last executing test programs:

2m6.808601982s ago: executing program 1 (id=1539):
r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000001c0), 0x0)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f0000000200)={0x2, 0x0, 0x8, 0x0, 0x7fffffff})

2m6.678295416s ago: executing program 1 (id=1540):
syz_mount_image$msdos(&(0x7f0000000180), &(0x7f00000001c0)='./file0\x00', 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x1, 0x176, &(0x7f0000000240)="$eJzs3TFKK1EUBuCTl7z3glVqsRiwsQrqCiISQRwQlBRaKUSbRATTjFbZhTtwK25HUqWL6EiiIZbJoPN9TX74CdzbzKnmzMXGTa97O7h+en6Mer0StVa0YlyJRvyJauSGAQD8JuPJJF4muaLPAgCshvkPAOVj/gNA+Zj/AFA+p2fnR3tp2j5JknrEaJh1sk7+m/cHh2l7O3nXmP1rlGWd6rTfyfvka/831j763YX9v9jazPu3bv84nev/R3f51wcAAAAAAAAAAAAAAAAAAAAAgEI0k6mF+32aze/6PH3aDzS3v6cW67WVXQMAAAAAAAAAAAAAAAAAAAB+tMH9Q++y37+6EwRBmIain0wAAAAAAAAAAAAAAAAAAFA+s5d+iz4JAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABRn9v3/5YWi7wgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAK8BAAD//9OzTek=")
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0)
fcntl$notify(r0, 0x402, 0x80000024)
ioctl$FAT_IOCTL_SET_ATTRIBUTES(r0, 0x40047211, &(0x7f0000000040))

2m6.616613134s ago: executing program 1 (id=1541):
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000580)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x5, [@datasec={0x3, 0x1, 0x0, 0xf, 0x2, [{0x2, 0x8, 0x9}], "6c80"}, @datasec={0x7, 0x0, 0x0, 0xf, 0x2, [], "e923"}]}, {0x0, [0x61, 0x5f, 0x30]}}, 0x0, 0x45, 0x0, 0x1, 0x81}, 0x28)

2m6.616422228s ago: executing program 1 (id=1542):
syz_mount_image$exfat(&(0x7f00000000c0), &(0x7f0000000040)='./file0\x00', 0x800, &(0x7f00000001c0)=ANY=[@ANYBLOB="696f636861727365743d6d6163677265656bb8756d61736b3d30303030303030303030303030303030303030303030342c6e616d65636173653d312c6e616d65636173653d312c666d61736b3d30303030303030303030303030303030303030303031302c646973636172642c6b6565705f6c6173745f646f74732c696f636861727365743d6575632d6a702c646973636172642c6572726f72733d636f6e74696e75652c00"], 0x1, 0x1528, &(0x7f00000037c0)="$eJzs3AuYT9X6OPD3XWvtMSS+TXIZ1lrv5ptclkmSXJLkkiRJkuSWkDTJkYTEEJI0JCG5DEkMIblMTBr3+/2SkCRNkoTklqz/M+FxOnX+p/M7/XKe37yf59mP9X73ftd+9/f9XvbeZubbrkNrNaldvRERwX8EL/yTBACxADAQAPICQAAA5ePKx2Wtzykx6T/bCftzPZh6pStgVxL3P3vj/mdv3P/sjfufvXH/szfuf/bG/c/euP+MZWebphW6hpfsu/D9/+yMv///D8ksM/bLNWWu6wYQ80dTuP/ZG/f//6zgj2zE/c/euP/ZVeyVLoD9F+D3f3aQ45+u4f5nb9x/xrKzK33/+UovEPkvew6O5LzQmL/q+BljjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMsb/AaX+ZAoBL4ytdF2OMMcYYY4wxxv48PseVroAxxhhjjDHGGGP/+xAESFAQQAzkgFjICblAAMDVkAfyQgSugTi4FvLBdZAfCkBBKATxUBiKgAYDFghCKArFIArXQ3G4AUpASSgFpcFBGUiAG6Es3ATl4GYoD7dABbgVKkIlqAxV4DaoCrdDNbgDqsOdUANqQi2oDXdBHbgb6sI9UA/uhfpwHzSA+6EhPACN4EFoDA9BE3gYmsIj0AyaQwtoCa3+R/nPQ094AXpBb0iCPtAXXoR+0B8GwEswEF6GQfAKDIZXIRmGwFB4DYbB6zAc3oARMBJGwZswGt6CMTAWxsF4SIEJMBHehknwDkyGd2EKTIVUmAbT4T2YATNhFrwPs+EDmANzYR7MhzT4EBbAQkiHj2ARfAwZsBiWwFJYBsthBayEVbAa1sBaWAfrYQNshE2wGbbAVtgG22EHfAI74VPYBbthD3wGe+HzfzP/1D/kd0NAQIECFSqMwRiMxVjMhbkwN+bGPJgHIxjBOIzDfJgP82N+LIgFMR7jsQgWQYMGCQmLYlGMYhSLY3EsgSWwFJZChw4TMAHL4k1YDstheSyPFbACVsRKWAmrYBWsilWxGlbD6lgda2ANrIW18C68C/tgXayL9bAe1sf6l25PYSNshI2xMTbBJtgUm2IzbIYtsAW2wlbYGltjG2yD7bAdtsf22AE7YCImYkfsiJ2wE3bGztgFu2BX7IrdsDt2z3w+B+AL+AL2xhqiD/bFvtgPk3MMwJfwJXwZB+Er+Aq+isk4BIfia/gavo7D8SSOwJE4CkdhVfEWjsGxSGI8pmAKTsSJOAknYVah7+JUTMVpOB2n4wyciTPxfZyNH+AHOBfn4nxMwzRcgAsxHdNxEZ7CDFyMS3ApLsPluAxX4ipciWtwLa7B9bgeN+JG3IybcStuxe24HT9BBYCf4m7cjcm4F/fiPtyH+3E/HsADmImZeBAP4iE8hIfxMB7BI3gUj+FxPIYn8ASexFN4Gk/jWTyL5/DZ+K8bf1JydTKILEooESNiRKyIFblELpFb5BZ5RB4RERERJ+JEPpFP5Bf5RUFRUMSLeFFEFBFGGEEijAEAERVRUVwUFyVECVFKlBJOOJEgEkRZUVaUE+VEeXGLqCBuFRVFJdHWVRFVRFXRzlUTd4jqorqoIWqKWqK2qC3qiDqirqgr6ol6or6oLxqI+0VD0QcH4IMiqzNNxBBsKoZiM9FcyIufYK3FcGwj2op24nExEkdgB9HaJYqnREcxBjuJv4mx+IzoIsZjV/Gc6Ca6ix7iedFTtHG9RG8xGfuIvmIq9hP9xQDxkpiBNcX7ODtnLfGqSBZDxFDxmpiPr4vh4g0xQowUo8SbYrR4S4wRY8U4MV6kiAlionhbTBLviMniXTFFTBWpYpqYLt4TM8RMMUu8L2aLD8QcMVfME/NFmvhQLBALRbr4SCwSH4sMsVgsEUvFMrFcrBArxSqxWqwRa8U6sV5sEBvFJrFZbBFbxTaxXewQn4id4lOxS+wWe8RnYq/4XOwTX4j94ktxQHwlMsXX4qD4RhwS34rD4jtxRHwvjopj4rj4QZwQP4qT4pQ4Lc6Is+IncU78LM4LL0CiFFJKJQMZI3PIWJlT5pJXydwyuPjsXiPj5LUyn7xO5pcFZEFZSMbLwrKI1NJIK0mGsqgsJqPyellc3iBLyJKylCwtnSwjE+SNsqy8SZaTN8vy8hZZQd4qK8pKsrKsIm+TVeXtEiIX9lFD1pS1ZG15l0yCu2VdeY+sJ++V9eV9soG8XzaUD8hG8kHZWD4km8iHZVP5iGwmm8sWsqVsJR+VreVjso1sK9vJx2V7+YTsIJ+UifIp2VH6iy+RZ2QX+azsKp+T3WR32UP+LM9LL3vJ3hL6gOwrX5T9ZH85IBYA5MtykHxFDpavymQ5RA6Vr8lh8nU5XL4hR8iRcpR8U46Wb8kxcqwcJ8fLFDlBTpRvy0nyHTlZviunyKkyVU6TA+TAX2aaJeW/zH/7d/IH/7L3jXKT3Cy3yK1ym9wud8hP5E65U+6Su+QeuUfulXvlPrlP7pf75QF5QGbKTHlQHpSH5CF5WB6WR+QReVQek2fkD/KE/FGelKfkKXlGnpVn5bmLzwEoVEJJpVSgYlQOFatyqlzqKpVbXa3yqLwqoq5RcepalU9dp/KrAqqgKqTiVWFVRGlllFWkQlVUFVNRdT1efMGoUqq0cqqMSlA3/jv5qri6QZVQJX+Vf6m+pH9SXyvVSrVWrVUb1Ua1U+1Ue9VedVAdVKJKVB1VR9VJdVKdVWfVRXVRXVVX1U11Uz1UD9VT9VS9VC+VpJJUX/Wi6qf6qwHqJTVQvawGqUFqsBqsklWyGqqGqmFqmBquhqsRaoQapUap0Wq0GqPGqHFqnEpRKWqimqgmqUlqspqspqgpKlWlqulqupqhZqhZapaarWarOWqOmqfmqTSVphaoBSpdpatFapHKUIvVYrVULVXL1XK1Uq1Uq9VqtVatVevVepWhNqlNaovaorapbWqH2qF2qp1ql9ql9qg9aq/aq/apfWq/2q8OqAMqU2Wqg+qgOqQOqcPqsDqijqij6qg6ro6rE+qEOqlOqtPqtDqrzqpz6pw6r85nnfYFIhCBClQQE8QEsUFskCvIFeQOcgd5gjxBJIgEcUFckC+4LsgfFAgKBoWC+KBwUCTQgQlsIC42PRpcHxQPbghKBCWDUkHpwAVlgoTgxqBscFNQLrg5KB/cElQIbg0qBpWCykGV4LaganB7UC24I6ge3BnUCGoGtYLawV1BneDuoG5wT1AvuDeoH9wXNAjuDxoGDwSNggeDxsFDQZPg4aBp8EjQLGgetAhaBq3+1Pm9P1ngMddL99ZJuo/uq1/U/XR/PUC/pAfql/Ug/YoerF/VyXqIHqpf08P063q4fkOP0CP1KP2mHq3f0mP0WD1Oj9cpeoKeqN/Wk/Q7erJ+V0/RU3Wqnqan6/f0DD1Tz9Lv69n6Az1Hz9Xz9Hydpj/UC/RCna4/0ov0xzpDL9ZL9FK9TC/XK/RKvUqv1mv0Wr1Or9cb9Ea9SW/WW/RWvU1v1zv0J3qn/lTv0rv1Hv2Z3qs/1/v0F3q//lIf0F/pTP21Pqi/0Yf0t/qw/k4f0d/ro/qYPq5/0Cf0j/qkPqVP6zP6rP5Jn9M/6/PaZ53cZ329G2WUiTExJtbEmlwml8ltcps8Jo+JmIiJM3Emn8ln8pv8pqApaOJNvCliipgsZMgUNUVN1ERNcVPclDAlTClTyjjjTIJJMGVNWVPOlDPlTXlTwVQwFU1FU9lUNreZ28zt5nZzh7nD3GnuNDVNTVPb1DZ1TB1T19Q19Uw9U9/UNw1MA9PQNDSNTCPT2DQ2TUwT09Q0Nc1MM9PCtDCtTCvT2rQ2bUwb0860M+1Ne9PBdDCJJtF0NB1NJ9PJdDadTRfTxXQ1XU030830MD1MT9PT9DK9TJJJMn1NX9PP9DMDzAAz0Aw0g8wgM9gMNskm2Qw1Q80wM8wMN8PNCDPSjMo6UTVvmTFmrBlnxpsUk2ImmolmkplkJpvJZoqZYlJNqpluppsZZoaZZWaZ2Wa2mWPmmHlmnkkzaWaBWWDSTbpZZBaZDJNhlpglZplZZlaYFWaVWWXWmDVmHawzG8wGs8lsMlvMFrPNbDM7zA6z0+w0u8wus8fsMXvNXrPP7DP7zX5zwBwwmSbTHDQHzSFzyBw2h80Rc8QcNUfNcXPcnDAnzElz0pw2p81ZU+Di96U3sTanzWWvsrnt1TaPzWv/MS5oC9l4W9gWsdrmtwV+FRtrbQlb0paypa2zZWyCvfE3cUVbyVa2Vexttqq93Vb7TVzH3m3r2ntsPXuvrW3v+lVc395nG9iHbUNEANvcNrYtbRP7sG1qH7HNbHPbwra07e0TtoN90ibap2xH+/Rv4gV2oV1lV9s1dq3dZXfb0/aMPWS/tWftT7aX7W0H2pftIPuKHWxftcl2yG/iUfZNO9q+ZcfYsXacHf+beIqdalPtNDvdvmdn2Jm/idPsh3a2Tbdz7Fw7z87/Jc6qKd1+ZBfZj22GDWCJXWqX2eV2hV15qVaf1663G+xGu9N+arfYrXab3W53XDoRtrvtHvuZ3Ws/twftN3a//dIesIdtpv36lzjr+A7b7+wR+709ao/Z4/YHe8L+qC5lZx37D/Zne956C4QEJElRQDGUg2IpJ+Wiqyg3XU15KC9F6BqKo2spH11H+akAFaRCFE+FqQhpMmSJKKSiVIyidD1dKq8UlSZHZSiBbqSydBOVo5upPN1CFehWqkiVqDJVoduoKt1O1egOqk53Ug2qSbWoNt1Fdehuqkv3UD26l+rTfdSA7qeG9AA1ogepMT1ETehhakqPUDNqTi2oJbWiR6k1PUZtqC21o8epPT1BHehJSqSnqCM9TZ3ob9SZnqEu9Cx1peeoG3WnHvQ89aQXqBf1piTqQ33pRepH/WkAvUQD6WUaRK/QYHqVkmkIDaXXaBi9TsPpDRpBI2kUvUmj6S0aQ2NpHI2nFJpAE+ltmkTv0GR6l6bQVEqlaTSd3qMZNJNm0fs0mz6gOTSX5tF8SqMPaQEtpHT6iBbRx5RBi2kJLaVltJxW0EpaRatpDa2ldbSeNtBG2kSbaQttpW20nXbQJ7STPqVdtJv20Ge0lz6nffQF7acv6QB9RZn0NR2kb+gQfUuH6Tvfm76no3SMjtMPdIJ+pJN0ik7TGTpLP9E5+pnOkycIMRShDFUYhDFhjjA2zBnmCq8Kc4dXh3nCvGEkvCaMC68N84XXhfnDAmHBsFAYHxYOi4Q6NKENKQzDomGxMBpeHxYPbwhLhCXDUmHp0IVlwoTwxrBseFNYLrw5LB/eElYIbw0rhpXCh++tEt4WVg1vD6uFd4TVwzvDGmHNsFZYO7wrrBPeHdYN7wnrhfeG5cL7wgbh/WHD8IGwUfhg2Dh8KGwSPhw2DR8Jm4XNwxZhy7BV+GjYOnwsbBO2DduFj4ftwyfCDuGTYWL4VNgxfPqX9fct/Ofrk8I+Yd/wxfDF0Pt75Lzo/Gha9MPogujCaHr0o+ii6MfRjOji6JLo0uiy6PLoiujK6Kro6uia6Nrouuj66Iboxqj3tXOAQyecdMoFLsblcLEup8vlrnK53dUuj8vrIu4aF+eudfncdS6/K+AKukIu3hV2RZx2xllHLnRFXTEXdde74u4GV8KVdKVcaedcGZfgWrpWrpVr7R5zbVxb18497h53T7gn3JPuSfeU6+iedp3c31xn94zr4p51z7rnXDfX3fVwz7uebkKeC+/JJNfX9XX9XD83wA1wA91AN8gNcoPdYJfskt1QN9QNc8PccDfcjXAj3Cg3yo12o90YN8aNc+NciktxE91EN8lNcpPdZDfFTXGpLtVNd9PdDDfDVZ15YS9z3Bw3z81zaS7NLXBZ54zpbpFb5DJchlvilrhlbplb4Va4VW6VW+PWuHVundvgNrhNbpPb4ra4bW6b2+F2uJ1up9vl816Y1O11+9w+t9/tdwfcVy7Tfe0Oum/cIfetO+y+c0fc9+6oO+aOux/cCfejO+lOudPujDvrfnLn3M/uvPMuJTIhMjHydmRS5J3I5Mi7kSmRqZHUyLTI9Mh7kRmRmZFZkfcjsyMfROZE5kbmReZH0iIfRhZEFkbSIx9FFkU+jmREFkeWRJZGlkWWR7wvvCX0RX0xH/XX++L+Bl/Cl/SlfGnvfBmf4G/0Zf1Nvpy/2Zf3t/gK/lZf0Vfylf0jvplv7lv4lr6Vf9S39o/5Nr6tb+cf9+39E76Df9In+qd8R/+07+T/5jv7Z3wX/6zv6p/z3Xx338M/73v6F3wv39sn+T6+r3/R9/P9/QD/kh/oX/aD/Ct+sH/VJ/shfqh/zQ/zr/vh/g0/wo/0o2Le9KMvXSLDeJ/iJ/iJ/m0/yb/jJ/t3/RQ/1af6aX66f8/P8DP9LP++n+0/8HP8XD/Pz/dp/kO/wC/06f4jv8h/7DP84ks3lf0Kv9Kv8qv9Gr/Wr/Pr/Qa/0W/ym/0Wv9Vv89v9Dv+J3+k/9bv8br/Hf+b3+s/9Pv+F3++/9Af8Vz7Tf+0P+m/8If+tP+y/80f89/6oP+aP+x/8Cf+jP+lP+dP+jD/rf/Ln/M/+PP/OGmOMMcbYHzLh8lD8es2F2/l9fidH/N3GfQHg6q2FMv9+fdYZ5br8F8b9RXz7CAA81bvrg5eWGjWSkpIubpshISg2F+DS/wRliYHL8WJoB09AIrSFsr9bf3/R/Sz9i/mjtwDk+rucWLgcX57/CwBM+p35H3181IIK4em4/8/8cwFKFLuckxMux4uh3S/3V9pCuX9Sf4HW/6L+nF+mALT5u5zccDm+XH8CPAZPQ+KvtmSMMcYYY4wxxi7oLyp3vnT9eeknPn/v+jxeXc7JAZfjf3V9zhhjjDHGGGOMsSvvme49nnw0MbFt539/UO1/lPWHB03hf2tmHvzuwHuAS48oAPgPJwTIGsi/8ig2/yX7Sr741vnHVcvO+AD+O1r5Zwyu8AcTY4wxxhhj7E93+aT/14+rK1UQY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDGWDf0Vf07sSh8jY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxxhhjjDHGGGOMMcYYY4wxdqX9vwAAAP//kfb+pw==")
mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x109041, 0x0)
mount$bind(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x100000, 0x0)
mount$bind(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x81105a, 0x0)
mount$bind(&(0x7f0000000880)='./file0/../file0\x00', &(0x7f0000000440)='./file0/file0\x00', 0x0, 0x3bdc51, 0x0)
mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000080)='./file0/file0/file0\x00', 0x0, 0x887008, 0x0)
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00')
read$FUSE(r0, &(0x7f0000006b40)={0x2020}, 0x206e)

2m6.533001486s ago: executing program 1 (id=1543):
r0 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0)
r1 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0})
ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc1105518, &(0x7f0000000040)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x1, [0x327cf3e4, 0xfffffffffffffffc, 0x0, 0x5, 0x0, 0x0, 0x0, 0x8000, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x4, 0x8, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000, 0x0, 0x0, 0x5, 0x3, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0xa, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x7fffffffffffffff, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x1, 0x0, 0x0, 0xffffffffffffffff]})

2m6.369539446s ago: executing program 1 (id=1544):
mount_setattr(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x0, 0x160000}, 0x20)

2m6.280900204s ago: executing program 32 (id=1544):
mount_setattr(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000080)={0x0, 0x0, 0x160000}, 0x20)

1m35.783347862s ago: executing program 2 (id=1952):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="640000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="2b03000000800000300012800b00010067656e657665000020000280080005000000000014000700ff0000000000000500000000000000011400350067656e65766531"], 0x64}}, 0x0)

1m35.783275542s ago: executing program 2 (id=1953):
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0)

1m35.713060999s ago: executing program 2 (id=1954):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r1 = socket(0x400000000010, 0x3, 0x0)
r2 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x42}}}]}, 0x38}}, 0x0)
sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x4, 0xa}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x18, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x4}]}}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8848}, 0x80)
r4 = socket(0x400000000010, 0x3, 0x0)
r5 = socket$unix(0x1, 0x5, 0x0)
ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r6=>0x0})
sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x30, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r6, {0x4, 0xa}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x8848}, 0x80)

