last executing test programs:

15.403205748s ago: executing program 2 (id=260):
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000000)={0x1, 0x2, 0x6, 0x1, 0xa8, 0x40, 0x3, 0x8, 0x1, 0x1, 0x78, 0x8, 0x9f, 0x5}, 0xe)
shutdown(r0, 0x1)
recvmsg(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0)
ioctl$SIOCGSTAMP(r0, 0x80108906, &(0x7f0000000100))

15.34437644s ago: executing program 2 (id=261):
fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, 0x0, 0x0, 0xffffffffffffffff)
syz_mount_image$iso9660(&(0x7f0000000200), &(0x7f0000000080)='./file0\x00', 0x0, &(0x7f00000007c0)=ANY=[], 0x3, 0x822, &(0x7f0000001000)="$eJzs3U9sHFf9APDvuHbsuL9fWrWoRFGaTpKCEpG6a7t1a+VQtuuxM629a+1uUCKE2qhJqihOW7WqSiNEyaUFBEKcOJZeq3LoDYQEEgfghEQPXDggIfUCKogDAiGkoJ3Z9f914tRJSvl8rO6bnfm+N983O53n2XhmAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACIpDZTqYwnMZ8PxKm0v9pMs7GwxfJeez9fU2yx3oik81+MjMTectbez6wsvq/zcij2l+/2x0inGInLd9539/F7Bwd69bdI6EYd7L9oaPWbJOIbnaQunllaOvfyTUjkFvr2T7sTI9dd5Z9XO69zWT1vNfKF6lyW5q1GOj01VXn4xGwrnc3ns9bpVjtbSGvNrNpuNNMjtaPp+PT0ZJqNnW6crM/NVOez3szHHpqoVKbSp8YWs2qz1ag//NRYq3Yin5/P63NFzETltejEPNbZEZ/O22k7qy6k6fkLS+cmV2WVbJZqJ2h8zZzhNTvO/gfv/vDVu7o7Xr/+Jt3lE+PjExPjU49OP/pYpTI4UZlYO6OyTixHxEBEJ+Km7LTcXnduMm+w3x4VcfWuj3/ghh0w0B3/Yz7yqMfJOBVppDFQvK78DEUtZqIZjVjovP/d0LrlG8b/zz38l99std7V439vlN+7snhfFOP/gYHi3YF+4/+GLHbgZ7Bfq/X3ytzKd8PF6yvxelyOi3EmlmIpzsXL21jT53/UbW/XSqs3/Wfgxur9X5/5c5FFPfJoRSPyWIhqMSftzkljOqZiKirxTJyI2c4nGLORx3xk0YrT0Yp2ZMUeVYtmZFGNdjSiGWkciVocjTTGYzqmYzLSyGIsTkcjTkY95mImqkUr5+NCsd0n1+V139ef/cnzv/3w7c70ctD4Fh1MOr/MdYL+tkXQhuF+G+N/J2Kgu3ffkjGJW2Rkm5/qjhy3YSdcLcb/wdudBgAAAHATJcW370lEDMX9xdRsPp99+XanBQAAAOygJHZH7I+kc/4fEfdH0jn/r2wS+cGtTw4AAADYEUkc6P77/2g8UE71Lpfa7EsAAAAA4L9QcV+zA51iNOKNYobzfwAAAPiU+eYm99jfFcfvHfzjru49dodiOPnZX6PZHEquLJ56MLlU7cRVL91R1usWX1pusT27L9lT3Kj3/ONFMTV4+c4kIgZr2f6kd/fLfw+X5UfF676VGxD2u9d/0i+BDfcuXEng3sHlBIp38Z04WMYcPFuWZ3tLyrWMzubz2VitMX98POl+OdJ+9YULX42i+9+qL+xJ4vyFpXNjz724dLbI5UqnlSuXureHT3q1IsoLKrbI5Wp3C8T9m/d4qLgQo7ve0XK9ldX9795NdmDr/ier1/lmHCpjDo2W5eja/o901jk+dnw8qtU9A+3sVPvVq6t6381ifKXnw73eJtv4FN6Mw2XM4SOHy2KTLCbWZPHCxiwmVm//69sW153F2wffOPX3XzaSbPJaWUx+zCwAbpfzxV1/Vkah3cUo9K+rpc6Atm7c3d2ruZ2j3PnYX15fuH+5/vKhL4nB2DC6p+t+vbiutbwZR8qYI+XvE4P7NhlXKpsc0V+68NKvukf0R979wQ+/cuDX768b17eRxbtxtIzpFnHPL/qMsZ0+f3fdqPpOp8Y7fdfbmp9IXhueHErKhw/F5YcuXDrz/Lnnz70wMTE5VXmkUnl0IoaKXxW6RZ9MjTwA/9sOFX//3/8ZO+9/bTm031N4kkeucVZ9z/KfFIzFc/FiLMXZOFZcbRARD2ze6uiqP0M4do2z1tFVT3g5do1zy5XYifWxw4eT6BM7uWqLffb7RfGPm/SBAMAtcKg3Du/q94y9u8vlr/1/t8a6iDuS5Ng1zrvXjuVHywfn9s6Oo/9YvtqfuuXjN32LAMCnX9b8KBltv5U0m/niM+PT0+PV9oksbTZqT6fNfGYuS/N6O2vWTlTrc1m62Gy0G7XeV8czWSttnVxcbDTb6WyjmS42Wvmp4snvaffR761soVpv57XW4nxWbSURUW9Xa+10Jm/V0sWTT87nrRNZs6jcWsxq+Wxeq7bzRj1tNU42a9lYmraybFVgPpPV2/lsng2leT1dbOYL1eaViJg/uZClM1mr1swX242ywVqjXFden200F4pmxzZ2/8+3ensDwCfBK69fvnhmaencyzc28fvrCb7dfQQA1jJKAwAAAAAAAAAAAADAJ9/Gy/U6c7d1IeBQ3PDlg68Mx8e5+vDTN/GF98qPZSca7NfO7oi4VvXdaz7TXd2d5fZvn21PPPvEExdX5iSDqzfvk2/sPfGHLMreDUev1sjGdjb/P2WzS13f2hOx68ffK+d8sU9wMrjDPf0gIm6g+tVki5jbcTQCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgK39JwAA//+5OUoE")
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0)

15.284373769s ago: executing program 2 (id=262):
r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./tracefs_dir/buffer_size_kb\x00', 0x2180, 0x1c)
read(r0, 0x0, 0x0)

15.284084923s ago: executing program 2 (id=263):
mkdir(&(0x7f0000000140)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x42, 0x0)
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='fd=', @ANYRESOCT=r0, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0)
unshare(0x26020480)
syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x80000, &(0x7f0000000640)=ANY=[], 0x1, 0x0, 0x0)
r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901)
move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0)
mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x20000, 0x0)

14.373412888s ago: executing program 2 (id=267):
r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00', <r2=>0x0})
sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0x34, r0, 0x1, 0x4, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_CH_SWITCH_COUNT={0x8, 0xb7, 0xa5}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}]]}, 0x34}}, 0x0)
mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x7e0b2000)
write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x10448)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000e, 0x11, 0xffffffffffffffff, 0x0)
r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r4 = openat$cgroup_ro(r3, 0x0, 0x275a, 0x0)
preadv(r4, 0x0, 0x0, 0x4, 0xfffffffe)
ioctl$BTRFS_IOC_SNAP_DESTROY(0xffffffffffffffff, 0x5000940f, 0x0)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x3e, 0x0, 0x1}, 0x28)
r5 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r4, 0x8933, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000140)={'gretap0\x00'})
r6 = socket(0x10, 0x3, 0x0)
sendmsg$nl_generic(r6, 0x0, 0x0)
sendmsg$NL80211_CMD_RELOAD_REGDB(0xffffffffffffffff, 0x0, 0x8014)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0)

14.113178546s ago: executing program 2 (id=268):
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0)
syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="20b52c020000065f"], 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$uac3(r0, 0x0, 0x0)
r1 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000580)={0x0, 0x280, 0x1e0, 0x34325241, 0x2, [0x2], [0xa00], [0x8, 0x0, 0x100000], [0x400000000000000]})

14.057039704s ago: executing program 32 (id=268):
r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011f00abbe6740e9174e8b089c000000010902120001000000000904000000ff"], 0x0)
syz_usb_control_io(r0, &(0x7f0000000000)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="20b52c020000065f"], 0x0, 0x0, 0x0, 0x0}, 0x0)
syz_usb_control_io$uac3(r0, 0x0, 0x0)
r1 = syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0)
ioctl$DRM_IOCTL_MODE_ADDFB2(r1, 0xc06864b8, &(0x7f0000000580)={0x0, 0x280, 0x1e0, 0x34325241, 0x2, [0x2], [0xa00], [0x8, 0x0, 0x100000], [0x400000000000000]})

