last executing test programs: 10m32.247735354s ago: executing program 0 (id=1): mmap(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x1000000, 0x13, 0xffffffffffffffff, 0x8cee000) mmap(&(0x7f0000ae2000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r3, &(0x7f0000000300)={{0x6, @rose, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @bcast, @bcast]}, 0x48) r4 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) bind$netrom(r4, &(0x7f0000000000)={{0x6, @rose, 0x2}, [@bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null]}, 0x48) listen(r4, 0x80) r5 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000000)='source', &(0x7f0000000180)='400:\x00\x8e\xf7\xd4\t\xe1\xae\x19\xe5\xf7c\x84\x9c\x06\x00\x00\x00\x11\x01\xf2 \xec\xbe#\'S\xc4\xbd\xb5\x1e\x98MM\x06\x1a\x7f5U\x18\x90\x99\xb2\xfa\')Z\x9ew\xae\xe8\xdd\b\t\xf0\xc4\xbfj\xb6\x88/)~\x93E\x1d4\xa7\xcb\xeb\x0f\xd4(\xb6>\x87\xc3\t\xb0\x80\xf7\xe6\x8b?\xa4\xb3\b\x00\x81\xbe\xea\x1f\xfe\xed\x9d\x1a\x8aQ\xafQ\x06\x0fJ\xc0\xc0=}\x7f\xaeB\xb1\xed\xa4\xf3c#\xbe\b\x1f\xa4L[\xfa\x01Uu\xe0\x8b\x94E\xda\xd9j\x93\xc8~\xd9\x82\x8f\xcam\x17\xa2\xed\xf3\xc3_h\xfc6\t\x96@\xaf\xe6\xd0!)\xc3\xcfe\xe1g\xe7\xe5F\xbdC\xd9$\x9b@\xaf\xc2j1p\xa9\xb2d\x92\x8fo\xcbg\x9fZ\xd7\xef\xb2z\xf5\x0fq\x7f\b\xc2\xa7\x90\xc5\xf5Y\xbc\xf1s\x93X\xb6\xeb\x86&\xa7\x14%B', 0x0) accept4$netrom(r4, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_clone(0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0) 10m16.810490592s ago: executing program 32 (id=1): mmap(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x1000000, 0x13, 0xffffffffffffffff, 0x8cee000) mmap(&(0x7f0000ae2000/0x3000)=nil, 0x3000, 0x0, 0x13, 0xffffffffffffffff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r3, &(0x7f0000000300)={{0x6, @rose, 0x1}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @bcast, @bcast]}, 0x48) r4 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) bind$netrom(r4, &(0x7f0000000000)={{0x6, @rose, 0x2}, [@bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @null, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null]}, 0x48) listen(r4, 0x80) r5 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000000)='source', &(0x7f0000000180)='400:\x00\x8e\xf7\xd4\t\xe1\xae\x19\xe5\xf7c\x84\x9c\x06\x00\x00\x00\x11\x01\xf2 \xec\xbe#\'S\xc4\xbd\xb5\x1e\x98MM\x06\x1a\x7f5U\x18\x90\x99\xb2\xfa\')Z\x9ew\xae\xe8\xdd\b\t\xf0\xc4\xbfj\xb6\x88/)~\x93E\x1d4\xa7\xcb\xeb\x0f\xd4(\xb6>\x87\xc3\t\xb0\x80\xf7\xe6\x8b?\xa4\xb3\b\x00\x81\xbe\xea\x1f\xfe\xed\x9d\x1a\x8aQ\xafQ\x06\x0fJ\xc0\xc0=}\x7f\xaeB\xb1\xed\xa4\xf3c#\xbe\b\x1f\xa4L[\xfa\x01Uu\xe0\x8b\x94E\xda\xd9j\x93\xc8~\xd9\x82\x8f\xcam\x17\xa2\xed\xf3\xc3_h\xfc6\t\x96@\xaf\xe6\xd0!)\xc3\xcfe\xe1g\xe7\xe5F\xbdC\xd9$\x9b@\xaf\xc2j1p\xa9\xb2d\x92\x8fo\xcbg\x9fZ\xd7\xef\xb2z\xf5\x0fq\x7f\b\xc2\xa7\x90\xc5\xf5Y\xbc\xf1s\x93X\xb6\xeb\x86&\xa7\x14%B', 0x0) accept4$netrom(r4, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_clone(0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0) 3m48.319443132s ago: executing program 3 (id=570): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x40100) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount(0x0, 0x0, &(0x7f00000000c0)='debugfs\x00', 0x1214040, 0x0) syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000180)='./bus\x00', 0x804, &(0x7f00000001c0)={[{@uni_xlate}, {@numtail}, {@rodir}, {@uni_xlateno}, {@shortname_mixed}, {@utf8no}, {@uni_xlateno}, {@iocharset={'iocharset', 0x3d, 'iso8859-4'}}, {@utf8}, {@shortname_mixed}, {@utf8}, {@utf8}, {@shortname_winnt}, {@iocharset={'iocharset', 0x3d, 'koi8-ru'}}, {@utf8no}, {@rodir}, {@iocharset={'iocharset', 0x3d, 'cp869'}}, {@shortname_winnt}]}, 0x9, 0x27b, &(0x7f0000000340)="$eJzs3cFqK1UYAOB/mqRJdJEsXInQAV24Kq1P0CIVxIKgZKEutNgUpAmFFgJVMXblE/gEPo8b8QV8AC93d7u43LmkM0nTyyQlvWlT7v2+TQ//+f85/5kZ2tWc/vBB//jw5Ozo4tf/otFIYm0nduIyiXasxdjvUerfJ+VxAOCRu8yyeJrl6nno/GZGbUZlde3emwMA7sX03/9V9wIAPIyvv/n2i939/b2v0rQR0f9j0Eki/5nP7x7FT9GLbmxFK55HZBP5+LPP9/eimo6046P+cNAZVfa//7u4/u7/EVf129GKdnn9dpqbqh8OOrV4p1h/pxfdL/+KVrxXXv9JSX101uPjD6f634xW/PNjnEQvDovexvW/bafpp9mfz375bhQd1SfDQac+ySuyKw/6YAAAAAAAAAAAAAAAAAAAAAAAeKNtphPtm+fvjA/+nzM/53yg4dT5PFtpmmZJnn9dX433q1Fd5d4BAAAAAAAAAAAAAAAAAADgsTg7//n4oNfrni51MP6sv2QqXtyM1CPi7mttLFoVlaK1XhKx2Fq1qF9V3p5cWXAXzVE/3dOkGst7BMkk0pye2oh8rVGkmQ+mIq+9eiOuBuO36/ggue3hNspekiUMspLXrzKzav3VSLPYQUlyc87q6+/eqeesNWMqiYja5GbOv05tuffw4X4HAQAAAAAAAAAAAAAAAAAAueuPfksmL1bQEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACswPX//19gMCyKZ+VkldGgGkVkxVsEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgLfAyAAD//0MUZ+o=") r1 = open(&(0x7f00000000c0)='.\x00', 0x8000, 0x50) getdents(r1, &(0x7f0000001fc0)=""/184, 0xb8) openat(0xffffffffffffff9c, 0x0, 0x4, 0x80) ioctl$F2FS_IOC_GET_PIN_FILE(0xffffffffffffffff, 0x8004f50e, 0x0) syz_mount_image$hfsplus(&(0x7f00000001c0), &(0x7f0000000400)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x4040, &(0x7f0000000100)=ANY=[@ANYBLOB='uid=', @ANYRESHEX=0xee01, @ANYBLOB=',barrier,s=cp862,uid=', @ANYRESHEX=0x0, @ANYBLOB=',part=0x0000000000000007,part=0x0000000000000004,\x00'], 0x20, 0x6fe, &(0x7f0000000500)="$eJzs3U9oXHkdAPDvm5lMMl3IztZ2t4rQsMWiW22TDIsVBKuI5LBowcteY5tuQydpSbKSFrGz6qo3PUkPe1iReNiTeBBWPIj1JgiC994LHrwVD468N+9NZvJ3Js0ksfv5wJv3e+/9/nx/33nz5k9aXgCfWHNvx1grkpi79NZ6uv1ko9F8stFYKsoRMR4RpYhKZxXJckTyOOJadJb4dLoz7y7ZbZw3n378wcVHHzU6W5V8yeqX9mq3qb3HCK18iamIKOfrIVV26+/GDv09HKrrpBt3mrALReLguLW3aQ3TfIDXLXDSPYwoj+2wvx5xKiIm8s8BkV8dSkcc3qEb6ioHAAAAJ1N5vwovP4tnsR6TRxMOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAvBiSzj0Dk3wpFeWpSPL7/38nr5apVo833H18cZ/j7986okAAAAAAAAAA4PCNbRbPP4tnsR6TxXY7yf7m/3q2cSZ7fCnejdVYiJW4HOsxH2uxFisxEzE22dNndX1+bW1lZnvLX0Xast1uP8xbzkZEfVvL2RHPGQAAAAAAAABebD+KuZg87iAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKBXElHurLLlTFGuR6kSERMRUU3rtSL+VJRPgvoB2/35kOMAAACAE6iWryeT/3YK7ST7zv9q9r1/It6N5ViLxViLZizEzey3gM63/tI/Wo3mk43GUrps7/jr/8p6aw8YR9ZjRJTjvV1Gns5qnO22mItvxXfjUkzF9ViJxfh+zMdaLMRU1NJJxHwkUa91fr2oF3H2x1vOu7rWF8r1rbGd37J9LoukFrdiMYvtctyoFr2VshpJnOsZ7Q/ViC0Zei/NTvK13IA5utnzfP0y/10m1355wD5Go57NfKybkek093k2Xtk594XOeXLgkWai1P0N6szmKOnm1pGKnH9vmJyfytdprn/an/PDNuRPaVszMRul/OyLeLU/5/c+9+h0f+Mv/PMv12+Xlu/cvrV6aYRTOiSVHfeOFYWtmWj0ZOK1vc++PBPNNBOtwTMxtnXHxMBzGalqno3OhW2wq+U3s9J8vN5zCt5dTh+/HNMxE1djOr4Ss9HoO8PO9uW10ljqz0n2Wittv77V9gj+wud7Kv1sn8qjsPt4aV5e6clr75Wunh3L91z7RUz3ZOn03mffQd4FKp/JC+kYP+6+45wEfZnIr81FdMUb1C6Z+HX2OWG1uXxn5fb8vQHHu5iv05ft+/3X5t8892SeS3q+nO5euLKc1IrzJT32qW60/fmq5n9x6bQrbTt2tnusHpOxGN+Ou3EzFnZ4pVbzz3Dbe+oce23HY43s2LmeY32fcuJuNLNPIVtMHU1WARjYqTdOVWtPa3+vfVj7Se127a2Jb4xfHf9sNcb+Wvlj+Xel35a+mrwRH8YPY/K4IwUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgBfB6v0Hd+abzYWVERaqBxwrSvvW2XhpsA6jHrH3WEleqI46G0MXfp7fr/Dwev73xJ7ZqMWIpvP7vWdRfe4hkkhaI35S0mfiUDosbpyW7WmX9231tysRnT2VaLfbD7uHtj6VlVid2O0ZHN+sHPU7883/tPvq1KLnJQO84K6sLd27snr/wZcWl+bfWXhnYXn2anF73FuLzYXpK9njMQcJjMTq/Qfl444BAAAAAAAAAAAAGE7+r//XVkppIRn+f+lU9qlTXVndeeTzRz1VAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4P/U3Nsx1ookZqYvT6fbTzYazXQpyps1KxFRiojkBxHJ44hr0Vmi3tNdsts4bz79+IOLjz5qbPZVKeqX9mo3mFa+xFRElPP1/sZ36GZ7fzd6+msdKLykO8M0YReKxMFx+18AAAD//yBC8a4=") r2 = openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r4 = syz_io_uring_setup(0x110, &(0x7f0000000140)={0x0, 0xfec9}, &(0x7f0000000240)=0x0, &(0x7f0000000280)=0x0) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0xc, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x842a}}) io_uring_enter(r4, 0xdb4, 0x0, 0x0, 0x0, 0x0) read(r3, &(0x7f00000019c0)=""/4097, 0x1001) getdents64(r2, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) rmdir(0x0) sendmsg$NL80211_CMD_SET_COALESCE(0xffffffffffffffff, 0x0, 0x20004140) 3m46.163228137s ago: executing program 3 (id=574): syz_pidfd_open(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f00000003c0)={'veth0_to_bridge\x00', &(0x7f0000000380)=@ethtool_stats={0x1d, 0x1, [0x7]}}) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x2, 0x1, 0x0, 0x2, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @private}}, @sadb_spirange={0x2, 0x10, 0x0, 0xffffffff}, @sadb_address={0x3, 0x6, 0x0, 0x20, 0x0, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}}]}, 0x50}}, 0x0) 3m45.415631111s ago: executing program 3 (id=577): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, 0x0, 0x2202, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r3 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) sendmmsg$alg(r3, 0x0, 0x0, 0x40800) sendmsg$NL80211_CMD_SET_MPATH(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000880)={0x50, 0x0, 0x4, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x2ee, 0x2d}}}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x40) syz_open_dev$sndmidi(0x0, 0x2, 0x141101) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=ANY=[@ANYBLOB="4c00000002060108000034e400000000000000020500010006000000050004000000fe000900020073797a3100000000050005000200000012000300686173683a6e65742c706f7274"], 0x4c}}, 0x2) mount$fuse(0x0, 0x0, 0x0, 0x308407, 0x0) sendmsg$IPSET_CMD_ADD(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="54000000090601080000000000000000050000000900020073797a310000000005000100070000002c000780060004404e21000005000700e30000000c00018008000140850101010c00028008000140"], 0x54}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) clock_adjtime(0x0, &(0x7f0000000000)={0x66b7, 0x4100000000000000, 0x0, 0x7, 0x0, 0xfffffffffffffffd, 0x77, 0x0, 0x0, 0x0, 0x3, 0x248a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x5, 0x0, 0xf439}) 3m44.289972427s ago: executing program 3 (id=578): syz_open_dev$video(0x0, 0x101, 0xab02) r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$netlink(r0, &(0x7f0000002a80)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000006940)=ANY=[@ANYBLOB="e0000000", @ANYBLOB], 0xe0}], 0x1, 0x0, 0x0, 0x20008020}, 0x8880) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, 0x0, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4044050}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000300)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00') read$FUSE(r3, &(0x7f00000020c0)={0x2020}, 0x2020) setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f0000000780)=0x101, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r4 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000000), 0x20000007d, 0x0) dup3(r4, r5, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/5, 0x211000, 0x1000, 0x100, 0x1}, 0x20) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'lo\x00'}) 3m40.852266226s ago: executing program 3 (id=584): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="280100000000000001000000"], 0x128}, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000007040)={0x0, 0x0, 0x0}, 0x0) recvmsg$unix(r0, 0x0, 0x10040) bpf$TOKEN_CREATE(0x24, &(0x7f0000000180), 0x8) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0), 0x50) socket$inet_sctp(0x2, 0x5, 0x84) r7 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0301, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r7, 0xc004500a, 0x0) ioctl$SNDCTL_DSP_GETODELAY(r7, 0x80045017, &(0x7f0000000000)) 3m37.987512763s ago: executing program 3 (id=590): openat$tun(0xffffffffffffff9c, &(0x7f0000000640), 0x80000, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0x17c, 0x19, 0x1, 0x0, 0x25dfdbfd, {{@in=@multicast1, @in=@remote, 0x0, 0xb, 0xffff, 0x0, 0xa, 0x80, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0x2}, {0x1, 0x0, 0x80}, 0x0, 0x0, 0x2}, [@tmpl={0xc4, 0x5, [{{@in=@local, 0x0, 0x3c}, 0xa, @in=@remote, 0x3500, 0x4, 0x0, 0x0, 0x800, 0x800, 0xfffffffc}, {{@in6=@dev={0xfe, 0x80, '\x00', 0x2f}, 0x0, 0x33}, 0x0, @in=@private=0xa010101, 0x3504, 0x1, 0x0, 0x1, 0x0, 0xabf, 0x1000004}, {{@in6=@loopback, 0x4d0, 0x2b}, 0x0, @in=@multicast1, 0x3, 0x0, 0x1, 0x8, 0x9, 0x0, 0x4}]}]}, 0x17c}}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB], 0x48) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(0xffffffffffffffff, 0xc080661a, 0x0) dup2(r4, 0xffffffffffffffff) connect$unix(r2, 0x0, 0x0) r5 = socket$vsock_stream(0x28, 0x1, 0x0) r6 = socket(0x10, 0x80002, 0x4) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=@newtaction={0x94, 0x13, 0x53b, 0x0, 0x0, {}, [{0x80, 0x1, [@m_sample={0x50, 0x4, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PARMS={0x18, 0x2, {0x9d, 0x0, 0x8, 0x6, 0x1}}, @TCA_SAMPLE_TRUNC_SIZE={0x8}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc}}}, @m_ife={0x2c, 0x2, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x3}}}}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x44000}, 0x800) syz_open_dev$usbfs(&(0x7f0000000040), 0x80006f, 0x81501) close_range(r5, 0xffffffffffffffff, 0x0) 3m21.101120596s ago: executing program 33 (id=590): openat$tun(0xffffffffffffff9c, &(0x7f0000000640), 0x80000, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0x17c, 0x19, 0x1, 0x0, 0x25dfdbfd, {{@in=@multicast1, @in=@remote, 0x0, 0xb, 0xffff, 0x0, 0xa, 0x80, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0x2}, {0x1, 0x0, 0x80}, 0x0, 0x0, 0x2}, [@tmpl={0xc4, 0x5, [{{@in=@local, 0x0, 0x3c}, 0xa, @in=@remote, 0x3500, 0x4, 0x0, 0x0, 0x800, 0x800, 0xfffffffc}, {{@in6=@dev={0xfe, 0x80, '\x00', 0x2f}, 0x0, 0x33}, 0x0, @in=@private=0xa010101, 0x3504, 0x1, 0x0, 0x1, 0x0, 0xabf, 0x1000004}, {{@in6=@loopback, 0x4d0, 0x2b}, 0x0, @in=@multicast1, 0x3, 0x0, 0x1, 0x8, 0x9, 0x0, 0x4}]}]}, 0x17c}}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB], 0x48) ioctl$FS_IOC_GET_ENCRYPTION_KEY_STATUS(0xffffffffffffffff, 0xc080661a, 0x0) dup2(r4, 0xffffffffffffffff) connect$unix(r2, 0x0, 0x0) r5 = socket$vsock_stream(0x28, 0x1, 0x0) r6 = socket(0x10, 0x80002, 0x4) sendmsg$nl_route_sched(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=@newtaction={0x94, 0x13, 0x53b, 0x0, 0x0, {}, [{0x80, 0x1, [@m_sample={0x50, 0x4, 0x0, 0x0, {{0xb}, {0x24, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PARMS={0x18, 0x2, {0x9d, 0x0, 0x8, 0x6, 0x1}}, @TCA_SAMPLE_TRUNC_SIZE={0x8}]}, {0x4}, {0xc, 0x7, {0x1}}, {0xc}}}, @m_ife={0x2c, 0x2, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x3}}}}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x44000}, 0x800) syz_open_dev$usbfs(&(0x7f0000000040), 0x80006f, 0x81501) close_range(r5, 0xffffffffffffffff, 0x0) 1m39.14339733s ago: executing program 6 (id=766): r0 = openat$comedi(0xffffffffffffff9c, 0x0, 0x400, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$kcm(0x29, 0x2, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={0xffffffffffffffff, 0x0, 0x65e, 0x0, &(0x7f0000000a00)="41721a68245f9c9c5dd6b6db870f00dc9cb40601e282785e8ee27b0234716ff3877be6ec9ad4e0d24c3dd0dc4197b1bcc056c5fdd42096f29e4a655344a884cb3f7da142ce7e1c638d29315df42eca53f98d128ed1a116a98cb4831b2d4992cd98ce6ab3b7e6de3fad06667955615baca8288a5fe5605b5862763c004fbb258ed093067e407b4ba8a8017eff1c043b7b4781fc47c86e914ab3968f7796e0b78334fa9b7c691464484ef328b180d97af6d07e65af7dd93983be3b6ce12abac019364a2efb47b2f388fa37bbe2f889142a79c41bf5f3378c5dc759485c2a47beca51786ae52ea891547ad9fdb076b81c3d3045a9bba017ea96a558bb029e34162136e79776459bcc97e4af43b9055cbd2a98d2001a8e8747ff1dedf3191a31a82be77b909cb716023fd375de9dcc8a231d21587ae651b0f8b7e076cc3c08b5c5b80208e9f5269b0b3675ae079e447d262a4309222d91d3ddc7498bc1e0b2bf02f3ab7241c41a259595faca10c7e6d10704b2fd99ed4364932ff676545f2d798c6d5f4b785f96dc3259119d2bb51d8cf418075621afc91b3dd491b4c0efc1da0f8746fd1e409e9b41a1dedd1bff75b89c80b5c36341bc296a92e78be692c08a42a8c225dee4b82f2e8fefcf1b14969539a7ad8bc95870c315a82cdd76b62f88cd047a26794ea1f36dadfb892cd7703b9c5aea99050e8803011acb2c9536a6c9d7cb774b3f0cc61d034036079c155173f44d4f9c32b5b67c883255f371b405d0386a2c9522ce804a630453d5b3f8b0dbcd1b5a6e119f75ee449c4d0f80ae1c9147ed92ad34eff2c5cef358e22033501f59cad1565e1f2538c8319941956f717b02689d5e72468d2d703a9e006649f0b39c9ea7b27323479284237776cd453856c48f8099ea33c12336df6cc65296f6df364dc425484d802ccfd1a477f16f5ea2573496a998f02ee67fcbfdc212b51e8b2e0814588cf0e2b544ce5662f949480785354e1f761b289b6917994e043cf31c36ead14c84c445138891052bd06bd0bc24093ab30909d3bc6cbda9abdc92bb6a031486776e41bc333d20448b01c2b727bed05486166e23ec4c500df4dd150f21c0a74adcfabce5ffa1c17ca3e9c6d0118d2a987e987968a905836a11d56a3e1afab22e488a15060da82a5e9b31dd406fa51f94c45340480642bf754abff76739ce77333b69d506dd5b744c13e4bf6866418fb168cca4baf1cfade0ddfb9bcc2fa69a3a9d7901ced42c8e279119817a99df841a384e2a3a49d25898551399d05c73e5e7fb7f3be3badb175539035a4bbc973855ad1a6fe98b63447fab1535ed85cd9b3db8d629c40badc856bfa3c475217fda7b561da615774b3f986629e01a500c3832e70dba7fbbca608deead32b5808a96354aac1ba0776d9a2e30e1edf7c4d52c605b62d3251190fd71699a9d6dcaf24a12a5b70ddcfdd51cfe608a777a54a87393b8c7d3988d7e33dbf4879ea051c982cc28c1b2ec148e919098b8805c09b83ab561d6083d7d513160e0c705f30b1f75d8a7962c0873bba3b48a72a218dcc990b899d3dc4349200eeb0a8066c03e0446c372472ff30a1e927ce82935325cb4912ce31e8321422425a05291006b0599d3305c6cf94c31d98063db8aca5d48b539f22cd7c3187fe61f671904302a174905931ceb7100b1ae33f9766d537aa586698fb4cd40a7b1bcfd86151a87b1efed6af9b0fe645735454bc8bd09937711c0278cee7964399a9bc2b565ab6236dee08dd11c1acfdeb59b3727e084a311eccd4ebb7e972c486f48111220a03f904ff86bd5f84b90b9a4dc8ec0831eb9299cd307a29e9599c221cb2b7ef8a9d37f0089f6930ad3f06e02a51781e0307abad73b9bcf51ec06c674a594bc6103883c8013f2edbf6baac4a93bfbdc3d738270f71fa5ec47e952604694002eb54d2acad7ac1e16ce08f6c88f992e03c920908781e64e22bd2e2d2f94cb9a3565aff946bf874c0fc45d862c26c58e3776bccf1b66b7c81bba727307f45b371b95b8ca3a026749fe466c1fca5b3e5b6a27106b6af98f7d41fcf1f24f5c26fa46dd35d5babc3537d25c588732775f9dda81b0e7b7578a270873b1cc3883c36ddde23f842c5796da5fda18b4ae0bf23418c9fe7cbeaac4c7895158fe89b9cdf1712a3ad060a92422fcd6ee80b8acb4c8bc27568dc55dea3624ac22109c676d334d634894daa8764e5dc045ab110e616491a7d8c3238c38bcdea0c552ab396233052e12e6fa446d71e57b6d8d7e330fd4c59e4ffb4c12ad734e509290bc55a6ac6577dbe14d63", 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0xc}, 0x50) r6 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_SET_FORCE_PACK_ID(r6, 0x227b, &(0x7f00000001c0)=0x2001) r7 = fcntl$dupfd(r6, 0x0, r6) write$sndseq(r7, &(0x7f00000002c0)=[{0x0, 0x0, 0x80, 0x3, @time={0x7, 0x2}, {0x0, 0x32}, {}, @connect={{0x1, 0x2}, {0x9b, 0x9}}}], 0x1c) readv(r7, &(0x7f0000000000)=[{&(0x7f0000001140)=""/136, 0x3f}], 0x1) close(r5) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="60000000020601046c0001000000000000000000050005000a000000050001000600000005000400000000000900020073797a300000000014000300686173683a6970"], 0x60}}, 0x0) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000440)={'dac02\x00', [0x4e24, 0x4, 0x24, 0x40300000, 0x7, 0x8, 0x8, 0xa82, 0xff46, 0x100, 0xcf3, 0xb, 0xdb, 0x9, 0x6, 0x6, 0xfffe, 0x10088, 0x3, 0x0, 0x4, 0x80000001, 0xf23, 0x2000007, 0xb, 0x2, 0x8003c, 0x0, 0xe90, 0x0, 0xfffffff8]}) 1m37.146630226s ago: executing program 6 (id=768): syz_pidfd_open(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f00000003c0)={'veth0_to_bridge\x00', &(0x7f0000000380)=@ethtool_stats={0x1d, 0x1, [0x7]}}) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x2, 0x1, 0x0, 0x2, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @private}}, @sadb_spirange={0x2, 0x10, 0x0, 0xffffffff}, @sadb_address={0x3, 0x6, 0x0, 0x20, 0x0, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}}]}, 0x50}}, 0x0) mount(0x0, &(0x7f00000002c0)='.\x00', 0x0, 0x2000ca6, 0x0) r4 = syz_clone(0xb2b60000, 0x0, 0xfffffffffffffcd1, 0x0, 0x0, 0x0) r5 = syz_pidfd_open(r4, 0x0) setns(r5, 0x24020000) mount(0x0, &(0x7f0000000000)='.\x00', 0x0, 0x2236824, 0x0) unshare(0x480) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x6004, 0x0) fadvise64(0xffffffffffffffff, 0x36a9, 0x9, 0x4) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000c40)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@array]}}, &(0x7f0000003000)=""/4128, 0x32, 0x1020, 0x1}, 0x28) 1m34.591189375s ago: executing program 6 (id=772): inotify_init() prlimit64(0x0, 0xe, 0x0, 0x0) openat$audio1(0xffffffffffffff9c, &(0x7f0000000240), 0x88002, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x11, 0x3, &(0x7f0000000180)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xc0, &(0x7f0000000440)=""/192, 0x41100, 0x39, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f000056f000/0x2000)=nil, 0x2000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) getpid() r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_inet6_tcp_SIOCINQ(r3, 0x541b, &(0x7f0000000bc0)) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi0\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, &(0x7f00000000c0)={'pcl816\x00', [0x8001, 0x6, 0x1, 0x0, 0x0, 0xcc7, 0x5, 0x7, 0xa, 0x471, 0x2, 0x1, 0x7, 0x4, 0x8, 0xfffb7fff, 0x1, 0x1a449, 0x7, 0x40000003, 0x87, 0x2, 0xf27, 0x0, 0x5, 0x8, 0xfffffffc, 0x1ff, 0x4, 0x10000, 0xfffffff8]}) sendmsg$NFT_BATCH(r2, 0x0, 0x854) sendmsg$NFT_BATCH(r1, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x100000a, 0x5d032, 0xffffffffffffffff, 0x0) r6 = userfaultfd(0x801) ioctl$UFFDIO_API(r6, 0xc018aa3f, 0x0) r7 = syz_open_dev$loop(0x0, 0x8000000000000000, 0x20040) accept4$nfc_llcp(r0, 0x0, 0x0, 0x80800) poll(&(0x7f0000000500)=[{r7, 0x8}, {r4, 0x20}, {r2, 0x8}, {r5, 0x1120}], 0x4, 0x7) 1m34.059681956s ago: executing program 6 (id=775): r0 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$PTP_SYS_OFFSET_PRECISE(r0, 0xc0403d08, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24004045) io_uring_setup(0x1b7b, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000080)={0xd, 0x4, &(0x7f0000001300)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x2, 0x1, 0xd0}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x9}, 0x90) fsopen(0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) prctl$PR_MCE_KILL(0x35, 0x0, 0x8) prctl$PR_MCE_KILL(0x35, 0x0, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r5 = io_uring_setup(0xc6a, &(0x7f0000000040)={0x0, 0x20c8a1, 0x1c881, 0x80000, 0xd1}) io_uring_enter(r5, 0x0, 0x2, 0x17, 0x0, 0x0) 1m31.869874193s ago: executing program 6 (id=786): fsmount(0xffffffffffffffff, 0x0, 0x0) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000540)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x43) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r5, &(0x7f0000000200)={0x2, 0x4e20, @multicast2}, 0x10) setsockopt$inet_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x4e24, @loopback}}, 0x0, 0x0, 0x4, 0x0, "e83ae75240c2d658ec87bb53679fd0000078548ceb6c4414fab0919616e19aecedec1b76aea5922406b64cddaeb9d339ba3c01c2c7b8df8e61740b9af2d4d58654a4af0fa0ce1f830cc1eaf991fd00"}, 0xd8) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, 0x0, 0x0) connect$inet(r5, 0x0, 0x0) sendmsg$inet(r5, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0x100120}], 0x1}, 0x0) sendfile(r4, r4, 0x0, 0x1000000201005) chdir(&(0x7f0000000480)='./bus\x00') r7 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x22480, 0x0) getdents(r7, 0xfffffffffffffffd, 0x58) 1m23.914908046s ago: executing program 6 (id=788): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x11, 0x13, &(0x7f0000000340)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400}, [@printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x6}, {0x85, 0x0, 0x0, 0x2d}}, @printk={@i, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0)={r0}, 0xc) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0xcf) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) socket$nl_route(0x10, 0x3, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000080)=@xdp={0x2c, 0x3, 0x0, 0x6}, 0x80, 0x0}, 0x4040804) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000002b40), 0x24, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x106, 0x2}}, 0x20) mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./file0\x00', 0x3a) mount$tmpfs(0x0, &(0x7f0000002040)='./file0\x00', &(0x7f0000002200), 0x1000000, &(0x7f0000000000)) syz_open_procfs(0x0, &(0x7f0000000540)='mounts\x00') getpid() pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x80000000000, 0x0, 0xfffffffffffff30a, 0x5}, &(0x7f0000000000)={0x1f, 0x0, 0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffe, 0x9}, 0x0, 0x0, 0x0) getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f0000000040)) mount$9p_unix(0x0, &(0x7f0000003600)='.