.597797][ T4338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 741.768535][ T4338] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 741.788263][ T4338] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 741.837429][ T4628] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 741.847628][ T4628] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 741.877392][ T4628] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 741.932220][T11563] device veth0_vlan entered promiscuous mode [ 741.940374][ T4628] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 741.998360][ T4628] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 742.119752][ T4535] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 742.152293][ T4535] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 742.170354][T11563] device veth1_vlan entered promiscuous mode [ 742.267012][ T5591] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 742.532755][T11887] netlink: 32 bytes leftover after parsing attributes in process `syz.8.1752'. [ 742.565423][ T5591] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 742.598125][ T5591] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 742.640076][T11563] device veth0_macvtap entered promiscuous mode [ 742.700389][T11563] device veth1_macvtap entered promiscuous mode [ 743.269961][ T4440] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 743.288956][ T4440] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 743.437135][T11563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 743.712233][T11563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 743.790625][T11563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 743.801176][T11563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 743.811101][T11563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 743.825784][T11563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 743.847186][T11563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 743.869904][T11563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 743.895767][T11563] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 743.906436][ T4289] Bluetooth: hci3: command 0x0406 tx timeout [ 743.950225][T11903] netlink: 32 bytes leftover after parsing attributes in process `syz.8.1756'. [ 743.966776][T11912] FAULT_INJECTION: forcing a failure. [ 743.966776][T11912] name failslab, interval 1, probability 0, space 0, times 0 [ 743.986865][T11912] CPU: 1 PID: 11912 Comm: syz.4.1758 Not tainted syzkaller #0 [ 743.994407][T11912] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 744.004498][T11912] Call Trace: [ 744.007861][T11912] [ 744.010846][T11912] dump_stack_lvl+0x188/0x24e [ 744.015584][T11912] ? show_regs_print_info+0x12/0x12 [ 744.020842][T11912] ? load_image+0x410/0x410 [ 744.025421][T11912] ? __might_sleep+0xd0/0xd0 [ 744.030097][T11912] ? __lock_acquire+0x7c40/0x7c40 [ 744.035180][T11912] ? __nla_validate_parse+0x1f67/0x2970 [ 744.040790][T11912] should_fail_ex+0x390/0x4c0 [ 744.045543][T11912] should_failslab+0x5/0x20 [ 744.050099][T11912] slab_pre_alloc_hook+0x59/0x300 [ 744.055183][T11912] kmem_cache_alloc_node+0x5a/0x310 [ 744.060432][T11912] ? __alloc_skb+0xf9/0x7d0 [ 744.064979][T11912] __alloc_skb+0xf9/0x7d0 [ 744.069352][T11912] ctrl_getfamily+0x3cd/0x5b0 [ 744.074149][T11912] ? nla_put_string+0x30/0x30 [ 744.078867][T11912] ? genl_family_rcv_msg_attrs_parse+0x1c6/0x290 [ 744.085247][T11912] genl_family_rcv_msg_doit+0x22f/0x350 [ 744.090913][T11912] ? genl_family_rcv_msg_dumpit+0x3c0/0x3c0 [ 744.096869][T11912] ? memcpy+0x3c/0x60 [ 744.100899][T11912] ? genl_get_cmd+0x4cf/0x8b0 [ 744.105604][ T4440] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 744.108081][ T4440] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 744.113605][T11912] genl_rcv_msg+0x601/0x790 [ 744.126271][T11912] ? genl_bind+0x360/0x360 [ 744.130739][T11912] ? nla_put_string+0x30/0x30 [ 744.135507][T11912] ? ctrl_getfamily+0x5b0/0x5b0 [ 744.140424][T11912] netlink_rcv_skb+0x1ef/0x440 [ 744.145237][T11912] ? genl_bind+0x360/0x360 [ 744.149741][T11912] ? netlink_ack+0x1160/0x1160 [ 744.154570][T11912] ? down_read+0x1a8/0x2d0 [ 744.159056][T11912] genl_rcv+0x24/0x40 [ 744.163077][T11912] netlink_unicast+0x7ad/0x920 [ 744.167923][T11912] netlink_sendmsg+0x8ad/0xbd0 [ 744.172739][T11912] ? netlink_getsockopt+0x550/0x550 [ 744.178018][T11912] ? apparmor_socket_sendmsg+0x8a/0x330 [ 744.183618][T11912] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 744.185070][T11563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 744.188931][T11912] ? security_socket_sendmsg+0x7c/0xa0 [ 744.188969][T11912] __sys_sendto+0x497/0x650 [ 744.188994][T11912] ? __ia32_sys_getpeername+0x80/0x80 [ 744.189039][T11912] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 744.220877][T11912] ? lock_chain_count+0x20/0x20 [ 744.225797][T11912] __x64_sys_sendto+0xda/0xf0 [ 744.230533][T11912] do_syscall_64+0x4c/0xa0 [ 744.235002][T11912] ? clear_bhb_loop+0x60/0xb0 [ 744.239749][T11912] ? clear_bhb_loop+0x60/0xb0 [ 744.244501][T11912] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 744.250443][T11912] RIP: 0033:0x7f500875e98e [ 744.254897][T11912] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 744.274536][T11912] RSP: 002b:00007f50095a5e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 744.282972][T11912] RAX: ffffffffffffffda RBX: 00007f50095a76c0 RCX: 00007f500875e98e [ 744.290959][T11912] RDX: 0000000000000020 RSI: 00007f50095a6000 RDI: 0000000000000005 [ 744.298954][T11912] RBP: 0000000000000000 R08: 00007f50095a5f04 R09: 000000000000000c [ 744.306953][T11912] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 744.314945][T11912] R13: 00007f50095a5f58 R14: 00007f50095a6000 R15: 0000000000000000 [ 744.322962][T11912] [ 744.326084][ C1] vkms_vblank_simulate: vblank timer overrun [ 744.353754][T11563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 744.404044][T11563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 744.470969][T11563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 744.514828][T11563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 744.555789][T11563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 744.589331][T11563] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 744.646416][T11563] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 744.678498][T11563] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 744.711834][T11921] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1760'. [ 744.739847][T11923] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1760'. [ 744.775628][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 744.785473][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 744.812437][T11563] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 744.846356][T11563] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 744.867343][T11563] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 744.876113][T11563] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 745.579393][ T4439] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 745.598279][ T4439] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 745.637982][T11938] loop2: detected capacity change from 0 to 1024 [ 745.645754][T11938] EXT4-fs: inline encryption not supported [ 745.666290][ T4439] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 745.745797][T11941] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1765'. [ 745.779518][ T4440] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 745.800559][ T4440] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 745.809087][T11938] EXT4-fs error (device loop2): ext4_map_blocks:747: inode #3: block 1: comm syz.2.1766: lblock 1 mapped to illegal pblock 1 (length 1) [ 745.823881][ T4628] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 745.930446][T11938] EXT4-fs (loop2): Remounting filesystem read-only [ 745.948513][T11938] Quota error (device loop2): write_blk: dquota write failed [ 745.955964][T11938] Quota error (device loop2): qtree_write_dquot: Error -117 occurred while creating quota [ 746.038992][T11938] EXT4-fs error (device loop2): ext4_acquire_dquot:6841: comm syz.2.1766: Failed to acquire dquot type 0 [ 746.160468][T11938] EXT4-fs (loop2): Remounting filesystem read-only [ 746.176817][T11938] EXT4-fs error (device loop2): ext4_free_blocks:6220: comm syz.2.1766: Freeing blocks not in datazone - block = 0, count = 4096 [ 746.268828][T11938] EXT4-fs (loop2): Remounting filesystem read-only [ 746.278803][T11938] EXT4-fs error (device loop2): ext4_read_inode_bitmap:140: comm syz.2.1766: Invalid inode bitmap blk 0 in block_group 0 [ 746.297151][ T4628] EXT4-fs error (device loop2): ext4_map_blocks:637: inode #3: block 1: comm kworker/u4:17: lblock 1 mapped to illegal pblock 1 (length 1) [ 746.313144][T11938] EXT4-fs (loop2): Remounting filesystem read-only [ 746.367376][T11938] EXT4-fs error (device loop2) in ext4_free_inode:362: Corrupt filesystem [ 746.502821][ T4628] EXT4-fs (loop2): Remounting filesystem read-only [ 746.673228][ T4628] Quota error (device loop2): remove_tree: Can't read quota data block 1 [ 746.764284][T11938] EXT4-fs (loop2): Remounting filesystem read-only [ 746.953489][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 746.959867][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 746.986188][ T4628] EXT4-fs error (device loop2): ext4_release_dquot:6877: comm kworker/u4:17: Failed to release dquot type 0 [ 746.998288][T11938] EXT4-fs (loop2): 1 orphan inode deleted [ 747.056237][T11938] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 747.128063][ T4628] EXT4-fs (loop2): Remounting filesystem read-only [ 747.346224][T11962] loop1: detected capacity change from 0 to 512 [ 747.372833][T11962] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 747.452706][T11962] EXT4-fs error (device loop1): ext4_get_branch:178: inode #11: block 4294967295: comm syz.1.1770: invalid block [ 747.477586][T11962] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #11: comm syz.1.1770: invalid indirect mapped block 4294967295 (level 1) [ 747.495464][T11962] EXT4-fs error (device loop1): ext4_free_branches:1030: inode #11: comm syz.1.1770: invalid indirect mapped block 4294967295 (level 1) [ 747.524785][T11962] EXT4-fs (loop1): 2 truncates cleaned up [ 747.530765][T11962] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 748.239265][T11563] EXT4-fs (loop1): unmounting filesystem. [ 748.249751][T10230] EXT4-fs (loop2): unmounting filesystem. [ 748.505815][T11970] loop2: detected capacity change from 0 to 1024 [ 748.715674][T11970] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 748.897430][ T27] audit: type=1804 audit(1700000504.562:61): pid=11980 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.1774" name="/newroot/72/file1/file0/file1" dev="overlay" ino=15 res=1 errno=0 [ 749.109578][ T27] audit: type=1804 audit(1700000504.622:62): pid=11970 