3.469768412s ago: executing program 1 (id=390):
syz_mount_image$udf(&(0x7f0000000f00), &(0x7f0000001040)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xa00010, &(0x7f0000001200)=ANY=[@ANYBLOB='volume=00000000000000000313,nostrict,uid=forget,lastblock=00000000000000000546,nostrict,novrs,umask=00000000000000000003227,mode=00000000000000000055540,uid=', @ANYRESDEC=0x0, @ANYBLOB=',session=00000000000000000003,dmode=00000000000000000000016,measure,euid<', @ANYRESDEC=0x0, @ANYBLOB=',euid>', @ANYRESDEC=0x0, @ANYBLOB="2c6d61736b3d4d41595f455845432c646f6e745f6d6561737572652c736d61636b665c2c617070726169730101747970653d696d617369672c657569643c4dceae4ea24d8c747e9aad700f2d6693c7d149bd67cd4c57f2edd10f2d0a2b14d016b9a19f5037374a03e08b9d6f45f76fb66bba0a06fb7b12a4ddedfe8db56690d74e3a58841f8c1a92320ec7a1733357da5ad89cffb484ab621ec15fb7d02aeb32eb3d568104d4b22b05c4a5a9a813b926a82d558947252feb36ca1071185c5195223346bb286729d96998ffda1c0bf052bb3ea7dd0e082fa46c603f75033e813cc049a1daf0f012", @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x1, 0xc43, &(0x7f00000001c0)="$eJzs3U9sHNd9B/DfGy3FldxWTOwqThoHm7ZIZcZy9S+mYhXuqqbZBpBlIhRzC8CVSKkLUyRBUo1spAXTSw89BCiKHnIi0BoFUjQwmiLokWldILn4UOTUE9HCRlD0wBYBAhQIWMzsW3FJkbYskhIlfz429Z2deW/mvZn1jCzozQsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIOL3Xrl46nTaZsOhh9AYAOCBuDz21VNntnv+AwCPrSs7/f8/AAAAAAAAAAAAAABwUKQo4slIMXd5LU1Unzvql9p9t26PD49sX+1IqmoeqsqXP/XTZ86e+9ILQ+e7eak98wH199pn4rWxKxcbL8/enJufWliYmmyMz7SvzU5O3fMedlt/q8HqBDRuvn5r8vr1hcaZ589u2nx74P3+J44PXBh69uQz3bLjwyMjYxtF6r3la/fdkI6dRngcjiJORornvvfT1IqIInZ/LuoP9tpvdaTqxGDVifHhkaoj0+3WzGK5cbR7IoqIRk+lZvccbX8totb3QPuws2bEUtn8ssGDZffG5lrzravTU43R1vxie7E9OzOaOq0t+9OIIs6niOWIWO2/e3d9UUQtUnzn2Fq6mt/6UZ2HL1YDg3duR7GPfbwHZTsbfRHLxSNwzQ6w/iji1Ujxs3dOxLV8n6nuNV+IeLXMH0S8VeZLEan8YpyLeG+b7xGPploU8efl9b+wliar+0H3vnLpa42vzFyf7Snbva98xOfDXXeKh/R8OLIlH4wDfm+qRxGt6o6/lu7/NzsAAAAAAAAAAAAAAAAA7LUjUcSnI8Ur//ZH1bjiqMalH7sw9PsDv9w7ZvzpD9lPWfb5iFgq7m1M7uE8MHA0jab0kMcSf5zVo4g/zuP/vvWwGwMAAAAAAAAAAAAAAAAAAPCxVsRPIsWL755Iy9E7p3h75kbjSuvqdGdW2O7cv90509fX19cbqZPNnBM5l3Iu51zJuZozilw/ZzPnRM6lnMs5V3Ku5oxDuX7OZs6JnEs5l3Ou5FzNGbVcP2cz50TOpZzLOVdyruaMAzJ3LwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA46SIIn4RKb79jbUUKSKaERPRyZX+h906AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAKDUn4r4fqRo/EHzzrpaRKTq344T5S/nonm4zE9Gc6jMl6J5MWerylrzWw+h/exOXyrix5Giv/72nQuer39f59Odr0G89c2NT5+pdfJQd+PA+/1PHD92YWjkc0/vtJy2a8DgpfbMrduN8eGRkbGe1bV89E/2rBvIxy32putExMIbb77emp6emr//hfIrsIvqj9BCqn1cemqhWojagWjGw+n7JvWHdYNiX5XP//cixW+/++/dB37n+V+PX+p8uvOEj5//ycbz/8WtO7rH539ta738/C+f6ds9/5/sWfdi/t1IXy2ivnhzru94RH3hjTdPtm+2bkzdmJo5d+rUl4eGvnz2VN/hiPr19vRUz9KenC4AAAAAAAAAAAAAAACABycV8buRovXjtdSIiNvVeK2BC0PPnnzmUByqxlttGrf92tiVi42XZ2/OzU8tLExNNsZn2tdmJ6fu9XD1arjX+PDIvnTmQx3Z5/Yfqb88O/fGfPvGHy5uu/1o/eLVhcX51rXtN8eRKCKavWsGqwaPD49UjZ5ut2aqqqPbDqb/6PpSEf8RKa6da6TP53V5/P/WEf6bxv8vbd3RHo7//9zRjfF/n+gpWh4zpSJ+Hil+6y+ejs9X7Twad52zXO5vIsXg+c/mcnG4LNdtQ+e9Ap2RgWXZ/4kU//CLzWW74yGf3Ch7+iOd3EdAef2PRYrv/9l349fzus3vf9j++h/duqN9ev/DUz3rjm56X8Guu06+/icjxUtPvh2/Ua35vw98/0f33RsnOoU33s+xT9f/V3vWDeTj/uZedR4AAAAAAAAAAOAR1peK+NtI8cORWnohr7uXv/83uXVH+/T3vz7Vs25yb+Yr+tCFXZ9UAAAAADgg+lIRP4kUNxbfvjOGevP4757xn7+zMf5zOG3ZWv05369U7w3Yyz//6zWQjzux+24DAAAAAAAAAAAAAAAAAADAgZJSES/k+dQnqvH8kzvOp74SKV75r+dyuXS8LNedB36g+rV+eXbm5MXp6dl6LLauTk81xuZa16bKuk9FirW//myuW1Tzq3fnm+/M8b4xF/t8pBj5u27Zzlzs3bnJn9ooe7os+4lI8Z9/v7lsnpo6zx1dlT1Tlv2rSPH1f9q+7PGNsmfLst+NFD/6eqNb9mhZtvt+1E9tlH3+2myxD1cFAAAAAAAAAAAAAAAAAACAj5u+VMSfRor/vrl8Zyx/nv+/r+dj5a1v9sz3v8Xtap7/gWr+/52W72f+/+q9Aks7HRUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB5PKYp4M1LMXV5LK/3l5476pfbMrdvjwyPbVzuSqpqHqvLlT/30mbPnvvTC0PlufnD9vfbpeG3sysXGy7M35+anFhamJhvjM+1rs5NT97yH3dbfarA6AY2br9+avH59oXHm+bObNt8eeL//ieMDF4aePflMt+z48MjIWE+ZWt99H/0uaYf1h6OIv4wUz33vp+mH/RFF7P5cfMh3Z78dqToxWHVifHik6sh0uzWzWG4c7Z6IIqLRU6nZPUcP4FrsSjNiqWx+2eDBsntjc6351tXpqcZoa36xvdienRlNndaW/WlEEedTxHJErPbfvbu+KOL1SPGdY2vpn/sjDnXPwxcvj3311Jmd21HsYx/vQdnORl/EcvEIXLMDrD+K+MdI8bN3TsS/9EfUovMTX4h4tcwfRLwVneudyi/GuYj3tvke8WiqRRH/W17/C2vpnf7yftC9r1z6WuMrM9dne8p27yuP/PPhQTrg96Z6FPGj6o6/lv7Vf9cAAAAAAAAAAAAAAAAAB0gRvxYpXnz3RKrGB98ZU9yeudG40ro63RnW1x371x0zvb6+vt5InWzmnMi5lHM550rO1ZxR5Po5m2XW19cn8uelnMs5V3Ku5oxDuX7OZs6JnEs5l3Ou5FzNGbVcP2cz50TOpZzLOVdyruaMAzJ2DwAAAAAAAAAAAAAAAAAAeLwU1T8pvv2NtbTe35lfeiI6uWI+0Mfe/wcAAP//dsP5HA==")
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0)
sendmsg$ETHTOOL_MSG_EEE_GET(0xffffffffffffffff, 0x0, 0x200040d4)
syz_mount_image$squashfs(&(0x7f0000000400), &(0x7f0000000200)='./file0\x00', 0x4000000, &(0x7f0000000000)=ANY=[@ANYRES32=0x0, @ANYRES16=0x0], 0x1, 0x1a2, &(0x7f0000000040)="$eJzs0b9qFFEUx/HvuXN3ZiJEXRWLCLpgcJxFyc4ELawWqwg7YGEjuOiyGZPgRNnMFiYkuI0EJJpX0EK0FEErEQXrYCFYaGzSSbYIFmKhK7t7I/gMuZ/mN+cc5t+5s3kr94DfO8tNqgw47Ocjgga8YQulhvlahvnd5LqZXzT1msnnJsfyxaVbjSxLF0oXShT/awA/Sl4R/rXyDkcVI0IV+byz3GzIjYRelXk1nVCsUX6IU6cVPmJMj3LkOg69YI1LipYENTgw0faZyBeXzs7NN2bSmfR2HE+ev6crlXP978/SyiskfCCKx6wQJngJI+EKhTr3N/Q+Sn+QcFZtOlLu4tZZ33BOnzzTRYXb9BDeBV28r9pFXeEU/rX+D01xWHiCkzBe46BCc3MuSytTyGX1UiL9Sf8sKPyO4/jNO9n06lUlv9xnVdn2JdqiEETE5YjJ/mo4xHtWN+mYpbL1jRPypv+W3b3qweyFqY5xnKcudxvt9kLkwgcJEuIOxEUYHTxOJYwPDvGtuccEX3YvLMuyLMuyLMuyrD3gbwAAAP//fU9ejg==")
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000780), r0)
pselect6(0x40, &(0x7f0000000100)={0x0, 0x9, 0x0, 0x80000001, 0x7fb, 0x8, 0x100201}, 0x0, 0x0, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', <r2=>0x0})
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB="88020000", @ANYRES16=r1, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="6102330050300100080211000001080211000000505050505050"], 0x288}, 0x1, 0x0, 0x0, 0x800}, 0x0)

2.543546491s ago: executing program 1 (id=405):
r0 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00')
r1 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff)
syz_usb_connect$uac2(0x0, 0x7b, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201100100000020cc171010400001020301090269000301069002080b0002010920090904000000010120000924010200090900040904010000010220"], 0x0)
write$binfmt_script(r1, &(0x7f0000000080)={'#! ', './file1', [{}]}, 0x2)
write$binfmt_elf64(r1, &(0x7f0000000200)=ANY=[], 0x1cb)
close(r1)
execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0)

2.04081757s ago: executing program 3 (id=408):
r0 = syz_open_dev$dvb_demux(&(0x7f0000001e00), 0x0, 0xca200)
ioctl$DVB_DEMUX_DMX_REMOVE_PID(r0, 0x40026f34, &(0x7f0000000100)=0xe256)

1.983681736s ago: executing program 3 (id=411):
r0 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c00009040000020701010009050102"], 0x0)
syz_usb_control_io$printer(r0, 0x0, &(0x7f00000011c0)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)={0x20, 0x0, 0x1}})
syz_open_dev$char_usb(0xc, 0xb4, 0x0)

1.753795574s ago: executing program 0 (id=415):
r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a00000004000000ff0f000007"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRESDEC=r0, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x1, '\x00', 0x0, @fallback=0xa, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
openat(0xffffffffffffff9c, &(0x7f0000000300)='./tracing/events/sched/filter\x00', 0x1, 0x0)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0xd, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
openat$cgroup_netprio_ifpriomap(r2, 0x0, 0x2, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x48)
bpf$MAP_CREATE(0x0, 0x0, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x7, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bind$802154_dgram(r3, &(0x7f0000000040)={0x24, @long={0x3, 0x0, {0xaaaaaaaaaaaa0102}}}, 0x14)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.avg_queue_size\x00', 0x26e1, 0x0)
close(r5)
socket$kcm(0x10, 0x2, 0x4)
sendmsg$kcm(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, r5, 0x4, 0x5, 0x3, 0x0, {0xa, 0x4e23, 0x9, @mcast1, 0x97}}}, 0x80, 0x0}, 0x2000f765)
ioctl$SIOCSIFHWADDR(r5, 0x8b32, &(0x7f0000000000)={'virt_wifi0\x00', @random="0100"})
connect$802154_dgram(r3, &(0x7f0000000240)={0x24, @short}, 0x14)
sendmmsg(r3, &(0x7f00000196c0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0xd, 0x0}}], 0x4000050, 0x400c010)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)

1.348201491s ago: executing program 1 (id=416):
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000e40)={'sit0\x00', &(0x7f0000000d80)={'sit0\x00', 0x0, 0x80, 0x7800, 0x7, 0x1, {{0x7, 0x4, 0x1, 0x3, 0x1c, 0x65, 0x0, 0x5, 0x4, 0x0, @multicast2, @remote, {[@cipso={0x86, 0x6, 0xffffffffffffffff}]}}}}})

1.252821953s ago: executing program 1 (id=417):
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000900)=0x6, 0x4)

1.252544832s ago: executing program 1 (id=418):
mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000)
r0 = syz_genetlink_get_family_id$batadv(&(0x7f00000000c0), 0xffffffffffffffff)
r1 = syz_usb_connect$hid(0x0, 0x3f, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000201c1b100c00000000000109022d000100006000090400800203000000092106040001220500090581032000090807090502", @ANYRES8], 0x0)
syz_usb_ep_read(r1, 0x2, 0x0, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_buf(r2, 0x6, 0x1f, &(0x7f0000000000)='$', 0x1)
setsockopt$inet6_mreq(r2, 0x29, 0x14, 0x0, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000200)={@empty, 0x4, 0x1, 0x0, 0x1, 0xb, 0x4e4}, 0x20)
sendmsg$BATADV_CMD_GET_BLA_CLAIM(0xffffffffffffffff, &(0x7f00000001c0)={&(0x7f0000000040), 0xc, &(0x7f0000000180)={&(0x7f0000000100)={0x54, r0, 0x20, 0x70bd25, 0x25dfdbfd, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8, 0xb, 0xc69}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x2}, @BATADV_ATTR_MESH_IFINDEX={0x8}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x9}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x3}, @BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x6}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}]}, 0x54}, 0x1, 0x0, 0x0, 0x4008001}, 0x14)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff)
r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r4 = openat$cgroup_netprio_ifpriomap(r3, &(0x7f0000000080), 0x2, 0x0)
sendfile(r4, r4, 0x0, 0x1)