\x00', &(0x7f0000003640), 0x2000000, &(0x7f0000000080)=ANY=[]) 1m7.443310825s ago: executing program 34 (id=788): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x11, 0x13, &(0x7f0000000340)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400}, [@printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x6}, {0x85, 0x0, 0x0, 0x2d}}, @printk={@i, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000007c0)={r0}, 0xc) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0xcf) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) socket$nl_route(0x10, 0x3, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000080)=@xdp={0x2c, 0x3, 0x0, 0x6}, 0x80, 0x0}, 0x4040804) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000340)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000002b40), 0x24, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x2, 0x0, 0x106, 0x2}}, 0x20) mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./file0\x00', 0x3a) mount$tmpfs(0x0, &(0x7f0000002040)='./file0\x00', &(0x7f0000002200), 0x1000000, &(0x7f0000000000)) syz_open_procfs(0x0, &(0x7f0000000540)='mounts\x00') getpid() pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x80000000000, 0x0, 0xfffffffffffff30a, 0x5}, &(0x7f0000000000)={0x1f, 0x0, 0x0, 0x0, 0x6, 0x0, 0xfffffffffffffffe, 0x9}, 0x0, 0x0, 0x0) getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f0000000040)) mount$9p_unix(0x0, &(0x7f0000003600)='.\x00', &(0x7f0000003640), 0x2000000, &(0x7f0000000080)=ANY=[]) 24.009689662s ago: executing program 7 (id=874): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000030c0), 0x0) openat2$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001640)=ANY=[], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$inet(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x4000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x270, 0x0, 0x8, 0xfa04, 0x108, 0x6c02, 0x230, 0x194, 0x194, 0x230, 0x194, 0x3, 0x0, {[{{@ip={@empty=0x1e00, @broadcast, 0x0, 0x0, 'veth0_to_hsr\x00', 'veth0_virt_wifi\x00', {}, {}, 0x6}, 0x0, 0x70, 0xd8, 0x0, {0x0, 0x74020000}}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x2, 0x0, 0xfffffffc, 0x2b0, 'pptp\x00', 'syz1\x00', {0x47c}}}}, {{@ip={@multicast2, @dev, 0x0, 0x0, '\x00', 'tunl0\x00'}, 0x0, 0xb8, 0x100, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'amanda\x00'}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2d0) syz_usb_ep_write$ath9k_ep2(0xffffffffffffffff, 0x83, 0x3b, 0x0) syz_open_dev$evdev(0x0, 0xfefffffa, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f0000000000)={0x3, 0x0, 0x0, 0x0, 0x7fffffff}) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000100)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x7fff, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x4}, 0x50) capset(&(0x7f0000000500)={0x20071026}, 0x0) r5 = accept4$unix(0xffffffffffffffff, &(0x7f0000000300), 0x0, 0x800) ioctl$F2FS_IOC_SEC_TRIM_FILE(r5, 0x4018f514, 0x0) open(0x0, 0xc40, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000040)={'vlan0\x00', &(0x7f0000000000)=@ethtool_eee={0x45, 0x6, 0x7, 0xa2d, 0x5, 0x9, 0x80000001, 0x8001, [0x7906, 0x8]}}) 17.125486363s ago: executing program 4 (id=881): syz_pidfd_open(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f00000003c0)={'veth0_to_bridge\x00', &(0x7f0000000380)=@ethtool_stats={0x1d, 0x1, [0x7]}}) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x2, 0x1, 0x0, 0x2, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @private}}, @sadb_spirange={0x2, 0x10, 0x0, 0xffffffff}, @sadb_address={0x3, 0x6, 0x0, 0x20, 0x0, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}}]}, 0x50}}, 0x0) mount(0x0, &(0x7f00000002c0)='.\x00', 0x0, 0x2000ca6, 0x0) r4 = syz_clone(0xb2b60000, 0x0, 0xfffffffffffffcd1, 0x0, 0x0, 0x0) r5 = syz_pidfd_open(r4, 0x0) setns(r5, 0x24020000) mount(0x0, &(0x7f0000000000)='.\x00', 0x0, 0x2236824, 0x0) unshare(0x480) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x6004, 0x0) fadvise64(0xffffffffffffffff, 0x36a9, 0x9, 0x4) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000c40)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@array]}}, &(0x7f0000003000)=""/4128, 0x32, 0x1020, 0x1}, 0x28) 15.80380432s ago: executing program 5 (id=883): syz_pidfd_open(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f00000003c0)={'veth0_to_bridge\x00', &(0x7f0000000380)=@ethtool_stats={0x1d, 0x1, [0x7]}}) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x2, 0x1, 0x0, 0x2, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @private}}, @sadb_spirange={0x2, 0x10, 0x0, 0xffffffff}, @sadb_address={0x3, 0x6, 0x0, 0x20, 0x0, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}}]}, 0x50}}, 0x0) mount(0x0, &(0x7f00000002c0)='.\x00', 0x0, 0x2000ca6, 0x0) r3 = syz_clone(0xb2b60000, 0x0, 0xfffffffffffffcd1, 0x0, 0x0, 0x0) r4 = syz_pidfd_open(r3, 0x0) setns(r4, 0x24020000) mount(0x0, &(0x7f0000000000)='.\x00', 0x0, 0x2236824, 0x0) unshare(0x480) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x6004, 0x0) fadvise64(0xffffffffffffffff, 0x36a9, 0x9, 0x4) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000c40)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@array]}}, &(0x7f0000003000)=""/4128, 0x32, 0x1020, 0x1}, 0x28) 15.544051615s ago: executing program 7 (id=884): r0 = syz_open_dev$loop(&(0x7f00000005c0), 0xffff, 0x109041) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffff}, 0x6) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_aout(r1, &(0x7f00000008c0)=ANY=[], 0x5b) sendfile(0xffffffffffffffff, r1, &(0x7f0000000000), 0x9) r2 = socket(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x80) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xce7c1000) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000640), 0x0) r6 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r6, &(0x7f0000000000)={0x28, 0x0, 0x2711, @hyper}, 0x10) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001340)={&(0x7f00000000c0)=ANY=[@ANYRES32=r2], 0x4c}}, 0x40000) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0xfc) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events.local\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, 0x0) 14.464805918s ago: executing program 1 (id=885): getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f00000000c0)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000180)=0x3) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x804, 0x0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, 0x0) mmap$binder(&(0x7f000023d000/0x2000)=nil, 0x2000, 0x1, 0x11, r3, 0x6) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e21, @empty}, 0x10) setsockopt$sock_int(r4, 0x1, 0x8, 0x0, 0x0) connect$inet(r4, &(0x7f0000000140)={0x2, 0x4e21, @empty}, 0x10) sendto$inet(r4, &(0x7f00000013c0)="bd31", 0x2, 0x0, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r6, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r6, 0x40946400, &(0x7f00000000c0)={'fl512\x00', [0x4fa7, 0x105, 0x2, 0x10000421, 0x2000001, 0xcc7, 0x7ffffffe, 0x5c952398, 0x5, 0x3ff, 0x2, 0x300, 0x1, 0x1, 0x9, 0x0, 0x40400, 0x8, 0x48f3, 0x1ff, 0x80000089, 0xa, 0x1400000, 0x20001e54, 0xffffeadb, 0x3, 0x3d, 0x8, 0x4, 0x7ffffff, 0x485b]}) mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2000007, 0x12, r6, 0xbc7ae000) sendmsg$NFT_BATCH(r5, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[], 0x114}}, 0x0) 13.162547254s ago: executing program 1 (id=886): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$rds(0x15, 0x5, 0x0) ioctl$sock_proto_private(r3, 0x89e0, 0x0) openat$capi20(0xffffffffffffff9c, 0x0, 0x100, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000040)="415b7ac700000000", 0x8) r4 = accept(0xffffffffffffffff, 0x0, 0x0) sendmmsg$alg(r4, &(0x7f0000000740)=[{0x0, 0x0, 0x0}], 0x1, 0x0) recvmsg(r4, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) mlockall(0x6) sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)={0x74, 0x0, 0x300, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_SCAN_SSIDS={0x58, 0x2d, 0x0, 0x1, [{0x4}, {0xa, 0x0, @default_ap_ssid}, {0x8, 0x0, @random="e45c1dd2"}, {0x4}, {0xa, 0x0, @default_ibss_ssid}, {0xa, 0x0, @default_ibss_ssid}, {0x1e, 0x0, @random="b3e9829139d22a1cb3d2409eaa16a9f91d4588040182deed4e3b"}]}]}, 0x74}}, 0x24000084) shmget$private(0x0, 0x1000, 0xc230eea466119881, &(0x7f0000000000/0x1000)=nil) add_key$fscrypt_v1(&(0x7f0000000040), 0x0, 0x0, 0x0, 0xffffffffffffffff) 12.554729269s ago: executing program 5 (id=888): bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x43) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r5, @ANYRES32=r4, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r5, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r3}, 0x20) sendmmsg$inet6(r3, &(0x7f0000002440)=[{{0x0, 0x0, &(0x7f0000000480)}}], 0x1, 0x10) 11.547619508s ago: executing program 1 (id=890): syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x0) pipe(0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x10000008ebc, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x1, 0xa0181) writev(r2, &(0x7f0000000600)=[{0x0}], 0x1) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x10081) r3 = socket(0x40000000015, 0x5, 0x0) bind$inet(r3, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) setsockopt$bt_BT_DEFER_SETUP(0xffffffffffffffff, 0x112, 0xf, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000200)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x10, 0x10, 0x9, [@int={0x0, 0x0, 0x0, 0x1, 0x5, 0x20, 0x0, 0xfc}]}, {0x0, [0x61, 0x30, 0x2e, 0x61, 0x61, 0x5f, 0x0]}}, 0x0, 0x31}, 0x28) r4 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r4, &(0x7f0000000300)={{0x6, @rose}, [@bcast, @null, @default, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x47) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(r1, 0xc0286405, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000007480)='./file0\x00', &(0x7f00000074c0), 0x4000) r5 = socket$kcm(0xa, 0x3, 0x87) sendmsg$kcm(r5, &(0x7f0000000580)={&(0x7f0000000380)=@l2tp6={0xa, 0x0, 0x7, @dev={0xfe, 0x80, '\x00', 0x28}}, 0x80, &(0x7f0000000c00)=[{&(0x7f0000000900)='r', 0x1}], 0x1}, 0x40810) getsockname$packet(r3, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x0) 11.349069959s ago: executing program 7 (id=891): pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) mount$overlay(0x0, 0x0, 0x0, 0x40000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x3) ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000240)={'\x00', 0x4000, 0x6, 0x1, 0x2, 0xff}) sched_setaffinity(0x0, 0xfffffffffffffd7a, &(0x7f0000000580)=0x8000000002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000400), 0x0, 0x0) read$msr(r2, &(0x7f000001aa40)=""/102392, 0x18ff8) r3 = socket(0x23, 0x4, 0x0) ioctl$sock_inet_SIOCGIFBRDADDR(r3, 0x8919, &(0x7f0000000000)={'hsr0\x00'}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000d84000)={0xa, 0x2, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000300)={@in6={{0xa, 0x0, 0x6, @remote, 0xfffffffc}}, 0x0, 0x0, 0x6, 0x0, "3f114438efdaca16d374b49a365be44d5e860ea3ba676c0b5047b80e2c3535d5bd9db3c8572560f4d1be5cd41f7716082ee3589f099942e6f1c395ddb8160381baadf27900"}, 0xd8) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f0000000480)={@in6={{0xa, 0x0, 0x20000000, @remote, 0x1}}, 0x0, 0x0, 0x0, 0x0, "ddfd3b7ed7c6a1c172a987ae5ce3cafd64c9a736831a5912d606798fb75c9981c4b3ac0e06891ff18bc5543ed57215a3c45f9154dfa319e52a15a2b9acf80c07fb1a854dad742eef6187f2304844c296"}, 0xd8) sendto$inet6(r4, 0x0, 0x0, 0x20004002, &(0x7f0000b63fe4)={0xa, 0x2, 0xa15f}, 0x1c) fsconfig$FSCONFIG_SET_FD(r1, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r5, 0xffffffffffffffff, 0x0) r6 = openat$vcsa(0xffffff9c, &(0x7f0000000140), 0x101000, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r7, 0x8933, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r7) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r6, 0x0, 0x0) 10.64011063s ago: executing program 5 (id=902): bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x43) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r5, @ANYRES32=r4, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r5, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r3}, 0x20) sendmmsg$inet6(r3, &(0x7f0000002440)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000480)}}], 0x2, 0x10) 8.451770118s ago: executing program 5 (id=894): r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_SETGAMMA(r0, 0xc02064a5, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) setresuid(0x0, 0x0, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) modify_ldt$write(0x1, 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) ioctl$SOUND_MIXER_WRITE_RECSRC(r4, 0xc0044dff, &(0x7f0000000200)=0xb) r5 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000140), 0x100, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x10, 0x4, 0x8, 0x5}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) ioctl$SNDRV_PCM_IOCTL_PAUSE(r5, 0x40044145, &(0x7f0000000180)=0x7e3c6070) mount$nfs(0x0, &(0x7f0000000640)='.\x00', &(0x7f0000000680), 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='acl,f']) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) 6.728416968s ago: executing program 1 (id=895): socket$inet_sctp(0x2, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_BT_POWER(r3, 0x112, 0x9, 0x0, &(0x7f00000001c0)) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket(0x10, 0x2, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r5, &(0x7f0000000340)={0xa, 0x5, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0xfffffffe}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000000c0), 0x4) writev(r5, &(0x7f0000000100), 0x0) close_range(r4, r5, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@dev={0xac, 0x14, 0x14, 0x3f}, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="3801000018000100feffffff0001000000000000000000000000ffffe0000002fc0100"/47, @ANYRES32=0x0, @ANYRES32=0x0], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x7, &(0x7f00000000c0)=0x10046, 0x4) socket$inet_tcp(0x2, 0x1, 0x0) 6.728214428s ago: executing program 2 (id=896): socket$kcm(0x10, 0x2, 0x4) setpgid(0xffffffffffffffff, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/stat\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socket(0xa, 0x5, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) io_uring_enter(0xffffffffffffffff, 0x3ae8, 0x41d2, 0x0, &(0x7f0000000080)={[0x5]}, 0x8) r3 = syz_io_uring_setup(0x10d, &(0x7f0000000140), &(0x7f00000000c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x48, 0x0, @fd, 0x3, {}, 0xa6, 0x3}) io_uring_enter(r3, 0x47f9, 0x0, 0x0, 0x0, 0x0) pipe(&(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x1, 0x0, 0x0) splice(r6, 0x0, 0xffffffffffffffff, 0x0, 0x25a5, 0x4) write$binfmt_script(r7, &(0x7f0000000180)={'#! ', './file0'}, 0xb) semget(0x0, 0x1, 0x281) read$FUSE(r7, &(0x7f00000006c0)={0x2020}, 0x2020) 6.728037278s ago: executing program 4 (id=897): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) dup3(0xffffffffffffffff, r0, 0x80000) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_mount_image$ext4(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)) openat(0xffffffffffffff9c, &(0x7f0000000080)='./file2\x00', 0x101042, 0x40) symlinkat(&(0x7f0000000000)='.\x00', 0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00') syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./bus\x00', 0x3000009, 0x0, 0x1, 0x0, 0x0) linkat(0xffffffffffffff9c, &(0x7f00000006c0)='./file2\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./file7\x00', 0x0) mount$overlay(0x0, &(0x7f0000000340)='./bus\x00', &(0x7f0000000b80), 0x200008, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1'}}, {@upperdir={'upperdir', 0x3d, './file0'}}, {@index_on}, {@metacopy_on}]}) syz_mount_image$fuse(&(0x7f00000001c0), &(0x7f0000000240)='./bus\x00', 0x322020, &(0x7f0000000240)=ANY=[], 0x1, 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file7\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./file1\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000440)='./file2\x00', 0x42, 0x0) openat(0xffffffffffffff9c, 0x0, 0x105042, 0x189) 5.631329972s ago: executing program 1 (id=898): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000180), r0) socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x1, 0x1, 0x40, 0x40, 0x41, 0xffffffffffffffff, 0xfffffffe}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000840), &(0x7f00000003c0), 0x1003, r2}, 0x38) r3 = socket$kcm(0x23, 0x2, 0x0) sendmsg$kcm(r3, &(0x7f0000000140)={&(0x7f0000000000)=@llc={0x1a, 0x311, 0x0, 0xd, 0x7f, 0x4, @link_local}, 0x80, 0x0}, 0x0) bpf$MAP_LOOKUP_ELEM(0x15, &(0x7f0000000b80)={r2, &(0x7f00000005c0), &(0x7f0000000b40)=""/31}, 0x20) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x11, 0xb, &(0x7f0000000240)=ANY=[@ANYRESOCT=r1], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_ifreq(r4, 0x8990, &(0x7f0000000180)={'bond0\x00', @ifru_names='rose0\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b7000000000000"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ppoll(&(0x7f0000000500)=[{}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r5 = socket$key(0xf, 0x3, 0x2) recvmmsg(r5, &(0x7f0000000440), 0x0, 0x2000000022, &(0x7f0000000480)={0x77359400}) setsockopt$sock_int(r5, 0x1, 0x4b, &(0x7f0000000040)=0xfd87, 0x4) sendmsg$key(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=ANY=[], 0x10}}, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000080)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha384\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, 0x0, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x8, 0x0, 0x0, 0x0, 0xfffe}, 0x0) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r7, 0x800452d2, &(0x7f0000000100)) 5.630230652s ago: executing program 2 (id=899): syz_pidfd_open(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f00000003c0)={'veth0_to_bridge\x00', &(0x7f0000000380)=@ethtool_stats={0x1d, 0x1, [0x7]}}) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000b, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x2, 0x1, 0x0, 0x2, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @private}}, @sadb_spirange={0x2, 0x10, 0x0, 0xffffffff}, @sadb_address={0x3, 0x6, 0x0, 0x20, 0x0, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}}]}, 0x50}}, 0x0) mount(0x0, &(0x7f00000002c0)='.\x00', 0x0, 0x2000ca6, 0x0) r4 = syz_clone(0xb2b60000, 0x0, 0xfffffffffffffcd1, 0x0, 0x0, 0x0) r5 = syz_pidfd_open(r4, 0x0) setns(r5, 0x24020000) mount(0x0, &(0x7f0000000000)='.\x00', 0x0, 0x2236824, 0x0) unshare(0x480) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x6004, 0x0) fadvise64(0xffffffffffffffff, 0x36a9, 0x9, 0x4) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000c40)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@array]}}, &(0x7f0000003000)=""/4128, 0x32, 0x1020, 0x1}, 0x28) 5.007610918s ago: executing program 7 (id=900): r0 = socket(0x2, 0x3, 0xff) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x6) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r4 = fanotify_init(0x200, 0x0) r5 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) ioctl$int_in(r5, 0x5421, &(0x7f0000000100)=0x5) connect$netrom(r5, &(0x7f0000000080)={{0x6, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}, [@null, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x8, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) fanotify_mark(r4, 0x1, 0x40000032, r3, 0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000e40), 0x40080, 0x0) ioctl$TIOCPKT(r6, 0x5420, &(0x7f00000000c0)=0x1) ioctl$TCSETS(r6, 0x5402, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, "fe94b89fc43c3328eae0cae1f5eba329e6f216"}) splice(r6, 0x0, r3, 0x0, 0x7ffff000, 0x1) readv(r4, &(0x7f00000001c0), 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r5, 0x81f8943c, &(0x7f0000000280)) ioctl$BTRFS_IOC_RM_DEV(r1, 0x5000940b, &(0x7f0000001e80)={{}, "7b9dc780137332830b193479b56548c31b2b7179df3e3670df548820ae111a9e221bd82b7c82f5d2b84db1522bb00749825a03987e3dbbef0eb7f784083c44009f78e787445dd7fd6a45255d815ca3478a732d5a9a49553fc442c378beeeee9d3fdfe41d9c661f74d670f88165bc151bf70699414c6d84352ce182ad2a34c6e2457f39ac5b2c5e3365e304e27ce326296c13e436416ebf3d861f83764041d8f83010f3da66d545ed3d76c38e4e2c47a1c4e08f54ff02ee8ddcaa4a6956fcec52df88b973d4f838fda706d03b2aac6d4848edf260f08b0a8eab964ba54b155ed51b61593221241b8126e399e540212440d0e5c9a989fe667f0a3bf85dc3fcb7c803a135aef2c48a3557835c937ec9e5ab4508eec149d757419a8253e65603744fd8008240d77cd5c29b97c1bd670b7b773eaf97c8365318ccf93b1171c1e360fdb88a63041dbfb2773e675eb66c5c91c19238d36f18859a9b48e71fcde726466c57257035619d82b2a4e4f2feb30e6c79d39cb4ba62eaae83bbca9dd955356fdf8c4b8896dcfdbcc04fdc65861fc12f45d9eb4c40b5fba12320ebcfea7a5a2796477887151c0c6add4ad7b928e4192bf08e706265e884c8a8d90fc53166c3d672b14010bf207099f73215415257280455d51c820979d643d0dfbea797c2e01514f566c6ddd00b5904debe263d3b80cc548a65b51b3e93d28b9dbd6d973bb1b4582fb626ef3cb7cadf5475f675d9faf522d4f724777923586fb1413057a128c72daa3dc506f6e63fe40566d57cb64cbc8c3541dd22ecff5fad21da04970de6071bcab16ee8fb03a8a9079c72661e98a7fc160f369205e119780d9fbb85029dd00c5f5ab9e6e34a08a6b57c61d43330e96297c89f5074980d62062d04a00fceac8f95abc7313c57bd67d16c1cc9895c7ef1398fe307d397eccb7746606dc263c1cebec172909d8df80b69464851461da1b20a74d3225e724c2e1f0e507716d2b76ad0728dffcc07f89e19d1902bee7cdfce794b825d2ca4a6c5d9b5c26c861d0a4ad40fc9dd36d70aa9b4e3a1247be8098128da9c074b9048df246134677f1479fd657e3f1bf184801002604bbcc482527838be0a26f22a44a7899fdf4d71c54dd4ab8e6bf86fb2200075827c5b040f71101a9c9eb6920175eb7b510b21911422d8ee8e74fe4607808690bbbf45b93226d801945bf8e76183b2e5fff93562d660ab9d4bbd29568f1771fc69333a4fe74816154d1c02bd3a8ca2280862b7d8a880c2621a0977cd495ba9f9c8ea6bac8b45ea3e2c74fd845523b6a2e2ddddacea59377c9c9401c6850f2b32d5fdccca5325530791318a15382840f2881430778d8af9d77baa34bfe124f013120c0386834c8b06842df0ea7b8bb369b6abe6615e5b6b1901e15e5ae864f6a13f3be12db563e435204f7fd9d7fa2b9483cd1b7ea27f51faafefb914b66d93b7dd891981aa05076dc8e428a0b92d5a1fc892b27f9af504b9497d2a968b2277bccbf13675751a23f12d98e4cfb282ffbf1c193e3b19246776e1796fc1eb0653a9a18e47a25d69ad3da3aab29219931d43fe53fbf76d8a558e288497afb240d728db75d32f58f935a2c1c3374caffec8b22dc0d5621615f354da5412e9fd1e9108fe8519049534b5043f3cf5762df67c83fd5ff851b3a7109cac156f012cff2b531449fc7554e67046b22f99e3e0fe1ccbee5bff6a9b5f84adc07715d51ddeddbc545c486161ef22c176cb1ecdcd432b1d17b31cd13212e136ceb56a48a7e25c20857f3542e04f94fbfd09b4f647b4db3c01adfe44ef8422a6a8b1ed0cd1e36371ddd41439205489c5cdd24d2b60e58da10755a0ec3814d57afbc7b1309858462cb0f4802f5f696e4f3ba7aacf3d50fb2c7e38775480c0ef32bb0bcfbbd95c37e360419527459b4c4113e9c5ff0acb2ab4de090e5b1b5acf2b7dbf9b361329957e8fbb177d4ae6c313994e76c2f459ca760728e6987d2ca4c40dba32e96db0744a2f88c4e5d4272f8ff390e6135ee99ae2141f162e266d2344783e83fdf7b387374343182a778ba9a4f7a4fcd084dfe42b4d49abd2d6ff83bb04db8529fa51fa86fe28aae7b3b175d1c9c2354f62c007e61f0b35f0e124513ccaed986728763cf308835fa8171d500eabcb3abf6c5d843ffe622c1f9c17cb318fffd0390673e7b139ce77526a438bb3d733c6253512d6eb850d4ca1c3192c057001912e5050f89fae0bdb2338c31b5aa8ebb22cbb4cc1fcd79655de8bcb8270309a01933333f13a685f652db865f510813ae4a7b504f0bab07cbf37a69695fc30ccfd7b6d9d82073ef78ab86023c8970fa65f55636d495d11423bb2734e9f0c90c4e501e46b1595683e9e5cb3a01dd25df189e56c6d6f91646dc4de093b9e11096252d119b1923c715bc27497d3abc6ee2bd09c9015f7868b3e3a86b5cd1ad1298f54ae115b08bfa0207904cb0ba1457e3b283528c3042746d48bc1fca6064f25dcab336ef3c9056b3910cb2597289079c064c55ea4fa395301d5124f28bafd231acc66be97b19888fad880050c5e7e6028e3b037233ed50c393812b1eef14c2bed08e40313cf2a48cd6fad90e6dba3d08ecf5e717b6e0f53cbdd0e3519fae9101234590e176c477c0cd9352e1fc68079e49149470f70f3e767a454b2da0c9dc16e46b68a1976cd8fc4b5e08c305c62ce7ef75d60fa3f895cdee4c2cd359dc35fc1d6f8ada99afa5192719a1be19ddab33b942351e09894cde0931f1ca3d2d8dd2cad6241a350cfd2f9950979567cb1face625d9c446671457fb6ddcf67ff29868a61e3c626938641a2bc846c78e0b4209f514907dbd210e886b9f73070d0aeffb12495e59c0e33b00bb95fe82c35f9e00cf0091c09d6dd258267373848dca0cffdbe5b78e6dc3d7d6c2c4d9ef9cdb1a21fea5146a3c2fee234cdaf7f89c86259e652dd0232a93dfeb720ebc427c0bb0e603c6aa40bf9ef367ebd50d1e123a69068f5f7d5ae6f7793b273f42b8527a5b54ad2a0b693576aa9a82c754dfa51567f4a1e97bc2ec1aac25fb90e983e8ee3d088947cc86004fbdbdb6679fab835cc6460ad47ae599aee9538021c86e88f45af11ed91446fa67190a770fc659d52ce75b5cec756431b01f3330d4b8512b45413c2d46367325d014b92313c9f0e53ad7df74acffb1f4ba469d037160197ff0fcfe5dfc5511084a5c87d542fd30b85717806a135b51d713b4f87e36d974e422da088979003542d73a174e9c39a863d3e5c33de0abbaf454738e8f7ff0ae40ecbcca09a4f71706d677cb8f2e11ab9caf640f6cdfcac4e63621e5c3899bb21ce479d821b7aa1075af01189781d92cb76e697ba94ab5e6e1065284649e2e8fa729c66f52d549ccfe8c37968c5c31de5834abf82b09138672bdf6582293182ab78b27f62fa56bafb04cde3fb726bfd898ab9d0d96c978f978a4dc94a89f65fd55b065a33bf1fc31d69eeba7246373580d29f58e36afca9b0b6237e69dd9f1c2c1ecbb206ff15d7c63702689888c02691af75c25a785e7cddffedc60172bd6dfc71212c7554abca3aa9a8834d93054c9f5b5ed0a5de8d6feb0ad6373a17701171e639ac0c29f2164eb13f1be2a700106927205a4debd8345424ff6d367d63191738370dbe907b4e21208ac7efc5c666090d95552e84617505f7ae0a383d5e5afb6deb969140d5d87f5e4be9d753690a8bcfcef8c2180116af3a0afbcbe86149c7c457f288c4b0b4344b36e7907d812bc59b41992551a63a790d652fa5b664bcea972569aad3f734fa660e143331a8bb4b0ed298d140fd896438028504e73692bd44991a0d4410a38986c0cb879b5bd7827bec6e502a94cd3394fca02d6772bd5d2588e92a83218f001b60ccaadf2a9a6d829d15d19dbc449971f96221a720feb47580fd57d640bf81d9dac82c7b6c75a3c8d582dabd030465293ee0856919eddce50a70bd3622fc165d9b7da8367d0d633f5bef7ad47f36314fa473292e2c12c5bd3be22eb1530a925570919e731d716cc4b52e578e8b9a9ac6895bff06c75e6618dc7b34f3d571f9aac02c5f68106adf6ce6f137c7f5f249baadd3cd44ebb84cb8705790521b564322dc7ee58e83e78605208ad092805ffa7c841edf8f88663a9067e13374c216a7e1891d2287d01d87e1d71c37a68045975d846b4cccecc98a92ab55b44be105e3544a8bfd21790108a3dc54aeb9a37eb3eeae07146a83554a1fe2e19ba5c764b5f60e6565f0845840a8e50a9abbbb89bbe081e3f5dc62d6121f0100102758b7486754f4d48ca4a9896d465a6aee65d849cea3245122db42d1a9230841fa81206d53e3b026bd9f9ac07b3deedbb9dfd3b339dc045a4752a92b2ff162ee90ac466d33b73dfbe954bdc13a80955b8c2d300a7f1b71045ce019e28ef12b830358c6434349d6ee045266bac4e98159c263c17ccfe1fa43cf7981501819f21a29dd43a389d5907acd5554df6d12be4268876f7a429013fc48a89a20be13df1a4be1a17f844474e4a5f69273cfe6956594e9c70d56ebc15a81e1cc8a7277695c0c7effa4e3475cbfb5d77899588b6d6db661913fee5015745e6b40c65f9664185e6ed8caead63e85969549f08cb8073342e040711b26b41ccaad6fef65128fde91f0b6efc9f4b4159e97ade4e5b8d2410eb1bcef4aec58db0b1e62ee2288539f7a91ef5e0a9a2bc0adfa5dbebd177433d6c7b4b56af41118997afcbf48656872fd48e0ef130687e484e1c02bc945c300aad545b76796d9e41ce808334238d76b9c4bae0ae54747ed70d183e2b810cbe88608bef08223cf4007f22e4bc435a6b87cbe7a1f174d8930c0dddcc0ac0794c79a600f9248fcfebea7df1a121a50406f957319c5ead42e8619ba155fd5ed6a6da6e67b6809df447aab045cab4f4a1b893b06e372cd834b296bebc0387064ae3151fec8ba52b614a1aa6d23300aaf1bc0890ca5b41c6c36a4f846f246e7ea66f798bd68554f09b5ce0dfccfd9586dec7bf6588821fb39483bede73450c78149365ed787147435408102672240903a6d1e2213941139d6e97a550d2705ca76360d42f945de0d12ae954302457da09fb319fb3a7dabc3d05a029cf1bba5a55300242e8604c070f6fb63465bf4e02cca56eb58611eac0c5c6a6589c57176799ca2c6d174957dae09996ac8b3a32c06c152c569a67512d3334a8cdfa1b3aa88b21060984f71b4fb1ca7d18369090cb20ef62474e1ce424a85f8e81265a15593b0abcd9cc67e98e05cd88a66329da45100716ec66c29bfb1dfce49cc12be2194d1a3ddedfc82b353c7c61aa3ec3cd951637fd80f95a1528fe231e2f7ff4d9143c8f28447f986e8442f687f4d9366b059c605b2d83a3ded99c3ed5bc59f709ebfedd38165bd66df0dbc93c91cb971a7c731de55b45d7c6a5bd0f4f6587a017acbfea8237fb45382614f4b47e595d3879c2f8f957c1ac430b44c97452b8df3d136a8d2f5f93bac99d177ec24af0be021b735319214e476cdb4240b99fbf43fda99ff0b649c1551689865387584ebb494fecc3b1d58c0d3a017d9c94665257160447af5288d1d5ce006e44be307dc61fb0ff1250da9783f85ba82012cb34395d251760ea1fab99935d9246a14d01b98e48e6b1b48194bd163e02849495cea1555b41ce8f876845cace38120d53bfb5d83563a891f9b671c9a00ddf887f780ade9e1e52b1a381e28ea4f8ea1d9c1111268e1843888f861be71bc72b5823963f23c9ec433ab9954a246cddd3d9960214bbfe9da770f8748303462"}) setsockopt$inet_int(r0, 