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.1774" name="/newroot/72/file1/file0/file1" dev="overlay" ino=15 res=1 errno=0 [ 749.695657][T10230] EXT4-fs (loop2): unmounting filesystem. [ 751.213813][T12003] Bluetooth: MGMT ver 1.22 [ 752.412392][T12020] fuse: Unknown parameter 'fd0x0000000000000003' [ 752.858477][ T4334] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 752.988789][ T4334] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 753.177703][ T4334] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 753.428820][ T4334] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 753.692762][T12053] ip_tables: iptables: counters copy to user failed while replacing table [ 755.127200][ T4289] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 755.137939][ T4289] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 755.148874][ T4289] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 755.157835][ T4289] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 755.166523][ T4289] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 755.175864][ T4289] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 755.627906][T12078] loop2: detected capacity change from 0 to 512 [ 755.900540][T12078] EXT4-fs error (device loop2): ext4_xattr_inode_iget:401: comm syz.2.1801: inode #1: comm syz.2.1801: iget: illegal inode # [ 755.921096][T12078] EXT4-fs error (device loop2): ext4_xattr_inode_iget:406: comm syz.2.1801: error while reading EA inode 1 err=-117 [ 755.935966][T12078] EXT4-fs (loop2): 1 orphan inode deleted [ 755.941814][T12078] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 756.259988][T10230] EXT4-fs (loop2): unmounting filesystem. [ 757.140190][T12100] Bluetooth: MGMT ver 1.22 [ 757.255865][ T4289] Bluetooth: hci0: command 0x0409 tx timeout [ 757.418238][T12107] binder: 12106:12107 ioctl c0306201 0 returned -14 [ 757.479191][T12109] FAULT_INJECTION: forcing a failure. [ 757.479191][T12109] name failslab, interval 1, probability 0, space 0, times 0 [ 757.551575][T12109] CPU: 1 PID: 12109 Comm: syz.8.1813 Not tainted syzkaller #0 [ 757.559136][T12109] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 757.569247][T12109] Call Trace: [ 757.572562][T12109] [ 757.575534][T12109] dump_stack_lvl+0x188/0x24e [ 757.580273][T12109] ? show_regs_print_info+0x12/0x12 [ 757.585529][T12109] ? load_image+0x410/0x410 [ 757.590176][T12109] should_fail_ex+0x390/0x4c0 [ 757.594919][T12109] should_failslab+0x5/0x20 [ 757.599500][T12109] slab_pre_alloc_hook+0x59/0x300 [ 757.604587][T12109] ? read_lock_is_recursive+0x10/0x10 [ 757.610037][T12109] ? nfc_genl_rcv_nl_event+0xa4/0x2a0 [ 757.615570][T12109] __kmem_cache_alloc_node+0x4f/0x270 [ 757.621003][T12109] ? nfc_genl_rcv_nl_event+0xa4/0x2a0 [ 757.626443][T12109] kmalloc_trace+0x26/0xe0 [ 757.630919][T12109] nfc_genl_rcv_nl_event+0xa4/0x2a0 [ 757.636179][T12109] blocking_notifier_call_chain+0x103/0x1b0 [ 757.642209][T12109] netlink_release+0x1115/0x19b0 [ 757.647193][T12109] ? netlink_release+0xf2/0x19b0 [ 757.652262][T12109] ? netlink_sock_destruct+0x190/0x190 [ 757.657762][T12109] sock_close+0xbf/0x210 [ 757.662032][T12109] ? sock_mmap+0x90/0x90 [ 757.666316][T12109] __fput+0x20a/0x8b0 [ 757.670343][T12109] task_work_run+0x1d0/0x260 [ 757.675179][T12109] ? task_work_cancel+0x220/0x220 [ 757.680260][T12109] ? exit_to_user_mode_loop+0x3b/0x110 [ 757.685768][T12109] exit_to_user_mode_loop+0xe6/0x110 [ 757.691137][T12109] exit_to_user_mode_prepare+0xee/0x180 [ 757.696729][T12109] syscall_exit_to_user_mode+0x16/0x40 [ 757.702225][T12109] do_syscall_64+0x58/0xa0 [ 757.706667][T12109] ? clear_bhb_loop+0x60/0xb0 [ 757.711385][T12109] ? clear_bhb_loop+0x60/0xb0 [ 757.716100][T12109] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 757.722035][T12109] RIP: 0033:0x7fe942d5e98e [ 757.726486][T12109] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 757.746168][T12109] RSP: 002b:00007fe943d21f38 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 757.754612][T12109] RAX: 0000000000000000 RBX: 00007fe943d236c0 RCX: 00007fe942d5e98e [ 757.762622][T12109] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 757.770620][T12109] RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000 [ 757.778614][T12109] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 757.786606][T12109] R13: 00007fe943026038 R14: 00007fe943025fa0 R15: 00007fffabc9ac88 [ 757.794614][T12109] [ 757.797730][ C1] vkms_vblank_simulate: vblank timer overrun [ 757.875831][T12111] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1814'. [ 757.910714][T12113] FAULT_INJECTION: forcing a failure. [ 757.910714][T12113] name failslab, interval 1, probability 0, space 0, times 0 [ 757.990438][T12113] CPU: 0 PID: 12113 Comm: syz.2.1815 Not tainted syzkaller #0 [ 757.998019][T12113] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 758.008133][T12113] Call Trace: [ 758.011450][T12113] [ 758.014417][T12113] dump_stack_lvl+0x188/0x24e [ 758.019144][T12113] ? show_regs_print_info+0x12/0x12 [ 758.024397][T12113] ? load_image+0x410/0x410 [ 758.028962][T12113] ? __lock_acquire+0x7c40/0x7c40 [ 758.034052][T12113] should_fail_ex+0x390/0x4c0 [ 758.038791][T12113] should_failslab+0x5/0x20 [ 758.043344][T12113] slab_pre_alloc_hook+0x59/0x300 [ 758.048438][T12113] ? key_alloc+0x346/0x1030 [ 758.053006][T12113] __kmem_cache_alloc_node+0x4f/0x270 [ 758.058543][T12113] ? key_alloc+0x346/0x1030 [ 758.063106][T12113] __kmalloc_node_track_caller+0xa0/0x240 [ 758.068896][T12113] kmemdup+0x27/0x60 [ 758.072859][T12113] key_alloc+0x346/0x1030 [ 758.077253][T12113] keyring_alloc+0x41/0xa0 [ 758.081722][T12113] lookup_user_key+0x4da/0x1110 [ 758.086634][T12113] ? lookup_user_key_possessed+0x40/0x40 [ 758.092317][T12113] ? do_futex+0x310/0x320 [ 758.096722][T12113] ? search_process_keyrings_rcu+0x2b0/0x2b0 [ 758.102762][T12113] ? strncpy_from_user+0x1dc/0x340 [ 758.107956][T12113] __se_sys_add_key+0x311/0x410 [ 758.112869][T12113] ? __x64_sys_add_key+0xc0/0xc0 [ 758.117865][T12113] ? lockdep_hardirqs_on+0x94/0x140 [ 758.123108][T12113] ? __x64_sys_add_key+0x1c/0xc0 [ 758.128095][T12113] do_syscall_64+0x4c/0xa0 [ 758.132549][T12113] ? clear_bhb_loop+0x60/0xb0 [ 758.137266][T12113] ? clear_bhb_loop+0x60/0xb0 [ 758.141998][T12113] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 758.147954][T12113] RIP: 0033:0x7f3716d9e159 [ 758.152439][T12113] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 758.172094][T12113] RSP: 002b:00007f3717d48028 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8 [ 758.180565][T12113] RAX: ffffffffffffffda RBX: 00007f3717025fa0 RCX: 00007f3716d9e159 [ 758.188595][T12113] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000000 [ 758.196613][T12113] RBP: 00007f3716e3506b R08: fffffffffffffffe R09: 0000000000000000 [ 758.204634][T12113] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 758.212655][T12113] R13: 00007f3717026038 R14: 00007f3717025fa0 R15: 00007ffd472a5af8 [ 758.220689][T12113] [ 758.633054][T12120] loop4: detected capacity change from 0 to 8192 [ 759.192755][T12128] syz.4.1818: attempt to access beyond end of device [ 759.192755][T12128] loop4: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 759.206433][T12128] Buffer I/O error on dev loop4, logical block 57847, async page read [ 759.369325][ T27] audit: type=1800 audit(1700000515.042:63): pid=12128 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.1818" name="file2" dev="loop4" ino=1048804 res=0 errno=0 [ 759.389885][ T4289] Bluetooth: hci0: command 0x041b tx timeout [ 759.776819][T12067] chnl_net:caif_netlink_parms(): no params data found [ 759.938059][T12141] binder: 12138:12141 ioctl c0306201 0 returned -14 [ 760.158997][T12144] netlink: 36 bytes leftover after parsing attributes in process `syz.8.1826'. [ 760.472406][ T4334] device hsr_slave_0 left promiscuous mode [ 760.552926][ T4334] device hsr_slave_1 left promiscuous mode [ 760.573972][ T4334] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 760.640890][ T4334] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 760.718482][ T4334] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 760.783426][ T4334] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 760.888597][ T4334] device bridge_slave_1 left promiscuous mode [ 760.944465][ T4334] bridge0: port 2(bridge_slave_1) entered disabled state [ 761.076833][ T4334] device bridge_slave_0 left promiscuous mode [ 761.083189][ T4334] bridge0: port 1(bridge_slave_0) entered disabled state [ 761.221495][ T4334] device veth1_macvtap left promiscuous mode [ 761.232304][ T4334] device veth0_macvtap left promiscuous mode [ 761.273970][T12158] FAULT_INJECTION: forcing a failure. [ 761.273970][T12158] name failslab, interval 1, probability 0, space 0, times 0 [ 761.295296][T12158] CPU: 1 PID: 12158 Comm: syz.4.1830 Not tainted syzkaller #0 [ 761.302837][T12158] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 761.313036][T12158] Call Trace: [ 761.313581][ T4334] device veth1_vlan left promiscuous mode [ 761.316346][T12158] [ 761.325129][T12158] dump_stack_lvl+0x188/0x24e [ 761.329943][T12158] ? show_regs_print_info+0x12/0x12 [ 761.335178][T12158] ? load_image+0x410/0x410 [ 761.339761][T12158] ? __stack_depot_save+0x35/0x480 [ 761.344918][T12158] ? verify_lock_unused+0x140/0x140 [ 761.350340][T12158] should_fail_ex+0x390/0x4c0 [ 761.355094][T12158] should_failslab+0x5/0x20 [ 761.359637][T12158] slab_pre_alloc_hook+0x59/0x300 [ 761.364692][T12158] ? tipc_conn_alloc+0x57/0x4a0 [ 761.369798][T12158] __kmem_cache_alloc_node+0x4f/0x270 [ 761.375224][T12158] ? tipc_conn_alloc+0x57/0x4a0 [ 761.380111][T12158] kmalloc_trace+0x26/0xe0 [ 761.384554][T12158] tipc_conn_alloc+0x57/0x4a0 [ 761.389271][T12158] tipc_topsrv_kern_subscr+0xf5/0x250 [ 761.394685][T12158] ? conn_put+0x320/0x320 [ 761.399053][T12158] ? tipc_own_addr+0x45/0x2a0 [ 761.403806][T12158] tipc_group_create+0x357/0x4e0 [ 761.408796][T12158] tipc_sk_join+0x256/0x6a0 [ 761.413341][T12158] ? __tipc_sendstream+0x1330/0x1330 [ 761.418673][T12158] tipc_setsockopt+0x6b8/0x960 [ 761.423481][T12158] ? tipc_shutdown+0x560/0x560 [ 761.428289][T12158] ? aa_sock_opt_perm+0x74/0x100 [ 761.433268][T12158] ? bpf_lsm_socket_setsockopt+0x5/0x10 [ 761.438850][T12158] ? security_socket_setsockopt+0x7a/0xa0 [ 761.444617][T12158] ? tipc_shutdown+0x560/0x560 [ 761.449418][T12158] __sys_setsockopt+0x2bf/0x3d0 [ 761.454308][T12158] __x64_sys_setsockopt+0xb1/0xc0 [ 761.459368][T12158] do_syscall_64+0x4c/0xa0 [ 761.463822][T12158] ? clear_bhb_loop+0x60/0xb0 [ 761.468543][T12158] ? clear_bhb_loop+0x60/0xb0 [ 761.473259][T12158] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 761.479198][T12158] RIP: 0033:0x7f500879e159 [ 761.483643][T12158] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 761.503290][T12158] RSP: 002b:00007f50095a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 761.511784][T12158] RAX: ffffffffffffffda RBX: 00007f5008a25fa0 RCX: 00007f500879e159 [ 761.519796][T12158] RDX: 0000000000000087 RSI: 000000000000010f RDI: 0000000000000005 [ 761.527849][T12158] RBP: 00007f500883506b R08: 0000000000000010 R09: 0000000000000000 [ 761.535855][T12158] R10: 0000200000000180 R11: 0000000000000246 R12: 0000000000000000 [ 761.543860][T12158] R13: 00007f5008a26038 R14: 00007f5008a25fa0 R15: 00007fff93137b98 [ 761.551880][T12158] [ 761.556159][ T4289] Bluetooth: hci0: command 0x040f tx timeout [ 761.580829][ T4334] device veth0_vlan left promiscuous mode [ 762.482594][T12170] loop1: detected capacity change from 0 to 8192 [ 762.938160][T12177] binder: 12176:12177 ioctl c0306201 0 returned -14 [ 764.050279][T12185] syz.1.1834: attempt to access beyond end of device [ 764.050279][T12185] loop1: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 764.123863][ T4289] Bluetooth: hci0: command 0x0419 tx timeout [ 764.171091][T12185] Buffer I/O error on dev loop1, logical block 57847, async page read [ 764.182679][T12185] syz.1.1834: attempt to access beyond end of device [ 764.182679][T12185] loop1: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 764.291008][T12185] Buffer I/O error on dev loop1, logical block 57847, async page read [ 764.351143][ T27] audit: type=1800 audit(1700000520.023:64): pid=12185 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1834" name="file2" dev="loop1" ino=1048806 res=0 errno=0 [ 764.641232][ T4334] team0 (unregistering): Port device team_slave_1 removed [ 764.707153][ T4334] team0 (unregistering): Port device team_slave_0 removed [ 764.781740][ T4334] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 764.876348][ T4334] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 765.409824][T11563] FAT-fs (loop1): error, invalid access to FAT (entry 0x0000e1b1) [ 765.438941][T11563] FAT-fs (loop1): Filesystem has been set read-only [ 765.750367][ T4334] bond0 (unregistering): Released all slaves [ 766.186515][ T4289] Bluetooth: hci0: command 0x0405 tx timeout [ 766.559352][T12067] bridge0: port 1(bridge_slave_0) entered blocking state [ 766.576808][T12067] bridge0: port 1(bridge_slave_0) entered disabled state [ 766.611530][T12067] device bridge_slave_0 entered promiscuous mode [ 766.625082][T12067] bridge0: port 2(bridge_slave_1) entered blocking state [ 766.632277][T12067] bridge0: port 2(bridge_slave_1) entered disabled state [ 766.640214][T12067] device bridge_slave_1 entered promiscuous mode [ 766.669695][T12179] netlink: 36 bytes leftover after parsing attributes in process `syz.4.1838'. [ 766.723874][T12067] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 766.854296][T12197] loop1: detected capacity change from 0 to 1024 [ 766.873440][T12067] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 767.001505][T12067] team0: Port device team_slave_0 added [ 767.035869][T12067] team0: Port device team_slave_1 added [ 767.301131][T12197] Quota error (device loop1): find_tree_dqentry: Cycle in quota tree detected: block 4 index 0 [ 767.355470][T12197] Quota error (device loop1): qtree_read_dquot: Can't read quota structure for id 0 [ 767.386681][T12067] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 767.393700][T12067] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 767.424817][T12197] EXT4-fs error (device loop1): ext4_acquire_dquot:6841: comm syz.1.1842: Failed to acquire dquot type 0 [ 767.535485][T12197] EXT4-fs (loop1): 1 truncate cleaned up [ 767.541240][T12197] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 767.571766][T12067] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 767.610576][T12197] Quota error (device loop1): find_tree_dqentry: Cycle in quota tree detected: block 4 index 0 [ 767.652663][T12197] Quota error (device loop1): qtree_read_dquot: Can't read quota structure for id 0 [ 767.690749][T12197] EXT4-fs error (device loop1): ext4_acquire_dquot:6841: comm syz.1.1842: Failed to acquire dquot type 0 [ 767.707598][T12067] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 767.727352][T12067] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 767.826423][T12067] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 767.881527][T12214] FAULT_INJECTION: forcing a failure. [ 767.881527][T12214] name failslab, interval 1, probability 0, space 0, times 0 [ 767.914877][T12214] CPU: 1 PID: 12214 Comm: syz.8.1849 Not tainted syzkaller #0 [ 767.922417][T12214] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 767.932512][T12214] Call Trace: [ 767.935833][T12214] [ 767.938800][T12214] dump_stack_lvl+0x188/0x24e [ 767.943540][T12214] ? show_regs_print_info+0x12/0x12 [ 767.948784][T12214] ? load_image+0x410/0x410 [ 767.953346][T12214] ? __might_sleep+0xd0/0xd0 [ 767.957985][T12214] ? __lock_acquire+0x7c40/0x7c40 [ 767.963117][T12214] should_fail_ex+0x390/0x4c0 [ 767.967861][T12214] should_failslab+0x5/0x20 [ 767.972408][T12214] slab_pre_alloc_hook+0x59/0x300 [ 767.977504][T12214] kmem_cache_alloc_node+0x5a/0x310 [ 767.982752][T12214] ? __alloc_skb+0xf9/0x7d0 [ 767.987296][T12214] __alloc_skb+0xf9/0x7d0 [ 767.991683][T12214] netlink_ack+0x373/0x1160 [ 767.996251][T12214] ? genl_bind+0x360/0x360 [ 768.000717][T12214] ? netlink_dump+0xcd0/0xcd0 [ 768.005478][T12214] netlink_rcv_skb+0x26d/0x440 [ 768.010296][T12214] ? genl_bind+0x360/0x360 [ 768.014756][T12214] ? netlink_ack+0x1160/0x1160 [ 768.019590][T12214] ? down_read+0x1a8/0x2d0 [ 768.024062][T12214] genl_rcv+0x24/0x40 [ 768.028085][T12214] netlink_unicast+0x7ad/0x920 [ 768.032929][T12214] netlink_sendmsg+0x8ad/0xbd0 [ 768.037754][T12214] ? netlink_getsockopt+0x550/0x550 [ 768.043004][T12214] ? apparmor_socket_sendmsg+0x8a/0x330 [ 768.048614][T12214] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 768.053971][T12214] ? security_socket_sendmsg+0x7c/0xa0 [ 768.059486][T12214] __sys_sendto+0x497/0x650 [ 768.064046][T12214] ? __ia32_sys_getpeername+0x80/0x80 [ 768.069473][T12214] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 768.075495][T12214] ? lock_chain_count+0x20/0x20 [ 768.080380][T12214] __x64_sys_sendto+0xda/0xf0 [ 768.085082][T12214] do_syscall_64+0x4c/0xa0 [ 768.089524][T12214] ? clear_bhb_loop+0x60/0xb0 [ 768.094244][T12214] ? clear_bhb_loop+0x60/0xb0 [ 768.098957][T12214] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 768.104888][T12214] RIP: 0033:0x7fe942d5e98e [ 768.109333][T12214] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 768.128967][T12214] RSP: 002b:00007fe943d21e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 768.137402][T12214] RAX: ffffffffffffffda RBX: 00007fe943d236c0 RCX: 00007fe942d5e98e [ 768.145396][T12214] RDX: 0000000000000020 RSI: 00007fe943d22000 RDI: 0000000000000005 [ 768.153392][T12214] RBP: 0000000000000000 R08: 00007fe943d21f04 R09: 000000000000000c [ 768.161389][T12214] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 768.169375][T12214] R13: 00007fe943d21f58 R14: 00007fe943d22000 R15: 0000000000000000 [ 768.177387][T12214] [ 768.204029][T11563] EXT4-fs (loop1): unmounting filesystem. [ 768.559574][T12222] loop4: detected capacity change from 0 to 8192 [ 768.572880][T12067] device hsr_slave_0 entered promiscuous mode [ 768.657629][T12222] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 769.584089][T12067] device hsr_slave_1 entered promiscuous mode [ 769.620842][T12067] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 769.691611][T12067] Cannot create hsr debugfs directory [ 771.491830][T12247] Bluetooth: hci0: service_discovery: expected 4 bytes, got 7 bytes [ 771.761730][T12253] IPVS: set_ctl: invalid protocol: 0 255.255.255.255:20002 [ 771.792042][T12253] loop4: detected capacity change from 0 to 128 [ 771.868568][T12253] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 771.880179][T12253] ext4 filesystem being mounted at /103/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 773.512481][T12245] loop1: detected capacity change from 0 to 512 [ 773.554193][T12257] FAULT_INJECTION: forcing a failure. [ 773.554193][T12257] name failslab, interval 1, probability 0, space 0, times 0 [ 773.585570][T12245] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 773.650118][T12257] CPU: 0 PID: 12257 Comm: syz.2.1865 Not tainted syzkaller #0 [ 773.657674][T12257] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 773.667784][T12257] Call Trace: [ 773.671106][T12257] [ 773.674074][T12257] dump_stack_lvl+0x188/0x24e [ 773.678802][T12257] ? show_regs_print_info+0x12/0x12 [ 773.684049][T12257] ? load_image+0x410/0x410 [ 773.688613][T12257] ? __might_sleep+0xd0/0xd0 [ 773.693274][T12257] ? __lock_acquire+0x7c40/0x7c40 [ 773.698368][T12257] should_fail_ex+0x390/0x4c0 [ 773.703127][T12257] should_failslab+0x5/0x20 [ 773.707679][T12257] slab_pre_alloc_hook+0x59/0x300 [ 773.712760][T12257] kmem_cache_alloc_node+0x5a/0x310 [ 773.718007][T12257] ? __alloc_skb+0xf9/0x7d0 [ 773.722566][T12257] __alloc_skb+0xf9/0x7d0 [ 773.726943][T12257] netlink_ack+0x373/0x1160 [ 773.731511][T12257] ? genl_bind+0x360/0x360 [ 773.735972][T12257] ? netlink_dump+0xcd0/0xcd0 [ 773.740707][T12257] netlink_rcv_skb+0x26d/0x440 [ 773.745522][T12257] ? genl_bind+0x360/0x360 [ 773.749987][T12257] ? netlink_ack+0x1160/0x1160 [ 773.754819][T12257] ? down_read+0x1a8/0x2d0 [ 773.759287][T12257] genl_rcv+0x24/0x40 [ 773.763340][T12257] netlink_unicast+0x7ad/0x920 [ 773.768166][T12257] netlink_sendmsg+0x8ad/0xbd0 [ 773.772982][T12257] ? netlink_getsockopt+0x550/0x550 [ 773.778222][T12257] ? apparmor_socket_sendmsg+0x8a/0x330 [ 773.783823][T12257] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 773.789149][T12257] ? security_socket_sendmsg+0x7c/0xa0 [ 773.794661][T12257] __sys_sendto+0x497/0x650 [ 773.799207][T12257] ? __ia32_sys_getpeername+0x80/0x80 [ 773.804662][T12257] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 773.810700][T12257] ? lock_chain_count+0x20/0x20 [ 773.815608][T12257] __x64_sys_sendto+0xda/0xf0 [ 773.820364][T12257] do_syscall_64+0x4c/0xa0 [ 773.824826][T12257] ? clear_bhb_loop+0x60/0xb0 [ 773.829546][T12257] ? clear_bhb_loop+0x60/0xb0 [ 773.834267][T12257] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 773.840219][T12257] RIP: 0033:0x7f3716d5e98e [ 773.844678][T12257] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 773.864345][T12257] RSP: 002b:00007f3717d46e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 773.872800][T12257] RAX: ffffffffffffffda RBX: 00007f3717d486c0 RCX: 00007f3716d5e98e [ 773.880818][T12257] RDX: 0000000000000020 RSI: 00007f3717d47000 RDI: 0000000000000005 [ 773.888830][T12257] RBP: 0000000000000000 R08: 00007f3717d46f04 R09: 000000000000000c [ 773.896832][T12257] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 [ 773.904837][T12257] R13: 00007f3717d46f58 R14: 00007f3717d47000 R15: 0000000000000000 [ 773.912870][T12257] [ 773.962781][T12245] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: writeback. [ 774.028020][T12245] ext4 filesystem being mounted at /26/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 774.051522][T12067] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 774.198743][T12067] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 