891.227402ms ago: executing program 0 (id=419):
mmap$IORING_OFF_SQ_RING(0x110c230000, 0x5, 0x3000003, 0x810, 0xffffffffffffffff, 0x0)
openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x206300, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f000030e000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f00005a4000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004054)
r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x400970, 0x1f280, 0xfffffffe, 0x399})
bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x13, 0x0, 0x0, &(0x7f0000000680)='syzkaller\x00', 0x1, 0x40, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
write$P9_RREADDIR(0xffffffffffffffff, &(0x7f0000000000)={0xb, 0x29, 0x2, {0x3}}, 0xb)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
io_uring_enter(r0, 0x8ae, 0xfbb9, 0x35, 0x0, 0x0)

733.091447ms ago: executing program 0 (id=420):
timer_create(0x3, 0x0, &(0x7f0000044000))
timer_settime(0x0, 0xffffffffffffffff, &(0x7f0000000080)={{0x77359400}, {0x0, 0x9}}, 0x0)
timer_settime(0x0, 0x236bd4336e4642df, &(0x7f0000000300)={{0x0, 0x1}, {0x0, 0xe4c}}, 0x0)

633.992072ms ago: executing program 0 (id=421):
prlimit64(0x0, 0xb, &(0x7f0000000140), 0x0)
r0 = getpid()
r1 = syz_pidfd_open(r0, 0x0)
setns(r1, 0x24020000)
ptrace(0x10, 0x0)
rt_sigqueueinfo(0x0, 0x18, &(0x7f0000000080)={0xd, 0x20a, 0xfffffff3})

633.753006ms ago: executing program 0 (id=422):
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./proc\x00', 0x777)
mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000300)='./proc\x00', &(0x7f0000000340)='proc\x00', 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/sys/vm/nr_hugepages\x00', 0x2, 0x0)
write(r0, &(0x7f00000003c0)='1', 0x1)

522.191477ms ago: executing program 3 (id=423):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f00000002c0)={0x44, 0x2, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0xfffd}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}]}, 0x44}}, 0x80)

521.877254ms ago: executing program 0 (id=424):
r0 = socket(0x40000000015, 0x5, 0x0)
connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10)
setsockopt$SO_RDS_TRANSPORT(r0, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4)
setsockopt$sock_int(r0, 0x1, 0x21, &(0x7f00006dbffc), 0x4)
sendmsg$xdp(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000d00)="0f198d5aa5caa1c55b84b414797cbdd4e8c576a921a070fc828060506683fd1106a961ac55b5b8ea3342ca7de5559ca2c14e05e42aed8ba14b2c78cb540f71a817d80fbf1945a046ebda494a8048a106a4d49d7f214735ada53397db3b203885ce39ee48d69465935eade21ce36e61826c52c82f038341d9bab5687c740ed3c18897094e7e1391eb84a4052e03c0c7c39ae86d454938f65e284620b99481c33d9f5e5b7a6c0d7548723f55b213c76be37f40c850c38e265758ebd8238257a146d6eced16fd658a784c928fea7a841db1a7fd6520442dae5fc0d3a3d3a5f16fcf6fe4f062ecdad7d0f3c6cd339339533c0ef28ad1e2729907094c3de93c1b1b00ad6df89507000000fb7565d3a8e9eaea020ed173c2179fb03e0944460989240a689c7fe795d310be4e7a6b778a903280dbf426b39c3603c49049980767e31edb997f59785184cbd7b9070400000073c745f71db0906cb51780f908fa61634af8ac85d9f04f3dff0a948e81cd3229a59aaeb00995358155343e3239588a0383e4df109d5ca24276d0d83a27d0e9bf681c1bbea12a6f3c20ad50f63430333bb327eb6ae32fe8809065bce26d2dc2fbb2b48d404637d61fd86852e0e1b6ccc6f75b1107aaa5f60ef45f94e953b3f213c3cb4ca4c716565078c666f84e1a99bb4cb5c7190648132f6ff1f6cb79b93f20752753c938da6241607a742361d995188b23cb4b8269e98e822585695962620673433748e476f7cc3e37db88639c525ff3a502c82c283b00aecfe7734ab369e1ed7c75e27a5a333641817baa3ea37844e20e6266c5095abf9d47ca5f8ad93f1a4d8795daec222ada00d65cf91425fae7939ceaa8d94ec1ab5082e1d251c27b3132119b350e81771f3733be232ffb90c03a818bf458aac3314007c3e35d5e4bed6b897608b01e7e26a54433e5f5c74a2ee3c2fc50067be05a677f122b7dba7010830b879a41b579d44158fb89ea05761d2d369853bea84dfb8081ed7b891dcb3bb3361534fdc5252e4964aed936ad2838e7af14fc65c7c1c6d44c6256f2462ae83cfd6a6b2651da607fe79d345e5080098e9e6e7482cc5c267e00d8d09dcde70b60fe6220fe9530547201664db91cf1885ecc2f106b66cd99131523c99f6102ddd7403791b3a7ac59b256cc4c938fe01740ae4f19b5204ca305b1666b0c2a7e5015d6d530995843adfbac3954306d4cd82257d4d2c3283d45dbae43548fed9879328f114f7c8238ac955391b24614d91be1701ae07c170a9c299fcf3d0ac4cea07e88fbf66b697883af17a06ac3f9954eb2fbd20f101802cd023fc48c5d464c16059cc9dce8558c5322ac7612db0e2725427628c2c41a21f0d2f3962e32f710bf9e216ff1694e8d88c8a81328744b36d9ef9f08c0ea3ccd4f8729e2f00a048162834a95", 0x3f1}, {&(0x7f00000003c0)="128b9306006d4810e5ac5040ad9201847839fc378469d5765b9cc241840896c1498194a7197b45d74a8532b82037b02c9e6045c361eb", 0x36}, {&(0x7f0000000200)="0000000000aa303e97380e90231bdbdaf6a4bd866226b7cdb7c26858c4e4fd703be2f51ed6ddc4a47116ec2db75c7042a22491af0ffea4174a9de3350c0a498396b28c7d1784d04aa38922721cb7816094cb82950fd012efd26d", 0x5a}], 0x3, 0x0, 0x0, 0x40088c5}, 0x0)
setsockopt$RDS_CONG_MONITOR(r0, 0x114, 0x6, &(0x7f0000000680)=0x1, 0x4)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0)
sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x40)
recvmmsg(r0, &(0x7f0000006fc0)=[{{0x0, 0x0, 0x0}, 0x400002}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000900)=""/72, 0x48}, 0x81}], 0x2, 0x20000020, 0x0)

442.371015ms ago: executing program 3 (id=425):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000010c30000000003000000851000000600000018000000", @ANYRES32, @ANYBLOB="00000000000000116608000000000100180000000000000000000000000010009500000000000000360a020000000001180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xa, 0xff5c, &(0x7f0000000340)=""/222, 0x0, 0x8}, 0x78)
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000880)=ANY=[], 0x32600)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0)
r1 = socket(0x2, 0x80805, 0x0)
getsockopt$bt_hci(r1, 0x84, 0x82, 0x0, &(0x7f0000001080))

372.235502ms ago: executing program 3 (id=426):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a0101000000dd000000000a0000070900010073797a31000000000900030073597a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000006000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc4c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000020000380100000800c00018006000100d10300000c000080080003400000000214000000110001"], 0xb0}, 0x1, 0x0, 0x0, 0x14}, 0x40)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_MSG_GETSETELEM(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="40000000210a018800000000000000000a0000010900020073797a31000000000900010073797a310000000014000380100000800c000180060001"], 0x40}, 0x1, 0x0, 0x0, 0x4000805}, 0x4000000)

365.590333ms ago: executing program 3 (id=427):
set_mempolicy(0x5, &(0x7f0000000000)=0x4000000ff9, 0xf)
r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0)
syz_usb_disconnect(r0)
syz_usb_connect$printer(0x4, 0x2d, &(0x7f0000000100)=ANY=[], 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000040)={'syztnl0\x00', 0x0})
ioctl$EVIOCRMFF(r0, 0xc0085504, &(0x7f0000000040)=0x18)

0s ago: executing program 1 (id=428):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/versions\x00', 0x2, 0x0)
write(r0, &(0x7f00000000c0)='-2 -3 +4\n', 0x9)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000140)='udp 20000\n', 0xa)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./nfsd/pool_threads\x00', 0x2, 0x0)
write(r2, &(0x7f00000001c0)='1\n', 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./nfsd/pool_threads\x00', 0x0, 0x0)
read(r3, &(0x7f0000000240)=""/100, 0x64)

kernel console output (not intermixed with test programs):