0x0, 0xb, &(0x7f0000000080)=0x100, 0x4) 4.767869052s ago: executing program 4 (id=901): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$rds(0x15, 0x5, 0x0) ioctl$sock_proto_private(r3, 0x89e0, 0x0) openat$capi20(0xffffffffffffff9c, 0x0, 0x100, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000040)="415b7ac700000000", 0x8) r4 = accept(0xffffffffffffffff, 0x0, 0x0) sendmmsg$alg(r4, &(0x7f0000000740)=[{0x0, 0x0, 0x0}], 0x1, 0x0) recvmsg(r4, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) mlockall(0x6) sendmsg$NL80211_CMD_TRIGGER_SCAN(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000240)={&(0x7f0000000140)={0x74, 0x0, 0x300, 0x70bd28, 0x25dfdbfb, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_SCAN_SSIDS={0x58, 0x2d, 0x0, 0x1, [{0x4}, {0xa, 0x0, @default_ap_ssid}, {0x8, 0x0, @random="e45c1dd2"}, {0x4}, {0xa, 0x0, @default_ibss_ssid}, {0xa, 0x0, @default_ibss_ssid}, {0x1e, 0x0, @random="b3e9829139d22a1cb3d2409eaa16a9f91d4588040182deed4e3b"}]}]}, 0x74}}, 0x24000084) shmget$private(0x0, 0x1000, 0xc230eea466119881, &(0x7f0000000000/0x1000)=nil) add_key$fscrypt_v1(&(0x7f0000000040), 0x0, 0x0, 0x0, 0xffffffffffffffff) 3.734853592s ago: executing program 7 (id=903): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={0xffffffffffffffff, 0x0, 0x0}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, 0x0, 0x0) setsockopt(0xffffffffffffffff, 0x84, 0x81, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x0, &(0x7f00000002c0)}) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000000c0), 0xfefe) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000b80)='n', 0x1}], 0x1}, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x9, 0x7a8, 0x6}, 0x14) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "fb00080000528e46", "252432e72844858a068b92a5a810f4dc", "b5ab0900", "5aee41448c84afb7"}, 0x28) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r2, &(0x7f0000001300)={'syz1\x00', {0x9, 0x7, 0x5, 0x5}, 0x3f, [0x9, 0x2, 0x18, 0x2, 0x2, 0x400, 0x80000000, 0x0, 0x8, 0x0, 0x6, 0x1, 0xfffffffb, 0x39, 0x747d5e13, 0x800, 0xfffffb9a, 0xfffffffe, 0x0, 0xfffffffb, 0x2004, 0x10003, 0x0, 0xf250, 0x80, 0x4800, 0x300000, 0x7, 0xe, 0x4623f, 0x0, 0x10001, 0x1ff, 0x8000, 0x0, 0x3, 0xc, 0x3, 0xba55, 0x8da8, 0x2, 0x202, 0x2, 0x4, 0xe, 0x4, 0x2, 0x6f, 0x8, 0x9, 0x1, 0x199d, 0x6, 0x2, 0x9, 0xffffffff, 0x4, 0x6, 0x1000, 0x5, 0x3d, 0x8, 0xa, 0x5], [0x7, 0x1e, 0x3, 0x8000, 0xfffffffd, 0x3, 0x0, 0x25, 0x7, 0xfffffffc, 0x8, 0x7fff, 0x72c, 0x1c32, 0x3, 0x5, 0xfffd, 0x3, 0x7ffd, 0x3, 0x3, 0x297, 0x5, 0x0, 0x981, 0x4, 0x0, 0x3ff, 0x0, 0xfffffffe, 0x8, 0x1000001, 0x10, 0xfffffff9, 0xfffffffd, 0x7, 0x1, 0xffffffff, 0x6, 0x2000008, 0x800, 0xffff, 0x6, 0x96, 0xfffffff9, 0x2, 0x0, 0x2, 0x401, 0xc, 0x3, 0x379, 0x9, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x1, 0x8, 0x7, 0x200, 0x3], [0xfffffeef, 0x8000c584, 0xffff, 0xcd3, 0x7, 0x1f, 0x404, 0x4, 0x4008, 0xc, 0x7, 0x9, 0xe88, 0x5, 0x80000001, 0x8, 0x8000, 0x1000, 0x0, 0x10, 0x1, 0xfffffff9, 0x0, 0x1000, 0x80040101, 0x5, 0x4, 0x5, 0x200003, 0x2, 0x5, 0x80, 0x9, 0x8001, 0x10000, 0x80000000, 0x3, 0x400004, 0x3, 0x6d7e, 0x3, 0x8, 0x5, 0xbf23, 0x6, 0x9, 0x956, 0x0, 0x3ff, 0xe, 0x6, 0x100fffd, 0x2005, 0x9, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0xd9, 0x0, 0x7d, 0x401, 0x5], [0x108e, 0xffff, 0x3, 0x3, 0x88, 0x2, 0x4000000, 0x4, 0x50, 0x2, 0x763, 0xb, 0x402, 0x2, 0x5, 0x1000, 0x7f, 0x5, 0x3fa6, 0x4, 0x0, 0x5, 0x3, 0x4, 0xe47, 0x4, 0x3, 0x4, 0x200, 0x2851, 0x3b, 0x20000001, 0x5, 0x5, 0xa80a, 0x65f413f9, 0x4, 0x20008, 0x8a5, 0x86, 0x44, 0x409, 0x6, 0x4, 0x4, 0xe, 0x4, 0xffffffff, 0x7fff, 0xffff8a33, 0xfffffff8, 0x401, 0x3, 0x200, 0x7, 0x4, 0xfffffffd, 0xa, 0xe, 0x101, 0xf, 0xf, 0x136, 0x6]}, 0x45c) epoll_create1(0x0) 3.734410032s ago: executing program 2 (id=904): openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu_sys\x00', 0x26e1, 0x0) socket$kcm(0xa, 0x3, 0x3a) r0 = socket$kcm(0x2, 0x200000000000001, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) sendto$inet(r1, 0x0, 0x0, 0x200007fd, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, 0x0, 0x0) sendmmsg$unix(r3, 0x0, 0x0, 0x0) recvmmsg(r2, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='attr\x00') getdents64(r4, &(0x7f0000002f40)=""/4097, 0x1001) r5 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x1) recvmsg$can_bcm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f00000002c0)=""/122, 0x7a}, {0x0}, {0x0}, {0x0}], 0x4}, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000300)='attr\x00') r8 = open_tree(r7, &(0x7f0000000640)='\x00', 0x89901) move_mount(r8, &(0x7f0000000040)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$fuseblk(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2025, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x4001024, &(0x7f0000000340)=ANY=[], 0x1, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x0, 0x0) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000340)={0x2, 0x4001, @dev}, 0x10, 0x0}, 0x3000c085) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.stat\x00', 0x26e1, 0x0) 3.595544301s ago: executing program 4 (id=905): bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x43) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r5, @ANYRES32=r4, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r5, &(0x7f0000000240), &(0x7f00000004c0)=@tcp6=r3}, 0x20) sendmmsg$inet6(r3, &(0x7f0000002440)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000480)}}], 0x2, 0x10) 3.595232381s ago: executing program 5 (id=906): bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x43) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r5, @ANYRES32=r4, @ANYBLOB='\a'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={r5, 0x0, 0x0}, 0x20) sendmmsg$inet6(r3, &(0x7f0000002440)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000600)="e2", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000480)}}], 0x56, 0x10) 3.360754844s ago: executing program 2 (id=907): syz_pidfd_open(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f00000003c0)={'veth0_to_bridge\x00', &(0x7f0000000380)=@ethtool_stats={0x1d, 0x1, [0x7]}}) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x2, 0x1, 0x0, 0x2, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @private}}, @sadb_spirange={0x2, 0x10, 0x0, 0xffffffff}, @sadb_address={0x3, 0x6, 0x0, 0x20, 0x0, @in={0x2, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}}}]}, 0x50}}, 0x0) mount(0x0, &(0x7f00000002c0)='.\x00', 0x0, 0x2000ca6, 0x0) r4 = syz_clone(0xb2b60000, 0x0, 0xfffffffffffffcd1, 0x0, 0x0, 0x0) r5 = syz_pidfd_open(r4, 0x0) setns(r5, 0x24020000) mount(0x0, &(0x7f0000000000)='.\x00', 0x0, 0x2236824, 0x0) unshare(0x480) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x6004, 0x0) fadvise64(0xffffffffffffffff, 0x36a9, 0x9, 0x4) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000c40)={&(0x7f0000000340)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@array]}}, &(0x7f0000003000)=""/4128, 0x32, 0x1020, 0x1}, 0x28) 2.243585789s ago: executing program 4 (id=908): r0 = openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x800) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], 0x0, 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000001080)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000ac0)={r4, 0xd0}, &(0x7f0000000b00)=0x8) r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$FUSE_DIRENTPLUS(r5, 0x0, 0xb0) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, 0x0) r6 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r6, &(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10) setsockopt$SO_BINDTODEVICE_wg(r6, 0x1, 0x19, &(0x7f0000000080)='wg1\x00', 0x4) sendto$inet(r6, &(0x7f0000000040)="e5", 0xffffffe4, 0x0, 0x0, 0x0) syz_emit_ethernet(0xe0, &(0x7f00000003c0)={@link_local, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "0300", 0xaa, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, [{0x0, 0x8, "a78ce54006598080a8030003004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac1"}, {}, {0x0, 0x9, "06aa85616177c61bc943afcb84619755403946b0730a1800c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808"}, {}, {0x19}]}}}}}}, 0x0) read$FUSE(r0, 0x0, 0x0) 1.794686126s ago: executing program 2 (id=909): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs={0x0, 0x0, 0xfffffffd}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) socket$key(0xf, 0x3, 0x2) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=@newsa={0x128, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x0, 0x2, 0x0, 0x10000000}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}, @lifetime_val={0x24, 0x9, {0xb4, 0x8000000000000001, 0xb4, 0x5}}]}, 0x128}}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newsa={0x104, 0x1a, 0x7, 0x0, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x1b}, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x5a, 0xb400, 0x2, 0xfeffff7f00000001, 0x0, 0x60000}, {0x0, 0x200000, 0x7, 0xfffffffffffffffd}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) socket(0x10, 0x80002, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) semop(0x0, 0x0, 0x0) semop(0x0, 0x0, 0x0) semtimedop(0x0, &(0x7f0000000180)=[{0x4, 0x5, 0x1000}], 0x1, 0x0) close(r2) socketpair$unix(0x1, 0x2, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET_STATS_CPU(r5, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000006c0)={0x14, 0x3, 0x2, 0x301, 0x0, 0x0, {0x7}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x40) recvmsg(r5, &(0x7f0000001f40)={0x0, 0x0, 0x0}, 0x20) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@newlink={0x2c, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_XDP={0x4}, @IFLA_GROUP={0x8}]}, 0x2c}}, 0x24048180) 2.19502ms ago: executing program 7 (id=910): socket$inet_sctp(0x2, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_BT_POWER(r3, 0x112, 0x9, 0x0, &(0x7f00000001c0)) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket(0x10, 0x2, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r5, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r5, &(0x7f0000000340)={0xa, 0x5, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, 0xfffffffe}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r5, 0x6, 0x1f, &(0x7f00000000c0), 0x4) writev(r5, &(0x7f0000000100), 0x0) close_range(r4, r5, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@dev={0xac, 0x14, 0x14, 0x3f}, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0xa, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="3801000018000100feffffff0001000000000000000000000000ffffe0000002fc0100"/47, @ANYRES32=0x0, @ANYRES32=0x0], 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x7, &(0x7f00000000c0)=0x10046, 0x4) socket$inet_tcp(0x2, 0x1, 0x0) 1.90032ms ago: executing program 4 (id=911): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(0x0, r0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) io_setup(0x6, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) socketpair$unix(0x1, 0x5, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) r2 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e2a, 0xffffffff, @mcast2, 0x9}, 0x1c) r3 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000140)=0x6, 0x4) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000200), 0x4) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000004c0)={0x94, 0x0, 0x1, 0x401, 0x0, 0x0, {0xa}, [@CTA_TUPLE_ORIG={0x3c, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @local}, {0x14, 0x4, @local}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}]}, 0x94}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="940000000001010400000000000000000a00000a3c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000001010c009afa05000100000000000800074000000000"], 0x94}}, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)={0x14, 0x2, 0x1, 0x5, 0x0, 0x0, {0x2, 0x0, 0x8}}, 0x14}, 0x1, 0x0, 0x0, 0x20044804}, 0x40040) sendmsg$IPCTNL_MSG_CT_GET_DYING(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x14, 0x6, 0x1, 0x101, 0x0, 0x0, {0x3, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2404c031}, 0x20000000) sendmmsg$inet6(r2, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171, 0x0, 0x0, 0x3a}}], 0x400000000000172, 0x4001c00) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b70500000000000061108b000000000007000000000000009500000000000000"], &(0x7f00000002c0)='GPL\x00', 0x5, 0xfd90, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79}, 0x2a) 1.10428ms ago: executing program 5 (id=920): bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={0xffffffffffffffff, 0x0, 0x0}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, 0x0, 0x0) setsockopt(0xffffffffffffffff, 0x84, 0x81, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x0, &(0x7f00000002c0)}) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000000c0), 0xfefe) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000b80)='n', 0x1}], 0x1}, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000040)={0x0, 0x9, 0x7a8, 0x6}, 0x14) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "fb00080000528e46", "252432e72844858a068b92a5a810f4dc", "b5ab0900", "5aee41448c84afb7"}, 0x28) r2 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r2, &(0x7f0000001300)={'syz1\x00', {0x9, 0x7, 0x5, 0x5}, 0x3f, [0x9, 0x2, 0x18, 0x2, 0x2, 0x400, 0x80000000, 0x0, 0x8, 0x0, 0x6, 0x1, 0xfffffffb, 0x39, 0x747d5e13, 0x800, 0xfffffb9a, 0xfffffffe, 0x0, 0xfffffffb, 0x2004, 0x10003, 0x0, 0xf250, 0x80, 0x4800, 0x300000, 0x7, 0xe, 0x4623f, 0x0, 0x10001, 0x1ff, 0x8000, 0x0, 0x3, 0xc, 0x3, 0xba55, 0x8da8, 0x2, 0x202, 0x2, 0x4, 0xe, 0x4, 0x2, 0x6f, 0x8, 0x9, 0x1, 0x199d, 0x6, 0x2, 0x9, 0xffffffff, 0x4, 0x6, 0x1000, 0x5, 0x3d, 0x8, 0xa, 0x5], [0x7, 0x1e, 0x3, 0x8000, 0xfffffffd, 0x3, 0x0, 0x25, 0x7, 0xfffffffc, 0x8, 0x7fff, 0x72c, 0x1c32, 0x3, 0x5, 0xfffd, 0x3, 0x7ffd, 0x3, 0x3, 0x297, 0x5, 0x0, 0x981, 0x4, 0x0, 0x3ff, 0x0, 0xfffffffe, 0x8, 0x1000001, 0x10, 0xfffffff9, 0xfffffffd, 0x7, 0x1, 0xffffffff, 0x6, 0x2000008, 0x800, 0xffff, 0x6, 0x96, 0xfffffff9, 0x2, 0x0, 0x2, 0x401, 0xc, 0x3, 0x379, 0x9, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x1, 0x8, 0x7, 0x200, 0x3], [0xfffffeef, 0x8000c584, 0xffff, 0xcd3, 0x7, 0x1f, 0x404, 0x4, 0x4008, 0xc, 0x7, 0x9, 0xe88, 0x5, 0x80000001, 0x8, 0x8000, 0x1000, 0x0, 0x10, 0x1, 0xfffffff9, 0x0, 0x1000, 0x80040101, 0x5, 0x4, 0x5, 0x200003, 0x2, 0x5, 0x80, 0x9, 0x8001, 0x10000, 0x80000000, 0x3, 0x400004, 0x3, 0x6d7e, 0x3, 0x8, 0x5, 0xbf23, 0x6, 0x9, 0x956, 0x0, 0x3ff, 0xe, 0x6, 0x100fffd, 0x2005, 0x9, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0xd9, 0x0, 0x7d, 0x401, 0x5], [0x108e, 0xffff, 0x3, 0x3, 0x88, 0x2, 0x4000000, 0x4, 0x50, 0x2, 0x763, 0xb, 0x402, 0x2, 0x5, 0x1000, 0x7f, 0x5, 0x3fa6, 0x4, 0x0, 0x5, 0x3, 0x4, 0xe47, 0x4, 0x3, 0x4, 0x200, 0x2851, 0x3b, 0x20000001, 0x5, 0x5, 0xa80a, 0x65f413f9, 0x4, 0x20008, 0x8a5, 0x86, 0x44, 0x409, 0x6, 0x4, 0x4, 0xe, 0x4, 0xffffffff, 0x7fff, 0xffff8a33, 0xfffffff8, 0x401, 0x3, 0x200, 0x7, 0x4, 0xfffffffd, 0xa, 0xe, 0x101, 0xf, 0xf, 0x136, 0x6]}, 0x45c) epoll_create1(0x0) 246.07µs ago: executing program 1 (id=912): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) openat$full(0xffffffffffffff9c, 0x0, 0x42, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_SET(r4, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) setsockopt$inet6_int(r0, 0x29, 0x35, &(0x7f0000000000)=0x100000b2, 0x4) sendmmsg$inet6(r0, &(0x7f00000002c0)=[{{&(0x7f0000000400)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xfffffffd}, 0x1c, 0x0}}], 0x1, 0x0) recvmmsg(r0, &(0x7f0000000280)=[{{&(0x7f0000000080)=@vsock, 0x80, 0x0}, 0x8}], 0x1, 0x12141, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r5, 0x400448c9, &(0x7f0000000080)) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r6, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xd}}, 0x6}, 0x1c) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) sendmmsg(r6, &(0x7f0000000880)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000001340)='qF', 0x2}], 0x1}}, {{0x0, 0x0, &(0x7f0000002740)=[{&(0x7f00000024c0)}], 0x1}}], 0x2, 0x1) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x23, &(0x7f0000000040)={&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x100000, 0x0, 0x0}, &(0x7f0000000380)=0x40) 0s ago: executing program 2 (id=913): r0 = socket(0x1e, 0x805, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000080), 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f0000000440)={0x0, 0x9}, 0x8) bind$inet6(r4, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000001500), 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = shmget(0x1, 0x4000, 0xa20, &(0x7f0000ffb000/0x4000)=nil) shmat(r5, &(0x7f0000ffd000/0x2000)=nil, 0x4000) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r6, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r6, 0x3) accept4$bt_l2cap(r6, &(0x7f0000000200), 0x0, 0x800) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100c900", @ANYBLOB=' '], 0x16) r7 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000200)={'geneve0\x00'}) kernel console output (not intermixed with test programs): 69024][ T5354] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 220.888165][ T5354] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 220.895178][ T5354] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 220.934723][ T5416] EXT4-fs error (device loop2): ext4_orphan_get:1399: inode #15: comm syz.2.195: iget: bad i_size value: 38620345925642 [ 220.965340][ T5354] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 221.446872][ T5427] netlink: 12 bytes leftover after parsing attributes in process `syz.3.190'. [ 221.673646][ T5416] EXT4-fs error (device loop2): ext4_orphan_get:1404: comm syz.2.195: couldn't read orphan inode 15 (err -117) [ 221.728835][ T5416] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 223.133861][ T5354] device hsr_slave_0 entered promiscuous mode [ 223.180700][ T5354] device hsr_slave_1 entered promiscuous mode [ 223.189343][ T4273] ntfs3: loop1: ntfs_evict_inode r=5 failed, -22. [ 223.205371][ T4273] ntfs3: loop1: Mark volume as dirty due to NTFS errors [ 223.940031][ T5354] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 224.017948][ T5354] Cannot create hsr debugfs directory [ 224.601204][ T5452] overlayfs: overlapping lowerdir path [ 225.504061][ T5424] EXT4-fs error (device loop2): ext4_validate_block_bitmap:429: comm ext4lazyinit: bg 0: block 5: invalid block bitmap [ 226.276725][ T4272] EXT4-fs (loop2): unmounting filesystem. [ 231.048547][ T5483] VFS: Can't find a Minix filesystem V1 | V2 | V3 on device nullb0. [ 231.313183][ T7] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 232.886675][ T7] usb 4-1: device descriptor read/all, error -71 [ 237.753517][ T5537] xt_hashlimit: max too large, truncated to 1048576 [ 237.764700][ T5537] x_tables: ip6_tables: TCPMSS target: only valid for protocol 6 [ 239.004328][ T5546] netlink: 5364 bytes leftover after parsing attributes in process `syz.1.218'. [ 239.698811][ T4269] Bluetooth: hci5: command 0x0405 tx timeout [ 241.943295][ T5354] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 241.973638][ T5354] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 242.042949][ T4753] device hsr_slave_0 left promiscuous mode [ 242.062272][ T4753] device hsr_slave_1 left promiscuous mode [ 243.217562][ T5564] loop2: detected capacity change from 0 to 16 [ 243.275869][ T4753] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 243.288538][ T5564] erofs: (device loop2): mounted with root inode @ nid 36. [ 243.367548][ T4753] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 243.488926][ T5575] erofs: (device loop2): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 243.532550][ T4753] device bridge_slave_1 left promiscuous mode [ 243.592950][ T5574] erofs: (device loop2): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 243.606650][ T5574] erofs: (device loop2): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 243.617367][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 42 @ nid 36 [ 243.627399][ T5574] erofs: (device loop2): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 243.637239][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 41 @ nid 36 [ 243.649347][ T5574] erofs: (device loop2): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 243.674013][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 40 @ nid 36 [ 243.684898][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 39 @ nid 36 [ 243.695512][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 38 @ nid 36 [ 243.706449][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 36 @ nid 36 [ 243.716380][ T5574] erofs: (device loop2): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 243.726538][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 31 @ nid 36 [ 243.740618][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 25 @ nid 36 [ 