774.331640][T12067] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 774.410603][T12067] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 774.543960][T10423] EXT4-fs (loop4): unmounting filesystem. [ 774.716684][T11563] EXT4-fs (loop1): unmounting filesystem. [ 774.899914][T12067] 8021q: adding VLAN 0 to HW filter on device bond0 [ 775.019870][ T4727] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 775.185316][ T4727] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 775.206366][T12067] 8021q: adding VLAN 0 to HW filter on device team0 [ 775.743152][T12067] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 775.792917][T12067] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 775.907524][ T4727] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 775.938287][ T4727] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 775.959580][ T4727] bridge0: port 1(bridge_slave_0) entered blocking state [ 775.968036][ T4727] bridge0: port 1(bridge_slave_0) entered forwarding state [ 776.009299][ T4727] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 776.055142][ T4727] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 776.063745][ T4727] bridge0: port 2(bridge_slave_1) entered blocking state [ 776.070932][ T4727] bridge0: port 2(bridge_slave_1) entered forwarding state [ 776.106098][ T4727] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 776.115320][ T4727] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 776.129862][ T4727] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 776.140814][ T4727] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 776.157164][ T4727] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 776.172106][ T4727] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 776.192511][ T4727] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 776.202098][ T4727] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 776.217412][ T4727] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 776.229689][ T4727] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 776.279526][ T4727] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 776.320540][T12294] loop2: detected capacity change from 0 to 512 [ 776.339345][T12294] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 776.552344][T12294] EXT4-fs error (device loop2): __ext4_iget:5102: inode #11: block 2: comm syz.2.1875: invalid block [ 776.566923][T12294] EXT4-fs error (device loop2): ext4_orphan_get:1414: comm syz.2.1875: couldn't read orphan inode 11 (err -117) [ 776.581023][T12294] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 776.692507][ T4727] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 776.859261][ T4727] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 777.384386][T12280] device syzkaller0 entered promiscuous mode [ 778.657401][T10230] EXT4-fs (loop2): unmounting filesystem. [ 779.440264][T12327] loop2: detected capacity change from 0 to 512 [ 779.578625][T12327] EXT4-fs error (device loop2): ext4_xattr_inode_iget:401: inode #2: comm syz.2.1883: missing EA_INODE flag [ 779.643467][T12327] EXT4-fs error (device loop2): ext4_xattr_inode_iget:406: comm syz.2.1883: error while reading EA inode 2 err=-117 [ 779.786402][T12327] EXT4-fs (loop2): 1 orphan inode deleted [ 779.815428][T12327] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 780.586762][ T4440] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 780.604611][ T4440] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 780.649148][T12067] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 780.689940][T12348] device syzkaller0 entered promiscuous mode [ 780.896254][ T4440] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 780.919953][ T4440] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 780.998323][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 781.021683][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 781.075061][T12356] autofs4:pid:12356:autofs_fill_super: called with bogus options [ 781.092610][T12067] device veth0_vlan entered promiscuous mode [ 781.102183][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 781.120717][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 781.170151][T12067] device veth1_vlan entered promiscuous mode [ 781.292311][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 781.331194][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 781.370552][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 781.396692][ T76] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 781.594297][T12067] device veth0_macvtap entered promiscuous mode [ 781.625436][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 782.180239][T12067] device veth1_macvtap entered promiscuous mode [ 782.345004][T12067] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 782.426365][T12067] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 782.437145][T12067] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 782.447688][T12067] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 782.457633][T12067] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 782.468437][T12067] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 782.478345][T12067] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 782.488905][T12067] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 782.501102][T12067] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 782.510913][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 782.574427][ T46] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 782.586802][T12067] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 782.604205][T12067] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 782.643915][T12067] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 782.673894][T12067] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 782.703916][T12067] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 782.723910][T12067] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 782.778748][T12067] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 782.813841][T12067] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 782.825661][T12067] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 782.869945][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 782.899011][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 782.962900][T12067] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 782.995873][T12067] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 783.026890][T12067] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 783.086862][T12067] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 783.977004][ T4439] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 783.993812][ T4439] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 784.015919][ T4440] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 784.105201][ T76] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 784.124855][ T76] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 784.132463][ T4439] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 784.392898][T12394] Console: switching to colour VGA+ 80x25 [ 784.404654][T10230] EXT4-fs (loop2): unmounting filesystem. [ 784.606408][T12399] device syzkaller0 entered promiscuous mode [ 784.854021][ T4274] Bluetooth: hci1: command 0x0406 tx timeout [ 785.716271][T12416] loop2: detected capacity change from 0 to 512 [ 785.724723][T12416] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 785.847487][T12416] EXT4-fs error (device loop2): ext4_get_branch:178: inode #11: block 4294967295: comm syz.2.1905: invalid block [ 785.861047][T12416] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.1905: invalid indirect mapped block 4294967295 (level 1) [ 785.877831][T12416] EXT4-fs error (device loop2): ext4_free_branches:1030: inode #11: comm syz.2.1905: invalid indirect mapped block 4294967295 (level 1) [ 785.898336][T12416] EXT4-fs (loop2): 2 truncates cleaned up [ 785.904437][T12416] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 786.537323][T10230] EXT4-fs (loop2): unmounting filesystem. [ 787.884620][T12440] loop4: detected capacity change from 0 to 512 [ 787.926152][T12440] EXT4-fs error (device loop4): ext4_xattr_inode_iget:401: inode #2: comm syz.4.1912: missing EA_INODE flag [ 787.953833][T12440] EXT4-fs error (device loop4): ext4_xattr_inode_iget:406: comm syz.4.1912: error while reading EA inode 2 err=-117 [ 788.109939][T12440] EXT4-fs (loop4): 1 orphan inode deleted [ 788.118815][T12440] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 788.870850][T12460] loop2: detected capacity change from 0 to 8192 [ 788.931344][T12460] FAT-fs (loop2): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 791.253631][T12487] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1922'. [ 793.015107][T12493] block nbd8: NBD_DISCONNECT [ 794.608319][T12512] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1932'. [ 794.941916][T10423] EXT4-fs (loop4): unmounting filesystem. [ 794.989681][T12523] loop2: detected capacity change from 0 to 512 [ 795.126845][T12527] netlink: 256 bytes leftover after parsing attributes in process `syz.3.1938'. [ 795.186745][T12523] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 795.203218][T12527] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1938'. [ 795.212429][T12523] ext4 filesystem being mounted at /113/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 795.295843][T12525] loop4: detected capacity change from 0 to 8192 [ 796.134905][T10230] EXT4-fs (loop2): unmounting filesystem. [ 797.608731][T12556] netlink: 32 bytes leftover after parsing attributes in process `syz.8.1946'. [ 797.699731][T12559] syz.4.1937: attempt to access beyond end of device [ 797.699731][T12559] loop4: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 797.713268][T12559] Buffer I/O error on dev loop4, logical block 57847, async page read [ 797.732777][T12559] syz.4.1937: attempt to access beyond end of device [ 797.732777][T12559] loop4: rw=0, sector=57847, nr_sectors = 1 limit=8192 [ 797.746942][T12559] Buffer I/O error on dev loop4, logical block 57847, async page read [ 797.782962][ T27] audit: type=1800 audit(1700000553.445:65): pid=12559 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.1937" name="file2" dev="loop4" ino=1048819 res=0 errno=0 [ 798.060200][T12563] loop3: detected capacity change from 0 to 512 [ 798.104217][T12563] EXT4-fs error (device loop3): ext4_xattr_inode_iget:401: inode #2: comm syz.3.1948: missing EA_INODE flag [ 798.162115][T12563] EXT4-fs error (device loop3): ext4_xattr_inode_iget:406: comm syz.3.1948: error while reading EA inode 2 err=-117 [ 798.261536][T10423] FAT-fs (loop4): error, invalid access to FAT (entry 0x0000e1b1) [ 798.272257][T12563] EXT4-fs (loop3): 1 orphan inode deleted [ 798.278468][T12563] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 798.287499][T10423] FAT-fs (loop4): Filesystem has been set read-only [ 798.464505][ T4274] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 