Warning: Permanently added '[localhost]:4086' (ED25519) to the list of known hosts.
syzkaller login: [   42.710144][ T5552] cgroup: Unknown subsys name 'net'
[   42.837356][ T5552] cgroup: Unknown subsys name 'cpuset'
[   42.841017][ T5552] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   44.704446][ T5552] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   48.447318][ T5591] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   48.450434][ T5591] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   48.453148][ T5591] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   48.456250][ T5591] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   48.460198][ T5591] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   48.475360][ T4991] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   48.478974][ T5594] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   48.482103][   T56] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   48.488479][ T5594] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   48.491735][ T5594] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   48.501596][ T5594] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   48.505718][ T4991] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   48.510300][ T4991] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   48.513584][ T4991] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   48.516936][ T4991] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   48.881873][ T5593] bridge0: port 1(bridge_slave_0) entered blocking state
[   48.882461][ T5593] bridge0: port 1(bridge_slave_0) entered disabled state
[   48.882623][ T5593] bridge_slave_0: entered allmulticast mode
[   48.884078][ T5593] bridge_slave_0: entered promiscuous mode
[   48.886778][ T5593] bridge0: port 2(bridge_slave_1) entered blocking state
[   48.886818][ T5593] bridge0: port 2(bridge_slave_1) entered disabled state
[   48.886876][ T5593] bridge_slave_1: entered allmulticast mode
[   48.888075][ T5593] bridge_slave_1: entered promiscuous mode
[   48.942951][ T5593] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   48.945812][ T5593] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   48.989287][ T5593] team0: Port device team_slave_0 added
[   49.001980][ T5593] team0: Port device team_slave_1 added
[   49.037299][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_0
[   49.037360][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   49.037421][ T5593] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   49.039874][ T5593] batman_adv: batadv0: Adding interface: batadv_slave_1
[   49.039886][ T5593] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   49.039902][ T5593] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   49.118442][ T5593] hsr_slave_0: entered promiscuous mode
[   49.119486][ T5593] hsr_slave_1: entered promiscuous mode
[   49.214244][ T5589] bridge0: port 1(bridge_slave_0) entered blocking state
[   49.214373][ T5589] bridge0: port 1(bridge_slave_0) entered disabled state
[   49.214564][ T5589] bridge_slave_0: entered allmulticast mode
[   49.215280][ T5589] bridge_slave_0: entered promiscuous mode
[   49.237074][ T5589] bridge0: port 2(bridge_slave_1) entered blocking state
[   49.240076][ T5589] bridge0: port 2(bridge_slave_1) entered disabled state
[   49.243113][ T5589] bridge_slave_1: entered allmulticast mode
[   49.246775][ T5589] bridge_slave_1: entered promiscuous mode
[   49.319648][ T5597] bridge0: port 1(bridge_slave_0) entered blocking state
[   49.322557][ T5597] bridge0: port 1(bridge_slave_0) entered disabled state
[   49.325419][ T5597] bridge_slave_0: entered allmulticast mode
[   49.329014][ T5597] bridge_slave_0: entered promiscuous mode
[   49.336491][ T5589] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   49.348602][ T5597] bridge0: port 2(bridge_slave_1) entered blocking state
[   49.348684][ T5597] bridge0: port 2(bridge_slave_1) entered disabled state
[   49.348807][ T5597] bridge_slave_1: entered allmulticast mode
[   49.349690][ T5597] bridge_slave_1: entered promiscuous mode
[   49.358796][ T5589] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   49.388330][ T5589] team0: Port device team_slave_0 added
[   49.392459][ T5597] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   49.398604][ T5597] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   49.403231][ T5589] team0: Port device team_slave_1 added
[   49.441469][ T5589] batman_adv: batadv0: Adding interface: batadv_slave_0
[   49.441515][ T5589] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   49.441559][ T5589] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   49.442476][ T5589] batman_adv: batadv0: Adding interface: batadv_slave_1
[   49.442483][ T5589] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   49.442492][ T5589] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   49.486774][ T5597] team0: Port device team_slave_0 added
[   49.491042][ T5597] team0: Port device team_slave_1 added
[   49.498591][ T5589] hsr_slave_0: entered promiscuous mode
[   49.499073][ T5589] hsr_slave_1: entered promiscuous mode
[   49.499450][ T5589] debugfs: 'hsr0' already exists in 'hsr'
[   49.499503][ T5589] Cannot create hsr debugfs directory
[   49.500252][ T5593] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   49.510577][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[   49.511583][ T5593] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   49.515853][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[   49.532202][ T5597] batman_adv: batadv0: Adding interface: batadv_slave_0
[   49.533916][ T5597] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   49.533936][ T5597] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   49.534880][ T5593] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   49.549271][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[   49.549919][ T5593] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   49.555458][ T5593] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[   49.575749][ T5597] batman_adv: batadv0: Adding interface: batadv_slave_1
[   49.575806][ T5597] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   49.575864][ T5597] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   49.656322][ T5597] hsr_slave_0: entered promiscuous mode
[   49.657078][ T5597] hsr_slave_1: entered promiscuous mode
[   49.657615][ T5597] debugfs: 'hsr0' already exists in 'hsr'
[   49.657628][ T5597] Cannot create hsr debugfs directory
[   49.723509][ T5593] bridge0: port 2(bridge_slave_1) entered blocking state
[   49.723644][ T5593] bridge0: port 2(bridge_slave_1) entered forwarding state
[   49.724282][ T5593] bridge0: port 1(bridge_slave_0) entered blocking state
[   49.724365][ T5593] bridge0: port 1(bridge_slave_0) entered forwarding state
[   49.724757][    C0] clocksource: Watchdog remote CPU 1 read timed out
[   49.790098][   T29] bridge0: port 1(bridge_slave_0) entered disabled state
[   49.793568][   T29] bridge0: port 2(bridge_slave_1) entered disabled state
[   49.902031][ T5589] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   49.909872][ T5589] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[   49.910301][ T5589] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   49.919010][ T5589] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[   49.922273][ T5589] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   49.929445][ T5589] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[   49.933182][ T5589] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   49.938594][ T5589] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[   49.995662][ T5597] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   50.000690][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[   50.001322][ T5597] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   50.006679][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[   50.011343][ T5597] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   50.016496][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[   50.016930][ T5597] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   50.020852][ T5597] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[   50.028267][ T5593] 8021q: adding VLAN 0 to HW filter on device bond0
[   50.057822][ T5593] 8021q: adding VLAN 0 to HW filter on device team0
[   50.069641][   T28] bridge0: port 1(bridge_slave_0) entered blocking state
[   50.069838][   T28] bridge0: port 1(bridge_slave_0) entered forwarding state
[   50.089396][   T29] bridge0: port 2(bridge_slave_1) entered blocking state
[   50.089501][   T29] bridge0: port 2(bridge_slave_1) entered forwarding state
[   50.133491][ T5589] 8021q: adding VLAN 0 to HW filter on device bond0
[   50.150461][ T5593] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   50.170581][ T5589] 8021q: adding VLAN 0 to HW filter on device team0
[   50.178589][   T29] bridge0: port 1(bridge_slave_0) entered blocking state
[   50.178675][   T29] bridge0: port 1(bridge_slave_0) entered forwarding state
[   50.193588][ T5597] 8021q: adding VLAN 0 to HW filter on device bond0
[   50.199179][   T29] bridge0: port 2(bridge_slave_1) entered blocking state
[   50.199258][   T29] bridge0: port 2(bridge_slave_1) entered forwarding state
[   50.240816][ T5597] 8021q: adding VLAN 0 to HW filter on device team0
[   50.252456][   T29] bridge0: port 1(bridge_slave_0) entered blocking state
[   50.252525][   T29] bridge0: port 1(bridge_slave_0) entered forwarding state
[   50.268031][   T28] bridge0: port 2(bridge_slave_1) entered blocking state
[   50.268132][   T28] bridge0: port 2(bridge_slave_1) entered forwarding state
[   50.413259][ T5593] 8021q: adding VLAN 0 to HW filter on device batadv0
[   50.456673][ T5593] veth0_vlan: entered promiscuous mode
[   50.461808][ T5593] veth1_vlan: entered promiscuous mode
[   50.478938][ T5593] veth0_macvtap: entered promiscuous mode
[   50.482922][ T5593] veth1_macvtap: entered promiscuous mode
[   50.492013][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_0
[   50.499343][ T5593] batman_adv: batadv0: Interface activated: batadv_slave_1
[   50.504608][ T4991] Bluetooth: hci1: command tx timeout
[   50.504726][ T4991] Bluetooth: hci0: command tx timeout
[   50.585790][ T5591] Bluetooth: hci2: command tx timeout
[   50.606061][ T1108] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   50.606137][ T1108] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   50.630443][ T5589] 8021q: adding VLAN 0 to HW filter on device batadv0
[   50.641213][ T1108] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   50.641257][ T1108] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   50.646465][ T5597] 8021q: adding VLAN 0 to HW filter on device batadv0
[   50.687820][ T5593] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   50.711552][ T5589] veth0_vlan: entered promiscuous mode
[   50.721057][ T5597] veth0_vlan: entered promiscuous mode
[   50.728148][ T5597] veth1_vlan: entered promiscuous mode
[   50.734855][   T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   50.735005][   T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   50.735044][   T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   50.735078][   T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   50.752266][ T5589] veth1_vlan: entered promiscuous mode
[   50.776930][ T5597] veth0_macvtap: entered promiscuous mode
[   50.782230][ T5597] veth1_macvtap: entered promiscuous mode
[   50.786691][ T5589] veth0_macvtap: entered promiscuous mode
[   50.791088][ T5589] veth1_macvtap: entered promiscuous mode
[   50.808936][ T5597] batman_adv: batadv0: Interface activated: batadv_slave_0
[   50.815935][ T5597] batman_adv: batadv0: Interface activated: batadv_slave_1
[   50.820681][ T5589] batman_adv: batadv0: Interface activated: batadv_slave_0
[   50.831138][ T5589] batman_adv: batadv0: Interface activated: batadv_slave_1
[   50.939027][ T1108] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   50.939074][ T1108] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   50.957471][   T13] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   50.957543][   T13] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   50.957594][   T13] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   50.957638][   T13] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   50.957680][   T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   50.957703][   T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   50.957724][   T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   50.957744][   T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   50.989641][ T1111] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   50.989688][ T1111] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   51.012564][ T1111] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   51.012614][ T1111] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   51.039912][ T1011] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   51.040008][ T1011] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   51.321847][ T5719] Cannot find set identified by id 0 to match
[   51.514999][   T25] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[   51.620960][ T5726] loop1: detected capacity change from 0 to 40427
[   51.639923][ T5726] F2FS-fs (loop1): Invalid log_blocksize (268), supports only 12
[   51.639984][ T5726] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock
[   51.649780][ T5726] F2FS-fs (loop1): invalid crc_offset: 33558524
[   51.694141][   T25] usb 3-1: Using ep0 maxpacket: 32
[   51.698447][   T25] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40
[   51.707009][   T25] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[   51.707055][   T25] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[   51.707096][   T25] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   51.724413][   T25] usb 3-1: config 0 descriptor??
[   51.734746][   T25] hub 3-1:0.0: USB hub found
[   51.739143][ T5726] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[   51.748572][ T5726] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0
[   51.748659][ T5726] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e5
[   51.842859][ T5755] capability: warning: `syz.0.28' uses deprecated v2 capabilities in a way that may be insecure
[   51.927360][ T5759] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[   51.942570][   T25] hub 3-1:0.0: 1 port detected
[   52.149257][ T5775] ipt_ECN: cannot use operation on non-tcp rule
[   52.218244][ T5777] loop1: detected capacity change from 0 to 1024