243.750611][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 24 @ nid 36 [ 243.762929][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 19 @ nid 36 [ 243.773828][ T5574] syz.2.225: attempt to access beyond end of device [ 243.773828][ T5574] loop2: rw=524288, sector=784, nr_sectors = 64 limit=16 [ 243.794141][ T5574] syz.2.225: attempt to access beyond end of device [ 243.794141][ T5574] loop2: rw=524288, sector=13478624080, nr_sectors = 24 limit=16 [ 243.810618][ T5574] syz.2.225: attempt to access beyond end of device [ 243.810618][ T5574] loop2: rw=524288, sector=13478624032, nr_sectors = 48 limit=16 [ 243.833498][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 87 @ nid 36 [ 243.843461][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 86 @ nid 36 [ 243.854622][ T5574] erofs: (device loop2): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 243.864873][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 83 @ nid 36 [ 243.875682][ T5574] erofs: (device loop2): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 243.886162][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 82 @ nid 36 [ 243.898120][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 79 @ nid 36 [ 243.911653][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 78 @ nid 36 [ 243.921516][ T5574] erofs: (device loop2): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 243.931040][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 76 @ nid 36 [ 243.941336][ T5574] erofs: (device loop2): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 243.950941][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 75 @ nid 36 [ 243.960471][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 74 @ nid 36 [ 243.969936][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 72 @ nid 36 [ 243.979453][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 71 @ nid 36 [ 243.988854][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 70 @ nid 36 [ 243.999243][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 63 @ nid 36 [ 244.008702][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 61 @ nid 36 [ 244.018275][ T5574] erofs: (device loop2): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 244.029346][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 59 @ nid 36 [ 244.038783][ T5574] erofs: (device loop2): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 244.048358][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 58 @ nid 36 [ 244.057842][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 56 @ nid 36 [ 244.067242][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 54 @ nid 36 [ 244.076999][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 50 @ nid 36 [ 244.087932][ T5574] erofs: (device loop2): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 244.097873][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 47 @ nid 36 [ 244.108894][ T5574] erofs: (device loop2): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 244.120181][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 46 @ nid 36 [ 244.129986][ T5574] erofs: (device loop2): z_erofs_readahead: readahead error at page 45 @ nid 36 [ 244.141402][ T5574] syz.2.225: attempt to access beyond end of device [ 244.141402][ T5574] loop2: rw=524288, sector=32, nr_sectors = 64 limit=16 [ 244.158694][ T5574] syz.2.225: attempt to access beyond end of device [ 244.158694][ T5574] loop2: rw=524288, sector=16, nr_sectors = 16 limit=16 [ 244.178246][ T5574] syz.2.225: attempt to access beyond end of device [ 244.178246][ T5574] loop2: rw=524288, sector=14425508768, nr_sectors = 8 limit=16 [ 244.338438][ T5575] erofs: (device loop2): z_erofs_lz4_decompress_mem: failed to decompress -11 in[46, 4050] out[5297] [ 244.351583][ T5575] erofs: (device loop2): z_erofs_read_folio: failed to read, err [-117] [ 244.481790][ T4753] bridge0: port 2(bridge_slave_1) entered disabled state [ 244.857185][ T4753] device bridge_slave_0 left promiscuous mode [ 244.867088][ T4753] bridge0: port 1(bridge_slave_0) entered disabled state [ 244.998580][ T5578] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 245.796882][ T5588] RDS: rds_bind could not find a transport for fc00::1, load rds_tcp or rds_rdma? [ 245.985811][ T5588] loop2: detected capacity change from 0 to 4096 [ 247.916503][ T5595] loop3: detected capacity change from 0 to 32768 [ 247.925174][ T5595] (syz.3.224,5595,1):ocfs2_parse_options:1446 ERROR: Unrecognized mount option "heartbeat=nc_commit" or missing value [ 247.938272][ T5595] (syz.3.224,5595,1):ocfs2_fill_super:1176 ERROR: status = -22 [ 249.683896][ T4450] I/O error, dev loop3, sector 32640 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 250.252267][ T5611] Illegal XDP return value 4294967274 on prog (id 10) dev N/A, expect packet loss! [ 250.716548][ T5612] netlink: 'syz.3.224': attribute type 16 has an invalid length. [ 250.730758][ T5612] netlink: 64138 bytes leftover after parsing attributes in process `syz.3.224'. [ 250.975603][ T4272] ntfs3: loop2: ntfs_evict_inode r=5 failed, -22. [ 251.008434][ T4272] ntfs3: loop2: Mark volume as dirty due to NTFS errors [ 253.743107][ T5628] loop4: detected capacity change from 0 to 256 [ 253.806190][ T5628] FAT-fs (loop4): Volume was not properly unmounted. Some data may be corrupt. Please run fsck. [ 255.107574][ T5645] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 255.118694][ T5645] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 256.348015][ T4753] team0 (unregistering): Port device team_slave_1 removed [ 258.165666][ T4753] team0 (unregistering): Port device team_slave_0 removed [ 258.194409][ T5650] loop2: detected capacity change from 0 to 1024 [ 258.344612][ T4753] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 258.419824][ T4753] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 258.550042][ T5653] syz.3.241 (5653): drop_caches: 2 [ 258.611824][ T5650] EXT4-fs error (device loop2): ext4_map_blocks:745: inode #3: block 2: comm syz.2.240: lblock 2 mapped to illegal pblock 2 (length 1) [ 258.644616][ T5650] Quota error (device loop2): write_blk: dquota write failed [ 258.654387][ T5650] Quota error (device loop2): find_free_dqentry: Can't write quota data block 2 [ 258.664379][ T5650] Quota error (device loop2): qtree_write_dquot: Error -117 occurred while creating quota [ 258.693353][ T5650] EXT4-fs error (device loop2): ext4_acquire_dquot:6835: comm syz.2.240: Failed to acquire dquot type 0 [ 258.734722][ T5650] EXT4-fs error (device loop2): ext4_map_blocks:635: inode #3: block 2: comm syz.2.240: lblock 2 mapped to illegal pblock 2 (length 1) [ 259.151642][ T5668] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 259.169558][ T5668] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 259.247454][ T5668] overlayfs: d_ino too big (., ino=4611686018427387905, xinobits=3) [ 259.256032][ T5668] overlayfs: d_ino too big (.., ino=4611686018427387905, xinobits=3) [ 259.267519][ T5668] overlayfs: d_ino too big (60, ino=9223372036854776154, xinobits=3) [ 259.278500][ T5668] overlayfs: d_ino too big (syzcgroup, ino=9223372036854775816, xinobits=3) [ 259.289394][ T5668] overlayfs: d_ino too big (syz-inputs, ino=9223372036854775815, xinobits=3) [ 259.299216][ T5668] overlayfs: d_ino too big (sys, ino=9223372036854775814, xinobits=3) [ 259.308321][ T5668] overlayfs: d_ino too big (selinux, ino=9223372036854775813, xinobits=3) [ 259.317839][ T5668] overlayfs: d_ino too big (proc, ino=9223372036854775812, xinobits=3) [ 259.329848][ T5668] overlayfs: d_ino too big (dev, ino=9223372036854775811, xinobits=3) [ 259.339911][ T5668] overlayfs: d_ino too big (io.pressure, ino=4611686018427387914, xinobits=3) [ 259.421054][ T5650] Quota error (device loop2): qtree_write_dquot: Error -117 occurred while creating quota [ 259.442733][ T5650] EXT4-fs error (device loop2): ext4_acquire_dquot:6835: comm syz.2.240: Failed to acquire dquot type 0 [ 260.715922][ T5650] EXT4-fs error (device loop2): ext4_free_blocks:6221: comm syz.2.240: Freeing blocks not in datazone - block = 0, count = 4096 [ 260.753010][ T5650] EXT4-fs error (device loop2): ext4_map_blocks:635: inode #3: block 2: comm syz.2.240: lblock 2 mapped to illegal pblock 2 (length 1) [ 260.786354][ T5650] Quota error (device loop2): qtree_write_dquot: Error -117 occurred while creating quota [ 260.802629][ T5650] EXT4-fs error (device loop2): ext4_acquire_dquot:6835: comm syz.2.240: Failed to acquire dquot type 0 [ 260.852197][ T5650] EXT4-fs (loop2): 1 orphan inode deleted [ 260.859791][ T5675] loop3: detected capacity change from 0 to 1024 [ 260.861256][ T5650] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: writeback. [ 260.897596][ T4753] bond0 (unregistering): Released all slaves [ 260.909131][ T5659] EXT4-fs error (device loop2): ext4_validate_block_bitmap:438: comm ext4lazyinit: bg 0: block 10: padding at end of block bitmap is not set [ 260.918761][ T5675] EXT4-fs: Ignoring removed orlov option [ 260.970463][ T5675] ext4: Unknown parameter 'uid' [ 260.992168][ T4272] EXT4-fs (loop2): unmounting filesystem. [ 261.578414][ T5354] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 261.705977][ T5354] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 261.997777][ T5684] loop2: detected capacity change from 0 to 128 [ 262.064487][ T5684] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 262.521180][ T5701] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 262.532514][ T5701] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 263.354246][ T5354] 8021q: adding VLAN 0 to HW filter on device bond0 [ 263.464426][ T1123] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 263.491889][ T1123] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 263.688940][ T5354] 8021q: adding VLAN 0 to HW filter on device team0 [ 263.741667][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 263.826060][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 264.035701][ T5710] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 264.080965][ T5710] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 264.460703][ T4460] bridge0: port 1(bridge_slave_0) entered blocking state [ 264.467982][ T4460] bridge0: port 1(bridge_slave_0) entered forwarding state [ 264.585934][ T1273] ieee802154 phy0 wpan0: encryption failed: -22 [ 264.618829][ T1273] ieee802154 phy1 wpan1: encryption failed: -22 [ 264.659387][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 264.670048][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 264.739107][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 264.760549][ T4460] bridge0: port 2(bridge_slave_1) entered blocking state [ 264.768535][ T4460] bridge0: port 2(bridge_slave_1) entered forwarding state [ 264.789654][ T5716] loop4: detected capacity change from 0 to 128 [ 264.924913][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 264.937202][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 264.970365][ T5721] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 264.982836][ T5721] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 264.995882][ T5716] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=256, location=256 [ 264.999209][ T5721] ovl_remap_lower_ino: 48 callbacks suppressed [ 264.999224][ T5721] overlayfs: d_ino too big (., ino=4611686018427387905, xinobits=3) [ 265.019940][ T5721] overlayfs: d_ino too big (.., ino=4611686018427387905, xinobits=3) [ 265.030234][ T5721] overlayfs: d_ino too big (64, ino=9223372036854776178, xinobits=3) [ 265.039255][ T5721] overlayfs: d_ino too big (syzcgroup, ino=9223372036854775816, xinobits=3) [ 265.049305][ T5721] overlayfs: d_ino too big (syz-inputs, ino=9223372036854775815, xinobits=3) [ 265.059133][ T5721] overlayfs: d_ino too big (sys, ino=9223372036854775814, xinobits=3) [ 265.069057][ T5721] overlayfs: d_ino too big (selinux, ino=9223372036854775813, xinobits=3) [ 265.078507][ T5721] overlayfs: d_ino too big (proc, ino=9223372036854775812, xinobits=3) [ 265.087554][ T5721] overlayfs: d_ino too big (dev, ino=9223372036854775811, xinobits=3) [ 265.096543][ T5721] overlayfs: d_ino too big (io.pressure, ino=4611686018427387914, xinobits=3) [ 265.222066][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 265.434611][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 265.632758][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 267.454022][ T5354] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 268.705663][ T5354] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 268.714658][ T5736] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 268.732625][ T5736] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 268.758255][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 268.785338][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 268.817053][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 268.850249][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 268.870581][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 268.927611][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 268.958578][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 269.730697][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 269.743975][ T11] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 269.772986][ T5354] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 272.187584][ T5765] comedi comedi3: Buffer allocation failed [ 279.265001][ T4269] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 279.287948][ T4269] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 279.289191][ T5815] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 279.304002][ T4269] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 279.311865][ T4269] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 279.321192][ T4269] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 279.336171][ T4269] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 279.452790][ T5818] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 279.531430][ T5811] lo speed is unknown, defaulting to 1000 [ 279.835787][ T5825] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 279.890722][ T5824] loop4: detected capacity change from 0 to 32768 [ 279.908080][ T5824] XFS (loop4): Mounting V5 Filesystem [ 279.933949][ T5822] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 280.010634][ T5824] XFS (loop4): Ending clean mount [ 280.026665][ T5824] XFS (loop4): Quotacheck needed: Please wait. [ 280.153934][ T5824] XFS (loop4): Quotacheck: Done. [ 280.177198][ T5811] chnl_net:caif_netlink_parms(): no params data found [ 280.309242][ T5589] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 280.574623][ T4269] Bluetooth: hci4: command 0x2016 tx timeout [ 280.860840][ T5589] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 280.901750][ T5811] bridge0: port 1(bridge_slave_0) entered blocking state [ 280.937667][ T5589] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 280.941318][ T5811] bridge0: port 1(bridge_slave_0) entered disabled state [ 280.965444][ T5589] usb 2-1: config 0 has no interface number 0 [ 280.973050][ T5589] usb 2-1: New USB device found, idVendor=050d, idProduct=011b, bcdDevice= 0.05 [ 280.987505][ T5589] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 281.001304][ T5589] usb 2-1: config 0 descriptor?? [ 281.021443][ T5811] device bridge_slave_0 entered promiscuous mode [ 281.041080][ T5589] usb 2-1: bad CDC descriptors [ 281.054360][ T5589] usb 2-1: bad CDC descriptors [ 281.073851][ T5811] bridge0: port 2(bridge_slave_1) entered blocking state [ 281.124342][ T5811] bridge0: port 2(bridge_slave_1) entered disabled state [ 281.138462][ T5811] device bridge_slave_1 entered promiscuous mode [ 281.211705][ T5811] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 281.262098][ T4383] usb 2-1: USB disconnect, device number 3 [ 281.282160][ T4277] XFS (loop4): Unmounting Filesystem [ 281.490464][ T5811] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 281.515170][ T4284] Bluetooth: hci0: command 0x0409 tx timeout [ 281.677051][ T5811] team0: Port device team_slave_0 added [ 281.730147][ T5811] team0: Port device team_slave_1 added [ 283.045447][ T5811] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 283.052446][ T5811] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 283.159155][ T5811] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 283.749591][ T4284] Bluetooth: hci0: command 0x041b tx timeout [ 284.260911][ T5811] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 284.283895][ T5811] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 284.456916][ T5876] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 284.467564][ T5876] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 284.481263][ T5876] ovl_remap_lower_ino: 48 callbacks suppressed [ 284.481281][ T5876] overlayfs: d_ino too big (., ino=4611686018427387905, xinobits=3) [ 284.495545][ T5876] overlayfs: d_ino too big (.., ino=4611686018427387905, xinobits=3) [ 284.503861][ T5876] overlayfs: d_ino too big (63, ino=9223372036854776188, xinobits=3) [ 284.512294][ T5876] overlayfs: d_ino too big (syzcgroup, ino=9223372036854775816, xinobits=3) [ 284.521237][ T5876] overlayfs: d_ino too big (syz-inputs, ino=9223372036854775815, xinobits=3) [ 284.530701][ T5876] overlayfs: d_ino too big (sys, ino=9223372036854775814, xinobits=3) [ 284.539048][ T5876] overlayfs: d_ino too big (selinux, ino=9223372036854775813, xinobits=3) [ 284.547807][ T5876] overlayfs: d_ino too big (proc, ino=9223372036854775812, xinobits=3) [ 284.556511][ T5876] overlayfs: d_ino too big (dev, ino=9223372036854775811, xinobits=3) [ 284.564962][ T5876] overlayfs: d_ino too big (io.pressure, ino=4611686018427387914, xinobits=3) [ 285.311126][ T5878] xt_hashlimit: overflow, try lower: 18446744073709551615/255 [ 286.657195][ T4269] Bluetooth: hci0: command 0x040f tx timeout [ 286.847776][ T5811] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 288.239014][ T5887] loop2: detected capacity change from 0 to 32768 [ 288.954951][ T4269] Bluetooth: hci0: command 0x0419 tx timeout [ 289.601856][ T5890] read_mapping_page failed! [ 289.607038][ T5890] ERROR: (device loop2): txCommit: [ 289.607038][ T5890] [ 289.614448][ T5890] ERROR: (device loop2): remounting filesystem as read-only [ 289.622277][ T5890] ERROR: (device loop2): diFree: numfree > numinos [ 289.622277][ T5890] [ 291.228759][ T5811] device hsr_slave_0 entered promiscuous mode [ 291.354506][ T5811] device hsr_slave_1 entered promiscuous mode [ 291.416830][ T5811] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 291.446638][ T5811] Cannot create hsr debugfs directory [ 292.435093][ T5913] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 292.462971][ T5913] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 292.532823][ T4753] device hsr_slave_0 left promiscuous mode [ 293.774687][ T5921] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 293.783797][ T5921] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 293.797934][ T5921] ovl_remap_lower_ino: 19 callbacks suppressed [ 293.797953][ T5921] overlayfs: d_ino too big (., ino=4611686018427387905, xinobits=3) [ 293.812239][ T5921] overlayfs: d_ino too big (.., ino=4611686018427387905, xinobits=3) [ 293.820563][ T5921] overlayfs: d_ino too big (68, ino=9223372036854776202, xinobits=3) [ 293.828858][ T5921] overlayfs: d_ino too big (syzcgroup, ino=9223372036854775816, xinobits=3) [ 293.838437][ T5921] overlayfs: d_ino too big (syz-inputs, ino=9223372036854775815, xinobits=3) [ 293.847487][ T5921] overlayfs: d_ino too big (sys, ino=9223372036854775814, xinobits=3) [ 293.855929][ T5921] overlayfs: d_ino too big (selinux, ino=9223372036854775813, xinobits=3) [ 293.864814][ T5921] overlayfs: d_ino too big (proc, ino=9223372036854775812, xinobits=3) [ 293.873513][ T5921] overlayfs: d_ino too big (dev, ino=9223372036854775811, xinobits=3) [ 293.881962][ T5921] overlayfs: d_ino too big (io.pressure, ino=4611686018427387914, xinobits=3) [ 293.904400][ T4753] device hsr_slave_1 left promiscuous mode [ 295.218975][ T4753] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 295.272786][ T4753] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 295.301599][ T4753] device bridge_slave_1 left promiscuous mode [ 295.315153][ T4753] bridge0: port 2(bridge_slave_1) entered disabled state [ 295.327940][ T4753] device bridge_slave_0 left promiscuous mode [ 295.335736][ T4753] bridge0: port 1(bridge_slave_0) entered disabled state [ 295.886185][ T5940] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 296.012741][ T5942] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 297.100936][ T5953] xt_hashlimit: overflow, try lower: 18446744073709551615/255 [ 298.613916][ T4753] team0 (unregistering): Port device team_slave_1 removed [ 301.216222][ T4753] team0 (unregistering): Port device team_slave_0 removed [ 301.429870][ T4753] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 301.616883][ T4753] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 301.876474][ T5967] Bluetooth: MGMT ver 1.22 [ 305.668940][ T27] audit: type=1326 audit(1770870869.149:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5988 comm="syz.4.301" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb97cf9bf79 code=0x0 [ 306.154670][ T5998] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 306.224616][ T5999] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 307.712910][ T4753] bond0 (unregistering): Released all slaves [ 310.101284][ T6023] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 310.110303][ T6023] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 310.289412][ T5811] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 310.438243][ T6026] loop4: detected capacity change from 0 to 1024 [ 310.476358][ T6026] EXT4-fs: inline encryption not supported [ 310.969578][ T6028] xt_hashlimit: overflow, try lower: 18446744073709551615/255 [ 312.265183][ T6026] EXT4-fs: Ignoring removed oldalloc option [ 312.266162][ T5811] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 312.298888][ T6026] EXT4-fs: Ignoring removed mblk_io_submit option [ 312.325813][ T5811] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 312.383836][ T5811] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 312.408787][ T6026] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 312.593544][ T6038] EXT4-fs error (device loop4): ext4_mb_generate_buddy:1113: group 0, block bitmap and bg descriptor inconsistent: 25 vs 161808409 free clusters [ 312.625270][ T6038] EXT4-fs (loop4): Remounting filesystem read-only [ 315.975656][ T4277] EXT4-fs (loop4): unmounting filesystem. [ 316.069497][ T5811] 8021q: adding VLAN 0 to HW filter on device bond0 [ 316.145907][ T5811] 8021q: adding VLAN 0 to HW filter on device team0 [ 316.203335][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 316.211225][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 316.382786][ T5811] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 316.537216][ T5811] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 316.619954][ T4753] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 316.657856][ T4753] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 316.929214][ T4753] bridge0: port 1(bridge_slave_0) entered blocking state [ 316.936434][ T4753] bridge0: port 1(bridge_slave_0) entered forwarding state [ 316.945394][ T4753] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 316.954621][ T4753] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 316.963324][ T4753] bridge0: port 2(bridge_slave_1) entered blocking state [ 316.970539][ T4753] bridge0: port 2(bridge_slave_1) entered forwarding state [ 317.090153][ T4753] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 317.184417][ T4753] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 319.170219][ T4753] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 319.182383][ T4753] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 319.191679][ T4753] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 319.348697][ T4753] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 319.434452][ T4753] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 319.523160][ T4753] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 319.656564][ T4753] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 