798.483324][ T4274] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 798.492900][ T4274] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 798.514156][ T4274] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 798.521735][ T4274] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 798.529131][ T4274] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 799.067342][T12581] FAULT_INJECTION: forcing a failure. [ 799.067342][T12581] name fail_futex, interval 1, probability 0, space 0, times 0 [ 799.080463][T12581] CPU: 0 PID: 12581 Comm: syz.2.1953 Not tainted syzkaller #0 [ 799.087968][T12581] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 799.098929][T12581] Call Trace: [ 799.102262][T12581] [ 799.105227][T12581] dump_stack_lvl+0x188/0x24e [ 799.109963][T12581] ? show_regs_print_info+0x12/0x12 [ 799.115198][T12581] ? load_image+0x410/0x410 [ 799.119767][T12581] ? psi_task_change+0xdc/0x240 [ 799.124674][T12581] should_fail_ex+0x390/0x4c0 [ 799.129415][T12581] get_futex_key+0x1b1/0x1000 [ 799.134144][T12581] ? futex_setup_timer+0xc0/0xc0 [ 799.139114][T12581] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 799.145196][T12581] ? __lock_acquire+0x7c40/0x7c40 [ 799.150273][T12581] ? lock_chain_count+0x20/0x20 [ 799.155170][T12581] futex_wait_setup+0xb8/0x270 [ 799.159974][T12581] ? futex_wait_multiple+0x920/0x920 [ 799.165296][T12581] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 799.171268][T12581] ? _raw_spin_unlock+0x40/0x40 [ 799.176162][T12581] ? task_woken_rt+0x6a/0x1e0 [ 799.180889][T12581] futex_wait+0x1b8/0x5c0 [ 799.185277][T12581] ? futex_wait_setup+0x270/0x270 [ 799.190395][T12581] do_futex+0x310/0x320 [ 799.194853][T12581] ? _copy_from_user+0x12f/0x170 [ 799.199905][T12581] ? __ia32_sys_get_robust_list+0x100/0x100 [ 799.205836][T12581] ? bpf_link_show_fdinfo+0x380/0x380 [ 799.211305][T12581] __se_sys_futex+0x381/0x410 [ 799.216022][T12581] ? __x64_sys_futex+0xf0/0xf0 [ 799.220843][T12581] ? __x64_sys_futex+0x1d/0xf0 [ 799.225648][T12581] do_syscall_64+0x4c/0xa0 [ 799.230097][T12581] ? clear_bhb_loop+0x60/0xb0 [ 799.234805][T12581] ? clear_bhb_loop+0x60/0xb0 [ 799.239510][T12581] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 799.245454][T12581] RIP: 0033:0x7f3716d9e159 [ 799.249905][T12581] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 799.269535][T12581] RSP: 002b:00007f3717d270e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 799.277973][T12581] RAX: ffffffffffffffda RBX: 00007f3717026098 RCX: 00007f3716d9e159 [ 799.285976][T12581] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f3717026098 [ 799.293971][T12581] RBP: 00007f3717026090 R08: 0000000000000000 R09: 0000000000000000 [ 799.301963][T12581] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 799.309952][T12581] R13: 00007f3717026128 R14: 00007ffd472a5a10 R15: 00007ffd472a5af8 [ 799.317979][T12581] [ 799.344597][T12569] chnl_net:caif_netlink_parms(): no params data found [ 799.801772][T12569] bridge0: port 1(bridge_slave_0) entered blocking state [ 799.839811][T12569] bridge0: port 1(bridge_slave_0) entered disabled state [ 799.905933][T12569] device bridge_slave_0 entered promiscuous mode [ 800.000234][T12569] bridge0: port 2(bridge_slave_1) entered blocking state [ 800.053613][T12569] bridge0: port 2(bridge_slave_1) entered disabled state [ 800.107619][T12569] device bridge_slave_1 entered promiscuous mode [ 800.294475][T12569] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 800.317273][T12067] EXT4-fs (loop3): unmounting filesystem. [ 800.373476][ T4289] Bluetooth: hci1: command 0x2016 tx timeout [ 800.405531][T12569] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 800.486255][T12600] netlink: 32 bytes leftover after parsing attributes in process `syz.2.1959'. [ 800.540103][T12569] team0: Port device team_slave_0 added [ 800.612994][ T4289] Bluetooth: hci4: command 0x0409 tx timeout [ 800.634774][T12569] team0: Port device team_slave_1 added [ 800.904988][T12569] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 800.912005][T12569] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 801.060844][T12569] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 801.146168][T12569] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 801.191937][T12569] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 801.196188][ T4289] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:0' [ 801.227964][ T4289] CPU: 1 PID: 4289 Comm: kworker/u5:8 Not tainted syzkaller #0 [ 801.235561][ T4289] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 801.245664][ T4289] Workqueue: hci1 hci_rx_work [ 801.250511][ T4289] Call Trace: [ 801.253838][ T4289] [ 801.256817][ T4289] dump_stack_lvl+0x188/0x24e [ 801.261549][ T4289] ? show_regs_print_info+0x12/0x12 [ 801.266802][ T4289] ? load_image+0x410/0x410 [ 801.271385][ T4289] sysfs_create_dir_ns+0x26a/0x290 [ 801.276562][ T4289] ? __lock_acquire+0x7c40/0x7c40 [ 801.281681][ T4289] ? sysfs_warn_dup+0xa0/0xa0 [ 801.286419][ T4289] ? do_raw_spin_unlock+0x11d/0x230 [ 801.291664][ T4289] kobject_add_internal+0x617/0xca0 [ 801.296920][ T4289] kobject_add+0x160/0x230 [ 801.301452][ T4289] ? kobject_init+0x1c0/0x1c0 [ 801.306172][ T4289] ? __raw_spin_lock_init+0x41/0x100 [ 801.311493][ T4289] ? klist_children_get+0x50/0x50 [ 801.316655][ T4289] ? get_device_parent+0x121/0x3e0 [ 801.321854][ T4289] device_add+0x470/0x1050 [ 801.326320][ T4289] hci_conn_add_sysfs+0xd1/0x1e0 [ 801.331383][ T4289] le_conn_complete_evt+0xf93/0x15c0 [ 801.336745][ T4289] ? hci_le_big_info_adv_report_evt+0x300/0x300 [ 801.343045][ T4289] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 801.348718][ T4289] ? mutex_unlock+0x10/0x10 [ 801.353250][ T4289] ? skb_pull_data+0xec/0x1f0 [ 801.357981][ T4289] hci_le_enh_conn_complete_evt+0x185/0x460 [ 801.363921][ T4289] ? hci_le_remote_conn_param_req_evt+0xcb0/0xcb0 [ 801.370380][ T4289] ? hci_remote_host_features_evt+0x230/0x230 [ 801.376491][ T4289] hci_event_packet+0x7b3/0x1290 [ 801.381498][ T4289] ? lock_chain_count+0x20/0x20 [ 801.386389][ T4289] ? bis_list+0x280/0x280 [ 801.390746][ T4289] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 801.396679][ T4289] ? kcov_remote_start+0x50f/0x810 [ 801.401824][ T4289] ? lockdep_hardirqs_on+0x94/0x140 [ 801.407065][ T4289] ? hci_send_to_monitor+0x9c/0x4a0 [ 801.412301][ T4289] hci_rx_work+0x3eb/0xd40 [ 801.416758][ T4289] ? _raw_spin_unlock+0x40/0x40 [ 801.421650][ T4289] ? process_one_work+0x7b4/0x1160 [ 801.426805][ T4289] process_one_work+0x8ab/0x1160 [ 801.431801][ T4289] ? worker_detach_from_pool+0x240/0x240 [ 801.437469][ T4289] ? _raw_spin_lock_irq+0xb7/0xf0 [ 801.442526][ T4289] ? _raw_spin_lock_irqsave+0x100/0x100 [ 801.448124][ T4289] ? wq_worker_running+0x97/0x190 [ 801.453180][ T4289] worker_thread+0xaf5/0x12a0 [ 801.457912][ T4289] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 801.463848][ T4289] kthread+0x29d/0x330 [ 801.467948][ T4289] ? worker_clr_flags+0x1a0/0x1a0 [ 801.473003][ T4289] ? kthread_blkcg+0xd0/0xd0 [ 801.477626][ T4289] ret_from_fork+0x1f/0x30 [ 801.482089][ T4289] [ 801.487818][ T4289] kobject_add_internal failed for hci1:0 with -EEXIST, don't try to register things with the same name in the same directory. [ 801.501024][ T4289] Bluetooth: hci1: failed to register connection device [ 801.593035][T12569] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 801.660659][T12621] loop3: detected capacity change from 0 to 512 [ 801.793499][T12623] IPVS: set_ctl: invalid protocol: 0 255.255.255.255:20002 [ 801.804938][T12623] loop2: detected capacity change from 0 to 128 [ 802.567156][ T4289] Bluetooth: hci1: command 0x0406 tx timeout [ 803.569568][ T4274] Bluetooth: hci4: command 0x041b tx timeout [ 804.146368][T12625] loop4: detected capacity change from 0 to 512 [ 804.558087][T12621] EXT4-fs: error -4 creating inode table initialization thread [ 804.601332][T12569] device hsr_slave_0 entered promiscuous mode [ 804.625119][T12623] EXT4-fs: failed to create workqueue [ 804.630567][T12623] EXT4-fs (loop2): mount failed [ 804.649364][ T4289] Bluetooth: hci1: command 0x2016 tx timeout [ 804.656163][T12621] EXT4-fs (loop3): mount failed [ 804.727135][T12569] device hsr_slave_1 entered promiscuous mode [ 804.745094][T12625] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 804.838689][T12569] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 804.903754][T12625] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1126: group 0, block bitmap and bg descriptor inconsistent: 48 vs 41 free clusters [ 804.921282][T12625] Quota error (device loop4): write_blk: dquota write failed [ 804.928790][T12625] Quota error (device loop4): find_free_dqentry: Can't write quota data block 5 [ 804.938511][T12625] Quota error (device loop4): write_blk: dquota write failed [ 804.946052][T12625] Quota error (device loop4): qtree_write_dquot: Error -28 occurred while creating quota [ 804.956496][T12625] EXT4-fs error (device loop4): ext4_acquire_dquot:6841: comm syz.4.1968: Failed to acquire dquot type 1 [ 804.974490][T12625] EXT4-fs (loop4): 1 truncate cleaned up [ 804.980290][T12625] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 805.037630][T12569] Cannot create hsr debugfs directory [ 805.233656][T10423] EXT4-fs (loop4): unmounting filesystem. [ 805.652960][ T4274] Bluetooth: hci4: command 0x040f tx timeout [ 806.095951][T12646] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1971'. [ 806.236420][ T4328] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 806.451700][ T4328] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 806.634084][T12661] FAULT_INJECTION: forcing a failure. [ 806.634084][T12661] name failslab, interval 1, probability 0, space 0, times 0 [ 806.647228][T12661] CPU: 0 PID: 12661 Comm: syz.2.1978 Not tainted syzkaller #0 [ 806.654780][T12661] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 806.664868][T12661] Call Trace: [ 806.668265][T12661] [ 806.671224][T12661] dump_stack_lvl+0x188/0x24e [ 806.675942][T12661] ? show_regs_print_info+0x12/0x12 [ 806.681174][T12661] ? load_image+0x410/0x410 [ 806.685742][T12661] ? verify_lock_unused+0x140/0x140 [ 806.690998][T12661] ? verify_lock_unused+0x140/0x140 [ 806.696244][T12661] should_fail_ex+0x390/0x4c0 [ 806.700981][T12661] should_failslab+0x5/0x20 [ 806.705522][T12661] slab_pre_alloc_hook+0x59/0x300 [ 806.710579][T12661] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 806.716597][T12661] ? tipc_nametbl_insert_publ+0x60/0x1380 [ 806.722352][T12661] __kmem_cache_alloc_node+0x4f/0x270 [ 806.727755][T12661] ? tipc_nametbl_insert_publ+0x60/0x1380 [ 806.733503][T12661] kmalloc_trace+0x26/0xe0 [ 806.737972][T12661] tipc_nametbl_insert_publ+0x60/0x1380 [ 806.743552][T12661] ? do_raw_spin_lock+0x128/0x2f0 [ 806.748608][T12661] ? __rwlock_init+0x140/0x140 [ 806.753393][T12661] ? tipc_net+0x45/0x270 [ 806.757680][T12661] ? tipc_nametbl_publish+0x70/0x1e0 [ 806.763015][T12661] tipc_nametbl_publish+0xb9/0x1e0 [ 806.768189][T12661] tipc_sk_publish+0x1c8/0x420 [ 806.773023][T12661] ? __lock_acquire+0x7c40/0x7c40 [ 806.778117][T12661] ? tipc_sk_withdraw+0x640/0x640 [ 806.783176][T12661] ? tipc_nametbl_build_group+0x2a/0x4c0 [ 806.788833][T12661] ? tipc_nametbl_build_group+0x47e/0x4c0 [ 806.794577][T12661] ? tipc_nametbl_build_group+0x2a/0x4c0 [ 806.800243][T12661] tipc_sk_join+0x3ac/0x6a0 [ 806.804789][T12661] ? __tipc_sendstream+0x1330/0x1330 [ 806.810120][T12661] tipc_setsockopt+0x6b8/0x960 [ 806.814945][T12661] ? tipc_shutdown+0x560/0x560 [ 806.819759][T12661] ? aa_sock_opt_perm+0x74/0x100 [ 806.824744][T12661] ? bpf_lsm_socket_setsockopt+0x5/0x10 [ 806.830322][T12661] ? security_socket_setsockopt+0x7a/0xa0 [ 806.836071][T12661] ? tipc_shutdown+0x560/0x560 [ 806.840875][T12661] __sys_setsockopt+0x2bf/0x3d0 [ 806.845755][T12661] __x64_sys_setsockopt+0xb1/0xc0 [ 806.850804][T12661] do_syscall_64+0x4c/0xa0 [ 806.855253][T12661] ? clear_bhb_loop+0x60/0xb0 [ 806.859960][T12661] ? clear_bhb_loop+0x60/0xb0 [ 806.864663][T12661] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 806.870595][T12661] RIP: 0033:0x7f3716d9e159 [ 806.875041][T12661] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 806.894676][T12661] RSP: 002b:00007f3717d48028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 806.903130][T12661] RAX: ffffffffffffffda RBX: 00007f3717025fa0 RCX: 00007f3716d9e159 [ 806.911150][T12661] RDX: 0000000000000087 RSI: 000000000000010f RDI: 0000000000000005 [ 806.919146][T12661] RBP: 00007f3716e3506b R08: 0000000000000010 R09: 0000000000000000 [ 806.927142][T12661] R10: 0000200000000180 R11: 0000000000000246 R12: 0000000000000000 [ 806.935142][T12661] R13: 00007f3717026038 R14: 00007f3717025fa0 R15: 00007ffd472a5af8 [ 806.943154][T12661] [ 806.950832][ T4274] Bluetooth: hci1: command 0x0406 tx timeout [ 807.008005][T12667] loop3: detected capacity change from 0 to 512 [ 807.136030][T12667] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: none. [ 807.165873][T12658] syz.8.1976 invoked oom-killer: gfp_mask=0x402dc2(GFP_KERNEL_ACCOUNT|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), order=0, oom_score_adj=1000 [ 807.188979][ T4328] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 807.263802][T12658] CPU: 1 PID: 12658 Comm: syz.8.1976 Not tainted syzkaller #0 [ 807.271348][T12658] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 807.281447][T12658] Call Trace: [ 807.284766][T12658] [ 807.287732][T12658] dump_stack_lvl+0x188/0x24e [ 807.292460][T12658] ? ___ratelimit+0x14e/0x610 [ 807.297187][T12658] ? show_regs_print_info+0x12/0x12 [ 807.302478][T12658] ? load_image+0x410/0x410 [ 807.307040][T12658] ? ___ratelimit+0x474/0x610 [ 807.311770][T12658] ? radix_tree_cpu_dead+0x160/0x160 [ 807.317114][T12658] dump_header+0xd8/0x820 [ 807.321518][T12658] oom_kill_process+0x361/0x550 [ 807.326496][T12658] out_of_memory+0xe25/0x1220 [ 807.331236][T12658] ? mutex_lock_nested+0x10/0x10 [ 807.336232][T12658] ? unregister_oom_notifier+0x20/0x20 [ 807.341758][T12658] mem_cgroup_out_of_memory+0x2c0/0x390 [ 807.347360][T12658] ? mem_cgroup_oom_trylock+0x210/0x210 [ 807.352970][T12658] ? do_raw_spin_unlock+0x11d/0x230 [ 807.358225][T12658] try_charge_memcg+0xc9d/0x17c0 [ 807.363223][T12658] ? __lock_acquire+0x7c40/0x7c40 [ 807.368322][T12658] ? percpu_ref_put+0x180/0x180 [ 807.373224][T12658] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 807.379014][T12658] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 807.384818][T12658] ? get_mem_cgroup_from_objcg+0x19/0x150 [ 807.390601][T12658] ? get_mem_cgroup_from_objcg+0x13c/0x150 [ 807.396464][T12658] __memcg_kmem_charge_page+0x220/0x380 [ 807.402072][T12658] __alloc_pages+0x21e/0x4f0 [ 807.406811][T12658] ? zone_statistics+0x170/0x170 [ 807.411818][T12658] __vmalloc_node_range+0x94a/0x1380 [ 807.417232][T12658] ? free_vm_area+0x50/0x50 [ 807.421794][T12658] ? kvmalloc_node+0x6c/0x180 [ 807.426533][T12658] ? rcu_is_watching+0x11/0xa0 [ 807.431441][T12658] ? kvmalloc_node+0x6c/0x180 [ 807.436180][T12658] ? trace_kmalloc+0x22/0xa0 [ 807.440819][T12658] kvmalloc_node+0x13b/0x180 [ 807.445481][T12658] ? newary+0x139/0xab0 [ 807.449762][T12658] newary+0x139/0xab0 [ 807.453792][T12658] ipcget+0x1cd/0xe10 [ 807.457811][T12658] ? do_futex+0x2e2/0x320 [ 807.462186][T12658] ? security_bpf+0x7a/0xa0 [ 807.466769][T12658] ? __ia32_sys_get_robust_list+0x100/0x100 [ 807.472707][T12658] ? bpf_link_show_fdinfo+0x380/0x380 [ 807.478652][T12658] ? ipc_obtain_object_check+0x1a0/0x1a0 [ 807.484349][T12658] __x64_sys_semget+0x1a7/0x210 [ 807.489252][T12658] ? sem_more_checks+0xa0/0xa0 [ 807.494071][T12658] ? lockdep_hardirqs_on+0x94/0x140 [ 807.499317][T12658] do_syscall_64+0x4c/0xa0 [ 807.503773][T12658] ? clear_bhb_loop+0x60/0xb0 [ 807.508492][T12658] ? clear_bhb_loop+0x60/0xb0 [ 807.513349][T12658] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 807.519291][T12658] RIP: 0033:0x7fe942d9e159 [ 807.523753][T12658] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 807.543417][T12658] RSP: 002b:00007fe943d23028 EFLAGS: 00000246 ORIG_RAX: 0000000000000040 [ 807.551880][T12658] RAX: ffffffffffffffda RBX: 00007fe943025fa0 RCX: 00007fe942d9e159 [ 807.559926][T12658] RDX: 00000000000000a0 RSI: 0000000000000207 RDI: 0000000000000000 [ 807.567941][T12658] RBP: 00007fe942e3506b R08: 0000000000000000 R09: 0000000000000000 [ 807.575951][T12658] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 807.583958][T12658] R13: 00007fe943026038 R14: 00007fe943025fa0 R15: 00007fffabc9ac88 [ 807.592005][T12658] [ 807.632367][T12658] memory: usage 96kB, limit 96kB, failcnt 49 [ 807.638414][T12658] memory+swap: usage 104kB, limit 9007199254740988kB, failcnt 0 [ 807.732836][ T4274] Bluetooth: hci4: command 0x0419 tx timeout [ 807.909696][T12678] IPVS: set_ctl: invalid protocol: 0 255.255.255.255:20002 [ 807.920695][T12678] loop2: detected capacity change from 0 to 128 [ 808.033116][T12067] EXT4-fs (loop3): unmounting filesystem. [ 808.074075][T12658] kmem: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 808.129766][T12678] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 808.141280][T12678] ext4 filesystem being mounted at /126/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 808.456560][ T1280] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.582570][ T1280] ieee802154 phy1 wpan1: encryption failed: -22 [ 808.669188][T12658] Memory cgroup stats for /syz8/test: [ 808.669665][T12658] anon 4096 [ 808.669665][T12658] file 0 [ 808.669665][T12658] kernel 61440 [ 808.669665][T12658] kernel_stack 0 [ 808.669665][T12658] pagetables 0 [ 808.669665][T12658] sec_pagetables 0 [ 808.669665][T12658] percpu 0 [ 808.669665][T12658] sock 0 [ 808.669665][T12658] vmalloc 0 [ 808.669665][T12658] shmem 0 [ 808.669665][T12658] zswap 0 [ 808.669665][T12658] zswapped 0 [ 808.669665][T12658] file_mapped 0 [ 808.669665][T12658] file_dirty 0 [ 808.669665][T12658] file_writeback 0 [ 808.669665][T12658] swapcached 16384 [ 808.669665][T12658] anon_thp 0 [ 808.669665][T12658] file_thp 0 [ 808.669665][T12658] shmem_thp 0 [ 808.669665][T12658] inactive_anon 0 [ 808.669665][T12658] active_anon 4096 [ 808.669665][T12658] inactive_file 0 [ 808.669665][T12658] active_file 0 [ 808.669665][T12658] unevictable 0 [ 808.669665][T12658] slab_reclaimable 13600 [ 808.669665][T12658] slab_unreclaimable 15400 [ 808.669665][T12658] slab 29000 [ 808.801762][ T4328] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 809.483343][T12658] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0-1,oom_memcg=/syz8/test,task_memcg=/syz8/test,task=syz.8.1976,pid=12657,uid=0 [ 809.582777][T12658] Memory cgroup out of memory: Killed process 12658 (syz.8.1976) total-vm:102376kB, anon-rss:1428kB, file-rss:22988kB, shmem-rss:0kB, UID:0 pgtables:136kB oom_score_adj:1000 [ 810.051887][T10230] EXT4-fs (loop2): unmounting filesystem. [ 810.217416][T12702] autofs4:pid:12702:autofs_fill_super: called with bogus options [ 810.339536][T12707] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1988'. [ 810.566361][T12712] netlink: 1379 bytes leftover after parsing attributes in process `syz.2.1992'. [ 810.631746][T12569] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 810.772875][T12569] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 810.822203][T12569] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 810.897357][T12569] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 811.441427][T12738] autofs4:pid:12738:autofs_fill_super: called with bogus options [ 811.607352][T12743] loop4: detected capacity change from 0 to 512 [ 811.698411][T12569] 8021q: adding VLAN 0 to HW filter on device bond0 [ 811.765919][T12743] EXT4-fs error (device loop4): ext4_xattr_inode_iget:401: inode #2: comm syz.4.2003: missing EA_INODE flag [ 811.782575][T12743] EXT4-fs error (device loop4): ext4_xattr_inode_iget:406: comm syz.4.2003: error while reading EA inode 2 err=-117 [ 811.796735][T12743] EXT4-fs (loop4): 1 orphan inode deleted [ 811.802885][T12743] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 812.081770][T12569] 8021q: adding VLAN 0 to HW filter on device team0 [ 812.132900][T10423] EXT4-fs (loop4): unmounting filesystem. [ 812.139196][ T4338] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 812.160352][ T4338] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 812.416426][T12761] loop4: detected capacity change from 0 to 512 [ 812.447392][T12761] EXT4-fs (loop4): mounting ext2 file system using the ext4 subsystem [ 812.462842][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 812.502802][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 812.576072][ T32] bridge0: port 1(bridge_slave_0) entered blocking state [ 812.583317][ T32] bridge0: port 1(bridge_slave_0) entered forwarding state [ 812.611433][T12761] EXT4-fs error (device loop4): ext4_validate_block_bitmap:438: comm syz.4.2008: bg 0: block 255: padding at end of block bitmap is not set [ 812.671316][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 812.852292][ T4289] Bluetooth: hci3: command 0x2016 tx timeout [ 812.865317][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 813.137970][ T32] bridge0: port 2(bridge_slave_1) entered blocking state [ 813.145200][ T32] bridge0: port 2(bridge_slave_1) entered forwarding state [ 813.245759][T12761] EXT4-fs error (device loop4) in ext4_mb_clear_bb:6180: Corrupt filesystem [ 813.503422][T12761] EXT4-fs error (device loop4): ext4_free_branches:1030: inode #11: comm syz.4.2008: invalid indirect mapped block 1 (level 1) [ 813.538709][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 813.580749][T12761] EXT4-fs (loop4): 1 truncate cleaned up [ 813.608659][T12761] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 813.652433][T12780] loop2: detected capacity change from 0 to 4096 [ 813.739031][T12780] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 813.890558][T10423] EXT4-fs (loop4): unmounting filesystem. [ 