[   52.382152][ T5786] loop1: detected capacity change from 0 to 512
[   52.382615][ T5786] ext4: Unknown parameter 'appraise_type'
[   52.386793][ T5786] mtrr: base(0x1a7000) is not aligned on a size(0x0000) boundary
[   52.555732][   T25] hub 3-1:0.0: activate --> -90
[   52.584512][ T5591] Bluetooth: hci0: command tx timeout
[   52.584550][ T5591] Bluetooth: hci1: command tx timeout
[   52.674556][ T4991] Bluetooth: hci2: command tx timeout
[   53.014309][    T9] usb 2-1: new full-speed USB device number 2 using dummy_hcd
[   53.159908][   T25] usb 3-1-port1: cannot reset (err = -71)
[   53.160062][   T25] usb 3-1-port1: Cannot enable. Maybe the USB cable is bad?
[   53.161281][   T25] usb 3-1-port1: cannot disable (err = -71)
[   53.161658][   T25] usb 3-1-port1: cannot reset (err = -71)
[   53.163849][   T25] usb 3-1-port1: cannot reset (err = -71)
[   53.163859][   T25] usb 3-1-port1: Cannot enable. Maybe the USB cable is bad?
[   53.168315][   T25] usb 3-1-port1: cannot disable (err = -71)
[   53.168350][   T25] usb 3-1-port1: attempt power cycle
[   53.169770][    T9] usb 2-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29
[   53.174184][    T9] usb 2-1: config 36 interface 0 altsetting 0 has an endpoint descriptor with address 0x7C, changing to 0xC
[   53.174206][    T9] usb 2-1: config 36 interface 0 altsetting 0 endpoint 0xC has invalid wMaxPacketSize 0
[   53.180442][    T9] usb 2-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16
[   53.180453][    T9] usb 2-1: Manufacturer: syz
[   53.180458][    T9] usb 2-1: SerialNumber: syz
[   53.186858][   T10] usb 3-1: USB disconnect, device number 2
[   53.422633][    T9] usbhid 2-1:36.0: couldn't find an input interrupt endpoint
[   53.431593][    T9] usb 2-1: USB disconnect, device number 2
[   53.451891][ T5835] netlink: 36 bytes leftover after parsing attributes in process `syz.0.60'.
[   53.467854][ T5832] loop0: detected capacity change from 0 to 1024
[   53.915410][ T5846] Zero length message leads to an empty skb
[   54.010283][ T5850] netlink: 24 bytes leftover after parsing attributes in process `syz.1.67'.
[   54.119446][ T5854] loop1: detected capacity change from 0 to 2048
[   54.171875][ T5857] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[   54.345040][   T27] IPVS: starting estimator thread 0...
[   54.456140][ T5872] IPVS: using max 80 ests per chain, 192000 per kthread
[   54.673915][ T4991] Bluetooth: hci1: command tx timeout
[   54.673968][ T4991] Bluetooth: hci0: command tx timeout
[   54.692816][   T29] IPVS: starting estimator thread 0...
[   54.693638][ T5914] IPVS: nq: FWM 3 0x00000003 - no destination available
[   54.753852][ T5591] Bluetooth: hci2: command tx timeout
[   54.834265][ T5916] IPVS: using max 81 ests per chain, 194400 per kthread
[   56.516041][    T9] usb 2-1: new high-speed USB device number 3 using dummy_hcd
[   56.606314][ T5973] loop2: detected capacity change from 0 to 512
[   56.607825][ T5973] ext4: Unknown parameter 'appraise_type'
[   56.666179][    T9] usb 2-1: unable to get BOS descriptor or descriptor too short
[   56.666238][    T9] usb 2-1: New USB device found, idVendor=8086, idProduct=0ad2, bcdDevice= 0.00
[   56.667189][    T9] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[   56.667211][    T9] usb 2-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1
[   56.669148][    T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[   56.669160][    T9] usb 2-1: Product: syz
[   56.669166][    T9] usb 2-1: Manufacturer: syz
[   56.687610][    T9] uvcvideo 2-1:1.0: Found UVC 1.00 device syz (8086:0ad2)
[   56.687697][    T9] uvcvideo 2-1:1.0: No streaming interface found for terminal 32770.
[   56.744103][ T5591] Bluetooth: hci0: command tx timeout
[   56.747725][ T5591] Bluetooth: hci1: command tx timeout
[   56.822267][ T5991] TCP: request_sock_TCPv6: Possible SYN flooding on port [::]:20002. Sending cookies.
[   56.825139][ T4991] Bluetooth: hci2: command tx timeout
[   56.893064][ T5997] netlink: 276 bytes leftover after parsing attributes in process `syz.2.137'.
[   56.903060][ T5652] usb 2-1: USB disconnect, device number 3
[   57.264002][    T9] usb 3-1: new high-speed USB device number 7 using dummy_hcd
[   57.413844][    T9] usb 3-1: Using ep0 maxpacket: 32
[   57.416007][    T9] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00
[   57.420037][    T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[   57.423682][    T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[   57.427282][    T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   57.437475][    T9] usb 3-1: config 0 descriptor??
[   57.727968][ T6039] loop1: detected capacity change from 0 to 512
[   57.731726][ T6039] ext4: Unknown parameter 'appraise_type'
[   57.852507][    T9] savu 0003:1E7D:2D5A.0001: unknown main item tag 0x0
[   57.852573][    T9] savu 0003:1E7D:2D5A.0001: ignoring exceeding usage max
[   57.860003][    T9] savu 0003:1E7D:2D5A.0001: item fetching failed at offset 4/8
[   57.860325][    T9] savu 0003:1E7D:2D5A.0001: parse failed
[   57.860352][    T9] savu 0003:1E7D:2D5A.0001: probe with driver savu failed with error -22
[   58.052525][    T9] usb 3-1: USB disconnect, device number 7
[   58.067924][ T6059] loop0: detected capacity change from 0 to 128
[   58.133236][ T6063] netlink: 4 bytes leftover after parsing attributes in process `syz.0.170'.
[   58.517693][ T6098] IPVS: nq: FWM 3 0x00000003 - no destination available
[   58.540401][ T6100] loop0: detected capacity change from 0 to 764
[   58.546835][ T6100] rock: corrupted directory entry. extent=32, offset=2044, size=237
[   58.668026][   T27] IPVS: starting estimator thread 0...
[   58.755510][ T6113] IPVS: using max 80 ests per chain, 192000 per kthread
[   58.761127][ T6122] loop0: detected capacity change from 0 to 1764
[   58.806459][ T6125] CIFS: VFS: UNC: missing share name
[   58.808834][ T6125] Malformed UNC in devname
[   58.808834][ T6125] 
[   58.813306][ T6125] CIFS: VFS: Malformed UNC in devname
[   58.833098][ T6127] openvswitch: netlink: Tunnel attr 68 out of range max 16
[   58.933859][    T9] usb 3-1: new full-speed USB device number 8 using dummy_hcd
[   59.084975][    T9] usb 3-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e
[   59.085912][    T9] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F
[   59.085926][    T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10
[   59.085936][    T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0
[   59.087565][    T9] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   59.087574][    T9] usb 3-1: Product: syz
[   59.087580][    T9] usb 3-1: Manufacturer: syz
[   59.087586][    T9] usb 3-1: SerialNumber: syz
[   59.088931][    T9] usb 3-1: config 0 descriptor??
[   59.091035][    T9] streamzap 3-1:0.0: streamzap_probe: endpoint Max Packet Size is 0!?!
[   59.132952][ T6143] loop1: detected capacity change from 0 to 4096
[   59.145220][ T6143] ntfs3(loop1): Different NTFS sector size (4096) and media sector size (512).
[   59.167911][ T6143] ntfs3(loop1): ino=19, mi_enum_attr
[   59.168027][ T6143] ntfs3(loop1): Mark volume as dirty due to NTFS errors
[   59.171162][ T6143] ntfs3(loop1): ino=1a, mi_enum_attr
[   59.171240][ T6143] ntfs3(loop1): ino=1a, mi_enum_attr
[   59.171251][ T6143] ntfs3(loop1): Failed to initialize $Extend/$Reparse.
[   59.295467][  T503] usb 3-1: USB disconnect, device number 8
[   59.524757][ T6147] process 'syz.1.209' launched './file2' with NULL argv: empty string added
[   59.991269][ T6163] loop2: detected capacity change from 0 to 512
[   60.002741][ T6163] EXT4-fs: Ignoring removed i_version option
[   60.027752][ T6163] EXT4-fs (loop2): feature flags set on rev 0 fs, running e2fsck is recommended
[   60.139009][ T6163] EXT4-fs error (device loop2): ext4_mb_generate_buddy:1317: group 0, block bitmap and bg descriptor inconsistent: 48 vs 41 free clusters
[   60.142858][ T6163] Quota error (device loop2): write_blk: dquota write failed
[   60.142867][ T6163] Quota error (device loop2): find_free_dqentry: Can't write quota data block 5
[   60.142908][ T6163] Quota error (device loop2): write_blk: dquota write failed
[   60.142961][ T6163] Quota error (device loop2): qtree_write_dquot: Error -28 occurred while creating quota
[   60.142979][ T6163] EXT4-fs error (device loop2): ext4_acquire_dquot:7069: comm syz.2.215: Failed to acquire dquot type 1
[   60.143024][ T6163] loop2: lost filesystem error report for type 5 error -28
[   60.143850][    C0] EXT4-fs (loop2): error count since last fsck: 2
[   60.143860][    C0] EXT4-fs (loop2): initial error at time 1790261466: ext4_mb_generate_buddy:1317
[   60.143869][    C0] EXT4-fs (loop2): last error at time 1790261466: ext4_acquire_dquot:7069
[   60.144012][ T6163] EXT4-fs (loop2): 1 truncate cleaned up
[   60.144820][ T6163] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[   60.166363][ T6163] Quota error (device loop2): write_blk: dquota write failed
[   60.166437][ T6163] Quota error (device loop2): qtree_write_dquot: Error -28 occurred while creating quota
[   60.166467][ T6163] EXT4-fs error (device loop2): ext4_acquire_dquot:7069: comm syz.2.215: Failed to acquire dquot type 1
[   60.231743][ T5593] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[   60.414494][ T6196] tipc: Failed to remove unknown binding: 66,0,0/0:916197585/916197586
[   60.418779][ T6196] tipc: Failed to remove unknown binding: 66,0,0/0:916197585/916197586
[   60.515656][ T6204] loop2: detected capacity change from 0 to 1764
[   60.717610][ T6212] loop2: detected capacity change from 0 to 32768
[   60.720146][ T6212] =======================================================
[   60.720146][ T6212] WARNING: The mand mount option has been deprecated and
[   60.720146][ T6212]          and is ignored by this kernel. Remove the mand
[   60.720146][ T6212]          option from the mount to silence this warning.
[   60.720146][ T6212] =======================================================
[   60.739245][ T6212] (syz.2.240,6212,1):ocfs2_verify_userspace_stack:858 ERROR: cluster stack passed to mount, but this filesystem does not support it
[   60.744694][ T6212] (syz.2.240,6212,1):ocfs2_fill_super:1177 ERROR: status = -22
[   60.776905][ T6223] loop2: detected capacity change from 0 to 1764
[   61.313870][  T806] usb 2-1: new full-speed USB device number 4 using dummy_hcd
[   61.484813][  T806] usb 2-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16
[   61.489155][  T806] usb 2-1: config 0 has an invalid interface number: 31 but max is 0
[   61.492108][  T806] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[   61.496077][  T806] usb 2-1: config 0 has no interface number 0
[   61.500816][  T806] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   61.504522][  T806] usb 2-1: Product: syz
[   61.506153][  T806] usb 2-1: Manufacturer: syz
[   61.507948][  T806] usb 2-1: SerialNumber: syz
[   61.512401][  T806] usb 2-1: config 0 descriptor??
[   61.517625][  T806] hub 2-1:0.31: bad descriptor, ignoring hub
[   61.520286][  T806] hub 2-1:0.31: probe with driver hub failed with error -5
[   61.524029][  T806] uvcvideo 2-1:0.31: Found UVC 0.04 device syz (046d:08c3)
[   61.526742][  T806] uvcvideo 2-1:0.31: Entity type for entity Output 32774 was not initialized!
[   61.529999][  T806] uvcvideo 2-1:0.31: Failed to create links for entity 32774
[   61.532766][  T806] uvcvideo 2-1:0.31: Failed to register entities (-22).
[   61.771462][ T6260] loop2: detected capacity change from 0 to 764
[   61.775611][ T6260] rock: corrupted directory entry. extent=32, offset=2044, size=237
[   61.836753][ T1958] usb 2-1: USB disconnect, device number 4
[   62.285707][    T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[   62.434433][    T9] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41
[   62.435788][    T9] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0
[   62.435805][    T9] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0
[   62.435819][    T9] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[   62.439498][    T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11
[   62.439514][    T9] usb 1-1: Product: syz
[   62.439522][    T9] usb 1-1: Manufacturer: syz
[   62.439532][    T9] usb 1-1: SerialNumber: syz
[   62.654333][    T9] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8
[   62.907512][    T9] usb 1-1: USB disconnect, device number 2
[   62.950458][ T6269] usblp0: removed
[   62.992606][   T12] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   63.057325][   T12] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   63.137557][   T12] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   63.214022][   T12] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   63.224721][ T5591] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   63.229741][ T5591] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   63.231368][ T5591] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   63.234522][ T5591] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   63.234909][ T5591] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   63.403095][   T12] bridge_slave_1: left allmulticast mode
[   63.403149][   T12] bridge_slave_1: left promiscuous mode
[   63.404026][   T12] bridge0: port 2(bridge_slave_1) entered disabled state
[   63.418615][   T12] bridge_slave_0: left allmulticast mode
[   63.418665][   T12] bridge_slave_0: left promiscuous mode
[   63.418790][   T12] bridge0: port 1(bridge_slave_0) entered disabled state
[   63.633409][   T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   63.642557][   T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   63.646398][   T12] bond0 (unregistering): Released all slaves
[   63.653633][ T5337] 8021q: adding VLAN 0 to HW filter on device eth1
[   63.921708][ T6320] loop0: detected capacity change from 0 to 2048
[   63.942353][ T6320] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found
[   63.942399][ T6320] UDF-fs: Scanning with blocksize 512 failed
[   63.945830][ T5337] 8021q: adding VLAN 0 to HW filter on device eth2
[   63.951269][ T6320] UDF-fs: error (device loop0): udf_process_sequence: Primary Volume Descriptor not found!
[   63.952781][ T6320] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[   63.993491][   T34] audit: type=1804 audit(1790261470.414:2): pid=6320 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.281" name="/newroot/99/file0/file2" dev="loop0" ino=839 res=1 errno=0
[   64.010030][ T6319] UDF-fs: warning (device loop0): udf_truncate_tail_extent: Too long extent after EOF in inode 839: i_size: 36864 lbcount: 40960 extent 67+12288