319.739573][ T4753] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 319.879994][ T4753] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 319.932073][ T4753] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 319.962081][ T4753] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 320.573965][ T4508] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 320.581507][ T4508] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 320.664557][ T5811] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 324.479593][ T6129] loop2: detected capacity change from 0 to 1024 [ 324.492606][ T6129] EXT4-fs: inline encryption not supported [ 324.498654][ T6129] EXT4-fs: Ignoring removed oldalloc option [ 324.504640][ T6129] EXT4-fs: Ignoring removed mblk_io_submit option [ 325.525927][ T6129] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 327.409033][ T6129] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1113: group 0, block bitmap and bg descriptor inconsistent: 25 vs 161808409 free clusters [ 327.424781][ T6129] EXT4-fs (loop2): Remounting filesystem read-only [ 327.621511][ T4272] EXT4-fs (loop2): unmounting filesystem. [ 327.663862][ T6162] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 327.673305][ T6162] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 328.075335][ T6169] loop2: detected capacity change from 0 to 256 [ 328.497017][ T6173] ptrace attach of "./syz-executor exec"[4274] was attempted by ""[6173] [ 329.147965][ T1123] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 329.161385][ T1123] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 329.433076][ T5811] device veth0_vlan entered promiscuous mode [ 329.445046][ T6179] loop3: detected capacity change from 0 to 32768 [ 329.446290][ T5811] device veth1_vlan entered promiscuous mode [ 329.465622][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 329.637587][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 329.804783][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 330.016343][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 330.101196][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 330.110140][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 330.289419][ T1273] ieee802154 phy0 wpan0: encryption failed: -22 [ 330.295901][ T1273] ieee802154 phy1 wpan1: encryption failed: -22 [ 330.308600][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 331.871282][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 332.036873][ T5811] device veth0_macvtap entered promiscuous mode [ 332.101075][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 332.316914][ T5811] device veth1_macvtap entered promiscuous mode [ 333.084334][ T5811] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 333.198073][ T5811] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 333.479140][ T5811] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 334.271023][ T5811] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 334.333967][ T5811] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 334.387727][ T5811] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 334.446981][ T5811] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 334.472493][ T5811] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 334.491658][ T5811] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 334.500768][ T2955] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 334.517145][ T2955] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 334.549096][ T5811] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 334.588387][ T5811] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 334.614143][ T5811] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 334.656453][ T5811] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 334.683892][ T6219] Bluetooth: hci0: unsupported parameter 255 [ 334.688920][ T5811] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 334.689912][ T6219] Bluetooth: hci0: unsupported parameter 255 [ 334.737757][ T5811] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 334.764474][ T5811] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 334.790400][ T5811] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 334.828558][ T5811] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 334.859361][ T4753] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 334.888046][ T4753] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 334.933369][ T5811] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 334.960258][ T5811] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 334.986136][ T5811] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 335.009174][ T5811] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 335.206289][ T4646] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 335.261260][ T4646] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 335.283308][ T4753] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 335.461463][ T4753] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 335.507670][ T4753] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 336.351290][ T4646] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 337.019363][ T6243] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 337.028683][ T6243] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 337.042137][ T6236] syz.4.346 (6236): drop_caches: 2 [ 339.138089][ T6268] loop2: detected capacity change from 0 to 128 [ 339.593025][ T6268] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 339.606014][ T6268] ext4 filesystem being mounted at /81/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 339.637745][ T6271] loop4: detected capacity change from 0 to 1024 [ 340.990145][ T6282] hfsplus: xattr searching failed [ 340.999599][ T6284] hfsplus: xattr searching failed [ 341.824368][ T4646] hfsplus: b-tree write err: -5, ino 3 [ 341.875785][ T4445] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 342.748488][ T4445] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 342.796228][ T4284] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 342.818109][ T4280] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 342.827232][ T4284] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 342.851660][ T4280] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 342.862111][ T4280] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 342.869965][ T4280] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 344.199274][ T4272] EXT4-fs (loop2): unmounting filesystem. [ 344.327585][ T4445] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 344.635211][ T6292] lo speed is unknown, defaulting to 1000 [ 345.052627][ T4280] Bluetooth: hci0: command 0x0409 tx timeout [ 345.263232][ T4445] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 345.305390][ T6312] loop3: detected capacity change from 0 to 16 [ 345.388492][ T6312] erofs: (device loop3): mounted with root inode @ nid 36. [ 345.730849][ T6317] erofs: (device loop3): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 345.803984][ T6317] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -44 in[46, 4050] out[1851] [ 345.815140][ T6317] erofs: (device loop3): z_erofs_read_folio: failed to read, err [-117] [ 345.949005][ T6316] erofs: (device loop3): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 345.971365][ T6316] erofs: (device loop3): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 345.988862][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 42 @ nid 36 [ 346.000086][ T6316] erofs: (device loop3): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 346.009537][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 41 @ nid 36 [ 346.018714][ T6316] erofs: (device loop3): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 346.028077][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 40 @ nid 36 [ 346.037272][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 39 @ nid 36 [ 346.046873][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 38 @ nid 36 [ 346.056368][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 36 @ nid 36 [ 346.068389][ T6316] erofs: (device loop3): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 346.080496][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 31 @ nid 36 [ 346.090443][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 25 @ nid 36 [ 346.101042][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 24 @ nid 36 [ 346.111260][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 19 @ nid 36 [ 346.121957][ T6316] syz.3.362: attempt to access beyond end of device [ 346.121957][ T6316] loop3: rw=524288, sector=784, nr_sectors = 64 limit=16 [ 346.137156][ T6316] syz.3.362: attempt to access beyond end of device [ 346.137156][ T6316] loop3: rw=524288, sector=13478624080, nr_sectors = 24 limit=16 [ 346.153197][ T6316] syz.3.362: attempt to access beyond end of device [ 346.153197][ T6316] loop3: rw=524288, sector=13478624032, nr_sectors = 48 limit=16 [ 346.173612][ T6316] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -44 in[46, 4050] out[2639] [ 346.358664][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 87 @ nid 36 [ 346.370300][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 86 @ nid 36 [ 346.385851][ T6316] erofs: (device loop3): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 346.395752][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 83 @ nid 36 [ 346.405685][ T6316] erofs: (device loop3): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 346.415660][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 82 @ nid 36 [ 346.430994][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 79 @ nid 36 [ 346.441654][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 78 @ nid 36 [ 346.454859][ T6316] erofs: (device loop3): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 346.464652][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 76 @ nid 36 [ 346.474447][ T6316] erofs: (device loop3): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 346.484373][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 75 @ nid 36 [ 346.495012][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 74 @ nid 36 [ 346.504620][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 72 @ nid 36 [ 346.515444][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 71 @ nid 36 [ 346.528610][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 70 @ nid 36 [ 346.560608][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 63 @ nid 36 [ 346.573825][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 61 @ nid 36 [ 346.588980][ T6316] erofs: (device loop3): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 346.599954][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 59 @ nid 36 [ 346.609878][ T6316] erofs: (device loop3): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 346.620952][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 58 @ nid 36 [ 346.633895][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 56 @ nid 36 [ 346.652648][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 54 @ nid 36 [ 346.675245][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 50 @ nid 36 [ 346.691815][ T6316] erofs: (device loop3): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 346.701920][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 47 @ nid 36 [ 346.712656][ T6316] erofs: (device loop3): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 346.723950][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 46 @ nid 36 [ 346.738712][ T6316] erofs: (device loop3): z_erofs_readahead: readahead error at page 45 @ nid 36 [ 346.769848][ T6316] syz.3.362: attempt to access beyond end of device [ 346.769848][ T6316] loop3: rw=524288, sector=32, nr_sectors = 64 limit=16 [ 346.783622][ T6316] syz.3.362: attempt to access beyond end of device [ 346.783622][ T6316] loop3: rw=524288, sector=16, nr_sectors = 16 limit=16 [ 346.797320][ T6316] syz.3.362: attempt to access beyond end of device [ 346.797320][ T6316] loop3: rw=524288, sector=14425508768, nr_sectors = 8 limit=16 [ 346.811912][ T6316] erofs: (device loop3): z_erofs_lz4_decompress_mem: failed to decompress -11 in[46, 4050] out[5297] [ 346.869944][ T27] audit: type=1800 audit(1770870907.300:37): pid=6316 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.362" name="SYSV798dd820" dev="hugetlbfs" ino=0 res=0 errno=0 [ 347.350352][ T4280] Bluetooth: hci0: command 0x041b tx timeout [ 349.573873][ T4269] Bluetooth: hci0: command 0x040f tx timeout [ 350.897556][ T6292] chnl_net:caif_netlink_parms(): no params data found [ 351.372826][ T6350] syz.1.370 (6350): drop_caches: 2 [ 351.602600][ T6292] bridge0: port 1(bridge_slave_0) entered blocking state [ 351.617353][ T6292] bridge0: port 1(bridge_slave_0) entered disabled state [ 351.652048][ T6292] device bridge_slave_0 entered promiscuous mode [ 351.671174][ T6292] bridge0: port 2(bridge_slave_1) entered blocking state [ 351.678989][ T6292] bridge0: port 2(bridge_slave_1) entered disabled state [ 351.698312][ T6292] device bridge_slave_1 entered promiscuous mode [ 351.722120][ T4269] Bluetooth: hci0: command 0x0419 tx timeout [ 351.797574][ T6292] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 351.866404][ T6292] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 351.938152][ T6292] team0: Port device team_slave_0 added [ 351.960436][ T6292] team0: Port device team_slave_1 added [ 352.215871][ T6292] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 352.228353][ T6292] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 352.428048][ T6292] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 352.765201][ T6292] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 352.785695][ T6292] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 352.847534][ T6292] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 353.016128][ T6292] device hsr_slave_0 entered promiscuous mode [ 353.038668][ T6292] device hsr_slave_1 entered promiscuous mode [ 353.068982][ T6292] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 353.076782][ T6292] Cannot create hsr debugfs directory [ 353.745445][ T6391] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 353.758345][ T6391] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 358.893901][ T4445] device hsr_slave_0 left promiscuous mode [ 358.907594][ T4445] device hsr_slave_1 left promiscuous mode [ 358.931177][ T4445] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 358.948249][ T4445] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 358.956171][ T4445] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 358.981199][ T4445] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 359.018790][ T4445] device bridge_slave_1 left promiscuous mode [ 359.025154][ T4445] bridge0: port 2(bridge_slave_1) entered disabled state [ 359.037918][ T4445] device bridge_slave_0 left promiscuous mode [ 359.097444][ T4445] bridge0: port 1(bridge_slave_0) entered disabled state [ 359.207336][ T4445] device veth1_macvtap left promiscuous mode [ 359.213447][ T4445] device veth0_macvtap left promiscuous mode [ 359.228608][ T4445] device veth1_vlan left promiscuous mode [ 359.234510][ T4445] device veth0_vlan left promiscuous mode [ 359.455586][ T6435] syz.1.376 (6435): drop_caches: 2 [ 359.605714][ T6435] syz.1.376 (6435): drop_caches: 2 [ 367.306638][ T6483] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 367.383258][ T6483] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 367.479384][ T6483] ovl_remap_lower_ino: 48 callbacks suppressed [ 367.479399][ T6483] overlayfs: d_ino too big (., ino=4611686018427387905, xinobits=3) [ 367.531294][ T6483] overlayfs: d_ino too big (.., ino=4611686018427387905, xinobits=3) [ 367.556905][ T6483] overlayfs: d_ino too big (103, ino=9223372036854776396, xinobits=3) [ 367.581990][ T6483] overlayfs: d_ino too big (syzcgroup, ino=9223372036854775816, xinobits=3) [ 367.596337][ T6483] overlayfs: d_ino too big (syz-inputs, ino=9223372036854775815, xinobits=3) [ 367.606232][ T6483] overlayfs: d_ino too big (sys, ino=9223372036854775814, xinobits=3) [ 367.615789][ T6483] overlayfs: d_ino too big (selinux, ino=9223372036854775813, xinobits=3) [ 369.678350][ T4445] team0 (unregistering): Port device team_slave_1 removed [ 369.805442][ T4445] team0 (unregistering): Port device team_slave_0 removed [ 370.101839][ T6495] syz.2.395 (6495): drop_caches: 2 [ 370.114097][ T6495] syz.2.395 (6495): drop_caches: 2 [ 371.169802][ T4445] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 371.777626][ T4445] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 373.440620][ T6506] loop3: detected capacity change from 0 to 40427 [ 373.572739][ T6506] F2FS-fs (loop3): invalid crc value [ 373.605689][ T6506] F2FS-fs (loop3): Found nat_bits in checkpoint [ 373.643420][ T6506] F2FS-fs (loop3): Start checkpoint disabled! [ 373.658427][ T6506] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6 [ 375.060536][ T31] kworker/u4:2: attempt to access beyond end of device [ 375.060536][ T31] loop3: rw=2049, sector=40960, nr_sectors = 24 limit=40427 [ 377.763221][ T4445] bond0 (unregistering): Released all slaves [ 379.059442][ T6292] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 379.116644][ T6292] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 379.193118][ T6292] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 379.229465][ T6292] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 379.460317][ T6292] 8021q: adding VLAN 0 to HW filter on device bond0 [ 379.481013][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 379.490132][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 379.501866][ T6292] 8021q: adding VLAN 0 to HW filter on device team0 [ 379.513904][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 379.530279][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 379.543638][ T4465] bridge0: port 1(bridge_slave_0) entered blocking state [ 379.550853][ T4465] bridge0: port 1(bridge_slave_0) entered forwarding state [ 379.567768][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 379.585740][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 379.595295][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 379.609995][ T4465] bridge0: port 2(bridge_slave_1) entered blocking state [ 379.617215][ T4465] bridge0: port 2(bridge_slave_1) entered forwarding state [ 379.651082][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 379.660782][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 379.670184][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 379.683322][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 379.693372][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 379.702938][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 379.724140][ T6292] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 379.735653][ T6292] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 379.750660][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 379.762883][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 379.772655][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 379.783912][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 379.793179][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 379.801704][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 380.129812][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 380.138114][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 380.154334][ T6292] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 380.507234][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 380.516410][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 380.544320][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 380.553521][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 380.565630][ T6292] device veth0_vlan entered promiscuous mode [ 380.573740][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 380.582191][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 380.595557][ T6292] device veth1_vlan entered promiscuous mode [ 380.634652][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 380.646357][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 380.660406][ T6292] device veth0_macvtap entered promiscuous mode [ 380.672280][ T6292] device veth1_macvtap entered promiscuous mode [ 380.691549][ T6292] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 380.702934][ T6292] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 380.713343][ T6292] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 380.724118][ T6292] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 380.735049][ T6292] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 380.746411][ T6292] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 380.757199][ T6292] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 380.768031][ T6292] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 380.780397][ T6292] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 380.793873][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 380.803750][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 380.812986][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 380.821825][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 380.837735][ T6292] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 380.848666][ T6292] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 380.859580][ T6292] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 380.871015][ T6292] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 380.880937][ T6292] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 380.897007][ T6292] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 380.907452][ T6292] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 380.923130][ T6292] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 380.934745][ T6292] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 380.951949][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 380.968167][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 380.986062][ T6292] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.996772][ T6292] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 381.010200][ T6292] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 381.020832][ T6292] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 381.152358][ T4445] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 381.167185][ T4445] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 381.191770][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 381.224139][ T4465] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 381.233709][ T4465] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 381.249008][ T4465] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 381.590560][ T4269] Bluetooth: hci2: Malformed Event: 0x02 [ 387.840028][ T6662] overlayfs: overlapping lowerdir path [ 388.012653][ T6663] overlayfs: "xino=on" is useless with all layers on same fs, ignore. [ 388.046431][ T6663] overlayfs: overlapping lowerdir path [ 388.059334][ T6667] loop5: detected capacity change from 0 to 16 [ 388.989181][ T6667] erofs: (device loop5): mounted with root inode @ nid 36. [ 389.153570][ T6672] erofs: (device loop5): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 389.271624][ T6671] erofs: (device loop5): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 389.282578][ T6671] erofs: (device loop5): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 389.292072][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 42 @ nid 36 [ 389.301344][ T6671] erofs: (device loop5): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 389.310836][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 41 @ nid 36 [ 389.320080][ T6671] erofs: (device loop5): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 389.341026][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 40 @ nid 36 [ 389.360858][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 39 @ nid 36 [ 389.370015][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 38 @ nid 36 [ 389.379538][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 36 @ nid 36 [ 389.389274][ T6671] erofs: (device loop5): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 389.399084][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 31 @ nid 36 [ 389.408889][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 