1m35.623134317s ago: executing program 2 (id=1955):
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000380)={0xffffffffffffffff, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x5, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000100)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xb7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x49, 0x8, 0x0, 0x0}}, 0x10)
bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x1f, 0x4c, &(0x7f0000000940)=ANY=[], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
syz_open_procfs(0x0, &(0x7f0000000380)='net/dev_mcast\x00')
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19)
syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
syz_mount_image$hfsplus(&(0x7f0000000600), &(0x7f0000000640)='./file0\x00', 0x0, &(0x7f0000000680), 0x1, 0x5c8, &(0x7f00000006c0)="$eJzs3c9rFO8ZAPBndpNNNoW4avxRWzBYKKKo2Y3YFgpNi5QcRIRevIZmNcFNlGQtq4eSFv8Qe0hPHnopQunBg+ce/AcCPRYKPYZe8mVmZzerxphokt18/Xzw3XnffWeeeedx5mVnNrABfLNm78fwWiQxe/VOK21vrE83Ntanlzr1iBiJiEL2L4bS6r8jii8iJqNd4ocRkeThkk/t53Xt1YV3d1uX261CXrL1i7tttzdreYmZfJAzBxjv7VfHS7pHmAa93Qk+CLY+73+HuPviIcZmH5JP/F9UIsYiYjSfBzonbuFoR3fwBuYCBAAAgEN0YjM2oxXj/R4HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHCf57/8neSl06pORdH7/v5S/F3n9WHvT7wEAAAAAAAAAwAG4uBmb0YrxTnsryb7zv5Q1JrLXH8TTWI16rMT1aMVcNKMZK1GNiEpPoFJrrtlcqe5hy9qOW9aO5ngBAAAAAAAA4HvqzzG7/f0/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMgiSi2F5kZaJTr0RhKCJGI6KUrrcW8c9O/Th70+8BAAAAwBE4sRmb0YrxTnsrye75z2b3/aPxNJajGYvRjEbUYz57FtC+6y9srE83Ntanl9Lycdxf/3dfw8giRvvZw857nsrWONPdYjZ+G7+LqzEZ92IlFuMPMRfNqMdk3M5qc5FEJX96UemMc+fxzrzXuve5sZ7PRlKOB7GYje16/D4eRyPmo5AdQ7bO7nv8U5qd5Fe5PeZoPl8mEcmP8iMbDJUsI8PdjEzluU+zcXL3TOzzPPlwT9UodJ9BTRxCzsfyZZrz0YHOea3n7Du7eyYirjX/fnGhsfxo4cHq1cE5pC/0YSamezJx7pvKRCnPRnsW3d9seSnbdjwW4248jvmox8/iVtSyMp0te/N6Zg/XWmF/19pPLueVUxFJub0cEGleT/bktXemq2R9ve9sZ+nUwc9IQxfySjEiGeqOaRB8mIlqTyZO756Jv2ylr6uN5UcrC3NP9ri/n+bLdG4eGai5uZSfvUNZ6/2zI+07vWNfNeub6PYVPuo70+373JVayj/DfRyplvWd27Gvvd35nr6dPuUAMPDGroyVyv8p/6v8svyivFC+M/qbkZ+P/LgUw2+H/lH8W+GvhV8mV+Jl/HH7/h8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPhyq8+eP5prNOorKioqKt1Kv2cmjsKN5tKTG6vPnl9bXJp7WH9YX745Vaveuln9xc0bDxYb9an2a79HyWHZvuj7PRIAAAAAAAAAAAD24yj+nLTfxwgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMDxMXs/htciierU9am0vbE+3UhLp769ZiEihtLl/yOKLyImo12i0hMu+dR+XtdeXXh3t3V5O1ahs35xt+32Zi0vMZMPcuYA47396nhJ9wjToLc7waHfvgsAAP//FQYeZg==")
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff4000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff4000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045)
io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0xa, 0x20002f7})
syz_clone(0x8d002240, 0x0, 0x0, 0x0, 0x0, 0x0)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)
mmap(&(0x7f000000d000/0x1000)=nil, 0x1000, 0x0, 0x11, 0xffffffffffffffff, 0x0)
r1 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc)
write$binfmt_elf32(r1, 0x0, 0x0)
close(r1)
r2 = syz_init_net_socket$llc(0x1a, 0x802, 0x0)
close(r2)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, 0x0)
setsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, 0x0, 0x0)
ioctl$SNDRV_PCM_IOCTL_DRAIN(0xffffffffffffffff, 0x4144, 0x0)
setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, &(0x7f0000000680)={0x7, {{0xa, 0x4e23, 0x70, @private2={0xfc, 0x2, '\x00', 0x1}, 0x2}}}, 0x88)

1m35.50275501s ago: executing program 2 (id=1956):
mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0)
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r1 = openat$cgroup_type(r0, &(0x7f0000000040), 0x2, 0x0)
write$cgroup_type(r1, &(0x7f00000000c0), 0x9)
rmdir(&(0x7f0000000080)='./cgroup/../file0\x00')

1m35.181375589s ago: executing program 2 (id=1962):
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$sock_netdev_private(r0, 0x8946, &(0x7f0000000a00)="4749c2368bb8dd2c7f17323cf53a")

1m35.005553964s ago: executing program 33 (id=1962):
r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2)
ioctl$sock_netdev_private(r0, 0x8946, &(0x7f0000000a00)="4749c2368bb8dd2c7f17323cf53a")

1m12.908046803s ago: executing program 4 (id=2318):
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000080)={0x0, 0x8000}, 0x8)
r0 = socket$inet6_sctp(0xa, 0x801, 0x84)
sendmmsg$inet6(r0, &(0x7f0000003300)=[{{&(0x7f0000001080)={0xa, 0x4e22, 0x40, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8}, 0x1c, &(0x7f00000014c0)=[{&(0x7f00000010c0)="13d04648", 0x4}], 0x1}}, {{&(0x7f0000001580)={0xa, 0x4e20, 0x81, @remote, 0x7}, 0x1c, &(0x7f0000001740)=[{&(0x7f00000015c0)="c1311ed272", 0x5}], 0x1}}], 0x2, 0x202a804)
shutdown(r0, 0x1)
getsockopt$bt_hci(r0, 0x84, 0x7f, &(0x7f0000000080)=""/4057, &(0x7f0000001180)=0xfd9)

1m12.853637456s ago: executing program 4 (id=2319):
r0 = creat(&(0x7f0000000080)='./file0\x00', 0x248)
close(r0)
r1 = socket$inet6_sctp(0xa, 0x5, 0x84)
sendto$inet6(r1, &(0x7f0000000300)="8b", 0x34000, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @private1}, 0x1c)
mount$9p_fd(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f0000000200), 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1])

1m11.908644308s ago: executing program 4 (id=2324):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0xc00)
sendmsg$NFT_MSG_GETSET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000c80)=ANY=[@ANYBLOB="2c000000040a050000000000000000000a0000090900010073797a31"], 0x2c}, 0x1, 0x0, 0x0, 0x24048014}, 0x4000)

1m11.690211288s ago: executing program 4 (id=2326):
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0)
mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0)
mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0)
mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101097, 0x0)
mount$bind(&(0x7f0000000100)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0xb500a, 0x0)
mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0)
pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file0/file0\x00')

1m11.593019145s ago: executing program 4 (id=2329):
modify_ldt$write(0x1, &(0x7f0000000000)={0x1001}, 0x10)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x40}, 0x90)

1m11.325778102s ago: executing program 4 (id=2332):
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000040)={0x4000000, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0xf, 0x8, 0x0, 0xa, 0x0, 0x0, 0x25dfdbfe, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x20, @empty}}, @sadb_address={0x5, 0x6, 0x0, 0x20, 0x0, @in6={0xa, 0x4e21, 0xc2e, @local, 0x10001}}]}, 0x50}}, 0x0)

1m11.115480449s ago: executing program 34 (id=2332):
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000040)={0x4000000, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0xf, 0x8, 0x0, 0xa, 0x0, 0x0, 0x25dfdbfe, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x20, @empty}}, @sadb_address={0x5, 0x6, 0x0, 0x20, 0x0, @in6={0xa, 0x4e21, 0xc2e, @local, 0x10001}}]}, 0x50}}, 0x0)

1m11.060432046s ago: executing program 3 (id=2336):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0xb, 0x8, 0x2, 0x4, 0x5}, 0x48)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000380)={{r3, <r4=>0xffffffffffffffff}, &(0x7f0000000b00), &(0x7f0000000300)}, 0x20)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x10000002}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94)
r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10)
socket$can_bcm(0x1d, 0x2, 0x2)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, 0x0, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94)
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000700)={'ip_vti0\x00', &(0x7f00000005c0)={'erspan0\x00', <r7=>0x0, 0x700, 0x8, 0xfffffffe, 0x0, {{0x6, 0x4, 0x0, 0x0, 0x18, 0x68, 0x0, 0x45, 0x4, 0x0, @empty, @private=0xa010102, {[@ra={0x94, 0x4}]}}}}})
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000800)={'tunl0\x00', &(0x7f0000000740)={'gre0\x00', <r8=>0x0, 0x7800, 0x8, 0x5, 0xd7e, {{0x5, 0x4, 0x3, 0x6, 0x14, 0x64, 0x0, 0xe, 0x4, 0x0, @multicast2, @broadcast}}}})
sendmsg$ETHTOOL_MSG_LINKSTATE_GET(0xffffffffffffffff, &(0x7f0000000a80)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000a40)={&(0x7f00000008c0)={0xf4, 0x0, 0x20, 0x70bd2d, 0x25dfdbff, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x30, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'hsr0\x00'}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'netpci0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_1\x00'}]}, @HEADER={0x68, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}]}]}, 0xf4}, 0x1, 0x0, 0x0, 0x20000000}, 0x841)
bind$inet(r6, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x10)
connect$inet(r6, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r6, 0x6, 0x16, 0x0, 0x0)
setsockopt$inet_tcp_TCP_REPAIR(r6, 0x6, 0x13, 0x0, 0x0)
sendto$inet(r6, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x11)
recvfrom$inet(r6, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x700, 0x0, 0xfffffffffffffd25)
shutdown(r6, 0x1)

1m10.066538961s ago: executing program 3 (id=2344):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f00000040c0)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff4070000000000000400000000000e1ff95000000000000002ba76bb3019c1341056bd8174b79603123"], &(0x7f0000000140)='GPL\x00'}, 0x94)
add_key(&(0x7f0000000080)='dns_resolver\x00', 0x0, &(0x7f0000000040)="42d7", 0xfffff, 0xfffffffffffffffe)

1m9.006087187s ago: executing program 3 (id=2350):
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000340)=@ipv6_delrule={0x30, 0x21, 0x11, 0x0, 0x0, {0xa, 0x0, 0x20}, [@FRA_SRC={0x14, 0x2, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}}]}, 0x30}}, 0x58)

1m8.646427304s ago: executing program 3 (id=2352):
syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000040)='./file0\x00', 0x11, &(0x7f0000000100)={[{@noblock_validity}, {@stripe={'stripe', 0x3d, 0x2}}, {@norecovery}, {@min_batch_time={'min_batch_time', 0x3d, 0x71d}}, {@abort}]}, 0x1, 0x61b, &(0x7f0000001080)="$eJzs3U1rXNUbAPDn3rw26f+ftAhaF7Yg0oI2adJWigg2S0FKffkCsUlLadqUJIJpC01Bl+LGheDKhfVbaMGduHDrwr0UikgXVooduZM76WRekkySyUxmfj+Y5r5M7nlumifn3HPPuRNA1zqW/ZNGHImIm0nESNm+3sh3Hlt93+O/7lzKXkkUCh/+mcSdu8lK+bGS/Otw/s3/jkTyaxpxuKeq2IHF5VvXpufmZhfyDeNL12+OLy7fOnn1+vSV2SuzNybfnDx39szZcxOndn5+Fb775mky8f3vF5I4H8/y2LLzqgpyRyVnZR+Lwqon5duzn+u5HR67Xfw9Uvo9eS6p3EDbupznbV9EvBgj0VP2vzkSn7/f0uCApiokUaqjgK6T1Mn/n6c2+ssw2LR4gL1SageUru1rXQdXS5vcKgH2wqOp1Q6p1dzvi4hS/vfmfWeDxb6BocfJun6eJCJ21jO3Kivjl58ufJa9ok4/HNAcK/dKvdyV9X9SzM3RGCyuDT1O1+f/SqGQ5i2BbPsH2yy/sn9e/sPeWbkXES/l9X9/bDn/0zx3S/n/8TbLl/8AAAAAAACwex5MRcQbtcb/pWvjf/prjP8Zjojzu1D+5vf/0of5QlLx1v5dKB662qOpiLdrjv9dG+M72pOv/a84HuB2cvnq3OypiPh/RJyIvoFsfaLiuOUjhE9+cfjreuWXj//LXln5pbGA+ZEe9lZMxJ2ZXpre6XkDEY/uRbxcHP97NN+yfvxPVv8nNer/LL9vbrGMw6/dv1hv3+b5DzRL4duI4zXr/+fN7WTj53OMF9sD46VWQbVXbn/5Q73yK/O/gdCvNPBeoIas/h/aOP8HsqW15/UsNnb87CL99HJvod7+7bb/+5OPeqKsE+DT6aWlhYmI/uS96u2TjcUMnSrPh6OR50uW/yde3bj/b639X5aHByJiZQvlDW6yX/sfWifL/5nq+v/dsvp/dH393/jC5P3RH+uVf3FL9f+ZYp1+It+i/w/KVT+PY6sJ2pJwAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGCfSyPiYCTp2Npymo6NRQxHxAsxlM7NLy69fnn+kxsz2b6I0ehLS5/0O7K6npQ+/3+0bH2yYv10RByKiK96DhTXxy7Nz820+uQBAAAAAAAAAAAAAAAAAACgTQwX5/wXBirn/2f+6Gl1dEDT9eZf5Tt0n95tf2dhYFcDAfbc9vMf2Meya/4G8r+vmbEALVA//588LRTtaTjAHtL+h+61zfx3uwD2uYPqf+hiW+zTG2x2HEArqP8BAAAAAKCjHDr64LckIlbeOlB8ZfrzfTVuDLoJCB0kbXUAQMsYwwvdq3e+1REArWJCP5CsLf1Tc7J//Y6/pDkBAQAAAAAAAAAAAABVjh9paP4/0EE2nv9vbD90sg3m/9dKfo8LgA5S/6M/1P3Q6VzjA5vV9ub/AwAAAAAAAAAAAEAbGLx1bXpubnZhcXn/LbzTHmE0trAy3RZhNLBQuBux8XueNaf0voholx/CwmIWzV6VVXoERwtPucV/lwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgDX/BQAA//927Rvw")
mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x109041, 0x0)
mount$bind(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x100000, 0x0)
mount$bind(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x81105a, 0x0)
mount$bind(&(0x7f0000000880)='./file0/../file0\x00', &(0x7f0000000440)='./file0/file0\x00', 0x0, 0x1adc11, 0x0)
mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000080)='./file0/file0/file0\x00', 0x0, 0x887008, 0x0)
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='mountinfo\x00')
read$FUSE(r0, &(0x7f0000006b40)={0x2020}, 0x2020)

1m8.468345238s ago: executing program 3 (id=2355):
r0 = socket$igmp(0x2, 0x3, 0x2)
getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000100)={0x0, @empty, @multicast1}, &(0x7f0000000140)=0xffffffffffffffa9)

1m8.100174171s ago: executing program 3 (id=2357):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), r0)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000440)={'batadv0\x00', <r2=>0x0})
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000980)={0x2c, r1, 0x1, 0x0, 0x2000000, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000040}, 0x0)

1m7.822126398s ago: executing program 35 (id=2357):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), r0)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000440)={'batadv0\x00', <r2=>0x0})
sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000980)={0x2c, r1, 0x1, 0x0, 0x2000000, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r2}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000040}, 0x0)

1m4.937411637s ago: executing program 6 (id=2402):
r0 = openat$dsp(0xffffffffffffff9c, &(0x7f00000001c0), 0x129400, 0x0)
ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000000200)=0x8)

1m4.872683046s ago: executing program 6 (id=2404):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x28, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0xffff}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x28}, 0x1, 0x0, 0x0, 0x800}, 0x40c0080)

1m4.872560556s ago: executing program 6 (id=2405):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010080030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a310000000070000000060a010400000000000000000100000008000b400000000048000480440001800b000100657874686472000034000280080001400000000c080003400000000008000440000000220500020007000000080006400000000308000540000000000900010073797a300000000020000000030a010300000000000000000a0000020900030073797a300000000044010000080a01080000000000000000010000073a00074032e97608c07b8f34d704cc507d07a8d4c429672a9b6841e516ce194f03354b3c46a930469ce36ee8391a02352a70d543c633dc17a9d300007900074012119f33dbd27dbba871f33b8206fc0a59dac6df96baf86f3deffa20b8a2b13fa2fbc917a33ad4b9dc903553ff1e7533cd9d1e3f6a3248b10a63552977fab38d9ad7409cbd223b094a0bb6f0884c8839890d122f9b9963668c97749b2304852a8d461ccc39dc307f41ac41688a4f2d64a916dc532d00000008000a40000000000900010073797a30000000000900020073797a31000000002c00058008000140000086dd080001400000002c080001400000001608000140000000736afd014000008100080009"], 0x248}}, 0x0)

1m4.751548712s ago: executing program 6 (id=2409):
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x2048c5, &(0x7f0000000840)={[{@utf8no}, {@shortname_winnt}, {@shortname_winnt}, {@fat=@nfs_nostale_ro}, {@uni_xlate}, {@fat=@check_normal}, {@utf8}, {@fat=@dmask={'dmask', 0x3d, 0x100}}, {@fat=@discard}, {@shortname_mixed}, {@fat=@quiet}, {@utf8no}]}, 0x0, 0x29f, &(0x7f0000000580)="$eJzs3UFrE1sYxvGnSdukKW2yKBfuhct9uW50M7TxEwRpQQwotRF1IUztREPGpGRiJCK2O7d+juLSlYL6Bbpx517cFEFw04UYaZKxaRswra1Tzf8HYU7OOe/MmZyZ8M5AJlvXn94rFwOn6NYVS5pi0rq2pcxOqWuku4y1y+Pqta5zk5/f/Xv1xs1LuXx+ftFsIbd0Pmtm0/+9evDo2f9v6pPXnk+/TGgzc2vrU/b95l+bf299XQrXXpVcW65W6+6y79lKKSg7Zld8zw08K1UCr1a3nvaiX11dbZpbWZlKrda8IDC30rSy17R61eq1prl33FLFHMexqZSGTfzQEYWNxUU3dyKDQRQm+lXWajk33rexsPErBgUAAE6XqPL/u6XASoFVqnvy+4P5f0yHyP+loc7/D4/8fxjs5P+p7vm7F/k/AAAAAAAAAAAAAAAAAAAAAAC/g+1WK91qtdLhMnwlJCUlhe+jHidOBvM/3Hp+uJeU/CeNQqPQWXbac0WV5MvT7Jj0pX08dHXKCxfz87PWltFrf60bv9YoxJUI40OZ/vFznXjrjV/TmFK9288qrZn+8dk+8Y3CuM6eaSW6W/bkKK23t1WVr5X2cb0b/3jO7MLl/L74iXY/AAAAAAD+BI59d+D6vd3uWPjYkH3tncrd+wNK/+D+wL7r61H9MxrdfgMAAAAAMEyC5sOy6/tebQgK4f8fHMsKo//okoN2HpXUrXlxWuZikEJM0lHD4z83yx8l7amZiXy6j6Pw4X7nDBikc5TfSgAAAABOQpj0j0Q9EAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAhtigDw8L+x/l2WM9m4tHs5cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADA6fAtAAD//2kbF4o=")
r0 = syz_open_procfs(0x0, &(0x7f0000000540)='mounts\x00')
mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x100000, 0x0)
mount$bind(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1333c06, 0x0)
mount$bind(&(0x7f0000000300)='./file0\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x11080, 0x0)
mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0)
read$FUSE(r0, &(0x7f0000002c00)={0x2020}, 0x2020)

1m4.751108748s ago: executing program 6 (id=2411):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@ipv6_newaddrlabel={0x38, 0x48, 0x3d3b866cab67281, 0x70bd25, 0x25dfdbff, {0xa, 0x0, 0x78, 0x0, 0x0, 0xff}, [@IFAL_LABEL={0x8, 0x2, 0xb}, @IFAL_ADDRESS={0x14, 0x1, @mcast2}]}, 0x38}}, 0x4)

1m2.22687567s ago: executing program 6 (id=2434):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000193c0)=@newlinkprop={0x28, 0x6c, 0x1, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x2680, 0x1800}, [@IFLA_NET_NS_PID={0x8}]}, 0x28}}, 0x0)

1m2.151397554s ago: executing program 36 (id=2434):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000193c0)=@newlinkprop={0x28, 0x6c, 0x1, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x2680, 0x1800}, [@IFLA_NET_NS_PID={0x8}]}, 0x28}}, 0x0)

45.220849628s ago: executing program 5 (id=2630):
r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/pm_wakeup_irq', 0x0, 0xb)
r1 = syz_open_dev$loop(&(0x7f0000000440), 0x81, 0x2000)
ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000001600)={r0, 0x800, {0x2a00, 0x80010000, 0x0, 0x5, 0xfffffffffffffffd, 0x0, 0x0, 0x20, 0x10, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd6447a4b4e00d9683dda1af1ea09de2b7fb0a0100000000000000000300", "2809e8dbe108598927875397bab21f40f05f819e01177d3d458dac00000000000000070000000000000000000000000200000000000400", "90be8b1c5512406c7f00", [0x4, 0x40000000000000]}})

43.98372494s ago: executing program 5 (id=2644):
bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xe, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x94)
r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000000120000007f00000001"], 0x48)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000680)={{r1}, &(0x7f00000007c0), &(0x7f0000000640)=r0}, 0x20)
bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r1}, &(0x7f0000000240), &(0x7f0000000280)='%pS    \x00'}, 0x20)
bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000001380)={r1, &(0x7f00000004c0)}, 0x20)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x1c, 0x0, 0x0, 0x4}, 0x94)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r1, &(0x7f0000000480), &(0x7f0000000180)=@tcp6}, 0x20)

43.78599997s ago: executing program 5 (id=2646):
r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000001280)={{0x12, 0x1, 0x300, 0x0, 0x1f, 0x66, 0x8, 0x58f, 0x6610, 0x4805, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x4, 0x95, 0x70, 0x81, [{{0x9, 0x4, 0x0, 0x81, 0x0, 0xff, 0xff, 0xff, 0x2}}]}}]}}, &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x23})
r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003)
ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000a40)={&(0x7f0000000380)=[{0x3, 0x6000, 0x1, &(0x7f00000003c0)='t'}, {0x1, 0x2a00, 0x0, 0x0}], 0x2})
openat(0xffffffffffffff9c, 0x0, 0x42, 0x0)
syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000200)={0x1c, &(0x7f0000000000)=ANY=[], 0x0, 0x0})