[   64.111567][   T12] hsr_slave_0: left promiscuous mode
[   64.114834][   T12] hsr_slave_1: left promiscuous mode
[   64.118133][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   64.118189][   T12] batman_adv: batadv0: Removing interface: batadv_slave_0
[   64.121689][   T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   64.121703][   T12] batman_adv: batadv0: Removing interface: batadv_slave_1
[   64.136816][   T12] veth1_macvtap: left promiscuous mode
[   64.136887][   T12] veth0_macvtap: left promiscuous mode
[   64.136997][   T12] veth1_vlan: left promiscuous mode
[   64.137101][   T12] veth0_vlan: left promiscuous mode
[   64.147119][ T6333] ip6_tables: ip6tables: counters copy to user failed while replacing table
[   64.288196][ T6349] loop0: detected capacity change from 0 to 8
[   64.301749][ T6349] unable to read xattr id index table
[   64.412012][   T12] team0 (unregistering): Port device team_slave_1 removed
[   64.419007][   T12] team0 (unregistering): Port device team_slave_0 removed
[   64.498637][ T5337] 8021q: adding VLAN 0 to HW filter on device eth3
[   64.585343][   T10] usb 1-1: new high-speed USB device number 3 using dummy_hcd
[   64.692562][ T6279] bridge0: port 1(bridge_slave_0) entered blocking state
[   64.692682][ T6279] bridge0: port 1(bridge_slave_0) entered disabled state
[   64.692735][ T6279] bridge_slave_0: entered allmulticast mode
[   64.694410][ T6279] bridge_slave_0: entered promiscuous mode
[   64.695692][ T6279] bridge0: port 2(bridge_slave_1) entered blocking state
[   64.695755][ T6279] bridge0: port 2(bridge_slave_1) entered disabled state
[   64.695806][ T6279] bridge_slave_1: entered allmulticast mode
[   64.696521][ T6279] bridge_slave_1: entered promiscuous mode
[   64.719166][ T6279] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   64.722440][   T12] IPVS: stop unused estimator thread 0...
[   64.722739][ T6279] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   64.734412][   T10] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41
[   64.738577][   T10] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0
[   64.738631][   T10] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0
[   64.738722][   T10] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[   64.744511][ T5337] 8021q: adding VLAN 0 to HW filter on device eth4
[   64.748957][ T6279] team0: Port device team_slave_0 added
[   64.752352][ T6279] team0: Port device team_slave_1 added
[   64.762755][   T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11
[   64.767746][   T10] usb 1-1: Product: syz
[   64.767795][   T10] usb 1-1: Manufacturer: syz
[   64.767819][   T10] usb 1-1: SerialNumber: syz
[   64.768322][ T6279] batman_adv: batadv0: Adding interface: batadv_slave_0
[   64.768347][ T6279] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   64.768448][ T6279] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   64.769352][ T6279] batman_adv: batadv0: Adding interface: batadv_slave_1
[   64.769358][ T6279] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   64.769419][ T6279] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   64.794186][ T6279] hsr_slave_0: entered promiscuous mode
[   64.794951][ T6279] hsr_slave_1: entered promiscuous mode
[   64.931542][ T6279] netdevsim netdevsim3 netdevsim0: renamed from eth0
[   64.934926][ T6279] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[   64.935486][ T6279] netdevsim netdevsim3 netdevsim1: renamed from eth1
[   64.939379][ T6279] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[   64.939863][ T6279] netdevsim netdevsim3 netdevsim2: renamed from eth2
[   64.943144][ T6279] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[   64.943583][ T6279] netdevsim netdevsim3 netdevsim3: renamed from eth3
[   64.945945][ T6279] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[   65.003414][ T6279] 8021q: adding VLAN 0 to HW filter on device bond0
[   65.014402][   T10] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 3 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8
[   65.016402][ T6279] 8021q: adding VLAN 0 to HW filter on device team0
[   65.025408][ T1011] bridge0: port 1(bridge_slave_0) entered blocking state
[   65.025488][ T1011] bridge0: port 1(bridge_slave_0) entered forwarding state
[   65.026351][ T1011] bridge0: port 2(bridge_slave_1) entered blocking state
[   65.026388][ T1011] bridge0: port 2(bridge_slave_1) entered forwarding state
[   65.201927][ T6279] 8021q: adding VLAN 0 to HW filter on device batadv0
[   65.215419][   T10] usb 1-1: USB disconnect, device number 3
[   65.219687][   T10] usblp0: removed
[   65.246301][ T6279] veth0_vlan: entered promiscuous mode
[   65.252861][ T6279] veth1_vlan: entered promiscuous mode
[   65.283494][ T6279] veth0_macvtap: entered promiscuous mode
[   65.288828][ T6279] veth1_macvtap: entered promiscuous mode
[   65.301097][ T6279] batman_adv: batadv0: Interface activated: batadv_slave_0
[   65.305610][ T5591] Bluetooth: hci1: command tx timeout
[   65.305638][ T6279] batman_adv: batadv0: Interface activated: batadv_slave_1
[   65.355670][ T5644] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   65.390142][ T1011] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.390204][ T1011] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.415271][ T1011] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   65.415330][ T1011] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   65.423968][   T12] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   65.424071][   T12] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   65.424134][   T12] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   65.853863][ T1958] usb 4-1: new high-speed USB device number 2 using dummy_hcd
[   66.003864][ T1958] usb 4-1: Using ep0 maxpacket: 32
[   66.006129][ T1958] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40
[   66.010343][ T1958] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[   66.010401][ T1958] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[   66.010464][ T1958] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   66.015272][ T1958] usb 4-1: config 0 descriptor??
[   66.029653][ T1958] hub 4-1:0.0: USB hub found
[   66.225003][ T1958] hub 4-1:0.0: 1 port detected
[   66.529623][   T34] audit: type=1326 audit(1790261472.954:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6413 comm="syz.1.305" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f259819e159 code=0x0
[   66.583738][   T34] audit: type=1326 audit(1790261473.004:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6413 comm="syz.1.305" exe="/syz-executor" sig=31 arch=c000003e syscall=436 compat=0 ip=0x7f259819e159 code=0x0
[   66.820774][ T6424] loop0: detected capacity change from 0 to 64
[   66.836147][ T1958] hub 4-1:0.0: activate --> -90
[   66.914554][ T6426] netlink: 16 bytes leftover after parsing attributes in process `syz.0.311'.
[   67.037188][ T5652] usb 4-1: USB disconnect, device number 2
[   67.059921][ T6433] loop0: detected capacity change from 0 to 2048
[   67.068284][ T6433] UDF-fs: warning (device loop0): udf_load_vrs: No anchor found
[   67.068330][ T6433] UDF-fs: Scanning with blocksize 512 failed
[   67.078584][ T6433] UDF-fs: error (device loop0): udf_process_sequence: Primary Volume Descriptor not found!
[   67.081892][ T6433] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[   67.095917][   T34] audit: type=1804 audit(1790261473.524:5): pid=6433 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.0.314" name="/newroot/117/file0/file2" dev="loop0" ino=839 res=1 errno=0
[   67.384047][ T5591] Bluetooth: hci1: command tx timeout
[   67.800945][ T6467] loop3: detected capacity change from 0 to 4096
[   68.003904][    T9] usb 2-1: new high-speed USB device number 5 using dummy_hcd
[   68.163936][    T9] usb 2-1: Using ep0 maxpacket: 8
[   68.167457][    T9] usb 2-1: New USB device found, idVendor=1a86, idProduct=e092, bcdDevice= 0.09
[   68.172395][    T9] usb 2-1: config 2 has an invalid interface number: 31 but max is 0
[   68.175587][    T9] usb 2-1: config 2 has no interface number 0
[   68.177648][    T9] usb 2-1: config 2 interface 31 has no altsetting 0
[   68.180882][    T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
[   68.183836][    T9] usb 2-1: SerialNumber: syz
[   68.498562][ T6478] loop0: detected capacity change from 0 to 40427
[   68.500649][ T6478] F2FS-fs (loop0): Invalid log_blocksize (64), supports only 12
[   68.500660][ T6478] F2FS-fs (loop0): Can't find valid F2FS filesystem in 1th superblock
[   68.501642][ T6478] F2FS-fs (loop0): invalid crc value
[   68.565541][ T6478] F2FS-fs (loop0): f2fs_recover_fsync_data: recovery fsync data, check_only: 1
[   68.567678][ T6478] F2FS-fs (loop0): f2fs_disable_checkpoint starts, unusable: 0
[   68.567696][ T6478] F2FS-fs (loop0): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0
[   68.567729][ T6478] F2FS-fs (loop0): Start checkpoint disabled!
[   68.571748][ T6478] F2FS-fs (loop0): f2fs_disable_checkpoint finishes, err:0
[   68.572700][ T6478] F2FS-fs (loop0): Try to recover 1th superblock, ret: 0
[   68.572716][ T6478] F2FS-fs (loop0): Mounted with checkpoint version = 48b305e6
[   68.611046][ T1108] kworker/u10:5: attempt to access beyond end of device
[   68.611046][ T1108] loop0: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[   68.611515][ T1108] CPU: 1 UID: 0 PID: 1108 Comm: kworker/u10:5 Not tainted syzkaller #0 PREEMPT(full) 
[   68.611527][ T1108] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   68.611532][ T1108] Workqueue: writeback wb_workfn (flush-7:0)
[   68.611547][ T1108] Call Trace:
[   68.611551][ T1108]  <TASK>
[   68.611555][ T1108]  dump_stack_lvl+0xe8/0x150
[   68.611568][ T1108]  f2fs_stop_checkpoint+0x3f6/0x5d0
[   68.611579][ T1108]  f2fs_write_end_bio+0x1211/0x16e0
[   68.611591][ T1108]  ? blkg_put+0x22/0x240
[   68.611605][ T1108]  __submit_merged_bio+0x258/0x6a0
[   68.611622][ T1108]  ? rcu_is_watching+0x16/0xb0
[   68.611633][ T1108]  __submit_merged_write_cond+0x3c9/0x4e0
[   68.611645][ T1108]  ? __pfx___submit_merged_write_cond+0x10/0x10
[   68.611663][ T1108]  f2fs_write_data_pages+0x2a27/0x36f0
[   68.611685][ T1108]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[   68.611700][ T1108]  ? __pfx_f2fs_available_free_memory+0x10/0x10
[   68.611723][ T1108]  ? __pfx_f2fs_balance_fs_bg+0x10/0x10
[   68.611738][ T1108]  ? __lock_acquire+0x6df/0x2e50
[   68.611752][ T1108]  ? set_shrinker_bit+0x7c/0x350
[   68.611761][ T1108]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[   68.611771][ T1108]  do_writepages+0x338/0x560
[   68.611786][ T1108]  ? reacquire_held_locks+0x117/0x1a0
[   68.611795][ T1108]  ? writeback_sb_inodes+0x450/0x1b00
[   68.611806][ T1108]  __writeback_single_inode+0x136/0x1220
[   68.611817][ T1108]  ? do_raw_spin_unlock+0x4d/0x200
[   68.611829][ T1108]  writeback_sb_inodes+0x9de/0x1b00
[   68.611837][ T1108]  ? __lock_acquire+0x6df/0x2e50
[   68.611850][ T1108]  ? lock_acquire+0x115/0x350
[   68.611859][ T1108]  ? __pfx_writeback_sb_inodes+0x10/0x10
[   68.611884][ T1108]  ? rcu_is_watching+0x16/0xb0
[   68.611892][ T1108]  ? queue_io+0x2d3/0x470
[   68.611903][ T1108]  wb_writeback+0x41c/0xad0
[   68.611913][ T1108]  ? queue_io+0x2b1/0x470
[   68.611946][ T1108]  ? __pfx_wb_writeback+0x10/0x10
[   68.611955][ T1108]  ? do_raw_spin_lock+0x12b/0x2f0
[   68.611971][ T1108]  wb_workfn+0x431/0x10f0
[   68.611986][ T1108]  ? __pfx_wb_workfn+0x10/0x10
[   68.611999][ T1108]  ? do_raw_spin_lock+0x12b/0x2f0
[   68.612034][ T1108]  ? lock_acquire+0x115/0x350
[   68.612047][ T1108]  ? rcu_is_watching+0x16/0xb0
[   68.612056][ T1108]  ? process_scheduled_works+0x97a/0x1630
[   68.612067][ T1108]  process_scheduled_works+0xc3d/0x1630
[   68.612089][ T1108]  ? __pfx_process_scheduled_works+0x10/0x10
[   68.612101][ T1108]  ? assign_work+0x3cf/0x5d0
[   68.612113][ T1108]  worker_thread+0xa47/0xfb0
[   68.612134][ T1108]  kthread+0x38b/0x480
[   68.612142][ T1108]  ? __pfx_worker_thread+0x10/0x10
[   68.612151][ T1108]  ? __pfx_kthread+0x10/0x10
[   68.612159][ T1108]  ret_from_fork+0x514/0xb70
[   68.612172][ T1108]  ? __pfx_ret_from_fork+0x10/0x10
[   68.612183][ T1108]  ? __switch_to+0xc89/0x1420
[   68.612195][ T1108]  ? __pfx_kthread+0x10/0x10
[   68.612202][ T1108]  ret_from_fork_asm+0x1a/0x30
[   68.612220][ T1108]  </TASK>
[   68.618498][ T1108] F2FS-fs (loop0): Stopped filesystem due to reason: 3
[   68.796599][    T9] ch9200 2-1:2.31: probe with driver ch9200 failed with error -22
[   68.806809][    T9] usb 2-1: USB disconnect, device number 5
[   69.465036][ T5591] Bluetooth: hci1: command tx timeout
[   69.560338][ T6496] netlink: 36 bytes leftover after parsing attributes in process `syz.1.341'.
[   69.575088][ T6496] loop1: detected capacity change from 0 to 1024
[   69.819345][ T6499] netlink: 20 bytes leftover after parsing attributes in process `syz.3.342'.
[   69.891381][ T6503] netlink: 52 bytes leftover after parsing attributes in process `syz.3.344'.
[   69.901948][ T6503] bridge0: port 2(bridge_slave_1) entered disabled state
[   69.902886][ T6503] bridge0: port 1(bridge_slave_0) entered disabled state
[   69.928411][ T6503] netlink: 76 bytes leftover after parsing attributes in process `syz.3.344'.
[   69.928591][ T6503] bridge0: port 2(bridge_slave_1) entered blocking state
[   69.928703][ T6503] bridge0: port 2(bridge_slave_1) entered forwarding state
[   69.928997][ T6503] bridge0: port 1(bridge_slave_0) entered blocking state
[   69.929124][ T6503] bridge0: port 1(bridge_slave_0) entered forwarding state
[   69.951856][ T6503] netlink: 52 bytes leftover after parsing attributes in process `syz.3.344'.
[   69.959976][ T6503] bridge0: port 2(bridge_slave_1) entered disabled state
[   69.960183][ T6503] bridge0: port 1(bridge_slave_0) entered disabled state
[   70.047062][   T10] usb 1-1: new high-speed USB device number 4 using dummy_hcd
[   70.205237][   T10] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41
[   70.210599][   T10] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0
[   70.215600][   T10] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0
[   70.215662][   T10] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[   70.229446][   T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11
[   70.232943][   T10] usb 1-1: Product: syz
[   70.235071][   T10] usb 1-1: Manufacturer: syz
[   70.237461][   T10] usb 1-1: SerialNumber: syz
[   70.459891][   T10] usblp 1-1:1.0: usblp0: USB Unidirectional printer dev 4 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8