25 @ nid 36 [ 389.424466][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 24 @ nid 36 [ 389.442180][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 19 @ nid 36 [ 389.452197][ T6671] syz.5.411: attempt to access beyond end of device [ 389.452197][ T6671] loop5: rw=524288, sector=784, nr_sectors = 64 limit=16 [ 389.466037][ T6671] syz.5.411: attempt to access beyond end of device [ 389.466037][ T6671] loop5: rw=524288, sector=13478624080, nr_sectors = 24 limit=16 [ 389.480831][ T6671] syz.5.411: attempt to access beyond end of device [ 389.480831][ T6671] loop5: rw=524288, sector=13478624032, nr_sectors = 48 limit=16 [ 389.500729][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 87 @ nid 36 [ 389.509972][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 86 @ nid 36 [ 389.519302][ T6671] erofs: (device loop5): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 389.528758][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 83 @ nid 36 [ 389.538133][ T6671] erofs: (device loop5): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 389.547669][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 82 @ nid 36 [ 389.557292][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 79 @ nid 36 [ 389.566942][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 78 @ nid 36 [ 389.576319][ T6671] erofs: (device loop5): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 389.586123][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 76 @ nid 36 [ 389.595490][ T6671] erofs: (device loop5): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 389.604876][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 75 @ nid 36 [ 389.614533][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 74 @ nid 36 [ 389.624371][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 72 @ nid 36 [ 389.633988][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 71 @ nid 36 [ 389.643585][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 70 @ nid 36 [ 389.653282][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 63 @ nid 36 [ 389.662626][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 61 @ nid 36 [ 389.671862][ T6671] erofs: (device loop5): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 389.681297][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 59 @ nid 36 [ 389.690372][ T6671] erofs: (device loop5): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 389.699824][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 58 @ nid 36 [ 389.709049][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 56 @ nid 36 [ 389.718291][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 54 @ nid 36 [ 389.727650][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 50 @ nid 36 [ 389.736917][ T6671] erofs: (device loop5): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 389.746376][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 47 @ nid 36 [ 389.755549][ T6671] erofs: (device loop5): z_erofs_extent_lookback: bogus lookback distance @ nid 36 [ 389.764908][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 46 @ nid 36 [ 389.774160][ T6671] erofs: (device loop5): z_erofs_readahead: readahead error at page 45 @ nid 36 [ 389.783593][ T6671] syz.5.411: attempt to access beyond end of device [ 389.783593][ T6671] loop5: rw=524288, sector=32, nr_sectors = 64 limit=16 [ 389.797486][ T6671] syz.5.411: attempt to access beyond end of device [ 389.797486][ T6671] loop5: rw=524288, sector=16, nr_sectors = 16 limit=16 [ 389.811190][ T6671] syz.5.411: attempt to access beyond end of device [ 389.811190][ T6671] loop5: rw=524288, sector=14425508768, nr_sectors = 8 limit=16 [ 389.870242][ T6672] erofs: (device loop5): z_erofs_lz4_decompress_mem: failed to decompress -11 in[46, 4050] out[5297] [ 389.881890][ T6672] erofs: (device loop5): z_erofs_read_folio: failed to read, err [-117] [ 391.491652][ T4269] Bluetooth: hci0: Malformed Event: 0x02 [ 395.939142][ T1273] ieee802154 phy0 wpan0: encryption failed: -22 [ 395.946077][ T1273] ieee802154 phy1 wpan1: encryption failed: -22 [ 399.575182][ T6734] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 399.674856][ T6735] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 400.847612][ T6740] loop5: detected capacity change from 0 to 2048 [ 401.700706][ T6743] NILFS (loop5): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 402.679754][ T6743] NILFS (loop5): vblocknr = 23 has abnormal lifetime: start cno (= 4294967298) > current cno (= 3) [ 402.717342][ T6743] NILFS error (device loop5): nilfs_bmap_propagate: broken bmap (inode number=4) [ 402.762676][ T6743] Remounting filesystem read-only [ 402.843284][ T6292] NILFS (loop5): disposed unprocessed dirty file(s) when stopping log writer [ 410.136366][ T6804] xt_cgroup: path and classid specified [ 410.144480][ T6804] netlink: 12 bytes leftover after parsing attributes in process `syz.3.450'. [ 414.657875][ T6833] loop2: detected capacity change from 0 to 128 [ 416.457457][ T6833] UDF-fs: error (device loop2): udf_read_tagged: read failed, block=256, location=256 [ 416.931541][ T6846] syz.4.458 (6846): drop_caches: 2 [ 416.939734][ T6846] syz.4.458 (6846): drop_caches: 2 [ 419.571183][ T6868] ptrace attach of "./syz-executor exec"[6292] was attempted by ""[6868] [ 421.252869][ T6874] loop2: detected capacity change from 0 to 2048 [ 421.463993][ T6884] NILFS (loop2): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 423.353664][ T6884] NILFS (loop2): vblocknr = 23 has abnormal lifetime: start cno (= 4294967298) > current cno (= 3) [ 423.735014][ T6884] NILFS error (device loop2): nilfs_bmap_propagate: broken bmap (inode number=4) [ 424.219166][ T6884] Remounting filesystem read-only [ 424.356676][ T4272] NILFS (loop2): disposed unprocessed dirty file(s) when stopping log writer [ 425.986447][ T6932] ptrace attach of "./syz-executor exec"[4273] was attempted by ""[6932] [ 426.379971][ T6933] syz.5.477 (6933): drop_caches: 2 [ 426.405167][ T6933] syz.5.477 (6933): drop_caches: 2 [ 432.525646][ T6983] ptrace attach of "./syz-executor exec"[4277] was attempted by ""[6983] [ 433.001221][ T6984] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 433.010861][ T6984] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 433.026761][ T6984] overlayfs: d_ino too big (., ino=4611686018427387905, xinobits=3) [ 433.034958][ T6984] overlayfs: d_ino too big (.., ino=4611686018427387905, xinobits=3) [ 433.043285][ T6984] overlayfs: d_ino too big (19, ino=9223372036854775937, xinobits=3) [ 433.051814][ T6984] overlayfs: d_ino too big (syzcgroup, ino=9223372036854775816, xinobits=3) [ 433.060730][ T6984] overlayfs: d_ino too big (syz-inputs, ino=9223372036854775815, xinobits=3) [ 433.070440][ T6984] overlayfs: d_ino too big (sys, ino=9223372036854775814, xinobits=3) [ 433.078865][ T6984] overlayfs: d_ino too big (selinux, ino=9223372036854775813, xinobits=3) [ 433.087644][ T6984] overlayfs: d_ino too big (proc, ino=9223372036854775812, xinobits=3) [ 433.096147][ T6984] overlayfs: d_ino too big (dev, ino=9223372036854775811, xinobits=3) [ 433.104486][ T6984] overlayfs: d_ino too big (io.pressure, ino=4611686018427387914, xinobits=3) [ 433.291664][ T6981] loop1: detected capacity change from 0 to 2048 [ 434.553656][ T6996] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 435.849774][ T4269] Bluetooth: hci0: link tx timeout [ 435.858248][ T4269] Bluetooth: hci0: killing stalled connection 11:aa:aa:aa:aa:aa [ 436.314179][ T4269] Bluetooth: hci0: link tx timeout [ 436.319471][ T4269] Bluetooth: hci0: killing stalled connection 11:aa:aa:aa:aa:aa [ 436.775358][ T6996] NILFS (loop1): vblocknr = 23 has abnormal lifetime: start cno (= 4294967298) > current cno (= 3) [ 436.789658][ T6996] NILFS error (device loop1): nilfs_bmap_propagate: broken bmap (inode number=4) [ 436.869076][ T6996] Remounting filesystem read-only [ 438.404840][ T4269] Bluetooth: hci0: command 0x0406 tx timeout [ 438.411212][ T4273] NILFS (loop1): disposed unprocessed dirty file(s) when stopping log writer [ 439.063718][ T7033] ptrace attach of "./syz-executor exec"[4277] was attempted by ""[7033] [ 444.617926][ T7059] syz.5.515 (7059): drop_caches: 2 [ 445.213310][ T7059] syz.5.515 (7059): drop_caches: 2 [ 450.741873][ T7124] loop3: detected capacity change from 0 to 1024 [ 451.167756][ T7120] loop5: detected capacity change from 0 to 2048 [ 453.030002][ T4459] hfsplus: b-tree write err: -5, ino 4 [ 453.044059][ T7120] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 453.816335][ C0] hrtimer: interrupt took 42864 ns [ 455.628840][ T7150] loop1: detected capacity change from 0 to 64 [ 456.162666][ T7150] hfs: get root inode failed [ 461.778242][ T1273] ieee802154 phy0 wpan0: encryption failed: -22 [ 461.784614][ T1273] ieee802154 phy1 wpan1: encryption failed: -22 [ 463.147683][ T4269] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 463.156508][ T4269] Bluetooth: hci4: Injecting HCI hardware error event [ 463.165665][ T4269] Bluetooth: hci4: hardware error 0x00 [ 466.001033][ T7229] siw: device registration error -23 [ 466.829890][ T4269] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 468.727880][ T7245] loop3: detected capacity change from 0 to 512 [ 468.957446][ T7245] EXT4-fs (loop3): mounted filesystem without journal. Quota mode: writeback. [ 468.983748][ T7245] ext4 filesystem being mounted at /135/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 470.931024][ T7263] EXT4-fs error (device loop3): ext4_empty_dir:3136: inode #12: comm syz.3.568: invalid size [ 471.097286][ T4274] EXT4-fs (loop3): unmounting filesystem. [ 475.887190][ T7291] loop3: detected capacity change from 0 to 256 [ 476.669214][ T7304] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 476.679953][ T7304] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 485.033630][ T7361] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 485.044988][ T7361] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 485.918765][ T7366] loop5: detected capacity change from 0 to 512 [ 486.214208][ T7366] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 486.321777][ T7366] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 487.474750][ T7366] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c018, mo2=0082] [ 487.492861][ T7366] System zones: 1-12 [ 487.560735][ T7366] EXT4-fs warning (device loop5): ext4_expand_extra_isize_ea:2800: Unable to expand inode 15. Delete some EAs or run e2fsck. [ 487.664504][ T7366] EXT4-fs (loop5): 1 truncate cleaned up [ 487.670556][ T7366] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 488.403551][ T7383] loop4: detected capacity change from 0 to 1024 [ 488.568547][ T7383] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: none. [ 488.577492][ T7383] ext4 filesystem being mounted at /136/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 488.598306][ T6292] EXT4-fs (loop5): unmounting filesystem. [ 489.315804][ T4269] Bluetooth: Frame is too long (len 18, expected len 4) [ 489.882690][ T7408] x_tables: ip6_tables: TPROXY target: used from hooks FORWARD, but only usable from PREROUTING [ 489.900087][ T7408] loop5: detected capacity change from 0 to 128 [ 489.907432][ T7408] FAT-fs (loop5): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 490.564688][ T7408] FAT-fs (loop5): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 492.002706][ T4458] FAT-fs (loop5): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 492.022894][ T4277] EXT4-fs (loop4): unmounting filesystem. [ 492.953181][ T7432] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 492.962256][ T7432] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 492.966677][ T7435] loop5: detected capacity change from 0 to 7 [ 493.366901][ T7435] loop5: [ 493.370494][ T7435] loop5: partition table partially beyond EOD, truncated [ 494.282629][ T7451] device bridge1 entered promiscuous mode [ 494.295074][ T7451] 9pnet_fd: Insufficient options for proto=fd [ 494.308741][ T3639] loop5: [ 494.315167][ T3639] loop5: partition table partially beyond EOD, truncated [ 497.905033][ T7478] loop5: detected capacity change from 0 to 1024 [ 498.046562][ T7477] loop3: detected capacity change from 0 to 7 [ 498.093427][ T7478] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 498.223443][ T6292] EXT4-fs (loop5): unmounting filesystem. [ 498.383495][ T7477] Dev loop3: unable to read RDB block 7 [ 499.505140][ T7477] loop3: unable to read partition table [ 499.524188][ T7477] loop3: partition table beyond EOD, truncated [ 499.574309][ T7477] loop_reread_partitions: partition scan of loop3 (úùƒå¡™‰ü¾SêjÌ–ã¢P=ý?ã}X‹ºÐ œëÜ%õ«`ÉæÖ€ù…ˆŠ5) failed (rc=-5) [ 499.703496][ T7497] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 499.718109][ T7497] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 502.894061][ T7510] loop2: detected capacity change from 0 to 1024 [ 502.986433][ T7510] EXT4-fs: Ignoring removed nobh option [ 503.866881][ T7510] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 504.841346][ T4280] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 504.853633][ T4280] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 504.885444][ T4280] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 504.995185][ T4272] EXT4-fs (loop2): unmounting filesystem. [ 505.008407][ T4280] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 505.028383][ T4280] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 505.036118][ T4280] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 505.294821][ T7525] lo speed is unknown, defaulting to 1000 [ 505.314101][ T7531] loop2: detected capacity change from 0 to 128 [ 505.849962][ T7531] EXT4-fs warning (device loop2): ext4_init_metadata_csum:4556: metadata_csum and uninit_bg are redundant flags; please run fsck. [ 505.980294][ T7531] EXT4-fs (loop2): VFS: Found ext4 filesystem with invalid superblock checksum. Run e2fsck? [ 506.096704][ T4374] udevd[4374]: incorrect jbd checksum on /dev/loop2 [ 506.502449][ T27] audit: type=1326 audit(1770871569.505:38): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7530 comm="syz.2.626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f335579bf79 code=0x7ffc0000 [ 506.680495][ T27] audit: type=1326 audit(1770871569.505:39): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7530 comm="syz.2.626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=99 compat=0 ip=0x7f335579bf79 code=0x7ffc0000 [ 506.736761][ T9] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 506.806077][ T27] audit: type=1326 audit(1770871569.514:40): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7530 comm="syz.2.626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f335579bf79 code=0x7ffc0000 [ 507.829955][ T4269] Bluetooth: hci4: command 0x0409 tx timeout [ 507.867767][ T27] audit: type=1326 audit(1770871569.514:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7530 comm="syz.2.626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f335579bf79 code=0x7ffc0000 [ 507.907258][ T27] audit: type=1326 audit(1770871569.514:42): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7530 comm="syz.2.626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f335579bf79 code=0x7ffc0000 [ 508.089940][ T27] audit: type=1326 audit(1770871569.514:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7530 comm="syz.2.626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=116 compat=0 ip=0x7f335579bf79 code=0x7ffc0000 [ 508.499900][ T27] audit: type=1326 audit(1770871569.514:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7530 comm="syz.2.626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f335579bf79 code=0x7ffc0000 [ 508.691245][ T27] audit: type=1326 audit(1770871569.524:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7530 comm="syz.2.626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=323 compat=0 ip=0x7f335579bf79 code=0x7ffc0000 [ 508.714759][ T27] audit: type=1326 audit(1770871569.524:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7530 comm="syz.2.626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f335579bf79 code=0x7ffc0000 [ 508.748758][ T27] audit: type=1326 audit(1770871569.524:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7530 comm="syz.2.626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f335579bf79 code=0x7ffc0000 [ 509.504706][ T9] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 509.584432][ T7553] loop2: detected capacity change from 0 to 64 [ 509.594095][ T7554] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 509.603710][ T7554] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 509.691829][ T4374] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 2 [ 509.861094][ T9] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 509.893428][ T7525] chnl_net:caif_netlink_parms(): no params data found [ 510.031884][ T4269] Bluetooth: hci4: command 0x041b tx timeout [ 510.399694][ T9] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 510.674628][ T7562] loop1: detected capacity change from 0 to 256 [ 511.614932][ T7525] bridge0: port 1(bridge_slave_0) entered blocking state [ 511.735070][ T7572] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 511.750730][ T7572] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 511.819752][ T7525] bridge0: port 1(bridge_slave_0) entered disabled state [ 511.947206][ T7525] device bridge_slave_0 entered promiscuous mode [ 512.053390][ T7525] bridge0: port 2(bridge_slave_1) entered blocking state [ 512.061046][ T7525] bridge0: port 2(bridge_slave_1) entered disabled state [ 512.087084][ T7525] device bridge_slave_1 entered promiscuous mode [ 512.244741][ T4280] Bluetooth: hci4: command 0x040f tx timeout [ 512.529500][ T7525] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 512.630673][ T7525] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 514.676942][ T4280] Bluetooth: hci4: command 0x0419 tx timeout [ 515.425874][ T7525] team0: Port device team_slave_0 added [ 515.548901][ T7599] platform regulatory.0: loading /lib/firmware/regulatory.db failed with error -12 [ 515.558561][ T7599] platform regulatory.0: Direct firmware load for regulatory.db failed with error -12 [ 515.568115][ T7599] platform regulatory.0: Falling back to sysfs fallback for: regulatory.db [ 515.624153][ T7599] syz.2.636 (7599) used greatest stack depth: 20120 bytes left [ 515.632358][ T27] kauditd_printk_skb: 18 callbacks suppressed [ 515.645036][ T27] audit: type=1800 audit(1770871578.056:66): pid=7599 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.636" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 515.861241][ T7525] team0: Port device team_slave_1 added [ 516.432412][ T7525] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 516.442795][ T7525] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 516.530831][ T7606] Cannot find add_set index 0 as target [ 516.699542][ T7525] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 516.830320][ T7525] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 516.844878][ T7525] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 516.871046][ C1] vkms_vblank_simulate: vblank timer overrun [ 517.742657][ T7620] loop4: detected capacity change from 0 to 512 [ 517.777512][ T7525] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 517.826220][ T7620] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 518.173816][ T7620] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 518.296592][ T7620] ext4 filesystem being mounted at /144/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 518.560496][ T7632] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 518.571463][ T7632] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 518.949396][ T7525] device hsr_slave_0 entered promiscuous mode [ 519.152842][ T7525] device hsr_slave_1 entered promiscuous mode [ 519.229246][ T7525] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 519.563699][ T7525] Cannot create hsr debugfs directory [ 520.117234][ T27] audit: type=1326 audit(1770871582.322:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7618 comm="syz.4.641" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb97cf9bf79 code=0x0 [ 520.615786][ T7639] loop5: detected capacity change from 0 to 256 [ 520.778591][ T4277] EXT4-fs (loop4): unmounting filesystem. [ 521.601899][ T7650] loop4: detected capacity change from 0 to 1024 [ 522.968080][ T7665] netlink: 48 bytes leftover after parsing attributes in process `syz.4.652'. [ 523.248143][ T7655] overlayfs: missing 'lowerdir' [ 523.745690][ T7673] loop1: detected capacity change from 0 to 164 [ 524.878316][ T7683] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 524.887873][ T7683] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 525.973413][ T7525] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 527.062289][ T9] device hsr_slave_0 left promiscuous mode [ 527.270894][ T9] device hsr_slave_1 left promiscuous mode [ 527.276762][ T7711] loop5: detected capacity change from 0 to 512 [ 527.382186][ T1273] ieee802154 phy0 wpan0: encryption failed: -22 [ 527.405692][ T1273] ieee802154 phy1 wpan1: encryption failed: -22 [ 527.667709][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 528.064366][ T4280] Bluetooth: hci4: command 0x0405 tx timeout [ 528.122188][ T9] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 528.163571][ T7711] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 528.224387][ T9] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 528.232768][ T9] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 528.575422][ T7722] cifs: Unknown parameter 'cache_strategy' [ 528.640617][ T7722] fuse: Bad value for 'fd' [ 528.675949][ T9] device bridge_slave_1 left promiscuous mode [ 528.735549][ T9] bridge0: port 2(bridge_slave_1) entered disabled state [ 528.964747][ T9] device bridge_slave_0 left promiscuous mode [ 528.971011][ T9] bridge0: port 1(bridge_slave_0) entered disabled state [ 529.000005][ T6292] EXT4-fs (loop5): unmounting filesystem. [ 529.963387][ T9] device veth1_macvtap left promiscuous mode [ 529.970694][ T9] device veth0_macvtap left promiscuous mode [ 529.976942][ T9] device veth1_vlan left promiscuous mode [ 530.017951][ T9] device veth0_vlan left promiscuous mode [ 531.652455][ T7740] loop2: detected capacity change from 0 to 164 [ 532.578462][ T7747] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 532.587642][ T7747] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 532.697464][ T7748] netlink: 20 bytes leftover after parsing attributes in process `syz.2.666'. [ 532.711671][ T7748] netlink: 20 bytes leftover after parsing attributes in process `syz.2.666'. [ 535.446290][ T7759] xt_policy: output policy not valid in PREROUTING and INPUT [ 537.295016][ T9] team0 (unregistering): Port device team_slave_1 removed [ 537.628117][ T9] team0 (unregistering): Port device team_slave_0 removed [ 539.147534][ T7783] syz.5.676 (7783): drop_caches: 2 [ 539.169597][ T7783] syz.5.676 (7783): drop_caches: 2 [ 540.004275][ T9] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 540.111744][ T9] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 540.642674][ T7789] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 540.651879][ T7789] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 541.367602][ T9] bond0 (unregistering): Released all slaves [ 541.471501][ T7525] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 541.480914][ T7525] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 541.522317][ T7525] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 541.749399][ T7525] 8021q: adding VLAN 0 to HW filter on device bond0 [ 541.764543][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 541.773802][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 541.790321][ T7525] 8021q: adding VLAN 0 to HW filter on device team0 [ 541.809320][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 541.837596][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 541.876657][ T4460] bridge0: port 1(bridge_slave_0) entered blocking state [ 541.883826][ T4460] bridge0: port 1(bridge_slave_0) entered forwarding state [ 541.911810][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 541.924767][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 541.935215][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 541.961099][ T4460] bridge0: port 2(bridge_slave_1) entered blocking state [ 541.968211][ T4460] bridge0: port 2(bridge_slave_1) entered forwarding state [ 541.976415][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 541.988410][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 542.023732][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 542.038205][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 542.066951][ T7525] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 542.084056][ T7525] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 542.104559][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 542.115822][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 542.127974][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 542.140393][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 542.156432][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 542.167455][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 542.179456][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 542.190806][ T4460] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 542.535599][ T6195] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 542.544105][ T6195] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 542.556801][ T7525] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 542.943108][ T6195] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 542.952803][ T6195] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 542.975596][ T7525] device veth0_vlan entered promiscuous mode [ 542.986381][ T6195] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 543.000904][ T6195] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 543.010060][ T6195] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 543.017972][ T6195] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 543.036099][ T7525] device veth1_vlan entered promiscuous mode [ 543.065183][ T6195] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 543.075527][ T6195] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 543.085953][ T6195] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 543.095678][ T6195] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 543.111601][ T7525] device veth0_macvtap entered promiscuous mode [ 543.129219][ T7525] device veth1_macvtap entered promiscuous mode [ 543.149157][ T7525] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 543.160107][ T7525] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 543.170631][ T7525] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 543.181187][ T7525] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 543.191713][ T7525] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 543.209734][ T7525] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 543.219736][ T7525] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 543.230452][ T7525] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 543.241747][ T7525] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 543.251673][ T7594] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 543.260761][ T7594] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 543.269690][ T7594] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 543.284077][ T7594] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 543.294741][ T7525] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 543.306527][ T7525] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 543.316969][ T7525] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 543.333240][ T7525] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 543.343411][ T7525] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 543.358725][ T7525] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 543.368681][ T7525] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 543.383018][ T7525] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 543.397701][ T7525] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 543.416112][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 543.428348][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 543.443381][ T7525] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.455734][ T7525] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.472918][ T7525] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.482178][ T7525] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 543.578276][ T4460] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 543.591927][ T4460] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 543.604086][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 543.635830][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 543.650792][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 543.659310][ T7594] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 544.530583][ T7861] Bluetooth: MGMT ver 1.22 [ 544.647814][ T7866] loop5: detected capacity change from 0 to 256 [ 545.901752][ T7866] FAT-fs (loop5): Directory bread(block 64) failed [ 545.908507][ T7866] FAT-fs (loop5): Directory bread(block 65) failed [ 545.915548][ T7866] FAT-fs (loop5): Directory bread(block 66) failed [ 545.922196][ T7866] FAT-fs (loop5): Directory bread(block 67) failed [ 545.930306][ T7866] FAT-fs (loop5): Directory bread(block 68) failed [ 545.938353][ T7866] FAT-fs (loop5): Directory bread(block 69) failed [ 545.946340][ T7866] FAT-fs (loop5): Directory bread(block 70) failed [ 545.967115][ T7866] FAT-fs (loop5): Directory bread(block 71) failed [ 545.976512][ T7866] FAT-fs (loop5): Directory bread(block 72) failed [ 545.985477][ T7866] FAT-fs (loop5): Directory bread(block 73) failed [ 546.949247][ T7875] loop4: detected capacity change from 0 to 512 [ 547.446071][ T7875] EXT4-fs: Ignoring removed nobh option [ 549.134801][ T7875] fscrypt (loop4, inode 2): Error -61 getting encryption context [ 549.176125][ T7875] EXT4-fs (loop4): Cannot turn on journaled quota: type 1: error -61 [ 549.309890][ T7875] EXT4-fs error (device loop4): ext4_orphan_get:1399: inode #13: comm syz.4.679: inode has both inline data and extents flags [ 549.357785][ T7875] EXT4-fs error (device loop4): ext4_orphan_get:1404: comm syz.4.679: couldn't read orphan inode 13 (err -117) [ 549.725344][ T7910] bridge0: port 1(bridge_slave_0) entered disabled state [ 549.736032][ T7910] bridge0: port 2(bridge_slave_1) entered disabled state [ 549.927415][ T7910] device macvtap1 left promiscuous mode [ 549.934635][ T7910] device bridge1 left promiscuous mode [ 550.328205][ T7875] EXT4-fs (loop4): mounted filesystem without journal. Quota mode: writeback. [ 552.326720][ T7915] loop6: detected capacity change from 0 to 1024 [ 552.536512][ T4277] EXT4-fs (loop4): unmounting filesystem. [ 552.547850][ T7915] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 553.091083][ T7915] ext4 filesystem being mounted at /3/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 554.327937][ T7525] EXT4-fs (loop6): unmounting filesystem. [ 555.045824][ T7943] capability: warning: `syz.4.694' uses deprecated v2 capabilities in a way that may be insecure [ 557.356573][ T7955] tmpfs: Unknown parameter 'quota' [ 562.239992][ T27] audit: type=1326 audit(1770871621.210:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7984 comm="syz.6.704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd8e039bf79 code=0x7ffc0000 [ 562.331234][ T27] audit: type=1326 audit(1770871621.210:69): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7984 comm="syz.6.704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd8e039bf79 code=0x7ffc0000 [ 562.435514][ T27] audit: type=1326 audit(1770871621.219:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7984 comm="syz.6.704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=136 compat=0 ip=0x7fd8e039bf79 code=0x7ffc0000 [ 562.497171][ T27] audit: type=1326 audit(1770871621.219:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7984 comm="syz.6.704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd8e039bf79 code=0x7ffc0000 [ 562.559591][ T27] audit: type=1326 audit(1770871621.219:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7984 comm="syz.6.704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd8e039bf79 code=0x7ffc0000 [ 562.686643][ T27] audit: type=1326 audit(1770871621.238:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7984 comm="syz.6.704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=323 compat=0 ip=0x7fd8e039bf79 code=0x7ffc0000 [ 562.980133][ T8003] Device name cannot be null; rc = [-22] [ 563.016359][ T8003] loop1: detected capacity change from 0 to 256 [ 563.681071][ T8001] syz.5.716 (8001) used greatest stack depth: 16920 bytes left [ 563.782066][ T27] audit: type=1326 audit(1770871621.238:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7984 comm="syz.6.704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd8e039bf79 code=0x7ffc0000 [ 564.213077][ T27] audit: type=1326 audit(1770871621.238:75): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7984 comm="syz.6.704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd8e039bf79 code=0x7ffc0000 [ 564.438791][ T27] audit: type=1326 audit(1770871621.266:76): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7984 comm="syz.6.704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7fd8e039bf79 code=0x7ffc0000 [ 564.568912][ T27] audit: type=1326 audit(1770871621.266:77): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7984 comm="syz.6.704" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fd8e039bf79 code=0x7ffc0000 [ 574.156518][ T8052] Cannot find add_set index 0 as target [ 576.582252][ T8078] netlink: 20 bytes leftover after parsing attributes in process `syz.4.723'. [ 576.593793][ T8078] netlink: 20 bytes leftover after parsing attributes in process `syz.4.723'. [ 577.005246][ T8087] capability: warning: `syz.1.725' uses 32-bit capabilities (legacy support in use) [ 577.816910][ T8100] loop4: detected capacity change from 0 to 256 [ 578.996962][ T8100] FAT-fs (loop4): Directory bread(block 64) failed [ 579.003756][ T8100] FAT-fs (loop4): Directory bread(block 65) failed [ 579.010815][ T8100] FAT-fs (loop4): Directory bread(block 66) failed [ 579.017523][ T8100] FAT-fs (loop4): Directory bread(block 67) failed [ 579.024550][ T8100] FAT-fs (loop4): Directory bread(block 68) failed [ 579.031265][ T8100] FAT-fs (loop4): Directory bread(block 69) failed [ 579.038302][ T8100] FAT-fs (loop4): Directory bread(block 70) failed [ 579.045116][ T8100] FAT-fs (loop4): Directory bread(block 71) failed [ 579.052063][ T8100] FAT-fs (loop4): Directory bread(block 72) failed [ 579.058964][ T8100] FAT-fs (loop4): Directory bread(block 73) failed [ 579.397214][ T8098] loop5: detected capacity change from 0 to 512 [ 579.634655][ T8098] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled [ 579.962340][ T8098] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: writeback. [ 580.098559][ T8098] ext4 filesystem being mounted at /75/bus supports timestamps until 2038-01-19 (0x7fffffff) [ 582.764035][ T8124] hub 2-0:1.0: USB hub found [ 582.772394][ T8124] hub 2-0:1.0: 1 port detected [ 583.261485][ T6292] EXT4-fs (loop5): unmounting filesystem. [ 584.484500][ T8141] loop6: detected capacity change from 0 to 512 [ 585.684011][ T27] kauditd_printk_skb: 7 callbacks suppressed [ 585.684025][ T27] audit: type=1326 audit(1770871643.145:85): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8140 comm="syz.5.747" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8656f9bf79 code=0x7ffc0000 [ 585.727623][ T8141] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 585.771106][ T8141] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a002c018, mo2=0082] [ 585.959562][ T8141] System zones: 1-12 [ 585.973128][ T8141] EXT4-fs (loop6): 1 truncate cleaned up [ 585.979115][ T8141] EXT4-fs (loop6): mounted filesystem without journal. Quota mode: none. [ 585.988761][ T27] audit: type=1326 audit(1770871643.145:86): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8140 comm="syz.5.747" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8656f9bf79 code=0x7ffc0000 [ 586.348718][ T8159] netlink: 20 bytes leftover after parsing attributes in process `syz.1.737'. [ 586.360183][ T8159] netlink: 20 bytes leftover after parsing attributes in process `syz.1.737'. [ 586.430642][ T27] audit: type=1326 audit(1770871643.173:87): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8140 comm="syz.5.747" exe="/root/syz-executor" sig=0 arch=c000003e syscall=136 compat=0 ip=0x7f8656f9bf79 code=0x7ffc0000 [ 586.453086][ T27] audit: type=1326 audit(1770871643.182:88): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8140 comm="syz.5.747" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8656f9bf79 code=0x7ffc0000 [ 587.170849][ T27] audit: type=1326 audit(1770871643.182:89): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8140 comm="syz.5.747" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8656f9bf79 code=0x7ffc0000 [ 587.302459][ T7525] EXT4-fs (loop6): unmounting filesystem. [ 587.351653][ T27] audit: type=1326 audit(1770871643.201:90): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8140 comm="syz.5.747" exe="/root/syz-executor" sig=0 arch=c000003e syscall=323 compat=0 ip=0x7f8656f9bf79 code=0x7ffc0000 [ 587.393707][ T27] audit: type=1326 audit(1770871643.201:91): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8140 comm="syz.5.747" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8656f9bf79 code=0x7ffc0000 [ 587.641411][ T27] audit: type=1326 audit(1770871643.201:92): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8140 comm="syz.5.747" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8656f9bf79 code=0x7ffc0000 [ 588.054328][ T27] audit: type=1326 audit(1770871643.220:93): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8140 comm="syz.5.747" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f8656f9bf79 code=0x7ffc0000 [ 588.394526][ T27] audit: type=1326 audit(1770871643.220:94): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8140 comm="syz.5.747" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8656f9bf79 code=0x7ffc0000 [ 589.652133][ T8188] binder: 8182:8188 ioctl 4018620d 0 returned -22 [ 591.434075][ T8204] loop1: detected capacity change from 0 to 256 [ 592.046130][ T8204] exFAT-fs (loop1): error, invalid access to FAT (entry 0x00000005) bogus content (0x00000001) [ 592.059373][ T8204] exFAT-fs (loop1): failed to load upcase table [ 592.066343][ T8204] exFAT-fs (loop1): failed to recognize exfat type [ 593.077402][ T1273] ieee802154 phy0 wpan0: encryption failed: -22 [ 593.088245][ T1273] ieee802154 phy1 wpan1: encryption failed: -22 [ 596.932798][ T8247] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 596.955225][ T8247] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 597.176648][ T8247] ovl_remap_lower_ino: 20 callbacks suppressed [ 597.176718][ T8247] overlayfs: d_ino too big (., ino=4611686018427387905, xinobits=3) [ 597.191349][ T8247] overlayfs: d_ino too big (.., ino=4611686018427387905, xinobits=3) [ 597.202649][ T8247] overlayfs: d_ino too big (167, ino=9223372036854776752, xinobits=3) [ 597.213609][ T8247] overlayfs: d_ino too big (syzcgroup, ino=9223372036854775816, xinobits=3) [ 597.225314][ T8247] overlayfs: d_ino too big (syz-inputs, ino=9223372036854775815, xinobits=3) [ 597.236956][ T8247] overlayfs: d_ino too big (sys, ino=9223372036854775814, xinobits=3) [ 597.247659][ T8247] overlayfs: d_ino too big (selinux, ino=9223372036854775813, xinobits=3) [ 597.259320][ T8247] overlayfs: d_ino too big (proc, ino=9223372036854775812, xinobits=3) [ 597.269585][ T8247] overlayfs: d_ino too big (dev, ino=9223372036854775811, xinobits=3) [ 597.280770][ T8247] overlayfs: d_ino too big (io.pressure, ino=4611686018427387914, xinobits=3) [ 598.214986][ T8253] overlayfs: fs on './bus' does not support file handles, falling back to index=off,nfs_export=off. [ 598.226583][ T8253] overlayfs: upperdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 599.686239][ T8261] tmpfs: Unknown parameter 'quota' [ 601.582882][ T8278] loop5: detected capacity change from 0 to 1024 [ 603.959045][ T27] kauditd_printk_skb: 7 callbacks suppressed [ 603.959089][ T27] audit: type=1326 audit(1770871660.749:102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8289 comm="syz.4.764" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb97cf9bf79 code=0x7ffc0000 [ 604.520497][ T27] audit: type=1326 audit(1770871660.749:103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8289 comm="syz.4.764" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb97cf9bf79 code=0x7ffc0000 [ 604.998861][ T8303] netlink: 20 bytes leftover after parsing attributes in process `syz.6.766'. [ 605.009563][ T8303] netlink: 20 bytes leftover after parsing attributes in process `syz.6.766'. [ 605.886673][ T27] audit: type=1326 audit(1770871660.777:104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8289 comm="syz.4.764" exe="/root/syz-executor" sig=0 arch=c000003e syscall=136 compat=0 ip=0x7fb97cf9bf79 code=0x7ffc0000 [ 607.420240][ T27] audit: type=1326 audit(1770871660.777:105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8289 comm="syz.4.764" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb97cf9bf79 code=0x7ffc0000 [ 607.688083][ T27] audit: type=1326 audit(1770871660.777:106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8289 comm="syz.4.764" exe="/root/syz-executor" sig=0 arch=c000003e syscall=323 compat=0 ip=0x7fb97cf9bf79 code=0x7ffc0000 [ 608.101685][ T27] audit: type=1326 audit(1770871660.777:107): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8289 comm="syz.4.764" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb97cf9bf79 code=0x7ffc0000 [ 608.409562][ T27] audit: type=1326 audit(1770871660.777:108): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8289 comm="syz.4.764" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7fb97cf9bf79 code=0x7ffc0000 [ 608.504628][ T8324] comedi comedi0: pcl816: I/O port conflict (0x8001,16) [ 608.528932][ T27] audit: type=1326 audit(1770871660.777:109): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8289 comm="syz.4.764" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb97cf9bf79 code=0x7ffc0000 [ 608.649819][ T27] audit: type=1326 audit(1770871660.796:110): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8289 comm="syz.4.764" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fb97cf9bf79 code=0x7ffc0000 [ 608.750428][ T27] audit: type=1326 audit(1770871660.796:111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8289 comm="syz.4.764" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb97cf9bf79 code=0x7ffc0000 [ 611.457635][ T4280] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 611.698994][ T4280] Bluetooth: hci0: command 0x0406 tx timeout [ 615.192222][ T8363] loop2: detected capacity change from 0 to 1024 [ 615.575166][ T8363] EXT4-fs (loop2): mounted filesystem without journal. Quota mode: none. [ 616.334033][ T8363] ext4 filesystem being mounted at /176/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 617.297528][ T8397] loop5: detected capacity change from 0 to 128 [ 617.585339][ T4272] EXT4-fs (loop2): unmounting filesystem. [ 617.627237][ T8397] EXT4-fs (loop5): mounted filesystem without journal. Quota mode: none. [ 617.704036][ T8397] ext4 filesystem being mounted at /86/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 620.052531][ T6292] EXT4-fs (loop5): unmounting filesystem. [ 621.912521][ T8425] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 622.075248][ T8432] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 622.138860][ T8422] Cannot find add_set index 0 as target [ 623.698238][ T8447] Device name cannot be null; rc = [-22] [ 623.725041][ T8447] loop4: detected capacity change from 0 to 256 [ 630.258933][ T8493] loop2: detected capacity change from 0 to 40427 [ 630.270640][ T8493] F2FS-fs (loop2): invalid crc value [ 630.314430][ T8493] F2FS-fs (loop2): Found nat_bits in checkpoint [ 630.388694][ T8493] F2FS-fs (loop2): Start checkpoint disabled! [ 630.476441][ T8493] F2FS-fs (loop2): Mounted with checkpoint version = 48b305e6 [ 632.316858][ T8500] hub 2-0:1.0: USB hub found [ 632.323221][ T8500] hub 2-0:1.0: 1 port detected [ 634.943906][ T31] kworker/u4:2: attempt to access beyond end of device [ 634.943906][ T31] loop2: rw=2049, sector=40960, nr_sectors = 24 limit=40427 [ 636.547484][ T8535] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 636.582784][ T8533] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 636.612696][ T8533] ovl_remap_lower_ino: 21 callbacks suppressed [ 636.612720][ T8533] overlayfs: d_ino too big (., ino=4611686018427387905, xinobits=3) [ 636.827619][ T8533] overlayfs: d_ino too big (.., ino=4611686018427387905, xinobits=3) [ 636.839538][ T8533] overlayfs: d_ino too big (182, ino=9223372036854776850, xinobits=3) [ 636.847931][ T8533] overlayfs: d_ino too big (syzcgroup, ino=9223372036854775816, xinobits=3) [ 636.857341][ T8533] overlayfs: d_ino too big (syz-inputs, ino=9223372036854775815, xinobits=3) [ 636.866704][ T8533] overlayfs: d_ino too big (sys, ino=9223372036854775814, xinobits=3) [ 636.875549][ T8533] overlayfs: d_ino too big (selinux, ino=9223372036854775813, xinobits=3) [ 637.436447][ T8533] overlayfs: d_ino too big (proc, ino=9223372036854775812, xinobits=3) [ 637.445673][ T8533] overlayfs: d_ino too big (dev, ino=9223372036854775811, xinobits=3) [ 637.454447][ T8533] overlayfs: d_ino too big (io.pressure, ino=4611686018427387914, xinobits=3) [ 638.405052][ T4269] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 638.417733][ T4269] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 638.441425][ T4269] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 638.450984][ T4269] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 638.459171][ T4269] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3 [ 638.466549][ T4269] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 638.498570][ T8551] lo speed is unknown, defaulting to 1000 [ 639.650072][ T8559] hub 2-0:1.0: USB hub found [ 639.658736][ T8559] hub 2-0:1.0: 1 port detected [ 640.032630][ T8563] loop1: detected capacity change from 0 to 128 [ 640.127140][ T8563] EXT4-fs (loop1): mounted filesystem without journal. Quota mode: none. [ 640.169180][ T8563] ext4 filesystem being mounted at /188/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa supports timestamps until 2038-01-19 (0x7fffffff) [ 640.287119][ T4412] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 640.699578][ T4280] Bluetooth: hci4: command 0x0409 tx timeout [ 641.110521][ T4273] EXT4-fs (loop1): unmounting filesystem. [ 641.602021][ T4412] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 641.863828][ T4412] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 642.181007][ T4412] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 643.040051][ T4280] Bluetooth: hci4: command 0x041b tx timeout [ 644.946580][ T8606] loop2: detected capacity change from 0 to 256 [ 645.032088][ T8606] FAT-fs (loop2): Directory bread(block 64) failed [ 645.038925][ T8606] FAT-fs (loop2): Directory bread(block 65) failed [ 645.045888][ T8606] FAT-fs (loop2): Directory bread(block 66) failed [ 645.052644][ T8606] FAT-fs (loop2): Directory bread(block 67) failed [ 645.059702][ T8606] FAT-fs (loop2): Directory bread(block 68) failed [ 645.066402][ T8606] FAT-fs (loop2): Directory bread(block 69) failed [ 645.073444][ T8606] FAT-fs (loop2): Directory bread(block 70) failed [ 645.080246][ T8606] FAT-fs (loop2): Directory bread(block 71) failed [ 645.087277][ T8606] FAT-fs (loop2): Directory bread(block 72) failed [ 645.094095][ T8606] FAT-fs (loop2): Directory bread(block 73) failed [ 645.229896][ T4280] Bluetooth: hci4: command 0x040f tx timeout [ 645.790148][ T8551] chnl_net:caif_netlink_parms(): no params data found [ 646.678925][ T8551] bridge0: port 1(bridge_slave_0) entered blocking state [ 646.726733][ T8551] bridge0: port 1(bridge_slave_0) entered disabled state [ 646.811451][ T8551] device bridge_slave_0 entered promiscuous mode [ 646.835602][ T8551] bridge0: port 2(bridge_slave_1) entered blocking state [ 646.842735][ T8551] bridge0: port 2(bridge_slave_1) entered disabled state [ 646.868856][ T8551] device bridge_slave_1 entered promiscuous mode [ 648.298484][ T4280] Bluetooth: hci4: command 0x0419 tx timeout [ 649.071954][ T8631] hub 2-0:1.0: USB hub found [ 649.077047][ T8631] hub 2-0:1.0: 1 port detected [ 649.303705][ T8551] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 649.329640][ T8551] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 650.253537][ T8551] team0: Port device team_slave_0 added [ 650.269986][ T8551] team0: Port device team_slave_1 added [ 650.584902][ T8551] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 650.619655][ T8551] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 651.108482][ T8551] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 651.633115][ T8551] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 651.713733][ T8551] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 651.746440][ T8551] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 653.299755][ T8551] device hsr_slave_0 entered promiscuous mode [ 653.377155][ T8551] device hsr_slave_1 entered promiscuous mode [ 654.568246][ T8551] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 654.679587][ T8551] Cannot create hsr debugfs directory [ 655.273923][ T8551] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 655.386745][ T8551] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 655.412490][ T8551] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 655.459059][ T8551] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 655.485599][ T4412] device hsr_slave_0 left promiscuous mode [ 655.493525][ T4412] device hsr_slave_1 left promiscuous mode [ 655.500069][ T4412] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 655.508719][ T4412] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 655.517301][ T4412] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 655.525147][ T4412] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 655.532927][ T4412] device bridge_slave_1 left promiscuous mode [ 655.539854][ T4412] bridge0: port 2(bridge_slave_1) entered disabled state [ 655.549301][ T4412] device bridge_slave_0 left promiscuous mode [ 655.555666][ T4412] bridge0: port 1(bridge_slave_0) entered disabled state [ 655.586933][ T4412] device veth1_macvtap left promiscuous mode [ 655.593183][ T4412] device veth0_macvtap left promiscuous mode [ 655.599341][ T4412] device veth1_vlan left promiscuous mode [ 655.606428][ T4412] device veth0_vlan left promiscuous mode [ 656.246939][ T4412] team0 (unregistering): Port device team_slave_1 removed [ 656.300523][ T4412] team0 (unregistering): Port device team_slave_0 removed [ 656.351698][ T4412] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 656.408371][ T4412] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 656.810059][ T4412] bond0 (unregistering): Released all slaves [ 656.990478][ T8551] 8021q: adding VLAN 0 to HW filter on device bond0 [ 657.027354][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 657.042751][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 657.054657][ T8551] 8021q: adding VLAN 0 to HW filter on device team0 [ 657.065720][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 657.074586][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 657.089870][ T4746] bridge0: port 1(bridge_slave_0) entered blocking state [ 657.097077][ T4746] bridge0: port 1(bridge_slave_0) entered forwarding state [ 657.115006][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 657.142409][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 657.176889][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 657.186252][ T4746] bridge0: port 2(bridge_slave_1) entered blocking state [ 657.193433][ T4746] bridge0: port 2(bridge_slave_1) entered forwarding state [ 657.217450][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 657.227387][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 657.238381][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 657.250660][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 657.260657][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 657.269771][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 657.279085][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 657.290327][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 657.310785][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 657.356298][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 657.372411][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 657.382598][ T8551] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 657.710560][ T4501] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 657.718893][ T4501] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 657.739330][ T8551] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 658.144636][ T2955] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 658.154089][ T2955] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 658.177616][ T8551] device veth0_vlan entered promiscuous mode [ 658.190358][ T2955] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 658.198899][ T2955] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 658.208831][ T8551] device veth1_vlan entered promiscuous mode [ 658.219096][ T2955] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 658.227092][ T2955] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 658.236688][ T2955] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 658.261268][ T2955] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 658.270546][ T2955] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 658.280393][ T2955] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 658.292202][ T8551] device veth0_macvtap entered promiscuous mode [ 658.303421][ T8551] device veth1_macvtap entered promiscuous mode [ 658.322941][ T8551] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 658.335308][ T8551] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 658.345610][ T8551] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 658.356877][ T8551] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 658.367318][ T8551] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 658.378151][ T8551] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 658.388386][ T8551] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 658.399191][ T8551] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 658.410779][ T8551] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 658.423144][ T8551] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 658.434153][ T8551] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 658.444734][ T8551] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 658.455848][ T8551] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 658.466552][ T8551] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 658.477290][ T8551] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 658.487743][ T8551] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 658.498535][ T8551] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 658.509434][ T8551] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 658.516920][ T4501] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 658.525519][ T4501] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 658.533553][ T4501] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 658.543206][ T4501] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 658.553131][ T4501] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 658.562303][ T4501] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 658.589559][ T8551] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 658.599560][ T8551] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 658.609397][ T8551] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 658.618324][ T8551] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 658.662701][ T1273] ieee802154 phy0 wpan0: encryption failed: -22 [ 658.669280][ T1273] ieee802154 phy1 wpan1: encryption failed: -22 [ 658.726006][ T2955] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 658.741424][ T2955] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 658.750441][ T4501] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 658.797420][ T2955] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 658.805309][ T2955] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 658.840244][ T6195] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 661.841637][ T8769] 8021q: adding VLAN 0 to HW filter on device bond0 [ 663.381783][ T8787] hub 2-0:1.0: USB hub found [ 663.388486][ T8787] hub 2-0:1.0: 1 port detected [ 663.672940][ T8769] bond0: (slave rose0): Enslaving as an active interface with an up link [ 663.693491][ T4746] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 663.772004][ T8797] netlink: 64 bytes leftover after parsing attributes in process `syz.4.846'. [ 668.770301][ T8846] loop1: detected capacity change from 0 to 256 [ 672.368088][ T8846] FAT-fs (loop1): Directory bread(block 64) failed [ 672.374809][ T8846] FAT-fs (loop1): Directory bread(block 65) failed [ 672.381383][ T8846] FAT-fs (loop1): Directory bread(block 66) failed [ 672.388375][ T8846] FAT-fs (loop1): Directory bread(block 67) failed [ 672.405414][ T8846] FAT-fs (loop1): Directory bread(block 68) failed [ 672.412105][ T8846] FAT-fs (loop1): Directory bread(block 69) failed [ 672.423006][ T8846] FAT-fs (loop1): Directory bread(block 70) failed [ 672.433760][ T8846] FAT-fs (loop1): Directory bread(block 71) failed [ 672.444650][ T8846] FAT-fs (loop1): Directory bread(block 72) failed [ 672.451916][ T8846] FAT-fs (loop1): Directory bread(block 73) failed [ 674.461714][ T8867] hub 2-0:1.0: USB hub found [ 674.472470][ T8867] hub 2-0:1.0: 1 port detected [ 674.859260][ T8870] fuse: Bad value for 'fd' [ 675.094631][ T8870] loop4: detected capacity change from 0 to 2048 [ 675.168245][ T8876] netlink: 64 bytes leftover after parsing attributes in process `syz.2.865'. [ 683.448876][ T5589] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 684.209629][ T8943] trusted_key: encrypted_key: insufficient parameters specified [ 685.631717][ T5589] usb 5-1: device descriptor read/64, error -71 [ 686.571226][ T8959] netlink: 64 bytes leftover after parsing attributes in process `syz.5.880'. [ 692.527842][ T9000] trusted_key: encrypted_key: insufficient parameters specified [ 695.726629][ T9004] autofs4:pid:9004:autofs_fill_super: called with bogus options [ 696.861636][ T9033] netlink: 64 bytes leftover after parsing attributes in process `syz.1.895'. [ 697.990699][ T9042] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 703.620942][ T4280] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 703.632739][ T4280] CPU: 1 PID: 4280 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 703.640331][ T4280] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 703.650416][ T4280] Workqueue: hci2 hci_rx_work [ 703.655132][ T4280] Call Trace: [ 703.658431][ T4280] [ 703.661376][ T4280] dump_stack_lvl+0x188/0x24e [ 703.666083][ T4280] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 703.671745][ T4280] ? show_regs_print_info+0x12/0x12 [ 703.676975][ T4280] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 703.682652][ T4280] sysfs_create_dir_ns+0x26a/0x290 [ 703.687804][ T4280] ? sysfs_warn_dup+0xa0/0xa0 [ 703.692513][ T4280] ? do_raw_spin_unlock+0x11d/0x230 [ 703.697717][ T4280] kobject_add_internal+0x61c/0xcc0 [ 703.702958][ T4280] kobject_add+0x160/0x230 [ 703.707374][ T4280] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 703.713021][ T4280] ? kobject_init+0x1d0/0x1d0 [ 703.717712][ T4280] ? klist_children_get+0x50/0x50 [ 703.722744][ T4280] ? get_device_parent+0x121/0x3f0 [ 703.727869][ T4280] device_add+0x483/0xfb0 [ 703.732212][ T4280] ? kmem_cache_free+0xf7/0x290 [ 703.737072][ T4280] hci_conn_add_sysfs+0xd1/0x1e0 [ 703.742022][ T4280] le_conn_complete_evt+0x105f/0x1670 [ 703.747407][ T4280] ? hci_le_big_info_adv_report_evt+0x2f0/0x2f0 [ 703.753657][ T4280] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 703.759299][ T4280] ? lockdep_hardirqs_on+0x94/0x140 [ 703.764507][ T4280] ? skb_pull_data+0xf7/0x200 [ 703.769201][ T4280] hci_le_conn_complete_evt+0x183/0x440 [ 703.774786][ T4280] ? hci_remote_host_features_evt+0x270/0x270 [ 703.780879][ T4280] hci_event_packet+0x7b6/0x1280 [ 703.785838][ T4280] ? bis_list+0x280/0x280 [ 703.790173][ T4280] ? lockdep_hardirqs_on+0x94/0x140 [ 703.795458][ T4280] ? hci_rx_work+0x1c1/0xd40 [ 703.800120][ T4280] hci_rx_work+0x3eb/0xd40 [ 703.804608][ T4280] ? process_one_work+0x7b0/0x1160 [ 703.809788][ T4280] process_one_work+0x8a2/0x1160 [ 703.814824][ T4280] ? worker_detach_from_pool+0x240/0x240 [ 703.820532][ T4280] ? _raw_spin_lock_irq+0xb7/0xf0 [ 703.825603][ T4280] ? _raw_spin_lock_irqsave+0x100/0x100 [ 703.831275][ T4280] ? kthread_data+0x4b/0xc0 [ 703.835863][ T4280] worker_thread+0xaa2/0x1270 [ 703.840624][ T4280] kthread+0x29d/0x330 [ 703.844729][ T4280] ? worker_clr_flags+0x1a0/0x1a0 [ 703.849813][ T4280] ? kthread_blkcg+0xd0/0xd0 [ 703.854434][ T4280] ret_from_fork+0x1f/0x30 [ 703.858943][ T4280] [ 703.878629][ T4280] kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 703.896671][ T4280] Bluetooth: hci2: failed to register connection device [ 704.316481][ T4280] ================================================================== [ 704.324700][ T4280] BUG: KASAN: use-after-free in l2cap_sock_new_connection_cb+0x1f5/0x2a0 [ 704.333183][ T4280] Read of size 8 at addr ffff88801f2ca548 by task kworker/u5:4/4280 [ 704.341236][ T4280] [ 704.343608][ T4280] CPU: 0 PID: 4280 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 704.351210][ T4280] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 704.361329][ T4280] Workqueue: hci2 hci_rx_work [ 704.366084][ T4280] Call Trace: [ 704.369394][ T4280] [ 704.372357][ T4280] dump_stack_lvl+0x188/0x24e [ 704.377151][ T4280] ? __lock_acquire+0x7d10/0x7d10 [ 704.382271][ T4280] ? show_regs_print_info+0x12/0x12 [ 704.387514][ T4280] ? load_image+0x400/0x400 [ 704.392079][ T4280] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 704.397568][ T4280] ? __virt_addr_valid+0x188/0x540 [ 704.402713][ T4280] ? __virt_addr_valid+0x465/0x540 [ 704.407862][ T4280] ? l2cap_sock_new_connection_cb+0x1f5/0x2a0 [ 704.414036][ T4280] print_report+0xa8/0x210 [ 704.418476][ T4280] kasan_report+0x10b/0x140 [ 704.423009][ T4280] ? l2cap_sock_new_connection_cb+0x1f5/0x2a0 [ 704.429137][ T4280] l2cap_sock_new_connection_cb+0x1f5/0x2a0 [ 704.435110][ T4280] l2cap_connect_cfm+0x35f/0x1120 [ 704.440422][ T4280] ? l2cap_ertm_resend+0x10d0/0x10d0 [ 704.445806][ T4280] ? l2cap_ertm_resend+0x10d0/0x10d0 [ 704.451180][ T4280] hci_connect_cfm+0x8f/0x130 [ 704.455935][ T4280] le_conn_complete_evt+0x10ec/0x1670 [ 704.461398][ T4280] ? hci_le_big_info_adv_report_evt+0x2f0/0x2f0 [ 704.467800][ T4280] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 704.473517][ T4280] ? lockdep_hardirqs_on+0x94/0x140 [ 704.478777][ T4280] ? skb_pull_data+0xf7/0x200 [ 704.483646][ T4280] hci_le_conn_complete_evt+0x183/0x440 [ 704.489256][ T4280] ? hci_remote_host_features_evt+0x270/0x270 [ 704.495434][ T4280] hci_event_packet+0x7b6/0x1280 [ 704.500476][ T4280] ? bis_list+0x280/0x280 [ 704.504910][ T4280] ? lockdep_hardirqs_on+0x94/0x140 [ 704.510356][ T4280] ? hci_rx_work+0x1c1/0xd40 [ 704.515124][ T4280] hci_rx_work+0x3eb/0xd40 [ 704.519620][ T4280] ? process_one_work+0x7b0/0x1160 [ 704.525791][ T4280] process_one_work+0x8a2/0x1160 [ 704.531244][ T4280] ? worker_detach_from_pool+0x240/0x240 [ 704.537038][ T4280] ? _raw_spin_lock_irq+0xb7/0xf0 [ 704.542166][ T4280] ? _raw_spin_lock_irqsave+0x100/0x100 [ 704.547773][ T4280] ? kthread_data+0x4b/0xc0 [ 704.552616][ T4280] worker_thread+0xaa2/0x1270 [ 704.557653][ T4280] kthread+0x29d/0x330 [ 704.561784][ T4280] ? worker_clr_flags+0x1a0/0x1a0 [ 704.567399][ T4280] ? kthread_blkcg+0xd0/0xd0 [ 704.572038][ T4280] ret_from_fork+0x1f/0x30 [ 704.576552][ T4280] [ 704.579615][ T4280] [ 704.581960][ T4280] Allocated by task 4280: [ 704.586338][ T4280] kasan_set_track+0x4b/0x70 [ 704.591003][ T4280] __kasan_kmalloc+0x8e/0xa0 [ 704.595698][ T4280] __kmalloc+0xb0/0x240 [ 704.599951][ T4280] sk_prot_alloc+0xe7/0x210 [ 704.604557][ T4280] sk_alloc+0x36/0x340 [ 704.608738][ T4280] bt_sock_alloc+0x36/0x130 [ 704.613348][ T4280] l2cap_sock_new_connection_cb+0xde/0x2a0 [ 704.619219][ T4280] l2cap_connect_cfm+0x35f/0x1120 [ 704.624339][ T4280] hci_connect_cfm+0x8f/0x130 [ 704.629182][ T4280] le_conn_complete_evt+0x10ec/0x1670 [ 704.634644][ T4280] hci_le_conn_complete_evt+0x183/0x440 [ 704.640285][ T4280] hci_event_packet+0x7b6/0x1280 [ 704.645316][ T4280] hci_rx_work+0x3eb/0xd40 [ 704.649810][ T4280] process_one_work+0x8a2/0x1160 [ 704.654774][ T4280] worker_thread+0xaa2/0x1270 [ 704.659466][ T4280] kthread+0x29d/0x330 [ 704.663547][ T4280] ret_from_fork+0x1f/0x30 [ 704.667983][ T4280] [ 704.670309][ T4280] Freed by task 9094: [ 704.674291][ T4280] kasan_set_track+0x4b/0x70 [ 704.678899][ T4280] kasan_save_free_info+0x2d/0x50 [ 704.683947][ T4280] ____kasan_slab_free+0x126/0x1e0 [ 704.689088][ T4280] slab_free_freelist_hook+0x131/0x1a0 [ 704.694573][ T4280] __kmem_cache_free+0xb6/0x1f0 [ 704.699443][ T4280] __sk_destruct+0x4ba/0x650 [ 704.704051][ T4280] l2cap_sock_cleanup_listen+0xda/0x270 [ 704.709624][ T4280] l2cap_sock_release+0x66/0x1e0 [ 704.714590][ T4280] sock_close+0xd5/0x240 [ 704.718865][ T4280] __fput+0x22c/0x920 [ 704.722865][ T4280] task_work_run+0x1d0/0x260 [ 704.727472][ T4280] get_signal+0x11a6/0x1350 [ 704.732012][ T4280] arch_do_signal_or_restart+0xc4/0x1350 [ 704.737675][ T4280] exit_to_user_mode_loop+0x70/0x110 [ 704.743034][ T4280] exit_to_user_mode_prepare+0xee/0x180 [ 704.748605][ T4280] syscall_exit_to_user_mode+0x16/0x40 [ 704.754086][ T4280] do_syscall_64+0x58/0xa0 [ 704.758522][ T4280] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 704.764434][ T4280] [ 704.766775][ T4280] Last potentially related work creation: [ 704.772513][ T4280] kasan_save_stack+0x3a/0x60 [ 704.777219][ T4280] __kasan_record_aux_stack+0xb2/0xc0 [ 704.782606][ T4280] call_rcu+0x14f/0x990 [ 704.786782][ T4280] dev_shutdown+0x92/0x440 [ 704.791217][ T4280] unregister_netdevice_many+0xa4f/0x1930 [ 704.796968][ T4280] default_device_exit_batch+0x9e6/0xa80 [ 704.802635][ T4280] cleanup_net+0x791/0xba0 [ 704.807074][ T4280] process_one_work+0x8a2/0x1160 [ 704.812030][ T4280] worker_thread+0xaa2/0x1270 [ 704.816812][ T4280] kthread+0x29d/0x330 [ 704.820897][ T4280] ret_from_fork+0x1f/0x30 [ 704.825338][ T4280] [ 704.827673][ T4280] Second to last potentially related work creation: [ 704.834263][ T4280] kasan_save_stack+0x3a/0x60 [ 704.838964][ T4280] __kasan_record_aux_stack+0xb2/0xc0 [ 704.844349][ T4280] call_rcu+0x14f/0x990 [ 704.848529][ T4280] netlink_release+0x158e/0x19e0 [ 704.853487][ T4280] sock_release+0x7b/0x140 [ 704.857931][ T4280] rtnetlink_net_exit+0x3c/0x60 [ 704.862808][ T4280] cleanup_net+0x706/0xba0 [ 704.867243][ T4280] process_one_work+0x8a2/0x1160 [ 704.872202][ T4280] worker_thread+0xaa2/0x1270 [ 704.876899][ T4280] kthread+0x29d/0x330 [ 704.880987][ T4280] ret_from_fork+0x1f/0x30 [ 704.885426][ T4280] [ 704.887755][ T4280] The buggy address belongs to the object at ffff88801f2ca000 [ 704.887755][ T4280] which belongs to the cache kmalloc-2k of size 2048 [ 704.901827][ T4280] The buggy address is located 1352 bytes inside of [ 704.901827][ T4280] 2048-byte region [ffff88801f2ca000, ffff88801f2ca800) [ 704.915383][ T4280] [ 704.917722][ T4280] The buggy address belongs to the physical page: [ 704.924139][ T4280] page:ffffea00007cb200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1f2c8 [ 704.934313][ T4280] head:ffffea00007cb200 order:3 compound_mapcount:0 compound_pincount:0 [ 704.942654][ T4280] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 704.950674][ T4280] raw: 00fff00000010200 0000000000000000 dead000000000001 ffff888017442000 [ 704.959278][ T4280] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 [ 704.967876][ T4280] page dumped because: kasan: bad access detected [ 704.974307][ T4280] page_owner tracks the page as allocated [ 704.980038][ T4280] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 3806590500, free_ts 0 [ 704.999685][ T4280] post_alloc_hook+0x173/0x1a0 [ 705.004480][ T4280] get_page_from_freelist+0x1a1e/0x1ab0 [ 705.010051][ T4280] __alloc_pages+0x1ec/0x4f0 [ 705.014663][ T4280] alloc_page_interleave+0x24/0x1e0 [ 705.019887][ T4280] alloc_slab_page+0x5d/0x160 [ 705.024579][ T4280] new_slab+0x87/0x2c0 [ 705.028660][ T4280] ___slab_alloc+0xbc6/0x1240 [ 705.033358][ T4280] __kmem_cache_alloc_node+0x1a0/0x260 [ 705.038921][ T4280] kmalloc_trace+0x26/0xe0 [ 705.043361][ T4280] acpi_ds_create_walk_state+0xe2/0x270 [ 705.048926][ T4280] acpi_ps_execute_method+0x21c/0x7b0 [ 705.054321][ T4280] acpi_ns_evaluate+0x617/0x9d0 [ 705.059184][ T4280] acpi_ut_evaluate_object+0x12f/0x490 [ 705.064660][ T4280] acpi_ut_execute_STA+0x44/0x130 [ 705.069700][ T4280] acpi_ns_get_device_callback+0x210/0x4b0 [ 705.075528][ T4280] acpi_ns_walk_namespace+0x235/0x680 [ 705.080917][ T4280] page_owner free stack trace missing [ 705.086290][ T4280] [ 705.088615][ T4280] Memory state around the buggy address: [ 705.094255][ T4280] ffff88801f2ca400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 705.102331][ T4280] ffff88801f2ca480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 705.110672][ T4280] >ffff88801f2ca500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 705.119180][ T4280] ^ [ 705.125601][ T4280] ffff88801f2ca580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 705.133680][ T4280] ffff88801f2ca600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 705.141758][ T4280] ================================================================== [ 705.541428][ T4280] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 705.548686][ T4280] CPU: 0 PID: 4280 Comm: kworker/u5:4 Not tainted syzkaller #0 [ 705.556247][ T4280] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 705.566323][ T4280] Workqueue: hci2 hci_rx_work [ 705.571060][ T4280] Call Trace: [ 705.574355][ T4280] [ 705.577298][ T4280] dump_stack_lvl+0x188/0x24e [ 705.582012][ T4280] ? memcpy+0x3c/0x60 [ 705.586010][ T4280] ? show_regs_print_info+0x12/0x12 [ 705.591238][ T4280] ? load_image+0x400/0x400 [ 705.595772][ T4280] panic+0x2e5/0x730 [ 705.599685][ T4280] ? bpf_jit_dump+0xd0/0xd0 [ 705.604203][ T4280] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 705.609876][ T4280] ? check_panic_on_warn+0x6c/0xa0 [ 705.615016][ T4280] check_panic_on_warn+0x80/0xa0 [ 705.619982][ T4280] ? l2cap_sock_new_connection_cb+0x1f5/0x2a0 [ 705.626075][ T4280] end_report+0x66/0x110 [ 705.630347][ T4280] kasan_report+0x118/0x140 [ 705.634875][ T4280] ? l2cap_sock_new_connection_cb+0x1f5/0x2a0 [ 705.641047][ T4280] l2cap_sock_new_connection_cb+0x1f5/0x2a0 [ 705.646972][ T4280] l2cap_connect_cfm+0x35f/0x1120 [ 705.652028][ T4280] ? l2cap_ertm_resend+0x10d0/0x10d0 [ 705.657361][ T4280] ? l2cap_ertm_resend+0x10d0/0x10d0 [ 705.662671][ T4280] hci_connect_cfm+0x8f/0x130 [ 705.667374][ T4280] le_conn_complete_evt+0x10ec/0x1670 [ 705.672791][ T4280] ? hci_le_big_info_adv_report_evt+0x2f0/0x2f0 [ 705.679054][ T4280] ? asm_sysvec_reschedule_ipi+0x16/0x20 [ 705.684707][ T4280] ? lockdep_hardirqs_on+0x94/0x140 [ 705.689922][ T4280] ? skb_pull_data+0xf7/0x200 [ 705.694632][ T4280] hci_le_conn_complete_evt+0x183/0x440 [ 705.700203][ T4280] ? hci_remote_host_features_evt+0x270/0x270 [ 705.706301][ T4280] hci_event_packet+0x7b6/0x1280 [ 705.711291][ T4280] ? bis_list+0x280/0x280 [ 705.715667][ T4280] ? lockdep_hardirqs_on+0x94/0x140 [ 705.720895][ T4280] ? hci_rx_work+0x1c1/0xd40 [ 705.725502][ T4280] hci_rx_work+0x3eb/0xd40 [ 705.729937][ T4280] ? process_one_work+0x7b0/0x1160 [ 705.735065][ T4280] process_one_work+0x8a2/0x1160 [ 705.740029][ T4280] ? worker_detach_from_pool+0x240/0x240 [ 705.745686][ T4280] ? _raw_spin_lock_irq+0xb7/0xf0 [ 705.750733][ T4280] ? _raw_spin_lock_irqsave+0x100/0x100 [ 705.756395][ T4280] ? kthread_data+0x4b/0xc0 [ 705.760937][ T4280] worker_thread+0xaa2/0x1270 [ 705.765647][ T4280] kthread+0x29d/0x330 [ 705.769741][ T4280] ? worker_clr_flags+0x1a0/0x1a0 [ 705.774788][ T4280] ? kthread_blkcg+0xd0/0xd0 [ 705.779394][ T4280] ret_from_fork+0x1f/0x30 [ 705.783840][ T4280] [ 705.787252][ T4280] Kernel Offset: disabled [ 705.791583][ T4280] Rebooting in 86400 seconds..