41.829873483s ago: executing program 5 (id=2672):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000500)=@ipv4_newroute={0x38, 0x18, 0xe917fbd514dea7d7, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, [@RTA_ENCAP_TYPE={0x6, 0x15, 0x2}, @RTA_ENCAP={0x14, 0x16, 0x0, 0x1, @LWTUNNEL_IP_OPTS={0x10, 0x8, 0x0, 0x1, @LWTUNNEL_IP_OPTS_GENEVE={0xc, 0x1, 0x0, 0x1, @LWTUNNEL_IP_OPT_GENEVE_CLASS={0x6, 0x1, 0x9}}}}]}, 0x38}}, 0x0)

41.755702673s ago: executing program 5 (id=2674):
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0)
mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0])
mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400))
chdir(&(0x7f0000000080)='./file1\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x220)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x40000, 0x120)
mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0)
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000300)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x888000, 0x0)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r1, 0xc018937c, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0, {0x1}}, './file0\x00'})

40.800387078s ago: executing program 5 (id=2686):
getsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x18, 0x0, &(0x7f0000000040))

24.575930995s ago: executing program 37 (id=2686):
getsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x18, 0x0, &(0x7f0000000040))

4.309358333s ago: executing program 0 (id=3140):
eventfd(0x9)
r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0)
ioctl$SNDCTL_DSP_SETFMT(r0, 0xc0045005, &(0x7f0000001180)=0x2000000)
mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3, 0x12, r0, 0x0)
r1 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xe825, 0x3400, 0x1, 0x2db}, &(0x7f0000000dc0)=<r2=>0x0, &(0x7f00000001c0)=<r3=>0x0)
syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4)
syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0})
io_uring_enter(r1, 0x847ba, 0x0, 0xe, 0x0, 0x0)
ioctl$SNDCTL_DSP_GETOPTR(r0, 0x5008, 0x0)
ioctl$SNDCTL_DSP_GETOSPACE(r0, 0x8010500c, &(0x7f00000000c0))

4.207974899s ago: executing program 0 (id=3141):
r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0)
ioctl$SIOCX25SDTEFACILITIES(r0, 0x89eb, &(0x7f0000000340)={0x6b, 0x5, 0x10, 0x8, 0xc, 0x1c, 0x17, "879f524094bbf3af86345214ae732571370500f1", "b37c7b635f0e9382e2588695991dbaad5fc0819c"})

4.207798172s ago: executing program 0 (id=3142):
r0 = syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4)
capset(&(0x7f0000000180)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff})
ioctl$sock_bt_bnep_BNEPCONNADD(r0, 0x400442c8, 0x0)

4.131877289s ago: executing program 0 (id=3144):
syz_mount_image$btrfs(&(0x7f0000005100), &(0x7f0000000180)='\xe9\x1fq\x89Y\x1e\x923aK\x00', 0x200810, &(0x7f0000000240)={[{@datacow}, {@nodatacow}, {@enospc_debug}, {@nossd}, {@nodatasum}, {@nodatasum}, {@user_subvol_rm}, {@max_inline={'max_inline', 0x3d, [0x6d, 0x33, 0x78, 0x39, 0x65, 0x36]}}]}, 0x1, 0x50f3, &(0x7f000000a2c0)="$eJzs3U+IVWUfB/Dnzp1x5lVw7isEtsoikGrh4CYioqtMUFF0y8VgBE4tgnThJEi0EMQW/Vt4S4paSK6kFsksjKA2LqQwArehYS7cKAaSi3Yac8957pz7HO+5d0ZtTD8fmTnnOb/zPOe5l7O43+uccwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACEEF74/bNDVfVT16bPnJtp7jywZebyvul1p0OodbbX8vqOrc++8ua2HS9OxA6zL2fLRqPfkFnX81ljVc/GhX69P6+HEMaSAer58pk1pVGLq3vKA1a6fnH30U17mxuPH27Xr146e7L80lkwsdITWCn5eXVh8Vxqdn6PJHt024VTr9Zzimb90xPuX3kRAMCSTLU6i+7H0fwjbre9P60n7WbSbift+AmhXWwsRzbuqn7z3JDWV2iezSwqjPedZ1LP3/9uu5X2T9pJ1FjCPHt3zSPNRL95ziX1lZonAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwJ3kkbdHH6qqn7o2febcTHPngS0zl/dNrzsdQqOzvZaVa6vfP9z869utxw78uPmr4xeef6ye94vL0cLO4be48sRkCG8UKhfisBfXhtDqLXSa4cty4a3OynOxAAAAwN3k/s7vkW47i4NjPe1aJ03WOv+iLCxev7j76Ka9zY3HD7frVy+dPbn88Vp9xmvecLxuu7H4UysE4xh/0/EW63HXPaVxqqUjpnn+8fNTf1f1L+X/RnX+j++c/A8AAMDNkP/TcaoNyv/fvfbHJ1X9S/l/Q88hS/k/zjjm/5GwvPwPAAAAd7Lbnf+bpXGqDcr/4y+NfV3Vv5T/p4bL/6PFaceNv8YJ75oMYWrQ1AEAAIA+4v+7L361EPN69s1BmtefevTguarxSvm/OVz+H7ulrwoAAAC4GUe+2P5wVb2U/1vD5f/x2zprAAAAYCne+XDig6p6Kf/PDpf/V+fL/MqHrNNP8a8QDk2GMLGwMpcVfg7tp7sFAAAA4BaJOf3PT3f+ULVfKf/PVd//P97pIF7/33P/v9L1/4VCdte/J90YAAAAgHtR+Xr+eHv87MkF/Z6/P+z1/w/87+CrVccv5f/9w+X/enF5K5//BwAAAMvwX3v+3/bSONUG3f//vo/e/aWqfyn/t4fL/3G5pvjyTtRq2fvz3mQI6xdW8rsJfhMPtyspzI8VCh2tpMe22CMvzI8XCh1zSY/NkyE8uLCyPyn8PxbaSeHK2rxwJCmcjoX8fOgWjiWFE/FM+3xtPt208H0s5BdYzMcrKNZ0L4lIelzt12OhcMMeZ7sHBwAAuKfE8Jxn2bHeZkij7Hxt0A6rB+0wMmiH+qAdRpMd0h37bQ+zvYW4vX1m49Ke/39kuPwf34pV2aLf9f8hXv+fP9ewe/3/bCw0ksJ8LLTSOwa04jGysPtxPEajlfe4sr5bAAAAgLta/F6gvsLzAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP5h715j5KruA4CffY734fVCUoXQKNkkNY6beL22gUQtVdaUqhEpzbqhoCqi2NhrsnjBjm1KjEJkbCIaIShtkJIPRRhFUc0HqBWISAoIFymOUHlEVEUBBAqtIQoipSQRaYIUqtl7z+ydc3cefqzx0t9P8s6Z+Z/nnYfn3HvnXAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+P/h4Feu+dtm8Ud/e96zL1w8fsWetRe/et15pz4ZwsTM4x1ZuKP/xtvHf373uffseWD1HfcdPv+jvXm5PB4Gqn868zs3xFoPLw7h/o4QutPAisEs0JPfH4z1vW8whFPCbKBWYrI/K5E2HL7fF8K+MBuoVfW9vhAGC4ELn3rk4Zuridv6QlgaQqikbTxfydroSwNn9GaB/jSwtTsL/OqtTC3w3c4sAMcsvhlqL/oDE/UZhucu1+D113PcOvb2SofXFRPDjfP9bO08d6qgN31g4pietlJ1zIvS2+Ogd9sCeLeVtvOtnrbiF6n8G8pbs6FK6Nw0uXnD1dM74yOdYXS0q1FN8/Q8P/P6lzYeSXrBvA5jB4aPy+vwlieW3t21/ILH71ux9OX9H9v7yrF280eFTVpMz7dKyF9zC+Z5jMZ9niyAt1/pW9KIL10hhM2f/73PNIuX5v/Dzef/8eUcbzvrcsda3xzK5ubxkcGYeG0om5sDAADAgrEQ9ppuHX3oE83qK83/R9o7/h8P+eeT+Wy0B0MYn0nsXRLCaTOPZ4G7YnOXLQnhgzOpifrA2iRwMIT3ziSW16pKSiyKJUaSwE+G8sB4EjgUAxNJ4FsxcGsSuCEGDiSBjTFwMAmcGwNhqn4cvz+Uj6PtQF8MrM824oF4FsIvhmJrybZ6rlYVAADAcZLPDnvq7xbOdTjWDHF6eaCvVYZ4BnbDDJWkhnQGW5tWNayhu1UNna1qqI17d/Phl2ruaFVz6TSMjvoMt//ybz4bmijN/8eaz/8rc3Sko3T8P4R1M39j7s48Ml2Lr5+oywAAAAAcg4H/ffGbzeKl+f94e+f/x30iXYXM4bG4G2LLkhDG6gNZtX9YDmRHvQfyAAAAACwEtePxtWPhU/ltdop2Op8u5584wvzxwP/4nPl7Dz64vll/S/P/ifbO/++vv806cSj24mtLQlhUCPwg9rIamDESAz/+ZH0gH/+huAFuilXlJybUqropllgfA2NJYF+jEj+slTitPpA/WbXG99bGMZWXKAQAAADghIu7A+Jx+Xj+/4d+s/qaZuVK8//1R3b+/8w8uHR6//RACCu7Q+hKfxjwWH+2MGAMDHbkiYf6s7q60qqu7w/hnOrA0qpezNf/707XGHyqL6sqBk770P7Xz6gmvtkXwspi4OnP3XlWNbEzCdQa/8u+ED5QHW3a+HcWZY33pI1/fVEI7y8EalVdtiiEamO9aVWPVPLrGKRV/XMlhHcVArWqzq6EsCsAsEDF/0o3FR/csevaLRumpye3z2Mi7sPvC5unpidHN26d3lRp0KdNSZ/rljG6vjymdq9881y+RNFF964bbCdd+53gWLGtfD9+6cTB/H78LtQzM87VPXV316RD/siHy02EwjepRkPunOch9xcrmX0SS/XH/L1hICy6esfk9tEvbti5c/uq7G+72Vdnf+NhpmxbrUq3Vf9cfWvj5dFwtazE0W6rZcVKVu68ctvKHbuuXTF15YbLJy+fvGrV2avHzhxbM/bxM1dWRzWW/W0x1GVzVZ0M9a072xzXcRzq6d2FSk7Ep4aEhMRCS2wdWNb0/+TS/H9b8/l//NSJn/z5+gyNjv8Px8P82eOzh/nXx8C+do//Dzc6ml87MWAkCeyOgd0O8wMAAPDOECf5cW9m3Cv90+XfeblZudL8f3d7v/8/Tuv/15auP7/RMv/LY4mxRuv/p8v819b/391o/f90mf/a+v/73ob1/6+uBZJN8gvr/wMAAO8EJ279/5bL+6cXCChlaLm8f3qBgFKGlsv4t3uBgCNe///5//yr/w5NlOb/t7Y3/7dwPwAAAJw8vvxn1/xOs3hp/r+vvfn/iV//LzQ6/3+kUWCi0cKA1v8DAABggWq0/t/wjf2XNitXmv8faG/+H0+76KzLHWt9cyhb0y6ka9q9NlT7yQAAAAAsDJ1hdLSnzbx1K6OuPfo2n8mXAm2WLnrxTw4f2fn/B9ub/9f9LuOWJ5be3bX8gsffvG/F0pf3f2zvK7PH/wEAAID50+5+CQAAAAAAAAAAAAAA4O334n/sWdMsXvr9f1g383ij3//H6/7F3xe8uy53rLX1+n/5/Qs/fc+umSULHxsK4cPFwJY9W04J+bX5lxUDD1+y/D3VxJ60xIMvnPtSNXFpGvjUilPfqCbOSQLr4yKJ700D8aqKbyxOAnF5xX9PA3F7HEgDvXngq4uzcXSk2+qng9m26ki31bODISwpBGrb6v7BrI2OdIC3JYHaAL+QBuIA/zwPdKa9umcg61UMDMaidwxkvQIA4KQVvwX2hM1T05Nj8St8vD29u/42qluy7PpytR1tNv9cvjTZRfeuG2wn3ZV+F5291nhPqFSHsKr0dbWYpWNmlMenlhab7t0NhtxqtbfOBuVSR7rpehuPqC8b0ejGrdObeloOfE3rLKu7W2ZZVZrsFLN0zmzSNmppoy9tjKjNbdNGl+P9zjA62pXk+oMYHA51Wr0i2v29fnGdv0avgmKeqw7v/VWz+krz/+H25v+V4rjeyC8GsDteWe/vlljmHwAAAObXV9f++hvx32dvfPTpZnlL8/+R9ub/cQ9Wfig429txMF7/f++SEGYurT+cBe6KzV22JIQPzqQmYonsgvrnxxJjWeCuuMNkeSyxfqK+qkUxcCAJ/GQoDxxMAodiIN9LsT/ku3L+fiiEs2ZS6+pLbIslhpPAZ2JgJAmMxsBYElgcA+NJ4NXFeWAiCfxbDISp+m117+J8WwEAAByJfJ7VU383pPO8A92tMnS0ytDfKkNnqwyVVhkajSLe/3bM0JOcvNJRyNST1tqX1FLKEC+Gf8T9KmUIP6zPmRYsNR3PP6idb9BRn+GBT3RXQhOl+f9Ye/P//vrbrPVDcf4/e/2/LPCD2L2vxVPHR2Lgx5+sD+Q7Bg7Fye5Ntaom8hL5pP2mWGI8BkaSwLYYGE8C69flgX3vqQ/kM+1a43trjU/lJQoBAAAAOOHiDoK4mybO/+/Y8ZWBZuVK8//x9ub/sb2BYmM3xFoPLw7h/o7Z3tQCKwazQNyPMRh/Hv++wRBOKezgqJWY7M9K9CYNh+/3Zb9Q702r+l5f9uODeP/Cpx55+OZq4ra+EJYW9r7U2ni+krXRlwbO6M0C/Wlga3cWiHt+aoHvdmYBOGa1vYLxBZWf6lIzPHe5Bq+/d8o1QdPhlfaBzpFvrt9czZfSDtd8n2rNkT1tTfffctyU3h4HvdsW4rtt2Lut+EUq/4by1myoEjo3TW7ecPX0zvhI8ZesJfP0PBd/pdpO+ji8DncffW9bq6QdGEs+PsbmLjf367AjVnfLE0vv7lp+weP3rVj68v6P7X2l7W40EH8o/Mh1/zr4o8LmnW+VkL/mFtznyYTPk4X438CIpy2EsO7Vr9/ULF6a/0+0N//vTm5n/DpuzB1LQvhIYeM+Fjf/Hy/JPgcLgexT8l3lQHbI/b+GGn5yAgAAwPFW291R218wld9mJ4Sn8+Ry/okjzB/3V4zPmb/dfvf/9SVLm8VL8//1zef/i5JuOv7v+D/zxPH/OZ3su6IXpQ/sPqZd0aXqmBeO/8/pZH+3Of4/J8f/Hf+fi+P/LTj+P6eT/WkrfUva5ktXCOHlP3ro2Wbx0vx/W3vzf+v/zb1oX239v/WN1v/b1mj9v93W/wMAAOZVg4Xm0nleafW+UoZ09b5ShpYLBLZcYtD6f0e8/t9Lpz//m9BEaf6/u735f3w5DBRbXyjr/42sa1DVrTGwzcKAAAAAnIwa7SAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADg7fXAP/zPpmbxR3973rMvXDx+xZ61F7963XmnPhnC1MzjHVm4o//G28d/fve59+x5YPUd9x0+/6OVvFxPfvu7dbljrW8OhbCv8MhgTLw2VL0zG7jw0/fs6q4mHhsK4cPFwJY9W06pJr41FMKyYuDhS5a/p5rYk5Z48IVzX6omLk0Dn1px6hvVxDl5oCPt7j8uzrrbkXb35sUhLCkEat29YnF9VbU2/jQPdKZt/NNg1kYMDMai3xjM2oiB6VhialEIK7tD6EqrerSSVdWVVvUvlayqrrSqL1dCOCeE0J1W9UJvVlV3OvIne7OqYuC0D+1//YxqYl9vCCuLgac/d+dZ1cQXkkCt8b/oDeED1ZdM2vi3e7LGe9LGb+sJ4f0hhN60xC+7sxK9aYkXu0N4VyFQa/zz3SHsCrwjxA+fuk+0Hbuu3bJhenpy+zwmevO2+sLmqenJ0Y1bpzdVkj410lFIv3X90Y/9ude/tLF6e9G96wbbSXfn5Xpmury6p+7umpO997Ff/cVKZp+PUv0xf28YCIuu3jG5ffSLG3bu3L4q+9tu9tXZ3648mm2rVQtlWy0rVrJy55XbVu7Yde2KqSs3XD55+eRVq85ePXbm2Jqxj5+5sjqqsezv8RjqnSd+qKd3Fyo5ER8AEhISCy3RWffpNnayf5CXvujPdrQnVGY+oEvTimKWjplRHo9Brz3KER/N95SWI1pVmjiUsqyeI8v19VnWlCYTs7X0ZVlmvteVJofFxjpnNmm83xlGR7sabYfh+rvFzfuzY9i8z+Sbrt00AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP/HDhwIAAAAAAD5vzZCVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVFXbgQAAAAAAAyP+1EaqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqwA8cCAAAAAML8rcPo2QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgEsBAAD//+erI4o=")
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x20080, 0x51)
ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000080)={0x8})
fstat(r0, &(0x7f0000000100))

3.853149775s ago: executing program 0 (id=3146):
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000240)=@bpf_lsm={0xb, 0x3, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x99}}, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xe}, 0x94)

3.591330886s ago: executing program 0 (id=3153):
r0 = syz_usb_connect(0x2, 0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="120100006df57108e2042414ebc7010203010902380003960000000904cc070002596105052406000105240006000d240f01900800000000070008060600000011090401"], 0x0)
syz_usb_control_io$lan78xx(r0, &(0x7f00000001c0)={0x14, 0x0, &(0x7f00000002c0)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)

3.472628911s ago: executing program 38 (id=3153):
r0 = syz_usb_connect(0x2, 0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="120100006df57108e2042414ebc7010203010902380003960000000904cc070002596105052406000105240006000d240f01900800000000070008060600000011090401"], 0x0)
syz_usb_control_io$lan78xx(r0, &(0x7f00000001c0)={0x14, 0x0, &(0x7f00000002c0)={0x0, 0x3, 0x2, @string={0x2}}}, 0x0)
syz_usb_control_io$uac1(r0, 0x0, 0x0)

2.30425867s ago: executing program 8 (id=3162):
syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0)
r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00')
close(r0)

2.252339777s ago: executing program 8 (id=3163):
syz_usb_connect(0x0, 0x24, &(0x7f00000008c0)=ANY=[@ANYBLOB="12010000f26c44204f080100b8e0010203010902120001010000000904"], 0x0)

959.449613ms ago: executing program 8 (id=3166):
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
sendmmsg$inet6(r0, &(0x7f0000000900)=[{{&(0x7f0000000240)={0xa, 0x4e24, 0x9, @dev={0xfe, 0x80, '\x00', 0x14}, 0x6}, 0x1c, &(0x7f0000000680)=[{&(0x7f0000000280)='Q', 0x1}], 0x1}}, {{&(0x7f0000000040)={0xa, 0x4e23, 0xa2cc, @local, 0xf}, 0x1c, &(0x7f0000000880)=[{&(0x7f0000000080)='\\', 0x1}], 0x1}}], 0x2, 0x4000840)
shutdown(r0, 0x1)
getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000980)={0x0, 0x5}, &(0x7f00000009c0)=0x8)

886.086268ms ago: executing program 8 (id=3169):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x2, 0x4, 0x2, 0x1, 0xd4}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94)

811.766314ms ago: executing program 8 (id=3170):
r0 = socket$inet6(0xa, 0x5, 0x0)
listen(r0, 0x50)
listen(r0, 0x0)

741.64329ms ago: executing program 8 (id=3172):
r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r1 = getpid()
sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
ioctl$sock_FIOSETOWN(r0, 0x8901, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
setsockopt$inet_buf(r0, 0x0, 0x8008000000010, &(0x7f00000000c0)="170000000200010000ffbe8c5ee17688a2003c000301000a000002a257fc5ad90200bb6a880000d6c8db000000df018002000000fc0607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dfc060115003901000000000000ea000000000000000062068f5ee50ce5af9b1c568302ffff02ff030000ba000840024f0298e9e90539062a80e605007f71174aa951f3c63e5a1b47b63a6323ded2231454668492f9c681a6a9fc", 0xb8)
close(0x3)

626.705139ms ago: executing program 7 (id=3174):
bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x11, 0x4, 0x4, 0x8, 0x4}, 0x48)

626.520264ms ago: executing program 7 (id=3175):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@mpls_delroute={0x30, 0x18, 0x9, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}, [@RTA_VIA={0x4, 0x12, {0x0, "f1b9a81697008d68a0328c49d2ee"}}]}, 0x30}}, 0x0)

319.490628ms ago: executing program 7 (id=3176):
bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x12, 0x0, 0x0, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x4b, 0x0, 0x0, 0x48, '\x00', 0x0, @fallback=0xf}, 0x94)
r0 = syz_io_uring_setup(0x53f, &(0x7f0000000440)={0x0, 0xf05e, 0x400, 0xfffffff8, 0xfe}, &(0x7f0000000300)=<r1=>0x0, &(0x7f00000002c0)=<r2=>0x0)
syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5)
syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x50, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1})
io_uring_enter(r0, 0x47bc, 0x0, 0x0, 0x0, 0x0)