[   70.469455][   T10] usb 1-1: USB disconnect, device number 4
[   70.475596][   T10] usblp0: removed
[   70.926433][ T6525] loop3: detected capacity change from 0 to 2048
[   70.932847][ T6525] UDF-fs: warning (device loop3): udf_load_vrs: No anchor found
[   70.935751][ T6525] UDF-fs: Scanning with blocksize 512 failed
[   70.939069][ T6525] UDF-fs: error (device loop3): udf_process_sequence: Primary Volume Descriptor not found!
[   70.943188][ T6525] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[   70.954280][ T6524] UDF-fs: warning (device loop3): udf_truncate_tail_extent: Too long extent after EOF in inode 839: i_size: 36864 lbcount: 40960 extent 67+12288
[   71.308851][ T6532] can0: slcan on ttyS3.
[   71.543933][ T5591] Bluetooth: hci1: command tx timeout
[   71.579088][ T6537] netlink: 68 bytes leftover after parsing attributes in process `syz.1.356'.
[   71.786632][ T1377] ieee802154 phy0 wpan0: encryption failed: -22
[   71.786695][ T1377] ieee802154 phy1 wpan1: encryption failed: -22
[   71.885553][ T6528] can0 (unregistered): slcan off ttyS3.
[   71.905195][ T6549] netlink: 36 bytes leftover after parsing attributes in process `syz.1.359'.
[   71.913449][ T6549] loop1: detected capacity change from 0 to 1024
[   72.270242][ T6554] netlink: 8 bytes leftover after parsing attributes in process `syz.3.361'.
[   72.489565][ T6579] iommufd_mock iommufd_mock0: Adding to iommu group 0
[   72.566671][ T6566] loop1: detected capacity change from 0 to 40427
[   72.573367][ T6566] F2FS-fs (loop1): Invalid log_blocksize (64), supports only 12
[   72.579333][ T6566] F2FS-fs (loop1): Can't find valid F2FS filesystem in 1th superblock
[   72.582223][ T6566] F2FS-fs (loop1): invalid crc value
[   72.634180][ T6583] loop3: detected capacity change from 0 to 2048
[   72.638952][ T6583] UDF-fs: warning (device loop3): udf_load_vrs: No anchor found
[   72.641479][ T6583] UDF-fs: Scanning with blocksize 512 failed
[   72.646621][ T6583] UDF-fs: warning (device loop3): udf_load_vrs: No anchor found
[   72.649237][ T6583] UDF-fs: Scanning with blocksize 1024 failed
[   72.652692][ T6583] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=515, location=515
[   72.656782][ T6583] UDF-fs: warning (device loop3): udf_load_vrs: No anchor found
[   72.659348][ T6583] UDF-fs: Scanning with blocksize 2048 failed
[   72.662229][ T6583] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=259, location=259
[   72.665928][ T6583] UDF-fs: error (device loop3): udf_read_tagged: read failed, block=515, location=515
[   72.669670][ T6583] UDF-fs: warning (device loop3): udf_load_vrs: No anchor found
[   72.669679][ T6583] UDF-fs: Scanning with blocksize 4096 failed
[   72.669684][ T6583] UDF-fs: warning (device loop3): udf_fill_super: No partition found (1)
[   72.676115][ T6566] F2FS-fs (loop1): f2fs_recover_fsync_data: recovery fsync data, check_only: 1
[   72.678229][ T6566] F2FS-fs (loop1): f2fs_disable_checkpoint starts, unusable: 0
[   72.678241][ T6566] F2FS-fs (loop1): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0
[   72.678251][ T6566] F2FS-fs (loop1): Start checkpoint disabled!
[   72.680660][ T6566] F2FS-fs (loop1): f2fs_disable_checkpoint finishes, err:0
[   72.681298][ T6566] F2FS-fs (loop1): Try to recover 1th superblock, ret: 0
[   72.681309][ T6566] F2FS-fs (loop1): Mounted with checkpoint version = 48b305e6
[   72.699925][ T6583] loop3: detected capacity change from 0 to 8
[   72.704650][ T6583] SQUASHFS error: lzo decompression failed, data probably corrupt
[   72.707061][ T6583] SQUASHFS error: Failed to read block 0x91: -5
[   72.709451][ T6583] SQUASHFS error: Unable to read metadata cache entry [8f]
[   72.711765][ T6583] SQUASHFS error: Unable to read inode 0x7
[   72.768092][ T6585] netlink: 8 bytes leftover after parsing attributes in process `syz.3.371'.
[   72.904876][ T6592] ip6_tables: ip6tables: counters copy to user failed while replacing table
[   72.964351][ T6599] loop0: detected capacity change from 0 to 64
[   73.650366][ T6619] ath9k pcspkr: error -EINVAL: invalid resource (null)
[   73.650422][ T6619] ath9k pcspkr: ioremap failed
[   73.650908][ T6619] ath9k pcspkr: probe with driver ath9k failed with error -22
[   73.699570][ T6624] loop1: detected capacity change from 0 to 2048
[   73.715406][ T6624] UDF-fs: warning (device loop1): udf_load_vrs: No anchor found
[   73.715455][ T6624] UDF-fs: Scanning with blocksize 512 failed
[   73.719125][ T6624] UDF-fs: warning (device loop1): udf_load_vrs: No anchor found
[   73.719136][ T6624] UDF-fs: Scanning with blocksize 1024 failed
[   73.722928][ T6624] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=515, location=515
[   73.722944][ T6624] UDF-fs: warning (device loop1): udf_load_vrs: No anchor found
[   73.722952][ T6624] UDF-fs: Scanning with blocksize 2048 failed
[   73.723389][ T6624] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=259, location=259
[   73.725757][ T6624] UDF-fs: error (device loop1): udf_read_tagged: read failed, block=515, location=515
[   73.725773][ T6624] UDF-fs: warning (device loop1): udf_load_vrs: No anchor found
[   73.725781][ T6624] UDF-fs: Scanning with blocksize 4096 failed
[   73.725788][ T6624] UDF-fs: warning (device loop1): udf_fill_super: No partition found (1)
[   73.752804][ T6624] loop1: detected capacity change from 0 to 8
[   73.765303][ T6624] SQUASHFS error: lzo decompression failed, data probably corrupt
[   73.765354][ T6624] SQUASHFS error: Failed to read block 0x91: -5
[   73.766461][ T6624] SQUASHFS error: Unable to read metadata cache entry [8f]
[   73.766469][ T6624] SQUASHFS error: Unable to read inode 0x7
[   73.822073][ T6631] netlink: 8 bytes leftover after parsing attributes in process `syz.1.390'.
[   73.910521][ T6639] ath9k pcspkr: error -EINVAL: invalid resource (null)
[   73.910574][ T6639] ath9k pcspkr: ioremap failed
[   73.910824][ T6639] ath9k pcspkr: probe with driver ath9k failed with error -22
[   74.179418][ T6657] netlink: 36 bytes leftover after parsing attributes in process `syz.0.404'.
[   74.834070][   T25] usb 2-1: new high-speed USB device number 6 using dummy_hcd
[   74.985184][   T25] usb 2-1: Using ep0 maxpacket: 32
[   74.992141][   T25] usb 2-1: New USB device found, idVendor=17cc, idProduct=1010, bcdDevice= 0.40
[   75.003414][   T25] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[   75.003458][   T25] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3
[   75.019007][   T25] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   75.019057][   T25] usb 2-1: Product: syz
[   75.019097][   T25] usb 2-1: Manufacturer: syz
[   75.019130][   T25] usb 2-1: SerialNumber: syz
[   75.251612][   T25] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -71
[   75.258429][   T25] snd-usb-audio 2-1:1.1: probe with driver snd-usb-audio failed with error -71
[   75.266964][   T25] usb 2-1: USB disconnect, device number 6
[   75.424032][    T9] usb 4-1: new high-speed USB device number 3 using dummy_hcd
[   75.445147][ T6693] warning: `syz.0.415' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[   75.574394][    T9] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41
[   75.578326][    T9] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0
[   75.581786][    T9] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0
[   75.585079][    T9] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[   75.591020][    T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11
[   75.593704][    T9] usb 4-1: Product: syz
[   75.595371][    T9] usb 4-1: Manufacturer: syz
[   75.596954][    T9] usb 4-1: SerialNumber: syz
[   75.834288][    T9] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 3 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8
[   76.029170][  T503] usb 4-1: USB disconnect, device number 3
[   76.038614][  T503] usblp0: removed
[   76.134037][    T9] usb 2-1: new high-speed USB device number 7 using dummy_hcd
[   76.294491][    T9] usb 2-1: Using ep0 maxpacket: 32
[   76.298199][    T9] usb 2-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00
[   76.303470][    T9] usb 2-1: config 0 interface 0 altsetting 128 endpoint 0x2 has an invalid bInterval 0, changing to 7
[   76.308468][    T9] usb 2-1: config 0 interface 0 altsetting 128 endpoint 0x2 has invalid wMaxPacketSize 0
[   76.312666][    T9] usb 2-1: config 0 interface 0 has no altsetting 0
[   76.315807][    T9] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[   76.322133][    T9] usb 2-1: config 0 descriptor??
[   76.601863][    T9] usbhid 2-1:0.0: can't add hid device: -71
[   76.601994][    T9] usbhid 2-1:0.0: probe with driver usbhid failed with error -71
[   76.637339][    T9] usb 2-1: USB disconnect, device number 7
[   76.917937][   T33] cfg80211: failed to load regulatory.db
[   77.224668][   T34] audit: type=1804 audit(1790261483.644:6): pid=6733 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.428" name="/newroot/148/nfsd/pool_threads" dev="nfsd" ino=9 res=1 errno=0
[   77.242476][ T6735] INFO: trying to register non-static key.
[   77.244998][ T6735] The code is fine but needs lockdep annotation, or maybe
[   77.249078][ T6735] you didn't initialize this object before use?
[   77.251599][ T6735] turning off the locking correctness validator.
[   77.254243][ T6735] CPU: 0 UID: 0 PID: 6735 Comm: nfsd Not tainted syzkaller #0 PREEMPT(full) 
[   77.257845][ T6735] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   77.262077][ T6735] Call Trace:
[   77.263527][ T6735]  <TASK>
[   77.264748][ T6735]  dump_stack_lvl+0xe8/0x150
[   77.266740][ T6735]  assign_lock_key+0x133/0x150
[   77.268786][ T6735]  register_lock_class+0xcc/0x2e0
[   77.270901][ T6735]  __lock_acquire+0xaf/0x2e50
[   77.272830][ T6735]  ? __pfx_svc_udp_recvfrom+0x10/0x10
[   77.275062][ T6735]  ? __alloc_pages_noprof+0x80/0x100
[   77.277283][ T6735]  ? lock_acquire+0x115/0x350
[   77.279262][ T6735]  lock_acquire+0x115/0x350
[   77.281195][ T6735]  ? nfsd_file_net_dispose+0xff/0x450
[   77.283439][ T6735]  ? svc_xprt_put+0xea/0x6b0
[   77.285398][ T6735]  _raw_spin_lock+0x2e/0x40
[   77.287303][ T6735]  ? nfsd_file_net_dispose+0xff/0x450
[   77.289580][ T6735]  nfsd_file_net_dispose+0xff/0x450
[   77.291745][ T6735]  ? __pfx_nfsd_file_net_dispose+0x10/0x10
[   77.294159][ T6735]  ? set_freezable+0x89/0x250
[   77.296142][ T6735]  nfsd+0x2ed/0xbb0
[   77.297777][ T6735]  ? __pfx_nfsd+0x10/0x10
[   77.299599][ T6735]  ? __kthread_parkme+0x71/0x1f0
[   77.301636][ T6735]  ? __kthread_parkme+0x199/0x1f0
[   77.303807][ T6735]  kthread+0x38b/0x480
[   77.305433][ T6735]  ? __pfx_nfsd+0x10/0x10
[   77.307247][ T6735]  ? __pfx_kthread+0x10/0x10
[   77.309220][ T6735]  ret_from_fork+0x514/0xb70
[   77.311169][ T6735]  ? __pfx_ret_from_fork+0x10/0x10
[   77.313671][ T6735]  ? __switch_to+0xc89/0x1420
[   77.315696][ T6735]  ? __pfx_kthread+0x10/0x10
[   77.317658][ T6735]  ret_from_fork_asm+0x1a/0x30
[   77.319668][ T6735]  </TASK>
[   77.321453][ T6735] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN PTI
[   77.326228][ T6735] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
[   77.329792][ T6735] CPU: 0 UID: 0 PID: 6735 Comm: nfsd Not tainted syzkaller #0 PREEMPT(full) 
[   77.333372][ T6735] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   77.337604][ T6735] RIP: 0010:__list_del_entry_valid_or_report+0x25/0x190
[   77.340534][ T6735] Code: 90 90 90 90 90 f3 0f 1e fa 41 57 41 56 41 55 41 54 53 48 89 fb 49 bd 00 00 00 00 00 fc ff df 48 83 c7 08 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 05 e8 8f f2 4d fd 4c 8b 7b 08 48 89 d8 48 c1 e8
[   77.348575][ T6735] RSP: 0018:ffffc9000412fbd0 EFLAGS: 00010202
[   77.351147][ T6735] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000001
[   77.354430][ T6735] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000008
[   77.357736][ T6735] RBP: ffffc9000412fcd0 R08: 0000000000000003 R09: 0000000000000004
[   77.361065][ T6735] R10: dffffc0000000000 R11: fffff52000825f70 R12: ffff88816feaac40
[   77.364365][ T6735] R13: dffffc0000000000 R14: ffffc9000412fc60 R15: 0000000000000007
[   77.367690][ T6735] FS:  0000000000000000(0000) GS:ffff88818d6da000(0000) knlGS:0000000000000000
[   77.371402][ T6735] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   77.374155][ T6735] CR2: 00007f00c5c87634 CR3: 0000000110992000 CR4: 00000000000006f0
[   77.377521][ T6735] Call Trace:
[   77.378940][ T6735]  <TASK>
[   77.380216][ T6735]  nfsd_file_net_dispose+0x132/0x450
[   77.382448][ T6735]  ? __pfx_nfsd_file_net_dispose+0x10/0x10
[   77.384883][ T6735]  ? set_freezable+0x89/0x250
[   77.386871][ T6735]  nfsd+0x2ed/0xbb0
[   77.388525][ T6735]  ? __pfx_nfsd+0x10/0x10
[   77.390362][ T6735]  ? __kthread_parkme+0x71/0x1f0
[   77.392443][ T6735]  ? __kthread_parkme+0x199/0x1f0
[   77.394553][ T6735]  kthread+0x38b/0x480
[   77.396301][ T6735]  ? __pfx_nfsd+0x10/0x10
[   77.398141][ T6735]  ? __pfx_kthread+0x10/0x10
[   77.400104][ T6735]  ret_from_fork+0x514/0xb70
[   77.402069][ T6735]  ? __pfx_ret_from_fork+0x10/0x10
[   77.404226][ T6735]  ? __switch_to+0xc89/0x1420
[   77.406140][ T6735]  ? __pfx_kthread+0x10/0x10
[   77.408067][ T6735]  ret_from_fork_asm+0x1a/0x30
[   77.410046][ T6735]  </TASK>
[   77.411357][ T6735] Modules linked in:
[   77.413931][ T6735] ---[ end trace 0000000000000000 ]---
[
** replaying previous printk message **
[   77.416289][ T6735] RIP: 0010:__list_del_entry_valid_or_report+0x25/0x190
[   77.416330][ T6735] Code: 90 90 90 90 90 f3 0f 1e fa 41 57 41 56 41 55 41 54 53 48 89 fb 49 bd 00 00 00 00 00 fc ff df 48 83 c7 08 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 05 e8 8f f2 4d fd 4c 8b 7b 08 48 89 d8 48 c1 e8
[   77.416362][ T6735] RSP: 0018:ffffc9000412fbd0 EFLAGS: 00010202
[   77.416418][ T6735] RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000001
[   77.416448][ T6735] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 0000000000000008
[   77.416477][ T6735] RBP: ffffc9000412fcd0 R08: 0000000000000003 R09: 0000000000000004
[   77.416487][ T6735] R10: dffffc0000000000 R11: fffff52000825f70 R12: ffff88816feaac40
[   77.416496][ T6735] R13: dffffc0000000000 R14: ffffc9000412fc60 R15: 0000000000000007
[   77.416504][ T6735] FS:  0000000000000000(0000) GS:ffff88818d6da000(0000) knlGS:0000000000000000
[   77.416514][ T6735] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   77.416523][ T6735] CR2: 00007f00c5c87634 CR3: 0000000110992000 CR4: 00000000000006f0
[   77.416566][ T6735] Kernel panic - not syncing: Fatal exception
[   77.458744][ T6735] Kernel Offset: disabled
[   77.460115][ T6735] Rebooting in 86400 seconds..