814.006641][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 814.045341][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 814.080564][T12789] autofs4:pid:12789:autofs_fill_super: called with bogus options [ 814.113012][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 814.171682][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 814.212145][ T4289] Bluetooth: hci5: command 0x2016 tx timeout [ 814.323828][T12569] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 814.411825][T12569] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 814.862429][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 814.932066][ T4274] Bluetooth: hci3: command 0x0406 tx timeout [ 814.986820][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 815.393971][T12803] loop3: detected capacity change from 0 to 512 [ 815.426631][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 815.463525][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 815.521209][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 815.531621][T12803] EXT4-fs error (device loop3): ext4_xattr_inode_iget:401: inode #2: comm syz.3.2017: missing EA_INODE flag [ 815.593495][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 815.653417][T12803] EXT4-fs error (device loop3): ext4_xattr_inode_iget:406: comm syz.3.2017: error while reading EA inode 2 err=-117 [ 815.682157][T12803] EXT4-fs (loop3): 1 orphan inode deleted [ 815.688065][T12803] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 815.702198][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 815.770142][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 815.897440][T12809] FAULT_INJECTION: forcing a failure. [ 815.897440][T12809] name fail_futex, interval 1, probability 0, space 0, times 0 [ 816.039351][T12809] CPU: 1 PID: 12809 Comm: syz.8.2018 Not tainted syzkaller #0 [ 816.046891][T12809] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 816.056988][T12809] Call Trace: [ 816.060380][T12809] [ 816.063343][T12809] dump_stack_lvl+0x188/0x24e [ 816.068065][T12809] ? show_regs_print_info+0x12/0x12 [ 816.073295][T12809] ? load_image+0x410/0x410 [ 816.077847][T12809] ? get_user_pages_fast_only+0x40/0x40 [ 816.083443][T12809] should_fail_ex+0x390/0x4c0 [ 816.088177][T12809] get_futex_key+0x922/0x1000 [ 816.092898][T12809] ? __stack_depot_save+0x35/0x480 [ 816.098069][T12809] ? futex_setup_timer+0xc0/0xc0 [ 816.103070][T12809] ? verify_lock_unused+0x140/0x140 [ 816.108339][T12809] futex_wake+0x123/0x4f0 [ 816.112705][T12809] ? futex_wake_mark+0x150/0x150 [ 816.117683][T12809] do_futex+0x2e2/0x320 [ 816.121321][T10230] EXT4-fs (loop2): unmounting filesystem. [ 816.121859][T12809] ? __ia32_sys_get_robust_list+0x100/0x100 [ 816.121888][T12809] ? __might_fault+0xc2/0x120 [ 816.121913][T12809] mm_release+0x20a/0x330 [ 816.142593][T12809] ? exit_robust_list+0x2ce/0x2f0 [ 816.147656][T12809] ? exit_mm_release+0x30/0x30 [ 816.152482][T12809] ? lockdep_hardirqs_on+0x94/0x140 [ 816.157728][T12809] exit_mm+0xa0/0x350 [ 816.161758][T12809] ? sysctl_delayacct+0x220/0x220 [ 816.166814][T12809] ? do_exit+0x2570/0x2570 [ 816.171275][T12809] ? mm_trace_rss_stat+0xa7/0x250 [ 816.176351][T12809] ? sync_mm_rss+0x211/0x350 [ 816.180994][T12809] do_exit+0x958/0x2570 [ 816.185213][T12809] ? put_task_struct+0x80/0x80 [ 816.190056][T12809] ? lockdep_hardirqs_on_prepare+0x448/0x7c0 [ 816.196112][T12809] ? lock_chain_count+0x20/0x20 [ 816.201010][T12809] ? _raw_spin_lock_irq+0xb7/0xf0 [ 816.206084][T12809] do_group_exit+0x229/0x2e0 [ 816.210725][T12809] ? lockdep_hardirqs_on+0x94/0x140 [ 816.215974][T12809] get_signal+0x1259/0x1340 [ 816.220545][T12809] arch_do_signal_or_restart+0xc4/0x1310 [ 816.226212][T12809] ? lockdep_hardirqs_on+0x94/0x140 [ 816.231489][T12809] ? __local_bh_enable_ip+0x136/0x1c0 [ 816.236898][T12809] ? do_futex+0x310/0x320 [ 816.241268][T12809] ? get_sigframe_size+0x10/0x10 [ 816.246244][T12809] ? __ia32_sys_get_robust_list+0x100/0x100 [ 816.252164][T12809] ? tipc_setsockopt+0x72c/0x960 [ 816.257159][T12809] ? exit_to_user_mode_loop+0x3b/0x110 [ 816.262645][T12809] exit_to_user_mode_loop+0x70/0x110 [ 816.267977][T12809] exit_to_user_mode_prepare+0xee/0x180 [ 816.273634][T12809] syscall_exit_to_user_mode+0x16/0x40 [ 816.279118][T12809] do_syscall_64+0x58/0xa0 [ 816.283550][T12809] ? clear_bhb_loop+0x60/0xb0 [ 816.288258][T12809] ? clear_bhb_loop+0x60/0xb0 [ 816.292954][T12809] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 816.298888][T12809] RIP: 0033:0x7fe942d9e159 [ 816.303339][T12809] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 816.322963][T12809] RSP: 002b:00007fe943d230e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 816.331400][T12809] RAX: fffffffffffffe00 RBX: 00007fe943025fa8 RCX: 00007fe942d9e159 [ 816.339394][T12809] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fe943025fa8 [ 816.347394][T12809] RBP: 00007fe943025fa0 R08: 0000000000000000 R09: 0000000000000000 [ 816.355376][T12809] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 816.363358][T12809] R13: 00007fe943026038 R14: 00007fffabc9aba0 R15: 00007fffabc9ac88 [ 816.374940][T12809] [ 816.417554][T12067] EXT4-fs (loop3): unmounting filesystem. [ 816.425488][T12813] FAULT_INJECTION: forcing a failure. [ 816.425488][T12813] name failslab, interval 1, probability 0, space 0, times 0 [ 816.512804][T12813] CPU: 1 PID: 12813 Comm: syz.4.2021 Not tainted syzkaller #0 [ 816.520338][T12813] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 816.530434][T12813] Call Trace: [ 816.533754][T12813] [ 816.536727][T12813] dump_stack_lvl+0x188/0x24e [ 816.541463][T12813] ? show_regs_print_info+0x12/0x12 [ 816.546712][T12813] ? load_image+0x410/0x410 [ 816.551272][T12813] ? __might_sleep+0xd0/0xd0 [ 816.555913][T12813] ? __lock_acquire+0x7c40/0x7c40 [ 816.561018][T12813] should_fail_ex+0x390/0x4c0 [ 816.565768][T12813] should_failslab+0x5/0x20 [ 816.570321][T12813] slab_pre_alloc_hook+0x59/0x300 [ 816.575395][T12813] ? __lock_acquire+0x138a/0x7c40 [ 816.580494][T12813] ? tomoyo_realpath_from_path+0xe2/0x5c0 [ 816.586265][T12813] __kmem_cache_alloc_node+0x4f/0x270 [ 816.591701][T12813] ? tomoyo_realpath_from_path+0xe2/0x5c0 [ 816.597473][T12813] __kmalloc+0xa3/0x240 [ 816.601685][T12813] tomoyo_realpath_from_path+0xe2/0x5c0 [ 816.607301][T12813] ? tomoyo_domain+0xd2/0x120 [ 816.612037][T12813] ? tomoyo_path_number_perm+0x205/0x650 [ 816.617731][T12813] tomoyo_path_number_perm+0x22f/0x650 [ 816.623250][T12813] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 816.628811][T12813] ? __fget_files+0x28/0x460 [ 816.633483][T12813] security_file_ioctl+0x6c/0xa0 [ 816.638479][T12813] __se_sys_ioctl+0x48/0x170 [ 816.643139][T12813] do_syscall_64+0x4c/0xa0 [ 816.647605][T12813] ? clear_bhb_loop+0x60/0xb0 [ 816.652331][T12813] ? clear_bhb_loop+0x60/0xb0 [ 816.657071][T12813] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 816.663045][T12813] RIP: 0033:0x7f500879e159 [ 816.667505][T12813] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 816.687238][T12813] RSP: 002b:00007f50095a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 816.695699][T12813] RAX: ffffffffffffffda RBX: 00007f5008a25fa0 RCX: 00007f500879e159 [ 816.703742][T12813] RDX: 0000000000000000 RSI: 0000000080186e84 RDI: 0000000000000003 [ 816.711745][T12813] RBP: 00007f500883506b R08: 0000000000000000 R09: 0000000000000000 [ 816.719751][T12813] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 816.727767][T12813] R13: 00007f5008a26038 R14: 00007f5008a25fa0 R15: 00007fff93137b98 [ 816.735820][T12813] [ 816.993139][T12813] ERROR: Out of memory at tomoyo_realpath_from_path. [ 817.880472][ T4328] device hsr_slave_0 left promiscuous mode [ 817.906505][ T4328] device hsr_slave_1 left promiscuous mode [ 817.919041][ T4328] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 817.949339][ T4328] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 817.996072][ T4328] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 818.027878][ T4328] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 818.062775][ T4328] device bridge_slave_1 left promiscuous mode [ 818.102963][ T4328] bridge0: port 2(bridge_slave_1) entered disabled state [ 818.225350][ T4328] device bridge_slave_0 left promiscuous mode [ 818.240254][ T4328] bridge0: port 1(bridge_slave_0) entered disabled state [ 819.068178][ T4328] device veth1_macvtap left promiscuous mode [ 819.085257][ T4328] device veth0_macvtap left promiscuous mode [ 819.115614][ T4328] device veth1_vlan left promiscuous mode [ 819.151551][ T4328] device veth0_vlan left promiscuous mode [ 819.163843][T12846] loop2: detected capacity change from 0 to 512 [ 819.315512][T12846] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 819.331661][T12846] ext4 filesystem being mounted at /137/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 819.443037][T12857] loop3: detected capacity change from 0 to 512 [ 819.490937][T12857] EXT4-fs error (device loop3): ext4_xattr_inode_iget:401: inode #2: comm syz.3.2031: missing EA_INODE flag [ 819.605442][T12857] EXT4-fs error (device loop3): ext4_xattr_inode_iget:406: comm syz.3.2031: error while reading EA inode 2 err=-117 [ 819.641914][T12857] EXT4-fs (loop3): 1 orphan inode deleted [ 819.651690][T12857] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 820.010345][T12067] EXT4-fs (loop3): unmounting filesystem. [ 821.010671][T12851] loop8: detected capacity change from 0 to 65536 [ 821.400038][T12889] loop3: detected capacity change from 0 to 1024 [ 821.433272][T12889] ext4: Unknown parameter 'smackfshat' [ 822.538001][ T4328] team0 (unregistering): Port device team_slave_1 removed [ 822.655844][ T4328] team0 (unregistering): Port device team_slave_0 removed [ 822.782171][ T4328] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 822.908104][ T4328] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 824.590016][T12929] sctp: failed to load transform for md5: -2 [ 825.192552][ T4328] bond0 (unregistering): Released all slaves [ 825.516113][T12856] device syzkaller1 entered promiscuous mode [ 825.807456][T10230] EXT4-fs (loop2): unmounting filesystem. [ 826.118616][T10322] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 826.129436][T10322] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 826.171448][T12569] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 826.271170][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 826.294342][ T32] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 826.403304][T10322] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 826.428190][T10322] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 826.468252][T10322] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 826.501857][T10322] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 826.542165][T12569] device veth0_vlan entered promiscuous mode [ 826.570655][T12569] device veth1_vlan entered promiscuous mode [ 826.701728][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 