156.534374ms ago: executing program 7 (id=3177):
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xfeff, 0x3}, 0x6)

61.361224ms ago: executing program 7 (id=3178):
timer_create(0x2, 0x0, &(0x7f0000044000))
timer_create(0x3, 0x0, &(0x7f00000000c0)=<r0=>0x0)
timer_settime(r0, 0x0, &(0x7f0000000080)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0)
r1 = socket$inet_sctp(0x2, 0x1, 0x84)
getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000180), &(0x7f00000001c0)=0x4)
timer_settime(0x0, 0x1, &(0x7f0000000240)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0)
timer_settime(0x0, 0x1, &(0x7f0000000340)={{}, {0x0, 0x9}}, 0x0)

0s ago: executing program 7 (id=3179):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_DELFLOWTABLE={0x20, 0x18, 0xa, 0x801, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x48}}, 0x0)

kernel console output (not intermixed with test programs):

ith address 0xF3, changing to 0x83
[  218.245562][ T5884] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0
[  218.251898][ T5884] usb 4-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1
[  218.255730][ T5884] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  218.258866][ T5884] usb 4-1: Product: syz
[  218.260638][ T5884] usb 4-1: Manufacturer: syz
[  218.262598][ T5884] usb 4-1: SerialNumber: syz
[  218.270685][ T5884] usb 4-1: config 0 descriptor??
[  218.277729][ T5884] em28xx 4-1:0.0: error: skipping audio endpoint 0x83, because it uses bulk transfers !
[  218.483593][  T793] usb 4-1: USB disconnect, device number 11
[  218.725678][   T56] Bluetooth: hci1: unexpected cc 0x203e length: 2 > 1
[  218.729197][   T56] Bluetooth: hci1: unexpected event for opcode 0x203e
[  219.017330][T10899] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2058'.
[  219.087670][T10905] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2061'.
[  219.129303][T10909] netlink: 'syz.4.2063': attribute type 3 has an invalid length.
[  219.138892][T10909] netlink: 'syz.4.2063': attribute type 1 has an invalid length.
[  219.141808][T10909] netlink: 216 bytes leftover after parsing attributes in process `syz.4.2063'.
[  219.210894][T10917] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2067'.
[  219.254617][T10919] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2068'.
[  219.965880][T10944] netlink: 44 bytes leftover after parsing attributes in process `syz.0.2080'.
[  220.433879][ T5314] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[  220.560149][T10924] loop3: detected capacity change from 0 to 262144
[  220.596952][ T5314] usb 5-1: Using ep0 maxpacket: 8
[  220.611494][T10924] F2FS-fs (loop3): invalid crc value
[  220.617833][ T5314] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10a3, bcdDevice=23.a2
[  220.622273][ T5314] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  220.675316][T10924] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  220.679662][T10924] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5
[  220.687144][ T5314] usb 5-1: Product: syz
[  220.688839][ T5314] usb 5-1: Manufacturer: syz
[  220.690710][ T5314] usb 5-1: SerialNumber: syz
[  220.696507][ T5314] usb 5-1: config 0 descriptor??
[  220.911363][ T5314] usb 5-1: dvb_usb_v2: found a 'Terratec H7' in warm state
[  221.031567][T10975] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2094'.
[  221.136477][T10979] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2096'.
[  221.161669][   T56] Bluetooth: hci1: unexpected event for opcode 0x203d
[  221.316312][ T5314] usb write operation failed. (-71)
[  221.324224][ T5314] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer
[  221.331273][ T5314] dvbdev: DVB: registering new adapter (Terratec H7)
[  221.335605][ T5314] usb 5-1: media controller created
[  221.338468][ T5314] usb read operation failed. (-71)
[  221.341717][ T5314] usb write operation failed. (-71)
[  221.347316][ T5314] dvb_usb_az6007 5-1:0.0: probe with driver dvb_usb_az6007 failed with error -5
[  221.356465][ T5314] usb 5-1: USB disconnect, device number 2
[  221.807859][T10987] loop3: detected capacity change from 0 to 4096
[  221.819203][T10987] ntfs3(loop3): Different NTFS sector size (4096) and media sector size (512).
[  221.927877][T10987] ntfs3(loop3): Mark volume as dirty due to NTFS errors
[  221.934453][T10987] ntfs3(loop3): Failed to initialize $Extend/$Reparse.
[  221.963945][T10987] ntfs3(loop3): ino=1b, mi_enum_attr
[  222.392961][T11000] loop3: detected capacity change from 0 to 1024
[  222.396647][T11000] EXT4-fs: Ignoring removed bh option
[  222.413077][T11000] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-001000000000 r/w without journal. Quota mode: writeback.
[  222.434095][T11000] EXT4-fs: Ignoring removed orlov option
[  222.439263][T11000] EXT4-fs error (device loop3): __ext4_remount:6748: comm syz.3.2102: Abort forced by user
[  222.451226][T11000] EXT4-fs (loop3): Remounting filesystem read-only
[  222.458594][T11000] EXT4-fs (loop3): re-mounted 00000000-0000-0000-0000-001000000000.
[  222.492349][ T9637] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-001000000000.
[  222.580939][T10994] loop4: detected capacity change from 0 to 32768
[  222.588643][T10994] 
[  222.588643][T10994]  ... Log Wrap ... Log Wrap ... Log Wrap ...
[  222.588643][T10994] 
[  222.612189][T11007] loop3: detected capacity change from 0 to 512
[  222.627421][T11007] EXT4-fs (loop3): blocks per group (255) and clusters per group (8192) inconsistent
[  222.647970][T10650] 
[  222.647970][T10650]  ... Log Wrap ... Log Wrap ... Log Wrap ...
[  222.647970][T10650] 
[  222.664371][T10650] 
[  222.664371][T10650]  ... Log Wrap ... Log Wrap ... Log Wrap ...
[  222.664371][T10650] 
[  222.772983][   T10] IPVS: starting estimator thread 0...
[  222.825596][   T56] Bluetooth: hci2: Controller not accepting commands anymore: ncmd = 0
[  222.829320][   T56] Bluetooth: hci2: Injecting HCI hardware error event
[  222.834431][ T5851] Bluetooth: hci2: hardware error 0x00
[  222.842892][T11020] loop4: detected capacity change from 0 to 128
[  222.849879][T11020] UDF-fs: error (device loop4): udf_read_tagged: read failed, block=256, location=256
[  222.857719][T11020] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[  222.885226][T11014] IPVS: using max 75 ests per chain, 180000 per kthread
[  223.037359][T11032] overlayfs: failed to get inode (-116)
[  223.040309][T11032] overlayfs: failed to get inode (-116)
[  223.043959][T11032] overlayfs: failed to get inode (-116)
[  223.047629][T11032] overlayfs: failed to get inode (-116)
[  223.466711][T11042] loop4: detected capacity change from 0 to 32768
[  223.510602][T11042] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode.
[  223.570070][T10650] ocfs2: Unmounting device (7,4) on (node local)
[  223.729081][T11056] netlink: 'syz.3.2125': attribute type 27 has an invalid length.
[  223.730152][T11055] loop4: detected capacity change from 0 to 512
[  223.748685][T11055] EXT4-fs (loop4): bad geometry: first data block 1 is beyond end of filesystem (0)
[  223.844168][   T33] audit: type=1326 audit(1759351297.260:95): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11059 comm="syz.3.2127" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a2ab8ec29 code=0x7ffc0000
[  223.929780][   T33] audit: type=1326 audit(1759351297.260:96): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11059 comm="syz.3.2127" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a2ab8ec29 code=0x7ffc0000
[  223.939300][   T33] audit: type=1326 audit(1759351297.260:97): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11059 comm="syz.3.2127" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a2ab8ec29 code=0x7ffc0000
[  223.949067][   T33] audit: type=1326 audit(1759351297.270:98): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11059 comm="syz.3.2127" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a2ab8ec29 code=0x7ffc0000
[  223.959208][   T33] audit: type=1326 audit(1759351297.270:99): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11059 comm="syz.3.2127" exe="/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7f6a2ab8ec29 code=0x7ffc0000
[  223.959433][T11063] loop9: detected capacity change from 0 to 7
[  223.972804][   T33] audit: type=1326 audit(1759351297.280:100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11059 comm="syz.3.2127" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a2ab8ec29 code=0x7ffc0000
[  223.974647][ T6094] Buffer I/O error on dev loop9, logical block 0, async page read
[  223.981595][   T33] audit: type=1326 audit(1759351297.280:101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11059 comm="syz.3.2127" exe="/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f6a2ab8ec63 code=0x7ffc0000
[  223.981633][   T33] audit: type=1326 audit(1759351297.280:102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11059 comm="syz.3.2127" exe="/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f6a2ab8ec63 code=0x7ffc0000
[  223.981664][   T33] audit: type=1326 audit(1759351297.280:103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11059 comm="syz.3.2127" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a2ab8ec29 code=0x7ffc0000
[  224.003396][ T6094] Buffer I/O error on dev loop9, logical block 0, async page read
[  224.003488][ T6094] Buffer I/O error on dev loop9, logical block 0, async page read
[  224.003565][ T6094] Buffer I/O error on dev loop9, logical block 0, async page read
[  224.003660][ T6094] Buffer I/O error on dev loop9, logical block 0, async page read
[  224.027645][ T6094] Buffer I/O error on dev loop9, logical block 0, async page read
[  224.031072][ T6094] Buffer I/O error on dev loop9, logical block 0, async page read
[  224.034822][ T6094] ldm_validate_partition_table(): Disk read failed.
[  224.037794][ T6094] Buffer I/O error on dev loop9, logical block 0, async page read
[  224.041516][ T6094] Buffer I/O error on dev loop9, logical block 0, async page read
[  224.041899][   T33] audit: type=1326 audit(1759351297.280:104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11059 comm="syz.3.2127" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6a2ab8ec29 code=0x7ffc0000
[  224.045898][ T6094] Buffer I/O error on dev loop9, logical block 0, async page read
[  224.059181][ T6094] Dev loop9: unable to read RDB block 0
[  224.062297][ T6094]  loop9: unable to read partition table
[  224.065147][ T6094] loop9: partition table beyond EOD, truncated
[  224.069277][T11063] ldm_validate_partition_table(): Disk read failed.
[  224.072979][T11063] Dev loop9: unable to read RDB block 0
[  224.075601][T11063]  loop9: unable to read partition table
[  224.078516][T11063] loop9: partition table beyond EOD, truncated
[  224.090036][T11063] loop_reread_partitions: partition scan of loop9 (被xڬdGݡ
[  224.090036][T11063] ) failed (rc=-5)
[  224.647516][T11095] loop4: detected capacity change from 0 to 2048
[  224.669578][T11095] EXT4-fs (loop4): unsupported inode size: 0
[  224.672460][T11095] EXT4-fs (loop4): blocksize: 2048
[  224.701592][ T5314] usb 4-1: new high-speed USB device number 12 using dummy_hcd
[  224.882173][ T5314] usb 4-1: Using ep0 maxpacket: 8
[  224.886637][ T5314] usb 4-1: unable to get BOS descriptor or descriptor too short
[  224.890966][ T5314] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3
[  224.896506][ T5314] usb 4-1: config 1 has no interface number 1
[  224.899369][ T5314] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0
[  224.905112][ T5314] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 127, changing to 7
[  224.905206][ T5851] Bluetooth: hci2: Opcode 0x0c03 failed: -110
[  224.911900][ T5314] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  224.916300][ T5314] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  224.921041][ T5314] usb 4-1: Product: syz
[  224.924222][ T5314] usb 4-1: Manufacturer: syz
[  224.926255][ T5314] usb 4-1: SerialNumber: syz
[  225.057906][T11111] loop4: detected capacity change from 0 to 512
[  225.067633][T11111] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a846e02c, mo2=0002]
[  225.071093][T11111] System zones: 1-12
[  225.075678][T11111] EXT4-fs error (device loop4): dx_probe:791: inode #2: comm syz.4.2150: Directory hole found for htree index block 0
[  225.091563][T11111] EXT4-fs (loop4): Remounting filesystem read-only
[  225.095543][T11111] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -117
[  225.099241][T11111] EXT4-fs (loop4): Cannot turn on journaled quota: type 1: error -117
[  225.105748][T11111] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  225.135532][T10650] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  225.152619][ T5314] usb 4-1: 2:1 : no UAC_FORMAT_TYPE desc
[  225.186177][ T5314] usb 4-1: USB disconnect, device number 12
[  225.363287][T11125] sctp: [Deprecated]: syz.4.2156 (pid 11125) Use of int in max_burst socket option deprecated.
[  225.363287][T11125] Use struct sctp_assoc_value instead
[  225.415597][T11127] loop4: detected capacity change from 0 to 128
[  225.435761][T11127] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; going on - but anything won't be destroyed because it's read-only
[  225.444987][T11127] hpfs: filesystem error: improperly stopped
[  225.447557][T11127] hpfs: filesystem error: warning: spare dnodes used, try chkdsk
[  225.450856][T11127] hpfs: Proceeding, but your filesystem could be corrupted if you delete files or directories
[  225.455769][T11127] hpfs: You really don't want any checks? You are crazy...
[  225.459153][T11127] hpfs: hpfs_map_sector(): read error
[  225.461708][T11127] hpfs: code page support is disabled
[  225.465952][T11127] hpfs: hpfs_map_4sectors(): unaligned read
[  225.468541][T11127] hpfs: hpfs_map_4sectors(): unaligned read
[  225.471895][T11127] hpfs: filesystem error: unable to find root dir
[  225.882441][T11148] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2166'.
[  225.915047][T11148] vlan0: entered promiscuous mode
[  225.995651][T11151] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2161'.
[  225.999539][T11151] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2161'.
[  226.188124][T11150] xt_l2tp: wrong L2TP version: 1
[  226.434473][T11168] overlayfs: upper fs does not support RENAME_WHITEOUT.
[  226.443395][T11168] overlayfs: failed to set xattr on upper
[  226.445706][T11168] overlayfs: ...falling back to redirect_dir=nofollow.
[  226.460521][T11168] overlayfs: ...falling back to index=off.
[  226.462776][T11168] overlayfs: ...falling back to uuid=null.
[  226.465190][T11168] overlayfs: ...falling back to xino=off.
[  226.820565][ T5314] usb 4-1: new full-speed USB device number 13 using dummy_hcd
[  227.009237][ T5314] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  227.032026][ T5314] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3
[  227.111629][ T5314] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40
[  227.131150][ T5314] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  227.153452][ T5314] usb 4-1: Product: syz
[  227.180742][ T5314] usb 4-1: Manufacturer: syz
[  227.185118][ T5314] usb 4-1: SerialNumber: syz
[  227.602498][ T5314] usb 4-1: cannot find UAC_HEADER
[  227.606720][T11219] 9pnet_fd: p9_fd_create_tcp (11219): problem binding to privport
[  227.638784][ T5314] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -22
[  227.640866][T11221] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check.
[  227.692021][ T6094] udevd[6094]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  227.785035][T11232] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2193'.
[  227.829310][ T5987] usb 4-1: USB disconnect, device number 13
[  227.909533][T11240] XFS (nbd4): SB validate failed with error -5.
[  227.996161][T11253] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2201'.
[  228.065519][T11260] netlink: 830 bytes leftover after parsing attributes in process `syz.0.2203'.
[  228.080735][T11260] bond_slave_0: entered promiscuous mode
[  228.083457][T11260] bond_slave_1: entered promiscuous mode
[  228.372439][T11273] loop4: detected capacity change from 0 to 8192
[  228.396042][T11273] FAT-fs (loop4): error, fat_free_clusters: deleting FAT entry beyond EOF
[  228.402577][T11273] FAT-fs (loop4): Filesystem has been set read-only
[  229.816752][T11319] loop3: detected capacity change from 0 to 40427
[  229.837355][T11319] F2FS-fs (loop3): invalid crc value
[  229.903790][T11319] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 1
[  229.910792][T11319] F2FS-fs (loop3): Start checkpoint disabled!
[  229.921346][T11319] F2FS-fs (loop3): f2fs_disable_checkpoint() finish, err:0
[  229.932350][T11319] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e6
[  229.953606][   T33] kauditd_printk_skb: 8 callbacks suppressed
[  229.953619][   T33] audit: type=1804 audit(1759351303.383:113): pid=11319 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.2232" name="/newroot/178/file0/file0" dev="loop3" ino=10 res=1 errno=0
[  229.971179][ T1093] kworker/u9:7: attempt to access beyond end of device
[  229.971179][ T1093] loop3: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  229.977103][ T1093] CPU: 0 UID: 0 PID: 1093 Comm: kworker/u9:7 Not tainted syzkaller #0 PREEMPT(full) 
[  229.977120][ T1093] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  229.977128][ T1093] Workqueue: writeback wb_workfn (flush-7:3)
[  229.977154][ T1093] Call Trace:
[  229.977159][ T1093]  <TASK>
[  229.977166][ T1093]  dump_stack_lvl+0x189/0x250
[  229.977184][ T1093]  ? __pfx_dump_stack_lvl+0x10/0x10
[  229.977196][ T1093]  ? __pfx_queue_work_on+0x10/0x10
[  229.977209][ T1093]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  229.977223][ T1093]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  229.977243][ T1093]  f2fs_handle_critical_error+0x37c/0x540
[  229.977262][ T1093]  f2fs_write_end_io+0x886/0xb60
[  229.977291][ T1093]  __submit_merged_bio+0x27a/0x6a0
[  229.977310][ T1093]  __submit_merged_write_cond+0x255/0x530
[  229.977335][ T1093]  f2fs_write_data_pages+0x261d/0x3000
[  229.977375][ T1093]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  229.977407][ T1093]  ? __pfx_f2fs_available_free_memory+0x10/0x10
[  229.977451][ T1093]  ? __pfx_f2fs_balance_fs_bg+0x10/0x10
[  229.977463][ T1093]  ? look_up_lock_class+0x74/0x170
[  229.977485][ T1093]  ? trace_f2fs_writepages+0x7f/0x200
[  229.977499][ T1093]  ? f2fs_write_node_pages+0x478/0x6e0
[  229.977514][ T1093]  ? __pfx_f2fs_write_node_pages+0x10/0x10
[  229.977531][ T1093]  ? __lock_acquire+0xab9/0xd20
[  229.977554][ T1093]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  229.977568][ T1093]  do_writepages+0x32e/0x550
[  229.977587][ T1093]  ? reacquire_held_locks+0x127/0x1d0
[  229.977599][ T1093]  ? writeback_sb_inodes+0x384/0x1010
[  229.977620][ T1093]  __writeback_single_inode+0x145/0xff0
[  229.977634][ T1093]  ? do_raw_spin_unlock+0x4d/0x240
[  229.977652][ T1093]  writeback_sb_inodes+0x6c7/0x1010
[  229.977689][ T1093]  ? __pfx_writeback_sb_inodes+0x10/0x10
[  229.977739][ T1093]  ? rcu_is_watching+0x15/0xb0
[  229.977760][ T1093]  wb_writeback+0x43b/0xaf0
[  229.977781][ T1093]  ? queue_io+0x331/0x590
[  229.977799][ T1093]  ? __pfx_wb_writeback+0x10/0x10
[  229.977820][ T1093]  ? _raw_spin_unlock_irq+0x23/0x50
[  229.977838][ T1093]  wb_workfn+0x409/0xef0
[  229.977870][ T1093]  ? __pfx_wb_workfn+0x10/0x10
[  229.977918][ T1093]  ? __lock_acquire+0xab9/0xd20
[  229.977945][ T1093]  ? process_scheduled_works+0x9ef/0x17b0
[  229.977970][ T1093]  ? _raw_spin_unlock_irq+0x23/0x50
[  229.977982][ T1093]  ? process_scheduled_works+0x9ef/0x17b0
[  229.977999][ T1093]  ? process_scheduled_works+0x9ef/0x17b0
[  229.978018][ T1093]  process_scheduled_works+0xae1/0x17b0
[  229.978062][ T1093]  ? __pfx_process_scheduled_works+0x10/0x10
[  229.978096][ T1093]  worker_thread+0x8a0/0xda0
[  229.978139][ T1093]  kthread+0x711/0x8a0
[  229.978157][ T1093]  ? __pfx_worker_thread+0x10/0x10
[  229.978175][ T1093]  ? __pfx_kthread+0x10/0x10
[  229.978191][ T1093]  ? _raw_spin_unlock_irq+0x23/0x50
[  229.978205][ T1093]  ? lockdep_hardirqs_on+0x9c/0x150
[  229.978218][ T1093]  ? __pfx_kthread+0x10/0x10
[  229.978232][ T1093]  ret_from_fork+0x4bc/0x870