VM DIAGNOSIS:
14:51:23  Registers:
info registers vcpu 0

CPU#0
RAX=0000000000000063 RBX=0000000000000063 RCX=0000000000000000 RDX=00000000000003f8
RSI=0000000000000000 RDI=0000000000000020 RBP=00000000000003f8 RSP=ffffc9000412f240
R8 =0000000000000003 R9 =0000000000000004 R10=dffffc0000000000 R11=ffffffff8571d5d0
R12=dffffc0000000000 R13=0000000000000063 R14=ffffffff9ad310c0 R15=0000000000000000
RIP=ffffffff8571d64c RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff88818d6da000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f00c5c87634 CR3=0000000110992000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=0000000000000000 0000000000000000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=ffffffff81bb7598 RBX=ffff888121043708 RCX=ffff888168435a00 RDX=8000000000000000
RSI=0000000000000001 RDI=0000000000000000 RBP=ffffc9000409f470 RSP=ffffc9000409f318
R8 =ffffffff907a137f R9 =1ffffffff20f426f R10=dffffc0000000000 R11=fffffbfff20f4270
R12=1ffff110242086e1 R13=dffffc0000000000 R14=1ffff1102d086df3 R15=0000000000000000
RIP=ffffffff81c7b6f9 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f2598fb16c0 ffffffff 00c00000
GS =0000 ffff8882a8cda000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000000110c2d15db CR3=00000001066b6000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=ffffffffffffffff ffffffffffffffff
XMM02=ffffffffffffffff ffffffffffffffff XMM03=ffffffffffffff00 ffffffffffffffff
XMM04=0000000000000000 00000000000000ff XMM05=6161616161616161 6161616161616161
XMM06=6161616161616161 6161616161616161 XMM07=6161616161616161 6161616161616161
XMM08=6161616161616161 6161616161616161 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