826.727041][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 826.744276][T12569] device veth0_macvtap entered promiscuous mode [ 826.770795][T12569] device veth1_macvtap entered promiscuous mode [ 826.819277][T12569] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 826.850480][T12569] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 826.880284][T12569] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 826.901261][T12569] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 826.936202][T12569] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 826.981238][T12569] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 827.021018][T12569] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 827.081028][T12569] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 827.112540][T12569] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 827.154669][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 827.171744][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 827.231777][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 827.262127][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 827.286661][T12569] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 827.348063][T12569] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 827.388571][T12569] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 827.430946][T12569] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 827.440818][T12569] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 827.520965][T12569] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 827.530856][T12569] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 827.587619][T12569] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 827.629106][T12988] loop8: detected capacity change from 0 to 2048 [ 827.637248][T12569] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 827.672161][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 827.704159][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 827.766081][T12569] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 827.788849][T12569] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 827.833437][T12569] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 827.868827][T12988] EXT4-fs (loop8): mounted filesystem without journal. Quota mode: none. [ 827.877993][T12569] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 827.977544][T13000] ip_tables: iptables: counters copy to user failed while replacing table [ 828.863318][ T27] audit: type=1800 audit(1700000584.547:66): pid=12988 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.2062" name="file1" dev="loop8" ino=15 res=0 errno=0 [ 828.930289][T13004] FAULT_INJECTION: forcing a failure. [ 828.930289][T13004] name failslab, interval 1, probability 0, space 0, times 0 [ 828.963109][ T4328] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 828.999489][ T4328] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 829.007388][T13004] CPU: 0 PID: 13004 Comm: syz.4.2064 Not tainted syzkaller #0 [ 829.014907][T13004] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 829.025013][T13004] Call Trace: [ 829.028330][T13004] [ 829.031303][T13004] dump_stack_lvl+0x188/0x24e [ 829.036043][T13004] ? show_regs_print_info+0x12/0x12 [ 829.041295][T13004] ? load_image+0x410/0x410 [ 829.045856][T13004] ? __might_sleep+0xd0/0xd0 [ 829.050504][T13004] ? __lock_acquire+0x7c40/0x7c40 [ 829.055593][T13004] should_fail_ex+0x390/0x4c0 [ 829.060369][T13004] should_failslab+0x5/0x20 [ 829.064926][T13004] slab_pre_alloc_hook+0x59/0x300 [ 829.070000][T13004] ? __lock_acquire+0x138a/0x7c40 [ 829.075084][T13004] ? tomoyo_realpath_from_path+0xe2/0x5c0 [ 829.080856][T13004] __kmem_cache_alloc_node+0x4f/0x270 [ 829.086292][T13004] ? tomoyo_realpath_from_path+0xe2/0x5c0 [ 829.092072][T13004] __kmalloc+0xa3/0x240 [ 829.096321][T13004] tomoyo_realpath_from_path+0xe2/0x5c0 [ 829.101928][T13004] ? tomoyo_domain+0xd2/0x120 [ 829.106685][T13004] ? tomoyo_path_number_perm+0x205/0x650 [ 829.112367][T13004] tomoyo_path_number_perm+0x22f/0x650 [ 829.117875][T13004] ? tomoyo_check_path_acl+0x1c0/0x1c0 [ 829.123430][T13004] ? __fget_files+0x28/0x460 [ 829.128084][T13004] security_file_ioctl+0x6c/0xa0 [ 829.133077][T13004] __se_sys_ioctl+0x48/0x170 [ 829.137725][T13004] do_syscall_64+0x4c/0xa0 [ 829.142190][T13004] ? clear_bhb_loop+0x60/0xb0 [ 829.146921][T13004] ? clear_bhb_loop+0x60/0xb0 [ 829.151656][T13004] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 829.157614][T13004] RIP: 0033:0x7f500879e159 [ 829.162090][T13004] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 829.181738][T13004] RSP: 002b:00007f50095a7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 829.190198][T13004] RAX: ffffffffffffffda RBX: 00007f5008a25fa0 RCX: 00007f500879e159 [ 829.198209][T13004] RDX: 0000000000000000 RSI: 0000000080186e84 RDI: 0000000000000003 [ 829.206222][T13004] RBP: 00007f500883506b R08: 0000000000000000 R09: 0000000000000000 [ 829.214236][T13004] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 829.222239][T13004] R13: 00007f5008a26038 R14: 00007f5008a25fa0 R15: 00007fff93137b98 [ 829.230262][T13004] [ 829.257078][T10795] EXT4-fs (loop8): unmounting filesystem. [ 829.268327][ T4328] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 829.299338][ T4328] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 829.343427][ T4328] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 829.391468][T10322] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 829.480956][T13004] ERROR: Out of memory at tomoyo_realpath_from_path. [ 829.550675][T13014] loop2: detected capacity change from 0 to 128 [ 829.579613][T13014] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 829.616697][T13014] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 830.744198][T13041] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2076'. [ 831.249013][T13050] rxrpc: Assertion failed - 5(0x5) == 11(0xb) is false [ 831.327476][T13050] ------------[ cut here ]------------ [ 831.333114][T13050] kernel BUG at net/rxrpc/call_object.c:689! [ 831.371503][T13050] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 831.377842][T13050] CPU: 0 PID: 13050 Comm: syz.3.2078 Not tainted syzkaller #0 [ 831.385376][T13050] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026 [ 831.395509][T13050] RIP: 0010:rxrpc_cleanup_call+0x1cf/0x1f0 [ 831.401536][T13050] Code: e8 c6 d4 1f f8 41 b8 0b 00 00 00 41 b9 0b 00 00 00 48 c7 c7 80 af a1 8b 4c 89 f6 4c 89 f2 48 c7 c1 00 b0 a1 8b e8 b1 f7 c4 00 <0f> 0b e8 9a d4 1f f8 48 c7 c7 60 b0 a1 8b e8 9e f7 c4 00 0f 0b 66 [ 831.421185][T13050] RSP: 0018:ffffc90004d6f778 EFLAGS: 00010246 [ 831.427302][T13050] RAX: 0000000000000034 RBX: ffff8880286d1f80 RCX: 7de7962ea40f7600 [ 831.435321][T13050] RDX: ffffc9000ea63000 RSI: 0000000000005204 RDI: 0000000000005205 [ 831.443333][T13050] RBP: ffff8880286d1f80 R08: ffffc90004d6f487 R09: 1ffff920009ade90 [ 831.451361][T13050] R10: dffffc0000000000 R11: fffff520009ade91 R12: ffff8880286d26d8 [ 831.459399][T13050] R13: dffffc0000000000 R14: 0000000000000005 R15: dffffc0000000000 [ 831.467413][T13050] FS: 00007f9f0d8f56c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 831.476389][T13050] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 831.483019][T13050] CR2: 000000110c37698c CR3: 0000000063a60000 CR4: 00000000003506f0 [ 831.491051][T13050] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 831.499058][T13050] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 831.507076][T13050] Call Trace: [ 831.510416][T13050] [ 831.513432][T13050] rxrpc_service_prealloc_one+0xa4c/0xff0 [ 831.519200][T13050] ? rxrpc_user_charge_accept+0xb4/0xe0 [ 831.524798][T13050] rxrpc_user_charge_accept+0xb4/0xe0 [ 831.530228][T13050] rxrpc_do_sendmsg+0x7d3/0x10e0 [ 831.535247][T13050] ? lock_chain_count+0x20/0x20 [ 831.540157][T13050] ? rxrpc_look_up_server_security+0x530/0x530 [ 831.546362][T13050] ? __local_bh_enable_ip+0x136/0x1c0 [ 831.551782][T13050] ? _local_bh_enable+0xa0/0xa0 [ 831.556677][T13050] ? rxrpc_sendmsg+0x36b/0x890 [ 831.561486][T13050] ? bpf_lsm_socket_sendmsg+0x5/0x10 [ 831.566821][T13050] ? rxrpc_getsockopt+0x150/0x150 [ 831.571894][T13050] ____sys_sendmsg+0x5ed/0x9a0 [ 831.576711][T13050] ? __might_fault+0xa6/0x120 [ 831.581447][T13050] ? __sys_sendmsg_sock+0x30/0x30 [ 831.586536][T13050] ? __import_iovec+0x306/0x510 [ 831.591491][T13050] ? import_iovec+0x6f/0xa0 [ 831.596058][T13050] ___sys_sendmsg+0x2a2/0x360 [ 831.600791][T13050] ? __sys_sendmsg+0x2a0/0x2a0 [ 831.605808][T13050] __se_sys_sendmsg+0x1c3/0x2b0 [ 831.610712][T13050] ? __x64_sys_sendmsg+0x80/0x80 [ 831.615706][T13050] ? lockdep_hardirqs_on+0x94/0x140 [ 831.620957][T13050] do_syscall_64+0x4c/0xa0 [ 831.625432][T13050] ? clear_bhb_loop+0x60/0xb0 [ 831.630147][T13050] ? clear_bhb_loop+0x60/0xb0 [ 831.634886][T13050] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 831.640847][T13050] RIP: 0033:0x7f9f0c99e159 [ 831.645312][T13050] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 831.664967][T13050] RSP: 002b:00007f9f0d8f5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 831.673445][T13050] RAX: ffffffffffffffda RBX: 00007f9f0cc25fa0 RCX: 00007f9f0c99e159 [ 831.681477][T13050] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000003 [ 831.689525][T13050] RBP: 00007f9f0ca3506b R08: 0000000000000000 R09: 0000000000000000 [ 831.697549][T13050] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 831.705565][T13050] R13: 00007f9f0cc26038 R14: 00007f9f0cc25fa0 R15: 00007fff062d0578 [ 831.713588][T13050] [ 831.716657][T13050] Modules linked in: [ 832.031847][T13050] ---[ end trace 0000000000000000 ]--- [ 832.037404][T13050] RIP: 0010:rxrpc_cleanup_call+0x1cf/0x1f0 [ 832.045239][T13050] Code: e8 c6 d4 1f f8 41 b8 0b 00 00 00 41 b9 0b 00 00 00 48 c7 c7 80 af a1 8b 4c 89 f6 4c 89 f2 48 c7 c1 00 b0 a1 8b e8 b1 f7 c4 00 <0f> 0b e8 9a d4 1f f8 48 c7 c7 60 b0 a1 8b e8 9e f7 c4 00 0f 0b 66 [ 832.088158][T13050] RSP: 0018:ffffc90004d6f778 EFLAGS: 00010246 [ 832.100710][T13050] RAX: 0000000000000034 RBX: ffff8880286d1f80 RCX: 7de7962ea40f7600 [ 832.108787][T13050] RDX: ffffc9000ea63000 RSI: 0000000000005204 RDI: 0000000000005205 [ 832.138264][T13050] RBP: ffff8880286d1f80 R08: ffffc90004d6f487 R09: 1ffff920009ade90 [ 832.161216][T13050] R10: dffffc0000000000 R11: fffff520009ade91 R12: ffff8880286d26d8 [ 832.169325][T13050] R13: dffffc0000000000 R14: 0000000000000005 R15: dffffc0000000000 [ 832.190521][T13050] FS: 00007f9f0d8f56c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 832.202467][T13050] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 832.209195][T13050] CR2: 00007ff8f5e9deb8 CR3: 0000000063a60000 CR4: 00000000003506f0 [ 832.231138][T13050] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 832.247980][T13050] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 832.265028][T13050] Kernel panic - not syncing: Fatal exception [ 832.271718][T13050] Kernel Offset: disabled [ 832.276077][T13050] Rebooting in 86400 seconds..