[  229.978253][ T1093]  ? __pfx_ret_from_fork+0x10/0x10
[  229.978277][ T1093]  ? __switch_to_asm+0x39/0x70
[  229.978291][ T1093]  ? __switch_to_asm+0x33/0x70
[  229.978303][ T1093]  ? __pfx_kthread+0x10/0x10
[  229.978319][ T1093]  ret_from_fork_asm+0x1a/0x30
[  229.978350][ T1093]  </TASK>
[  229.978356][ T1093] F2FS-fs (loop3): Stopped filesystem due to reason: 3
[  230.639810][T11337] loop3: detected capacity change from 0 to 32768
[  230.650580][T11337] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop3 (7:3) scanned by syz.3.2239 (11337)
[  230.666924][T11337] BTRFS info (device loop3): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  230.672517][T11337] BTRFS info (device loop3): using crc32c (crc32c-lib) checksum algorithm
[  230.800653][T11337] BTRFS info (device loop3): enabling ssd optimizations
[  230.804101][T11337] BTRFS info (device loop3): disabling tree log
[  230.806478][T11337] BTRFS info (device loop3): turning on sync discard
[  230.821748][T11337] BTRFS info (device loop3): enabling free space tree
[  230.824497][T11337] BTRFS info (device loop3): force zstd compression, level 3
[  230.876321][   T33] audit: type=1800 audit(1759351304.303:114): pid=11337 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.2239" name="bus" dev="loop3" ino=263 res=0 errno=0
[  230.971983][ T9637] BTRFS info (device loop3): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  231.007257][T11361] sock: sock_set_timeout: `syz.4.2243' (pid 11361) tries to set negative timeout
[  231.496103][T11366] netlink: 'syz.3.2242': attribute type 11 has an invalid length.
[  231.728254][   T10] usb 5-1: new low-speed USB device number 3 using dummy_hcd
[  231.806995][T11381] netlink: 288 bytes leftover after parsing attributes in process `syz.3.2251'.
[  231.844767][T11386] loop3: detected capacity change from 0 to 256
[  231.889919][   T10] usb 5-1: config index 0 descriptor too short (expected 1307, got 27)
[  231.892719][   T10] usb 5-1: config 0 has an invalid interface number: 0 but max is -1
[  231.897191][   T10] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 0
[  231.900918][   T10] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 246, using maximum allowed: 30
[  231.906491][   T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 10
[  231.912455][   T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid maxpacket 39, setting to 8
[  231.916912][   T10] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 246
[  231.930626][   T10] usb 5-1: string descriptor 0 read error: -22
[  231.933016][   T10] usb 5-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de
[  231.938711][   T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  231.952758][   T10] usb 5-1: config 0 descriptor??
[  231.955092][T11364] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22
[  231.958556][   T10] hub 5-1:0.0: bad descriptor, ignoring hub
[  231.962188][   T10] hub 5-1:0.0: probe with driver hub failed with error -5
[  231.969848][   T10] input: USB Acecad 302 Tablet 0460:0008 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/input/input11
[  232.181134][   T10] usb 5-1: USB disconnect, device number 3
[  232.846892][T11417] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check.
[  233.050469][T11435] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2277'.
[  233.402429][T11472] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2294'.
[  233.543371][T11486] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2301'.
[  233.848059][   T10] usb 5-1: new high-speed USB device number 4 using dummy_hcd
[  234.012178][   T10] usb 5-1: config 2 has an invalid interface number: 174 but max is 0
[  234.015191][   T10] usb 5-1: config 2 has no interface number 0
[  234.017202][   T10] usb 5-1: config 2 interface 174 altsetting 0 has an endpoint descriptor with address 0x9E, changing to 0x8E
[  234.021726][T11505] loop3: detected capacity change from 0 to 8
[  234.033787][   T10] usb 5-1: config 2 interface 174 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 1023
[  234.041085][   T10] usb 5-1: config 2 interface 174 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 255
[  234.051137][   T10] usb 5-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice=22.7e
[  234.055484][   T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  234.069905][   T10] usb 5-1: Product: syz
[  234.071790][   T10] usb 5-1: Manufacturer: syz
[  234.073733][   T10] usb 5-1: SerialNumber: syz
[  234.084838][T11490] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22
[  234.089657][T11490] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22
[  234.319455][   T10] usb 5-1: probing VID:PID(0424:012C)   
[  234.326137][   T10] usb 5-1: vub300 testing BULK IN EndPoint(0) 8E
[  234.334960][   T10] usb 5-1: vub300 testing BULK IN EndPoint(1) 82
[  234.342763][   T10] usb 5-1: Could not find two sets of bulk-in/out endpoint pairs
[  234.350052][   T10] vub300 5-1:2.174: probe with driver vub300 failed with error -22
[  234.366592][   T10] usb 5-1: USB disconnect, device number 4
[  234.421413][T11511] Invalid logical block size (2310)
[  234.711500][T11518] overlayfs: failed to clone upperpath
[  235.608071][   T33] audit: type=1804 audit(1759351308.845:115): pid=11532 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.3.2321" name="file0" dev="ramfs" ino=23547 res=1 errno=0
[  236.033635][T11538] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2324'.
[  236.580910][ T5744] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  236.688927][ T5744] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  236.757144][ T5744] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  236.849891][ T5744] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  237.205974][   T56] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  237.213312][   T56] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  237.218226][   T56] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  237.221969][   T56] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  237.225081][   T56] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  237.284501][ T5744] bridge_slave_1: left allmulticast mode
[  237.286569][ T5744] bridge_slave_1: left promiscuous mode
[  237.288488][ T5744] bridge0: port 2(bridge_slave_1) entered disabled state
[  237.307210][ T5744] bridge_slave_0: left allmulticast mode
[  237.309615][ T5744] bridge_slave_0: left promiscuous mode
[  237.312140][ T5744] bridge0: port 1(bridge_slave_0) entered disabled state
[  237.683836][ T5744] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  237.688208][ T5744] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  237.692556][ T5744] bond0 (unregistering): Released all slaves
[  237.895792][T11560] chnl_net:caif_netlink_parms(): no params data found
[  238.041676][T11603] Invalid option length (1032005) for dns_resolver key
[  238.286040][T11560] bridge0: port 1(bridge_slave_0) entered blocking state
[  238.299437][T11560] bridge0: port 1(bridge_slave_0) entered disabled state
[  238.303050][T11560] bridge_slave_0: entered allmulticast mode
[  238.307865][T11560] bridge_slave_0: entered promiscuous mode
[  238.320708][ T5744] hsr_slave_0: left promiscuous mode
[  238.323656][ T5744] hsr_slave_1: left promiscuous mode
[  238.326411][ T5744] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  238.329191][ T5744] batman_adv: batadv0: Removing interface: batadv_slave_0
[  238.333990][ T5744] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  238.336626][ T5744] batman_adv: batadv0: Removing interface: batadv_slave_1
[  238.346614][ T5744] veth1_macvtap: left promiscuous mode
[  238.348496][ T5744] veth0_macvtap: left promiscuous mode
[  238.350501][ T5744] veth1_vlan: left promiscuous mode
[  238.353413][ T5744] veth0_vlan: left promiscuous mode
[  238.683093][ T5744] team0 (unregistering): Port device team_slave_1 removed
[  238.727784][ T5744] team0 (unregistering): Port device team_slave_0 removed
[  239.108586][T11560] bridge0: port 2(bridge_slave_1) entered blocking state
[  239.111722][T11560] bridge0: port 2(bridge_slave_1) entered disabled state
[  239.114704][T11560] bridge_slave_1: entered allmulticast mode
[  239.118412][T11560] bridge_slave_1: entered promiscuous mode
[  239.189576][T11560] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  239.189950][T11621] loop3: detected capacity change from 0 to 1024
[  239.201641][T11560] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  239.219966][T11621] EXT4-fs (loop3): ext4_check_descriptors: Inode bitmap for group 0 overlaps superblock
[  239.228135][T11621] EXT4-fs (loop3): ext4_check_descriptors: Checksum for group 0 failed (53445!=20869)
[  239.242549][T11621] EXT4-fs (loop3): stripe (2) is not aligned with cluster size (16), stripe is disabled
[  239.249545][T11621] EXT4-fs error (device loop3): ext4_get_journal_inode:5808: inode #32: comm syz.3.2352: iget: special inode unallocated
[  239.261315][T11621] EXT4-fs (loop3): no journal found
[  239.268495][T11621] EXT4-fs (loop3): can't get journal size
[  239.281404][T11560] team0: Port device team_slave_0 added
[  239.282354][T11621] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000007 ro without journal. Quota mode: writeback.
[  239.286718][T11560] team0: Port device team_slave_1 added
[  239.343179][ T9637] EXT4-fs error (device loop3): __ext4_iget:5435: inode #15: block 1803188595: comm syz-executor: invalid block
[  239.355421][ T9637] EXT4-fs error (device loop3): __ext4_iget:5435: inode #15: block 1803188595: comm syz-executor: invalid block
[  239.415647][T11560] batman_adv: batadv0: Adding interface: batadv_slave_0
[  239.418695][T11560] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  239.431037][T11008] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000007.
[  239.452780][T11560] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  239.469949][   T56] Bluetooth: hci2: command tx timeout
[  239.470371][T11560] batman_adv: batadv0: Adding interface: batadv_slave_1
[  239.474871][T11560] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  239.491665][T11560] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  239.600826][T11560] hsr_slave_0: entered promiscuous mode
[  239.603343][T11560] hsr_slave_1: entered promiscuous mode
[  239.605620][T11560] debugfs: 'hsr0' already exists in 'hsr'
[  239.607460][T11560] Cannot create hsr debugfs directory
[  240.060226][T11560] netdevsim netdevsim5 netdevsim0: renamed from eth0
[  240.070795][T11560] netdevsim netdevsim5 netdevsim1: renamed from eth1
[  240.081282][T11560] netdevsim netdevsim5 netdevsim2: renamed from eth2
[  240.094462][T11560] netdevsim netdevsim5 netdevsim3: renamed from eth3
[  240.200138][T11560] 8021q: adding VLAN 0 to HW filter on device bond0
[  240.231506][T11560] 8021q: adding VLAN 0 to HW filter on device team0
[  240.238645][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[  240.241165][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[  240.252532][ T5851] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  240.257476][ T5851] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  240.263359][   T27] bridge0: port 2(bridge_slave_1) entered blocking state
[  240.263380][ T5851] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  240.266376][   T27] bridge0: port 2(bridge_slave_1) entered forwarding state
[  240.276019][ T5851] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  240.279381][ T5851] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  240.457350][T11653] chnl_net:caif_netlink_parms(): no params data found
[  240.509482][T11653] bridge0: port 1(bridge_slave_0) entered blocking state
[  240.512236][T11653] bridge0: port 1(bridge_slave_0) entered disabled state
[  240.515241][T11653] bridge_slave_0: entered allmulticast mode
[  240.519027][T11653] bridge_slave_0: entered promiscuous mode
[  240.524349][T11653] bridge0: port 2(bridge_slave_1) entered blocking state
[  240.527241][T11653] bridge0: port 2(bridge_slave_1) entered disabled state
[  240.531334][T11653] bridge_slave_1: entered allmulticast mode
[  240.535019][T11653] bridge_slave_1: entered promiscuous mode
[  240.590125][T11560] 8021q: adding VLAN 0 to HW filter on device batadv0
[  240.599302][T11653] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  240.609555][T11653] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  240.670428][T11653] team0: Port device team_slave_0 added
[  240.675141][T11653] team0: Port device team_slave_1 added
[  240.779817][T11653] batman_adv: batadv0: Adding interface: batadv_slave_0
[  240.782666][T11653] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  240.794489][T11653] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  240.805629][T11653] batman_adv: batadv0: Adding interface: batadv_slave_1
[  240.809069][T11653] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  240.820311][T11653] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  240.890135][T11653] hsr_slave_0: entered promiscuous mode
[  240.893513][T11653] hsr_slave_1: entered promiscuous mode
[  240.896592][T11653] debugfs: 'hsr0' already exists in 'hsr'
[  240.899958][T11653] Cannot create hsr debugfs directory
[  240.968414][T11560] veth0_vlan: entered promiscuous mode
[  240.980348][T11560] veth1_vlan: entered promiscuous mode
[  240.994606][T11688] delete_channel: no stack
[  241.059089][T11560] veth0_macvtap: entered promiscuous mode
[  241.066517][T11560] veth1_macvtap: entered promiscuous mode
[  241.109289][T11560] batman_adv: batadv0: Interface activated: batadv_slave_0
[  241.118772][T11560] batman_adv: batadv0: Interface activated: batadv_slave_1
[  241.127948][ T5877] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  241.131207][ T5877] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  241.134128][ T5877] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  241.139195][ T5877] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  241.273976][T11653] netdevsim netdevsim6 netdevsim0: renamed from eth0
[  241.280976][T11653] netdevsim netdevsim6 netdevsim1: renamed from eth1
[  241.292470][T11653] netdevsim netdevsim6 netdevsim2: renamed from eth2
[  241.301430][T11653] netdevsim netdevsim6 netdevsim3: renamed from eth3
[  241.304523][   T54] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  241.313387][   T54] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  241.366785][   T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  241.370980][   T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  241.447334][T11653] 8021q: adding VLAN 0 to HW filter on device bond0
[  241.475291][T11653] 8021q: adding VLAN 0 to HW filter on device team0
[  241.485397][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[  241.487886][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[  241.501807][   T27] bridge0: port 2(bridge_slave_1) entered blocking state
[  241.504152][   T27] bridge0: port 2(bridge_slave_1) entered forwarding state
[  241.652295][T11653] 8021q: adding VLAN 0 to HW filter on device batadv0
[  241.720369][   T56] Bluetooth: hci2: command tx timeout
[  241.759343][T11733] loop5: detected capacity change from 0 to 32768
[  241.774735][T11733] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop5 (7:5) scanned by syz.5.2381 (11733)
[  241.790150][T11733] BTRFS info (device loop5): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  241.799076][T11653] veth0_vlan: entered promiscuous mode
[  241.799762][T11733] BTRFS info (device loop5): using sha256 (sha256-lib) checksum algorithm
[  241.808876][T11653] veth1_vlan: entered promiscuous mode
[  241.853338][T11653] veth0_macvtap: entered promiscuous mode
[  241.854796][T11733] BTRFS info (device loop5): rebuilding free space tree
[  241.858368][T11653] veth1_macvtap: entered promiscuous mode
[  241.874567][T11653] batman_adv: batadv0: Interface activated: batadv_slave_0
[  241.878830][T11733] BTRFS info (device loop5): enabling ssd optimizations
[  241.883261][T11653] batman_adv: batadv0: Interface activated: batadv_slave_1
[  241.883288][T11733] BTRFS info (device loop5): enabling free space tree
[  241.889911][   T13] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  241.895271][   T13] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  241.899001][   T13] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  241.902446][   T13] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  241.906135][T11733] BTRFS info (device loop5): force clearing of disk cache
[  241.909415][T11733] BTRFS info (device loop5): enabling auto defrag
[  241.914171][T11733] BTRFS info (device loop5): force zlib compression, level 3
[  241.932492][T11733] BTRFS info (device loop5): max_inline set to 0
[  242.010491][T11560] BTRFS info (device loop5): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  242.037532][   T27] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  242.043771][   T27] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  242.105328][   T27] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  242.108313][   T27] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  242.500218][   T56] Bluetooth: hci0: command tx timeout
[  242.580010][T11782] Bluetooth: MGMT ver 1.23
[  242.581620][T11782] Bluetooth: hci0: expected 2 bytes, got 7 bytes
[  242.795176][T11792] netlink: 16 bytes leftover after parsing attributes in process `syz.0.2395'.
[  242.798565][T11792] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2395'.
[  242.802144][T11792] netlink: 288 bytes leftover after parsing attributes in process `syz.0.2395'.
[  242.825729][T11792] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2395'.
[  243.022809][T11811] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2405'.
[  243.087554][T11819] loop6: detected capacity change from 0 to 128
[  243.135441][T11821] loop5: detected capacity change from 0 to 512
[  243.422535][ T5898] usb 6-1: new high-speed USB device number 2 using dummy_hcd
[  243.584735][ T5898] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0
[  243.588898][ T5898] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xA has an invalid bInterval 218, changing to 7
[  243.593712][ T5898] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid maxpacket 32945, setting to 1024
[  243.601217][ T5898] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b
[  243.607164][ T5898] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  243.610399][ T5898] usb 6-1: Product: syz
[  243.612265][ T5898] usb 6-1: Manufacturer: syz
[  243.614186][ T5898] usb 6-1: SerialNumber: syz
[  243.623635][ T5898] usb 6-1: config 0 descriptor??
[  243.641109][ T5898] usb 6-1: 0:0 : invalid sync pipe. bmAttributes e5, bLength 9, bSynchAddress 2f
[  243.880366][ T5898] usb 6-1: USB disconnect, device number 2
[  243.927313][ T5858] udevd[5858]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  243.974041][   T56] Bluetooth: hci2: command tx timeout
[  244.750699][T11841] loop5: detected capacity change from 0 to 32768
[  244.910457][T11845] /dev/nullb0: Can't open blockdev
[  244.980505][T11847] loop5: detected capacity change from 0 to 512
[  244.987834][T11847] ext4: Unknown parameter 'nouser_xattr'
[  245.102735][T11849] loop5: detected capacity change from 0 to 512
[  245.164272][T11849] EXT4-fs (loop5): 1 orphan inode deleted
[  245.167983][T11849] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  245.172930][T11849] ext4 filesystem being mounted at /21/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  245.187927][T11849] __find_get_block_slow() failed. block=144115188075855872, b_blocknr=0, b_state=0x0000601b, b_size=4096, device loop5 blocksize: 4096
[  245.193834][T11849] grow_buffers: requested out-of-range block 144115188075855872 for device loop5
[  245.208392][T11849] EXT4-fs warning (device loop5): ext4_resize_fs:2019: can't read last block, resize aborted
[  245.243364][T11560] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  245.644786][   T13] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  245.715848][ T5314] usb 6-1: new high-speed USB device number 3 using dummy_hcd
[  245.854672][ T5851] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[  245.858910][ T5851] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[  245.864195][ T5851] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[  245.869868][ T5851] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[  245.873084][ T5851] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[  245.895850][ T5314] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  245.903489][ T5314] usb 6-1: New USB device found, idVendor=258a, idProduct=6a88, bcdDevice= 0.00
[  245.907108][ T5314] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  245.919952][ T5314] usb 6-1: config 0 descriptor??
[  246.028293][T11873] chnl_net:caif_netlink_parms(): no params data found
[  246.114523][T11873] bridge0: port 1(bridge_slave_0) entered blocking state
[  246.118684][T11873] bridge0: port 1(bridge_slave_0) entered disabled state
[  246.121828][T11873] bridge_slave_0: entered allmulticast mode
[  246.128187][T11873] bridge_slave_0: entered promiscuous mode
[  246.134431][T11873] bridge0: port 2(bridge_slave_1) entered blocking state
[  246.137764][T11873] bridge0: port 2(bridge_slave_1) entered disabled state
[  246.150210][T11873] bridge_slave_1: entered allmulticast mode
[  246.155006][T11873] bridge_slave_1: entered promiscuous mode
[  246.210341][T11873] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  246.219688][T11873] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  246.235755][ T5851] Bluetooth: hci2: command tx timeout
[  246.274474][T11873] team0: Port device team_slave_0 added
[  246.282923][T11873] team0: Port device team_slave_1 added
[  246.339036][T11873] batman_adv: batadv0: Adding interface: batadv_slave_0
[  246.342059][T11873] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  246.353413][T11873] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  246.360691][T11873] batman_adv: batadv0: Adding interface: batadv_slave_1
[  246.363635][T11873] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  246.374312][T11873] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  246.379853][ T5314] hid (null): global environment stack underflow
[  246.387914][ T5314] itetech 0003:258A:6A88.0010: global environment stack underflow
[  246.391085][ T5314] itetech 0003:258A:6A88.0010: item 0 4 1 11 parsing failed
[  246.394549][ T5314] itetech 0003:258A:6A88.0010: probe with driver itetech failed with error -22
[  246.455796][T11873] hsr_slave_0: entered promiscuous mode
[  246.459067][T11873] hsr_slave_1: entered promiscuous mode
[  246.462057][T11873] debugfs: 'hsr0' already exists in 'hsr'
[  246.465198][T11873] Cannot create hsr debugfs directory
[  246.600795][ T5899] usb 6-1: USB disconnect, device number 3
[  247.129235][   T13] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  247.211707][T11873] netdevsim netdevsim7 netdevsim0: renamed from eth0
[  247.216577][T11873] netdevsim netdevsim7 netdevsim1: renamed from eth1
[  247.228639][T11873] netdevsim netdevsim7 netdevsim2: renamed from eth2
[  247.249326][T11873] netdevsim netdevsim7 netdevsim3: renamed from eth3
[  247.363620][   T13] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  247.728488][   T13] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  247.800579][T11909] loop5: detected capacity change from 0 to 32768
[  247.809020][T11873] 8021q: adding VLAN 0 to HW filter on device bond0
[  247.824403][T11909] XFS (loop5): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  247.846554][T11873] 8021q: adding VLAN 0 to HW filter on device team0
[  247.854710][T11909] XFS (loop5): Ending clean mount
[  247.874803][   T27] bridge0: port 1(bridge_slave_0) entered blocking state
[  247.877145][   T27] bridge0: port 1(bridge_slave_0) entered forwarding state
[  247.893430][   T27] bridge0: port 2(bridge_slave_1) entered blocking state
[  247.895840][   T27] bridge0: port 2(bridge_slave_1) entered forwarding state
[  247.926182][   T13] bridge_slave_1: left allmulticast mode
[  247.928070][   T13] bridge_slave_1: left promiscuous mode
[  247.930006][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[  247.943079][   T13] bridge_slave_0: left allmulticast mode
[  247.946246][   T13] bridge_slave_0: left promiscuous mode
[  247.948953][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[  247.950872][T11560] XFS (loop5): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  248.135749][ T5851] Bluetooth: hci0: command tx timeout
[  248.155421][T11928] loop5: detected capacity change from 0 to 164
[  248.160268][T11928] ISOFS: primary root directory is empty. Disabling Rock Ridge and switching to Joliet.
[  248.280271][T11932] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2452'.
[  248.284922][T11932] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2452'.
[  248.386045][   T33] audit: type=1326 audit(1759351320.647:116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11939 comm="syz.0.2456" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f0e98ec29 code=0x7ffc0000
[  248.411216][   T33] audit: type=1326 audit(1759351320.647:117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11939 comm="syz.0.2456" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f0e98ec29 code=0x7ffc0000
[  248.434356][   T33] audit: type=1326 audit(1759351320.647:118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11939 comm="syz.0.2456" exe="/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f7f0e98ec29 code=0x7ffc0000
[  248.453668][   T33] audit: type=1326 audit(1759351320.647:119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11939 comm="syz.0.2456" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f0e98ec29 code=0x7ffc0000
[  248.471435][   T33] audit: type=1326 audit(1759351320.647:120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11939 comm="syz.0.2456" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f0e98ec29 code=0x7ffc0000
[  248.491853][   T33] audit: type=1326 audit(1759351320.647:121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11939 comm="syz.0.2456" exe="/syz-executor" sig=0 arch=c000003e syscall=186 compat=0 ip=0x7f7f0e98ec29 code=0x7ffc0000
[  248.500542][   T33] audit: type=1326 audit(1759351320.647:122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11939 comm="syz.0.2456" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f0e98ec29 code=0x7ffc0000
[  248.508874][   T33] audit: type=1326 audit(1759351320.647:123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11939 comm="syz.0.2456" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f0e98ec29 code=0x7ffc0000
[  248.531692][   T33] audit: type=1326 audit(1759351320.647:124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11939 comm="syz.0.2456" exe="/syz-executor" sig=0 arch=c000003e syscall=222 compat=0 ip=0x7f7f0e98ec29 code=0x7ffc0000
[  248.551093][   T33] audit: type=1326 audit(1759351320.647:125): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11939 comm="syz.0.2456" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f7f0e98ec29 code=0x7ffc0000
[  248.699932][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  248.711247][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  248.718181][   T13] bond0 (unregistering): Released all slaves
[  248.723512][ T5851] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201'
[  248.727086][ T5851] CPU: 0 UID: 0 PID: 5851 Comm: kworker/u11:4 Not tainted syzkaller #0 PREEMPT(full) 
[  248.727097][ T5851] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  248.727102][ T5851] Workqueue: hci2 hci_rx_work
[  248.727131][ T5851] Call Trace:
[  248.727135][ T5851]  <TASK>
[  248.727139][ T5851]  dump_stack_lvl+0x189/0x250
[  248.727151][ T5851]  ? __pfx_dump_stack_lvl+0x10/0x10
[  248.727161][ T5851]  ? __pfx__printk+0x10/0x10
[  248.727174][ T5851]  ? kernfs_path_from_node+0x250/0x290
[  248.727182][ T5851]  ? kernfs_path_from_node+0x2f/0x290
[  248.727191][ T5851]  sysfs_create_dir_ns+0x259/0x280
[  248.727205][ T5851]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  248.727221][ T5851]  kobject_add_internal+0x59f/0xb40
[  248.727236][ T5851]  kobject_add+0x155/0x220
[  248.727248][ T5851]  ? __pfx_kobject_add+0x10/0x10
[  248.727257][ T5851]  ? _raw_spin_unlock+0x28/0x50
[  248.727268][ T5851]  ? get_device_parent+0x366/0x3a0
[  248.727281][ T5851]  device_add+0x408/0xb50
[  248.727295][ T5851]  hci_conn_add_sysfs+0xd5/0x1e0
[  248.727310][ T5851]  le_conn_complete_evt+0xf39/0x1500
[  248.727327][ T5851]  ? __pfx_le_conn_complete_evt+0x10/0x10
[  248.727338][ T5851]  ? __mutex_unlock_slowpath+0x1a1/0x740
[  248.727348][ T5851]  ? __asan_memcpy+0x40/0x70
[  248.727358][ T5851]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[  248.727368][ T5851]  ? skb_pull_data+0xfb/0x200
[  248.727381][ T5851]  hci_le_conn_complete_evt+0x187/0x450
[  248.727394][ T5851]  hci_event_packet+0x78f/0x1200
[  248.727404][ T5851]  ? __pfx_hci_le_meta_evt+0x10/0x10
[  248.727414][ T5851]  ? __pfx_hci_event_packet+0x10/0x10
[  248.727422][ T5851]  ? kcov_remote_start+0x4d3/0x7f0
[  248.727432][ T5851]  ? local_clock_noinstr+0xe0/0xe0
[  248.727442][ T5851]  ? hci_send_to_monitor+0xe2/0x570
[  248.727454][ T5851]  hci_rx_work+0x46a/0xe80
[  248.727467][ T5851]  ? process_scheduled_works+0x9ef/0x17b0
[  248.727479][ T5851]  process_scheduled_works+0xae1/0x17b0
[  248.727501][ T5851]  ? __pfx_process_scheduled_works+0x10/0x10
[  248.727519][ T5851]  worker_thread+0x8a0/0xda0
[  248.727532][ T5851]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  248.727543][ T5851]  ? __kthread_parkme+0x7b/0x200
[  248.727554][ T5851]  kthread+0x711/0x8a0
[  248.727564][ T5851]  ? __pfx_worker_thread+0x10/0x10
[  248.727679][ T5851]  ? __pfx_kthread+0x10/0x10
[  248.727689][ T5851]  ? _raw_spin_unlock_irq+0x23/0x50
[  248.727697][ T5851]  ? lockdep_hardirqs_on+0x9c/0x150
[  248.727705][ T5851]  ? __pfx_kthread+0x10/0x10
[  248.727714][ T5851]  ret_from_fork+0x4bc/0x870
[  248.727728][ T5851]  ? __pfx_ret_from_fork+0x10/0x10
[  248.727741][ T5851]  ? __switch_to_asm+0x39/0x70
[  248.727751][ T5851]  ? __switch_to_asm+0x33/0x70
[  248.727760][ T5851]  ? __pfx_kthread+0x10/0x10
[  248.727770][ T5851]  ret_from_fork_asm+0x1a/0x30
[  248.727787][ T5851]  </TASK>
[  248.727850][ T5851] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory.
[  248.756031][T11957] loop5: detected capacity change from 0 to 16
[  248.758888][ T5851] Bluetooth: hci2: failed to register connection device
[  248.773450][T11959] overlayfs: failed to clone upperpath
[  248.835696][T11957] erofs (device loop5): mounted with root inode @ nid 36.
[  249.438039][   T13] hsr_slave_0: left promiscuous mode
[  249.446213][   T13] hsr_slave_1: left promiscuous mode
[  249.449882][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  249.453351][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[  249.467955][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  249.470849][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[  249.565175][   T13] veth1_macvtap: left promiscuous mode
[  249.567037][   T13] veth0_macvtap: left promiscuous mode
[  249.581798][   T13] veth1_vlan: left promiscuous mode
[  249.585476][   T13] veth0_vlan: left promiscuous mode
[  249.931135][T11984] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2471'.
[  250.382802][   T56] Bluetooth: hci0: command tx timeout
[  250.501153][   T13] team0 (unregistering): Port device team_slave_1 removed
[  250.571657][   T13] team0 (unregistering): Port device team_slave_0 removed
[  250.706565][T12003] loop5: detected capacity change from 0 to 16
[  250.989984][   T56] Bluetooth: hci2: command tx timeout
[  251.090970][T11999] sch_tbf: burst 0 is lower than device veth1_virt_wifi mtu (1514) !
[  251.097838][ T5898] usb 6-1: new high-speed USB device number 4 using dummy_hcd
[  251.135439][T11873] 8021q: adding VLAN 0 to HW filter on device batadv0
[  251.270891][ T5898] usb 6-1: Using ep0 maxpacket: 32
[  251.286773][ T5898] usb 6-1: config 0 has an invalid interface number: 35 but max is 0
[  251.306690][ T5898] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  251.310895][ T5898] usb 6-1: config 0 has no interface number 0
[  251.325376][ T5898] usb 6-1: config 0 interface 35 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1
[  251.347272][ T5898] usb 6-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.8f
[  251.351552][ T5898] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  251.354835][ T5898] usb 6-1: Product: syz
[  251.356744][ T5898] usb 6-1: Manufacturer: syz
[  251.367263][ T5898] usb 6-1: SerialNumber: syz
[  251.392394][ T5898] usb 6-1: config 0 descriptor??
[  251.406066][ T5898] radio-si470x 6-1:0.35: could not find interrupt in endpoint
[  251.409149][ T5898] radio-si470x 6-1:0.35: probe with driver radio-si470x failed with error -5
[  251.497206][T11873] veth0_vlan: entered promiscuous mode
[  251.527320][T11873] veth1_vlan: entered promiscuous mode
[  251.572205][T11873] veth0_macvtap: entered promiscuous mode
[  251.584292][T11873] veth1_macvtap: entered promiscuous mode
[  251.611457][T11873] batman_adv: batadv0: Interface activated: batadv_slave_0
[  251.632838][ T5898] radio-raremono 6-1:0.35: Thanko's Raremono connected: (10C4:818A)
[  251.640517][T11873] batman_adv: batadv0: Interface activated: batadv_slave_1
[  251.655582][ T5744] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  251.661028][ T5744] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  251.664669][ T5744] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  251.668152][ T5744] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  251.782859][ T3653] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  251.785948][ T3653] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  251.830208][T12044] xt_time: unknown flags 0xf4
[  251.838950][   T26] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  251.844654][   T26] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  251.849779][ T5898] radio-raremono 6-1:0.35: raremono_cmd_main failed (-71)
[  251.874007][ T5898] radio-raremono 6-1:0.35: V4L2 device registered as radio48
[  251.889112][ T5898] usb 6-1: USB disconnect, device number 4
[  251.892019][ T5898] radio-raremono 6-1:0.35: Thanko's Raremono disconnected
[  252.157023][T12063] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap1
[  252.165732][T12063] batman_adv: batadv0: Adding interface: ip6gretap1
[  252.168622][T12063] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  252.185903][T12063] batman_adv: batadv0: Interface activated: ip6gretap1
[  252.346806][T12073] loop7: detected capacity change from 0 to 1024
[  252.407423][ T1090] hfsplus: b-tree write err: -5, ino 4
[  252.608910][T12084] loop7: detected capacity change from 0 to 2048
[  252.620103][T12084] UDF-fs: warning (device loop7): udf_load_vrs: No anchor found
[  252.623446][T12084] UDF-fs: Scanning with blocksize 512 failed
[  252.636441][   T56] Bluetooth: hci0: command tx timeout
[  252.644657][T12084] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[  252.675990][T12088] netlink: 36 bytes leftover after parsing attributes in process `syz.5.2505'.
[  252.729781][T12090] loop5: detected capacity change from 0 to 512
[  252.756066][T12090] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  252.766740][T12090] ext4 filesystem being mounted at /44/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  252.840198][T11560] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  252.859111][T12099] loop7: detected capacity change from 0 to 512
[  252.867699][T12099] EXT4-fs (loop7): feature flags set on rev 0 fs, running e2fsck is recommended
[  252.881528][T12099] EXT4-fs (loop7): warning: maximal mount count reached, running e2fsck is recommended
[  252.896485][T12099] EXT4-fs error (device loop7): ext4_orphan_get:1392: comm syz.7.2508: inode #15: comm syz.7.2508: iget: illegal inode #
[  252.913090][T12099] EXT4-fs (loop7): Remounting filesystem read-only
[  252.941394][T12099] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  252.994571][T11873] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  253.246639][T12128] netlink: 'syz.7.2520': attribute type 1 has an invalid length.
[  253.249811][T12128] netlink: 172 bytes leftover after parsing attributes in process `syz.7.2520'.
[  253.254750][T12128] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2520'.
[  253.520940][T12144] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2527'.
[  254.824603][T12206] loop7: detected capacity change from 0 to 4096
[  254.855233][T12208] NILFS (loop7): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  254.875814][T12206] NILFS (loop7): unable to set label with more than 80 bytes
[  254.889167][   T56] Bluetooth: hci0: command tx timeout
[  255.328946][T12225] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2554'.
[  255.841719][   T10] usb 6-1: new high-speed USB device number 5 using dummy_hcd
[  256.002703][   T10] usb 6-1: Using ep0 maxpacket: 16
[  256.007054][   T10] usb 6-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  256.011007][   T10] usb 6-1: config 0 interface 0 has no altsetting 0
[  256.014068][   T10] usb 6-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00
[  256.017275][   T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  256.021574][   T10] usb 6-1: config 0 descriptor??
[  256.469326][   T10] acrux 0003:1A34:0802.0011: unknown main item tag 0x0
[  256.472211][   T10] acrux 0003:1A34:0802.0011: unknown main item tag 0x0
[  256.475204][   T10] acrux 0003:1A34:0802.0011: unknown main item tag 0x0
[  256.478166][   T10] acrux 0003:1A34:0802.0011: unknown main item tag 0x0
[  256.481518][   T10] acrux 0003:1A34:0802.0011: unknown main item tag 0x0
[  256.485815][   T10] acrux 0003:1A34:0802.0011: hidraw0: USB HID v0.05 Device [HID 1a34:0802] on usb-dummy_hcd.5-1/input0
[  256.490674][   T10] acrux 0003:1A34:0802.0011: no inputs found
[  256.493148][   T10] acrux 0003:1A34:0802.0011: Failed to enable force feedback support, error: -19
[  256.575414][T12266] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2569'.
[  256.681287][  T793] usb 6-1: USB disconnect, device number 5
[  257.065132][ T1360] ieee802154 phy1 wpan1: encryption failed: -22
[  257.377119][T12278] loop5: detected capacity change from 0 to 128
[  257.396374][T12278] vxfs: unable to set final block size
[  257.705986][T12290] loop5: detected capacity change from 0 to 256
[  257.721735][T12290] FAT-fs (loop5): Directory bread(block 64) failed
[  257.728171][T12290] FAT-fs (loop5): Directory bread(block 65) failed
[  257.731010][T12290] FAT-fs (loop5): Directory bread(block 66) failed
[  257.733755][T12290] FAT-fs (loop5): Directory bread(block 67) failed
[  257.738133][T12290] FAT-fs (loop5): Directory bread(block 68) failed
[  257.743894][T12290] FAT-fs (loop5): Directory bread(block 69) failed
[  257.757523][T12290] FAT-fs (loop5): Directory bread(block 70) failed
[  257.763149][T12290] FAT-fs (loop5): Directory bread(block 71) failed
[  257.765951][T12290] FAT-fs (loop5): Directory bread(block 72) failed
[  257.769576][T12290] FAT-fs (loop5): Directory bread(block 73) failed
[  257.777469][T12292] netlink: 'syz.0.2581': attribute type 8 has an invalid length.
[  257.796027][T12290] FAT-fs (loop5): error, fat_free_clusters: deleting FAT entry beyond EOF
[  257.847512][ T3653] kworker/u10:6: attempt to access beyond end of device
[  257.847512][ T3653] loop5: rw=1, sector=1224, nr_sectors = 4 limit=256
[  259.550799][T12340] loop5: detected capacity change from 0 to 128
[  259.580617][T12340] EXT4-fs (loop5): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none.
[  259.602443][T12340] ext4 filesystem being mounted at /72/mnt supports timestamps until 2038-01-19 (0x7fffffff)
[  259.618884][T12340] fscrypt (loop5, inode 12): Unsupported encryption flags (0x08)
[  259.651502][T11560] EXT4-fs (loop5): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09.
[  259.688844][T12348] overlayfs: failed to clone upperpath
[  259.704075][T12350] netlink: 'syz.5.2604': attribute type 8 has an invalid length.
[  259.951370][T12368] loop5: detected capacity change from 0 to 1024
[  259.961665][T12368] EXT4-fs (loop5): stripe (65535) is not aligned with cluster size (4096), stripe is disabled
[  259.976333][T12368] EXT4-fs (loop5): revision level too high, forcing read-only mode
[  259.980570][T12368] EXT4-fs (loop5): orphan cleanup on readonly fs
[  259.983435][T12368] EXT4-fs error (device loop5): ext4_free_blocks:6706: comm syz.5.2615: Freeing blocks not in datazone - block = 0, count = 4096
[  259.996685][T12368] EXT4-fs (loop5): 1 orphan inode deleted
[  260.001771][T12368] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback.
[  260.028243][T12368] EXT4-fs error (device loop5): ext4_validate_block_bitmap:441: comm syz.5.2615: bg 0: block 10: padding at end of block bitmap is not set
[  260.082476][T11560] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  261.370820][T12381] loop5: detected capacity change from 0 to 32768
[  261.384492][T12381] XFS (loop5): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  261.408005][T12381] XFS (loop5): Ending clean mount
[  261.413563][T12381] XFS (loop5): Quotacheck needed: Please wait.
[  261.436029][T12381] XFS (loop5): Quotacheck: Done.
[  261.451597][   T33] kauditd_printk_skb: 9 callbacks suppressed
[  261.451612][   T33] audit: type=1800 audit(1759351332.717:135): pid=12381 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.2620" name="file1" dev="loop5" ino=9286 res=0 errno=0
[  261.478850][T11560] XFS (loop5): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
[  261.651753][T12393] loop5: detected capacity change from 0 to 4096
[  261.656151][T12393] ntfs3(loop5): Different NTFS sector size (2048) and media sector size (512).
[  261.661336][T12393] ntfs3(loop5): Mark volume as dirty due to NTFS errors
[  261.670507][T12393] ntfs3(loop5): volume is dirty and "force" flag is not set!
[  261.805099][T12401] PKCS7: Unknown OID: [4] 5.25.43183.11314.97.496.3.846527319083.2007.15776
[  261.815031][T12401] PKCS7: Only support pkcs7_signedData type
[  262.085779][T12405] loop5: detected capacity change from 0 to 40427
[  262.090255][T12405] F2FS-fs (loop5): build fault injection rate: 14
[  262.092851][T12405] F2FS-fs (loop5): build fault injection type: 0x3bfe8c
[  262.103139][T12405] F2FS-fs (loop5): invalid crc value
[  262.109482][    C1] F2FS-fs (loop5): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60
[  262.119284][    C1] F2FS-fs (loop5): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60
[  262.167150][T12405] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  262.170927][T12405] F2FS-fs (loop5): inject page alloc in f2fs_grab_cache_folio of __get_meta_folio+0x157/0x4f0
[  262.176895][T12405] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5
[  262.183538][T12405] F2FS-fs (loop5): inject slab alloc in f2fs_kmem_cache_alloc of f2fs_new_node_folio+0x1d9/0xa40
[  262.190301][T12405] F2FS-fs (loop5): inject inconsistent footer in sanity_check_node_footer of f2fs_get_dnode_of_data+0xab4/0x1cf0
[  262.195272][T12405] F2FS-fs (loop5): inconsistent node block, node_type:3, nid:11, node_footer[nid:11,ino:3,ofs:2041,cpver:0,blkaddr:0]
[  262.210783][T12405] F2FS-fs (loop5): inject evict_inode fail in f2fs_evict_inode of evict+0x504/0x9c0
[  262.259936][    C0] F2FS-fs (loop5): inject write IO error in f2fs_write_end_io of blk_update_request+0x57e/0xe60
[  262.264387][    C0] CPU: 0 UID: 0 PID: 11569 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) 
[  262.264405][    C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  262.264413][    C0] Call Trace:
[  262.264418][    C0]  <IRQ>
[  262.264424][    C0]  dump_stack_lvl+0x189/0x250
[  262.264443][    C0]  ? __pfx_dump_stack_lvl+0x10/0x10
[  262.264457][    C0]  ? __pfx_queue_work_on+0x10/0x10
[  262.264468][    C0]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  262.264482][    C0]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  262.264502][    C0]  f2fs_handle_critical_error+0x37c/0x540
[  262.264519][    C0]  f2fs_write_end_io+0x886/0xb60
[  262.264542][    C0]  blk_update_request+0x57e/0xe60
[  262.264563][    C0]  blk_mq_end_request+0x3e/0x70
[  262.264575][    C0]  blk_done_softirq+0x10a/0x160
[  262.264588][    C0]  handle_softirqs+0x286/0x870
[  262.264606][    C0]  ? __irq_exit_rcu+0xca/0x1f0
[  262.264626][    C0]  ? __pfx_handle_softirqs+0x10/0x10
[  262.264639][    C0]  ? sched_clock_cpu+0x74/0x430
[  262.264660][    C0]  __irq_exit_rcu+0xca/0x1f0
[  262.264676][    C0]  ? __pfx___irq_exit_rcu+0x10/0x10
[  262.264694][    C0]  ? rcu_is_watching+0x15/0xb0
[  262.264706][    C0]  irq_exit_rcu+0x9/0x30
[  262.264719][    C0]  sysvec_call_function_single+0xa3/0xc0
[  262.264731][    C0]  </IRQ>
[  262.264735][    C0]  <TASK>
[  262.264740][    C0]  asm_sysvec_call_function_single+0x1a/0x20
[  262.264752][    C0] RIP: 0010:deref_stack_reg+0x1b3/0x230
[  262.264764][    C0] Code: 39 f0 0f 96 c0 20 c8 3c 01 75 30 4c 89 c7 49 89 f7 e8 11 08 00 00 49 89 c6 48 8b 5c 24 18 48 89 d8 48 c1 e8 03 42 80 3c 38 00 <74> 08 48 89 df e8 23 b1 b1 00 4c 89 33 b0 01 eb 02 31 c0 48 83 c4
[  262.264774][    C0] RSP: 0018:ffffc90004117040 EFLAGS: 00000246
[  262.264785][    C0] RAX: 1ffff92000822e35 RBX: ffffc900041171a8 RCX: 0000000000000001
[  262.264794][    C0] RDX: ffffc900041171a8 RSI: dffffc0000000000 RDI: ffffc900041174e0
[  262.264802][    C0] RBP: 1ffff92000822e2d R08: ffffc900041174e0 R09: 0000000000000000
[  262.264810][    C0] R10: ffffc900041171b8 R11: fffff52000822e39 R12: 1ffff92000822e2e
[  262.264819][    C0] R13: 1ffff92000822e2f R14: 0000000000000000 R15: dffffc0000000000
[  262.264849][    C0]  unwind_next_frame+0x17c4/0x2390
[  262.264864][    C0]  ? unwind_next_frame+0xa5/0x2390
[  262.264875][    C0]  ? kasan_save_track+0x3e/0x80
[  262.264891][    C0]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  262.264904][    C0]  arch_stack_walk+0x11c/0x150
[  262.264918][    C0]  ? __kasan_save_free_info+0x46/0x50
[  262.264937][    C0]  stack_trace_save+0x9c/0xe0
[  262.264948][    C0]  ? __pfx_stack_trace_save+0x10/0x10
[  262.264966][    C0]  ? __lock_acquire+0xab9/0xd20
[  262.264980][    C0]  kasan_save_track+0x3e/0x80
[  262.264991][    C0]  ? kasan_save_track+0x3e/0x80
[  262.265037][    C0]  __kasan_save_free_info+0x46/0x50
[  262.265052][    C0]  __kasan_slab_free+0x5c/0x80
[  262.265065][    C0]  ? tomoyo_realpath_from_path+0x598/0x5d0
[  262.265079][    C0]  kfree+0x19a/0x6d0
[  262.265088][    C0]  ? tomoyo_encode+0x511/0x550
[  262.265105][    C0]  tomoyo_realpath_from_path+0x598/0x5d0
[  262.265128][    C0]  tomoyo_check_open_permission+0x1c1/0x3b0
[  262.265140][    C0]  ? tomoyo_check_open_permission+0x16a/0x3b0
[  262.265152][    C0]  ? __pfx_tomoyo_check_open_permission+0x10/0x10
[  262.265183][    C0]  ? lockref_get+0x15/0x60
[  262.265198][    C0]  ? tomoyo_file_open+0x165/0x220
[  262.265215][    C0]  security_file_open+0xb1/0x270
[  262.265226][    C0]  do_dentry_open+0x384/0x13f0
[  262.265247][    C0]  ? vfs_open+0x31/0x340
[  262.265264][    C0]  vfs_open+0x3b/0x340
[  262.265277][    C0]  ? path_openat+0x2ecd/0x3830
[  262.265289][    C0]  path_openat+0x2ee5/0x3830
[  262.265322][    C0]  ? __pfx_path_openat+0x10/0x10
[  262.265371][    C0]  do_filp_open+0x1fa/0x410
[  262.265383][    C0]  ? __lock_acquire+0xab9/0xd20
[  262.265399][    C0]  ? __pfx_do_filp_open+0x10/0x10
[  262.265423][    C0]  ? _raw_spin_unlock+0x28/0x50
[  262.265435][    C0]  ? alloc_fd+0x64c/0x6c0
[  262.265455][    C0]  do_sys_openat2+0x121/0x1c0
[  262.265474][    C0]  ? __pfx_do_sys_openat2+0x10/0x10
[  262.265492][    C0]  ? __pfx_do_unlinkat+0x10/0x10
[  262.265505][    C0]  ? strncpy_from_user+0x150/0x290
[  262.265521][    C0]  __x64_sys_openat+0x138/0x170
[  262.265540][    C0]  do_syscall_64+0xfa/0xfa0
[  262.265554][    C0]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  262.265564][    C0]  ? asm_sysvec_call_function_single+0x1a/0x20
[  262.265579][    C0]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  262.265589][    C0] RIP: 0033:0x7f34973169a4
[  262.265600][    C0] Code: 24 20 48 8d 44 24 30 48 89 44 24 28 64 8b 04 25 18 00 00 00 85 c0 75 2c 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 60 48 8b 15 55 a4 0d 00 f7 d8 64 89 02 48 83
[  262.265610][    C0] RSP: 002b:00007ffdfd542080 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[  262.265622][    C0] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007f34973169a4
[  262.265630][    C0] RDX: 0000000000080000 RSI: 00007ffdfd5421b8 RDI: 00000000ffffff9c
[  262.265639][    C0] RBP: 00007ffdfd5421b8 R08: 0000000000000008 R09: 0000000000000001
[  262.265646][    C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000080000
[  262.265654][    C0] R13: 000055e45d5f6b42 R14: 0000000000000001 R15: 000055e47fb34910
[  262.265674][    C0]  </TASK>
[  262.265679][    C0] F2FS-fs (loop5): Stopped filesystem due to reason: 3
[  262.471583][    C0] CPU: 0 UID: 0 PID: 11569 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) 
[  262.471606][    C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  262.471615][    C0] Call Trace:
[  262.471623][    C0]  <IRQ>
[  262.471635][    C0]  dump_stack_lvl+0x189/0x250
[  262.471656][    C0]  ? __pfx_dump_stack_lvl+0x10/0x10
[  262.471676][    C0]  ? __pfx_queue_work_on+0x10/0x10
[  262.471688][    C0]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  262.471701][    C0]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  262.471721][    C0]  f2fs_handle_critical_error+0x37c/0x540
[  262.471739][    C0]  f2fs_write_end_io+0x886/0xb60
[  262.471765][    C0]  blk_update_request+0x57e/0xe60
[  262.471787][    C0]  blk_mq_end_request+0x3e/0x70
[  262.471801][    C0]  blk_done_softirq+0x10a/0x160
[  262.471813][    C0]  handle_softirqs+0x286/0x870
[  262.471833][    C0]  ? __irq_exit_rcu+0xca/0x1f0
[  262.471852][    C0]  ? __pfx_handle_softirqs+0x10/0x10
[  262.471867][    C0]  ? sched_clock_cpu+0x74/0x430
[  262.471889][    C0]  __irq_exit_rcu+0xca/0x1f0
[  262.471905][    C0]  ? __pfx___irq_exit_rcu+0x10/0x10
[  262.471924][    C0]  ? rcu_is_watching+0x15/0xb0
[  262.471937][    C0]  irq_exit_rcu+0x9/0x30
[  262.471952][    C0]  sysvec_call_function_single+0xa3/0xc0
[  262.471967][    C0]  </IRQ>
[  262.471970][    C0]  <TASK>
[  262.471975][    C0]  asm_sysvec_call_function_single+0x1a/0x20
[  262.471988][    C0] RIP: 0010:deref_stack_reg+0x1b3/0x230
[  262.472001][    C0] Code: 39 f0 0f 96 c0 20 c8 3c 01 75 30 4c 89 c7 49 89 f7 e8 11 08 00 00 49 89 c6 48 8b 5c 24 18 48 89 d8 48 c1 e8 03 42 80 3c 38 00 <74> 08 48 89 df e8 23 b1 b1 00 4c 89 33 b0 01 eb 02 31 c0 48 83 c4
[  262.472010][    C0] RSP: 0018:ffffc90004117040 EFLAGS: 00000246
[  262.472023][    C0] RAX: 1ffff92000822e35 RBX: ffffc900041171a8 RCX: 0000000000000001
[  262.472031][    C0] RDX: ffffc900041171a8 RSI: dffffc0000000000 RDI: ffffc900041174e0
[  262.472040][    C0] RBP: 1ffff92000822e2d R08: ffffc900041174e0 R09: 0000000000000000
[  262.472048][    C0] R10: ffffc900041171b8 R11: fffff52000822e39 R12: 1ffff92000822e2e
[  262.472056][    C0] R13: 1ffff92000822e2f R14: 0000000000000000 R15: dffffc0000000000
[  262.472088][    C0]  unwind_next_frame+0x17c4/0x2390
[  262.472111][    C0]  ? unwind_next_frame+0xa5/0x2390
[  262.472122][    C0]  ? kasan_save_track+0x3e/0x80
[  262.472140][    C0]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  262.472154][    C0]  arch_stack_walk+0x11c/0x150
[  262.472185][    C0]  ? __kasan_save_free_info+0x46/0x50
[  262.472206][    C0]  stack_trace_save+0x9c/0xe0
[  262.472218][    C0]  ? __pfx_stack_trace_save+0x10/0x10
[  262.472236][    C0]  ? __lock_acquire+0xab9/0xd20
[  262.472253][    C0]  kasan_save_track+0x3e/0x80
[  262.472265][    C0]  ? kasan_save_track+0x3e/0x80
[  262.472309][    C0]  __kasan_save_free_info+0x46/0x50
[  262.472326][    C0]  __kasan_slab_free+0x5c/0x80
[  262.472367][    C0]  ? tomoyo_realpath_from_path+0x598/0x5d0
[  262.472381][    C0]  kfree+0x19a/0x6d0
[  262.472393][    C0]  ? tomoyo_encode+0x511/0x550
[  262.472410][    C0]  tomoyo_realpath_from_path+0x598/0x5d0
[  262.472431][    C0]  tomoyo_check_open_permission+0x1c1/0x3b0
[  262.472446][    C0]  ? tomoyo_check_open_permission+0x16a/0x3b0
[  262.472457][    C0]  ? __pfx_tomoyo_check_open_permission+0x10/0x10
[  262.472489][    C0]  ? lockref_get+0x15/0x60
[  262.472504][    C0]  ? tomoyo_file_open+0x165/0x220
[  262.472522][    C0]  security_file_open+0xb1/0x270
[  262.472536][    C0]  do_dentry_open+0x384/0x13f0
[  262.472557][    C0]  ? vfs_open+0x31/0x340
[  262.472575][    C0]  vfs_open+0x3b/0x340
[  262.472589][    C0]  ? path_openat+0x2ecd/0x3830
[  262.472603][    C0]  path_openat+0x2ee5/0x3830
[  262.472636][    C0]  ? __pfx_path_openat+0x10/0x10
[  262.472659][    C0]  do_filp_open+0x1fa/0x410
[  262.472671][    C0]  ? __lock_acquire+0xab9/0xd20
[  262.472687][    C0]  ? __pfx_do_filp_open+0x10/0x10
[  262.472713][    C0]  ? _raw_spin_unlock+0x28/0x50
[  262.472726][    C0]  ? alloc_fd+0x64c/0x6c0
[  262.472748][    C0]  do_sys_openat2+0x121/0x1c0
[  262.472766][    C0]  ? __pfx_do_sys_openat2+0x10/0x10
[  262.472785][    C0]  ? __pfx_do_unlinkat+0x10/0x10
[  262.472798][    C0]  ? strncpy_from_user+0x150/0x290
[  262.472815][    C0]  __x64_sys_openat+0x138/0x170
[  262.472832][    C0]  do_syscall_64+0xfa/0xfa0
[  262.472848][    C0]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  262.472861][    C0]  ? asm_sysvec_call_function_single+0x1a/0x20
[  262.472876][    C0]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  262.472886][    C0] RIP: 0033:0x7f34973169a4
[  262.472898][    C0] Code: 24 20 48 8d 44 24 30 48 89 44 24 28 64 8b 04 25 18 00 00 00 85 c0 75 2c 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 60 48 8b 15 55 a4 0d 00 f7 d8 64 89 02 48 83
[  262.472908][    C0] RSP: 002b:00007ffdfd542080 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[  262.472921][    C0] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007f34973169a4
[  262.472929][    C0] RDX: 0000000000080000 RSI: 00007ffdfd5421b8 RDI: 00000000ffffff9c
[  262.472936][    C0] RBP: 00007ffdfd5421b8 R08: 0000000000000008 R09: 0000000000000001
[  262.472944][    C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000080000
[  262.472952][    C0] R13: 000055e45d5f6b42 R14: 0000000000000001 R15: 000055e47fb34910
[  262.472970][    C0]  </TASK>
[  262.472976][    C0] F2FS-fs (loop5): Stopped filesystem due to reason: 3
[  262.676689][    C0] CPU: 0 UID: 0 PID: 11569 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) 
[  262.676707][    C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  262.676715][    C0] Call Trace:
[  262.676723][    C0]  <IRQ>
[  262.676730][    C0]  dump_stack_lvl+0x189/0x250
[  262.676749][    C0]  ? __pfx_dump_stack_lvl+0x10/0x10
[  262.676762][    C0]  ? __pfx_queue_work_on+0x10/0x10
[  262.676773][    C0]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  262.676788][    C0]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  262.676807][    C0]  f2fs_handle_critical_error+0x37c/0x540
[  262.676826][    C0]  f2fs_write_end_io+0x886/0xb60
[  262.676853][    C0]  blk_update_request+0x57e/0xe60
[  262.676875][    C0]  blk_mq_end_request+0x3e/0x70
[  262.676889][    C0]  blk_done_softirq+0x10a/0x160
[  262.676902][    C0]  handle_softirqs+0x286/0x870
[  262.676924][    C0]  ? __irq_exit_rcu+0xca/0x1f0
[  262.676945][    C0]  ? __pfx_handle_softirqs+0x10/0x10
[  262.676960][    C0]  ? sched_clock_cpu+0x74/0x430
[  262.676982][    C0]  __irq_exit_rcu+0xca/0x1f0
[  262.676997][    C0]  ? __pfx___irq_exit_rcu+0x10/0x10
[  262.677017][    C0]  ? rcu_is_watching+0x15/0xb0
[  262.677031][    C0]  irq_exit_rcu+0x9/0x30
[  262.677046][    C0]  sysvec_call_function_single+0xa3/0xc0
[  262.677068][    C0]  </IRQ>
[  262.677072][    C0]  <TASK>
[  262.677077][    C0]  asm_sysvec_call_function_single+0x1a/0x20
[  262.677091][    C0] RIP: 0010:deref_stack_reg+0x1b3/0x230
[  262.677104][    C0] Code: 39 f0 0f 96 c0 20 c8 3c 01 75 30 4c 89 c7 49 89 f7 e8 11 08 00 00 49 89 c6 48 8b 5c 24 18 48 89 d8 48 c1 e8 03 42 80 3c 38 00 <74> 08 48 89 df e8 23 b1 b1 00 4c 89 33 b0 01 eb 02 31 c0 48 83 c4
[  262.677114][    C0] RSP: 0018:ffffc90004117040 EFLAGS: 00000246
[  262.677126][    C0] RAX: 1ffff92000822e35 RBX: ffffc900041171a8 RCX: 0000000000000001
[  262.677135][    C0] RDX: ffffc900041171a8 RSI: dffffc0000000000 RDI: ffffc900041174e0
[  262.677145][    C0] RBP: 1ffff92000822e2d R08: ffffc900041174e0 R09: 0000000000000000
[  262.677153][    C0] R10: ffffc900041171b8 R11: fffff52000822e39 R12: 1ffff92000822e2e
[  262.677162][    C0] R13: 1ffff92000822e2f R14: 0000000000000000 R15: dffffc0000000000
[  262.677185][    C0]  unwind_next_frame+0x17c4/0x2390
[  262.677202][    C0]  ? unwind_next_frame+0xa5/0x2390
[  262.677214][    C0]  ? kasan_save_track+0x3e/0x80
[  262.677229][    C0]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  262.677244][    C0]  arch_stack_walk+0x11c/0x150
[  262.677260][    C0]  ? __kasan_save_free_info+0x46/0x50
[  262.677280][    C0]  stack_trace_save+0x9c/0xe0
[  262.677294][    C0]  ? __pfx_stack_trace_save+0x10/0x10
[  262.677310][    C0]  ? __lock_acquire+0xab9/0xd20
[  262.677326][    C0]  kasan_save_track+0x3e/0x80
[  262.677363][    C0]  ? kasan_save_track+0x3e/0x80
[  262.677407][    C0]  __kasan_save_free_info+0x46/0x50
[  262.677423][    C0]  __kasan_slab_free+0x5c/0x80
[  262.677435][    C0]  ? tomoyo_realpath_from_path+0x598/0x5d0
[  262.677450][    C0]  kfree+0x19a/0x6d0
[  262.677460][    C0]  ? tomoyo_encode+0x511/0x550
[  262.677478][    C0]  tomoyo_realpath_from_path+0x598/0x5d0
[  262.677503][    C0]  tomoyo_check_open_permission+0x1c1/0x3b0
[  262.677517][    C0]  ? tomoyo_check_open_permission+0x16a/0x3b0
[  262.677530][    C0]  ? __pfx_tomoyo_check_open_permission+0x10/0x10
[  262.677562][    C0]  ? lockref_get+0x15/0x60
[  262.677578][    C0]  ? tomoyo_file_open+0x165/0x220
[  262.677596][    C0]  security_file_open+0xb1/0x270
[  262.677610][    C0]  do_dentry_open+0x384/0x13f0
[  262.677631][    C0]  ? vfs_open+0x31/0x340
[  262.677648][    C0]  vfs_open+0x3b/0x340
[  262.677663][    C0]  ? path_openat+0x2ecd/0x3830
[  262.677676][    C0]  path_openat+0x2ee5/0x3830
[  262.677710][    C0]  ? __pfx_path_openat+0x10/0x10
[  262.677734][    C0]  do_filp_open+0x1fa/0x410
[  262.677746][    C0]  ? __lock_acquire+0xab9/0xd20
[  262.677763][    C0]  ? __pfx_do_filp_open+0x10/0x10
[  262.677789][    C0]  ? _raw_spin_unlock+0x28/0x50
[  262.677801][    C0]  ? alloc_fd+0x64c/0x6c0
[  262.677821][    C0]  do_sys_openat2+0x121/0x1c0
[  262.677840][    C0]  ? __pfx_do_sys_openat2+0x10/0x10
[  262.677860][    C0]  ? __pfx_do_unlinkat+0x10/0x10
[  262.677875][    C0]  ? strncpy_from_user+0x150/0x290
[  262.677892][    C0]  __x64_sys_openat+0x138/0x170
[  262.677913][    C0]  do_syscall_64+0xfa/0xfa0
[  262.677929][    C0]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  262.677941][    C0]  ? asm_sysvec_call_function_single+0x1a/0x20
[  262.677956][    C0]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  262.677968][    C0] RIP: 0033:0x7f34973169a4
[  262.677980][    C0] Code: 24 20 48 8d 44 24 30 48 89 44 24 28 64 8b 04 25 18 00 00 00 85 c0 75 2c 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 60 48 8b 15 55 a4 0d 00 f7 d8 64 89 02 48 83
[  262.677991][    C0] RSP: 002b:00007ffdfd542080 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[  262.678013][    C0] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007f34973169a4
[  262.678021][    C0] RDX: 0000000000080000 RSI: 00007ffdfd5421b8 RDI: 00000000ffffff9c
[  262.678029][    C0] RBP: 00007ffdfd5421b8 R08: 0000000000000008 R09: 0000000000000001
[  262.678037][    C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000080000
[  262.678044][    C0] R13: 000055e45d5f6b42 R14: 0000000000000001 R15: 000055e47fb34910
[  262.678069][    C0]  </TASK>
[  262.678075][    C0] F2FS-fs (loop5): Stopped filesystem due to reason: 3
[  262.883085][    C0] CPU: 0 UID: 0 PID: 11569 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) 
[  262.883102][    C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  262.883110][    C0] Call Trace:
[  262.883115][    C0]  <IRQ>
[  262.883121][    C0]  dump_stack_lvl+0x189/0x250
[  262.883143][    C0]  ? __pfx_dump_stack_lvl+0x10/0x10
[  262.883155][    C0]  ? __pfx_queue_work_on+0x10/0x10
[  262.883165][    C0]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  262.883181][    C0]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  262.883198][    C0]  f2fs_handle_critical_error+0x37c/0x540
[  262.883214][    C0]  f2fs_write_end_io+0x886/0xb60
[  262.883236][    C0]  blk_update_request+0x57e/0xe60
[  262.883259][    C0]  blk_mq_end_request+0x3e/0x70
[  262.883272][    C0]  blk_done_softirq+0x10a/0x160
[  262.883285][    C0]  handle_softirqs+0x286/0x870
[  262.883305][    C0]  ? __irq_exit_rcu+0xca/0x1f0
[  262.883324][    C0]  ? __pfx_handle_softirqs+0x10/0x10
[  262.883366][    C0]  ? sched_clock_cpu+0x74/0x430
[  262.883390][    C0]  __irq_exit_rcu+0xca/0x1f0
[  262.883407][    C0]  ? __pfx___irq_exit_rcu+0x10/0x10
[  262.883427][    C0]  ? rcu_is_watching+0x15/0xb0
[  262.883440][    C0]  irq_exit_rcu+0x9/0x30
[  262.883455][    C0]  sysvec_call_function_single+0xa3/0xc0
[  262.883470][    C0]  </IRQ>
[  262.883474][    C0]  <TASK>
[  262.883479][    C0]  asm_sysvec_call_function_single+0x1a/0x20
[  262.883491][    C0] RIP: 0010:deref_stack_reg+0x1b3/0x230
[  262.883504][    C0] Code: 39 f0 0f 96 c0 20 c8 3c 01 75 30 4c 89 c7 49 89 f7 e8 11 08 00 00 49 89 c6 48 8b 5c 24 18 48 89 d8 48 c1 e8 03 42 80 3c 38 00 <74> 08 48 89 df e8 23 b1 b1 00 4c 89 33 b0 01 eb 02 31 c0 48 83 c4
[  262.883514][    C0] RSP: 0018:ffffc90004117040 EFLAGS: 00000246
[  262.883526][    C0] RAX: 1ffff92000822e35 RBX: ffffc900041171a8 RCX: 0000000000000001
[  262.883534][    C0] RDX: ffffc900041171a8 RSI: dffffc0000000000 RDI: ffffc900041174e0
[  262.883541][    C0] RBP: 1ffff92000822e2d R08: ffffc900041174e0 R09: 0000000000000000
[  262.883548][    C0] R10: ffffc900041171b8 R11: fffff52000822e39 R12: 1ffff92000822e2e
[  262.883556][    C0] R13: 1ffff92000822e2f R14: 0000000000000000 R15: dffffc0000000000
[  262.883578][    C0]  unwind_next_frame+0x17c4/0x2390
[  262.883592][    C0]  ? unwind_next_frame+0xa5/0x2390
[  262.883602][    C0]  ? kasan_save_track+0x3e/0x80
[  262.883617][    C0]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  262.883630][    C0]  arch_stack_walk+0x11c/0x150
[  262.883644][    C0]  ? __kasan_save_free_info+0x46/0x50
[  262.883662][    C0]  stack_trace_save+0x9c/0xe0
[  262.883674][    C0]  ? __pfx_stack_trace_save+0x10/0x10
[  262.883690][    C0]  ? __lock_acquire+0xab9/0xd20
[  262.883704][    C0]  kasan_save_track+0x3e/0x80
[  262.883715][    C0]  ? kasan_save_track+0x3e/0x80
[  262.883755][    C0]  __kasan_save_free_info+0x46/0x50
[  262.883771][    C0]  __kasan_slab_free+0x5c/0x80
[  262.883784][    C0]  ? tomoyo_realpath_from_path+0x598/0x5d0
[  262.883797][    C0]  kfree+0x19a/0x6d0
[  262.883806][    C0]  ? tomoyo_encode+0x511/0x550
[  262.883819][    C0]  tomoyo_realpath_from_path+0x598/0x5d0
[  262.883832][    C0]  tomoyo_check_open_permission+0x1c1/0x3b0
[  262.883840][    C0]  ? tomoyo_check_open_permission+0x16a/0x3b0
[  262.883847][    C0]  ? __pfx_tomoyo_check_open_permission+0x10/0x10
[  262.883862][    C0]  ? lockref_get+0x15/0x60
[  262.883871][    C0]  ? tomoyo_file_open+0x165/0x220
[  262.883881][    C0]  security_file_open+0xb1/0x270
[  262.883888][    C0]  do_dentry_open+0x384/0x13f0
[  262.883900][    C0]  ? vfs_open+0x31/0x340
[  262.883910][    C0]  vfs_open+0x3b/0x340
[  262.883918][    C0]  ? path_openat+0x2ecd/0x3830
[  262.883926][    C0]  path_openat+0x2ee5/0x3830
[  262.883942][    C0]  ? __pfx_path_openat+0x10/0x10
[  262.883954][    C0]  do_filp_open+0x1fa/0x410
[  262.883960][    C0]  ? __lock_acquire+0xab9/0xd20
[  262.883969][    C0]  ? __pfx_do_filp_open+0x10/0x10
[  262.883982][    C0]  ? _raw_spin_unlock+0x28/0x50
[  262.883989][    C0]  ? alloc_fd+0x64c/0x6c0
[  262.884000][    C0]  do_sys_openat2+0x121/0x1c0
[  262.884010][    C0]  ? __pfx_do_sys_openat2+0x10/0x10
[  262.884021][    C0]  ? __pfx_do_unlinkat+0x10/0x10
[  262.884028][    C0]  ? strncpy_from_user+0x150/0x290
[  262.884037][    C0]  __x64_sys_openat+0x138/0x170
[  262.884054][    C0]  do_syscall_64+0xfa/0xfa0
[  262.884064][    C0]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  262.884070][    C0]  ? asm_sysvec_call_function_single+0x1a/0x20
[  262.884078][    C0]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  262.884084][    C0] RIP: 0033:0x7f34973169a4
[  262.884091][    C0] Code: 24 20 48 8d 44 24 30 48 89 44 24 28 64 8b 04 25 18 00 00 00 85 c0 75 2c 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 60 48 8b 15 55 a4 0d 00 f7 d8 64 89 02 48 83
[  262.884097][    C0] RSP: 002b:00007ffdfd542080 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[  262.884104][    C0] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007f34973169a4
[  262.884108][    C0] RDX: 0000000000080000 RSI: 00007ffdfd5421b8 RDI: 00000000ffffff9c
[  262.884113][    C0] RBP: 00007ffdfd5421b8 R08: 0000000000000008 R09: 0000000000000001
[  262.884117][    C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000080000
[  262.884121][    C0] R13: 000055e45d5f6b42 R14: 0000000000000001 R15: 000055e47fb34910
[  262.884131][    C0]  </TASK>
[  262.884134][    C0] F2FS-fs (loop5): Stopped filesystem due to reason: 3
[  263.081621][    C0] CPU: 0 UID: 0 PID: 11569 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) 
[  263.081632][    C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  263.081637][    C0] Call Trace:
[  263.081641][    C0]  <IRQ>
[  263.081644][    C0]  dump_stack_lvl+0x189/0x250
[  263.081657][    C0]  ? __pfx_dump_stack_lvl+0x10/0x10
[  263.081666][    C0]  ? __pfx_queue_work_on+0x10/0x10
[  263.081673][    C0]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  263.081681][    C0]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  263.081692][    C0]  f2fs_handle_critical_error+0x37c/0x540
[  263.081702][    C0]  f2fs_write_end_io+0x886/0xb60
[  263.081715][    C0]  blk_update_request+0x57e/0xe60
[  263.081727][    C0]  blk_mq_end_request+0x3e/0x70
[  263.081734][    C0]  blk_done_softirq+0x10a/0x160
[  263.081742][    C0]  handle_softirqs+0x286/0x870
[  263.081754][    C0]  ? __irq_exit_rcu+0xca/0x1f0
[  263.081765][    C0]  ? __pfx_handle_softirqs+0x10/0x10
[  263.081773][    C0]  ? sched_clock_cpu+0x74/0x430
[  263.081785][    C0]  __irq_exit_rcu+0xca/0x1f0
[  263.081795][    C0]  ? __pfx___irq_exit_rcu+0x10/0x10
[  263.081811][    C0]  ? rcu_is_watching+0x15/0xb0
[  263.081818][    C0]  irq_exit_rcu+0x9/0x30
[  263.081826][    C0]  sysvec_call_function_single+0xa3/0xc0
[  263.081835][    C0]  </IRQ>
[  263.081837][    C0]  <TASK>
[  263.081839][    C0]  asm_sysvec_call_function_single+0x1a/0x20
[  263.081847][    C0] RIP: 0010:deref_stack_reg+0x1b3/0x230
[  263.081854][    C0] Code: 39 f0 0f 96 c0 20 c8 3c 01 75 30 4c 89 c7 49 89 f7 e8 11 08 00 00 49 89 c6 48 8b 5c 24 18 48 89 d8 48 c1 e8 03 42 80 3c 38 00 <74> 08 48 89 df e8 23 b1 b1 00 4c 89 33 b0 01 eb 02 31 c0 48 83 c4
[  263.081860][    C0] RSP: 0018:ffffc90004117040 EFLAGS: 00000246
[  263.081868][    C0] RAX: 1ffff92000822e35 RBX: ffffc900041171a8 RCX: 0000000000000001
[  263.081873][    C0] RDX: ffffc900041171a8 RSI: dffffc0000000000 RDI: ffffc900041174e0
[  263.081878][    C0] RBP: 1ffff92000822e2d R08: ffffc900041174e0 R09: 0000000000000000
[  263.081882][    C0] R10: ffffc900041171b8 R11: fffff52000822e39 R12: 1ffff92000822e2e
[  263.081886][    C0] R13: 1ffff92000822e2f R14: 0000000000000000 R15: dffffc0000000000
[  263.081899][    C0]  unwind_next_frame+0x17c4/0x2390
[  263.081907][    C0]  ? unwind_next_frame+0xa5/0x2390
[  263.081914][    C0]  ? kasan_save_track+0x3e/0x80
[  263.081923][    C0]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  263.081930][    C0]  arch_stack_walk+0x11c/0x150
[  263.081939][    C0]  ? __kasan_save_free_info+0x46/0x50
[  263.081950][    C0]  stack_trace_save+0x9c/0xe0
[  263.081957][    C0]  ? __pfx_stack_trace_save+0x10/0x10
[  263.081971][    C0]  ? __lock_acquire+0xab9/0xd20
[  263.081980][    C0]  kasan_save_track+0x3e/0x80
[  263.081986][    C0]  ? kasan_save_track+0x3e/0x80
[  263.082009][    C0]  __kasan_save_free_info+0x46/0x50
[  263.082018][    C0]  __kasan_slab_free+0x5c/0x80
[  263.082026][    C0]  ? tomoyo_realpath_from_path+0x598/0x5d0
[  263.082035][    C0]  kfree+0x19a/0x6d0
[  263.082042][    C0]  ? tomoyo_encode+0x511/0x550
[  263.082054][    C0]  tomoyo_realpath_from_path+0x598/0x5d0
[  263.082074][    C0]  tomoyo_check_open_permission+0x1c1/0x3b0
[  263.082087][    C0]  ? tomoyo_check_open_permission+0x16a/0x3b0
[  263.082098][    C0]  ? __pfx_tomoyo_check_open_permission+0x10/0x10
[  263.082124][    C0]  ? lockref_get+0x15/0x60
[  263.082138][    C0]  ? tomoyo_file_open+0x165/0x220
[  263.082155][    C0]  security_file_open+0xb1/0x270
[  263.082169][    C0]  do_dentry_open+0x384/0x13f0
[  263.082189][    C0]  ? vfs_open+0x31/0x340
[  263.082201][    C0]  vfs_open+0x3b/0x340
[  263.082210][    C0]  ? path_openat+0x2ecd/0x3830
[  263.082222][    C0]  path_openat+0x2ee5/0x3830
[  263.082253][    C0]  ? __pfx_path_openat+0x10/0x10
[  263.082282][    C0]  do_filp_open+0x1fa/0x410
[  263.082291][    C0]  ? __lock_acquire+0xab9/0xd20
[  263.082307][    C0]  ? __pfx_do_filp_open+0x10/0x10
[  263.082355][    C0]  ? _raw_spin_unlock+0x28/0x50
[  263.082368][    C0]  ? alloc_fd+0x64c/0x6c0
[  263.082388][    C0]  do_sys_openat2+0x121/0x1c0
[  263.082406][    C0]  ? __pfx_do_sys_openat2+0x10/0x10
[  263.082422][    C0]  ? __pfx_do_unlinkat+0x10/0x10
[  263.082435][    C0]  ? strncpy_from_user+0x150/0x290
[  263.082452][    C0]  __x64_sys_openat+0x138/0x170
[  263.082471][    C0]  do_syscall_64+0xfa/0xfa0
[  263.082485][    C0]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  263.082495][    C0]  ? asm_sysvec_call_function_single+0x1a/0x20
[  263.082509][    C0]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  263.082520][    C0] RIP: 0033:0x7f34973169a4
[  263.082530][    C0] Code: 24 20 48 8d 44 24 30 48 89 44 24 28 64 8b 04 25 18 00 00 00 85 c0 75 2c 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 60 48 8b 15 55 a4 0d 00 f7 d8 64 89 02 48 83
[  263.082539][    C0] RSP: 002b:00007ffdfd542080 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[  263.082551][    C0] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007f34973169a4
[  263.082559][    C0] RDX: 0000000000080000 RSI: 00007ffdfd5421b8 RDI: 00000000ffffff9c
[  263.082566][    C0] RBP: 00007ffdfd5421b8 R08: 0000000000000008 R09: 0000000000000001
[  263.082572][    C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000080000
[  263.082579][    C0] R13: 000055e45d5f6b42 R14: 0000000000000001 R15: 000055e47fb34910
[  263.082597][    C0]  </TASK>
[  263.082602][    C0] F2FS-fs (loop5): Stopped filesystem due to reason: 3
[  263.276014][    C0] CPU: 0 UID: 0 PID: 11569 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) 
[  263.276031][    C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  263.276038][    C0] Call Trace:
[  263.276044][    C0]  <IRQ>
[  263.276049][    C0]  dump_stack_lvl+0x189/0x250
[  263.276069][    C0]  ? __pfx_dump_stack_lvl+0x10/0x10
[  263.276081][    C0]  ? __pfx_queue_work_on+0x10/0x10
[  263.276091][    C0]  ? _raw_spin_unlock_irqrestore+0xad/0x110
[  263.276106][    C0]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[  263.276123][    C0]  f2fs_handle_critical_error+0x37c/0x540
[  263.276142][    C0]  f2fs_write_end_io+0x886/0xb60
[  263.276165][    C0]  blk_update_request+0x57e/0xe60
[  263.276186][    C0]  blk_mq_end_request+0x3e/0x70
[  263.276200][    C0]  blk_done_softirq+0x10a/0x160
[  263.276212][    C0]  handle_softirqs+0x286/0x870
[  263.276231][    C0]  ? __irq_exit_rcu+0xca/0x1f0
[  263.276249][    C0]  ? __pfx_handle_softirqs+0x10/0x10
[  263.276264][    C0]  ? sched_clock_cpu+0x74/0x430
[  263.276284][    C0]  __irq_exit_rcu+0xca/0x1f0
[  263.276301][    C0]  ? __pfx___irq_exit_rcu+0x10/0x10
[  263.276319][    C0]  ? rcu_is_watching+0x15/0xb0
[  263.276353][    C0]  irq_exit_rcu+0x9/0x30
[  263.276369][    C0]  sysvec_call_function_single+0xa3/0xc0
[  263.276381][    C0]  </IRQ>
[  263.276385][    C0]  <TASK>
[  263.276390][    C0]  asm_sysvec_call_function_single+0x1a/0x20
[  263.276403][    C0] RIP: 0010:deref_stack_reg+0x1b3/0x230
[  263.276414][    C0] Code: 39 f0 0f 96 c0 20 c8 3c 01 75 30 4c 89 c7 49 89 f7 e8 11 08 00 00 49 89 c6 48 8b 5c 24 18 48 89 d8 48 c1 e8 03 42 80 3c 38 00 <74> 08 48 89 df e8 23 b1 b1 00 4c 89 33 b0 01 eb 02 31 c0 48 83 c4
[  263.276425][    C0] RSP: 0018:ffffc90004117040 EFLAGS: 00000246
[  263.276436][    C0] RAX: 1ffff92000822e35 RBX: ffffc900041171a8 RCX: 0000000000000001
[  263.276445][    C0] RDX: ffffc900041171a8 RSI: dffffc0000000000 RDI: ffffc900041174e0
[  263.276453][    C0] RBP: 1ffff92000822e2d R08: ffffc900041174e0 R09: 0000000000000000
[  263.276460][    C0] R10: ffffc900041171b8 R11: fffff52000822e39 R12: 1ffff92000822e2e
[  263.276467][    C0] R13: 1ffff92000822e2f R14: 0000000000000000 R15: dffffc0000000000
[  263.276489][    C0]  unwind_next_frame+0x17c4/0x2390
[  263.276505][    C0]  ? unwind_next_frame+0xa5/0x2390
[  263.276516][    C0]  ? kasan_save_track+0x3e/0x80
[  263.276532][    C0]  ? __pfx_stack_trace_consume_entry+0x10/0x10
[  263.276546][    C0]  arch_stack_walk+0x11c/0x150
[  263.276561][    C0]  ? __kasan_save_free_info+0x46/0x50
[  263.276579][    C0]  stack_trace_save+0x9c/0xe0
[  263.276592][    C0]  ? __pfx_stack_trace_save+0x10/0x10
[  263.276609][    C0]  ? __lock_acquire+0xab9/0xd20
[  263.276624][    C0]  kasan_save_track+0x3e/0x80
[  263.276634][    C0]  ? kasan_save_track+0x3e/0x80
[  263.276676][    C0]  __kasan_save_free_info+0x46/0x50
[  263.276692][    C0]  __kasan_slab_free+0x5c/0x80
[  263.276703][    C0]  ? tomoyo_realpath_from_path+0x598/0x5d0
[  263.276719][    C0]  kfree+0x19a/0x6d0
[  263.276729][    C0]  ? tomoyo_encode+0x511/0x550
[  263.276746][    C0]  tomoyo_realpath_from_path+0x598/0x5d0
[  263.276767][    C0]  tomoyo_check_open_permission+0x1c1/0x3b0
[  263.276781][    C0]  ? tomoyo_check_open_permission+0x16a/0x3b0
[  263.276793][    C0]  ? __pfx_tomoyo_check_open_permission+0x10/0x10
[  263.276822][    C0]  ? lockref_get+0x15/0x60
[  263.276845][    C0]  ? tomoyo_file_open+0x165/0x220
[  263.276863][    C0]  security_file_open+0xb1/0x270
[  263.276876][    C0]  do_dentry_open+0x384/0x13f0
[  263.276896][    C0]  ? vfs_open+0x31/0x340
[  263.276913][    C0]  vfs_open+0x3b/0x340
[  263.276927][    C0]  ? path_openat+0x2ecd/0x3830
[  263.276940][    C0]  path_openat+0x2ee5/0x3830
[  263.276970][    C0]  ? __pfx_path_openat+0x10/0x10
[  263.276994][    C0]  do_filp_open+0x1fa/0x410
[  263.277005][    C0]  ? __lock_acquire+0xab9/0xd20
[  263.277021][    C0]  ? __pfx_do_filp_open+0x10/0x10
[  263.277044][    C0]  ? _raw_spin_unlock+0x28/0x50
[  263.277055][    C0]  ? alloc_fd+0x64c/0x6c0
[  263.277075][    C0]  do_sys_openat2+0x121/0x1c0
[  263.277092][    C0]  ? __pfx_do_sys_openat2+0x10/0x10
[  263.277110][    C0]  ? __pfx_do_unlinkat+0x10/0x10
[  263.277122][    C0]  ? strncpy_from_user+0x150/0x290
[  263.277138][    C0]  __x64_sys_openat+0x138/0x170
[  263.277158][    C0]  do_syscall_64+0xfa/0xfa0
[  263.277172][    C0]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  263.277183][    C0]  ? asm_sysvec_call_function_single+0x1a/0x20
[  263.277196][    C0]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  263.277207][    C0] RIP: 0033:0x7f34973169a4
[  263.277218][    C0] Code: 24 20 48 8d 44 24 30 48 89 44 24 28 64 8b 04 25 18 00 00 00 85 c0 75 2c 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 60 48 8b 15 55 a4 0d 00 f7 d8 64 89 02 48 83
[  263.277226][    C0] RSP: 002b:00007ffdfd542080 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[  263.277238][    C0] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007f34973169a4
[  263.277245][    C0] RDX: 0000000000080000 RSI: 00007ffdfd5421b8 RDI: 00000000ffffff9c
[  263.277252][    C0] RBP: 00007ffdfd5421b8 R08: 0000000000000008 R09: 0000000000000001
[  263.277258][    C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000080000
[  263.277264][    C0] R13: 000055e45d5f6b42 R14: 0000000000000001 R15: 000055e47fb34910
[  263.277284][    C0]  </TASK>
[  263.277288][    C0] F2FS-fs (loop5): Stopped filesystem due to reason: 3
[  263.482136][    C0] clocksource: Long readout interval, skipping watchdog check: cs_nsec: 1437264658 wd_nsec: 1437264666
[  263.495544][T11560] F2FS-fs (loop5): do_checkpoint failed err:-5, stop checkpoint
[  263.963221][T12448] netlink: 'syz.7.2642': attribute type 4 has an invalid length.
[  263.985445][T12448] netlink: 'syz.7.2642': attribute type 4 has an invalid length.
[  264.557532][   T10] usb 6-1: new high-speed USB device number 6 using dummy_hcd
[  264.741256][   T10] usb 6-1: Using ep0 maxpacket: 8
[  264.746782][   T10] usb 6-1: unable to get BOS descriptor or descriptor too short
[  264.751863][   T10] usb 6-1: config 4 interface 0 has no altsetting 0
[  264.759103][   T10] usb 6-1: string descriptor 0 read error: -22
[  264.761294][   T10] usb 6-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05
[  264.764997][   T10] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  264.778238][   T10] usb 6-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state
[  264.791722][   T10] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer
[  264.801350][   T10] dvbdev: DVB: registering new adapter (Sigmatek DVB-110)
[  264.803754][   T10] usb 6-1: media controller created
[  264.815827][   T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[  265.442056][ T5314] usb 6-1: USB disconnect, device number 6
[  265.609317][T12509] rdma_op ffff88810d92e9f0 conn xmit_rdma 0000000000000000
[  266.119570][T12539] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2675'.
[  266.122961][T12539] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2675'.
[  266.133314][T12539] geneve2: entered promiscuous mode
[  266.135925][T12539] geneve2: entered allmulticast mode
[  268.631579][T12618] overlayfs: failed to clone upperpath
[  268.875037][T12632] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2715'.
[  268.878117][T12632] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2715'.
[  268.897586][T12632] gretap0: entered promiscuous mode
[  268.899977][T12632] macsec1: entered promiscuous mode
[  268.902827][T12632] macsec1: entered allmulticast mode
[  268.905176][T12632] gretap0: entered allmulticast mode
[  269.209100][T12636] netlink: 'syz.0.2720': attribute type 1 has an invalid length.
[  269.379781][T12640] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2722'.
[  269.726367][T12661] overlayfs: failed to clone upperpath
[  270.850801][T12694] netlink: 'syz.0.2748': attribute type 3 has an invalid length.
[  270.854099][T12694] netlink: 'syz.0.2748': attribute type 3 has an invalid length.
[  271.242167][T12699] netlink: 'syz.0.2749': attribute type 2 has an invalid length.
[  271.245471][T12699] netlink: 'syz.0.2749': attribute type 1 has an invalid length.
[  271.250701][T12699] sctp: [Deprecated]: syz.0.2749 (pid 12699) Use of struct sctp_assoc_value in delayed_ack socket option.
[  271.250701][T12699] Use struct sctp_sack_info instead
[  272.892637][T12732] netlink: 'syz.7.2765': attribute type 10 has an invalid length.
[  272.897761][T12732] netlink: 40 bytes leftover after parsing attributes in process `syz.7.2765'.
[  274.818491][T12789] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2790'.
[  276.558840][T12826] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2806'.
[  276.562792][T12826] netlink: 16 bytes leftover after parsing attributes in process `syz.7.2806'.
[  279.430700][T12873] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2826'.
[  279.437013][T12872] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2826'.
[  279.498795][   T33] audit: type=1326 audit(1759351349.377:136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12876 comm="syz.7.2828" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4aa98ec29 code=0x7ffc0000
[  279.521034][   T33] audit: type=1326 audit(1759351349.377:137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12876 comm="syz.7.2828" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4aa98ec29 code=0x7ffc0000
[  279.535641][   T33] audit: type=1326 audit(1759351349.396:138): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12876 comm="syz.7.2828" exe="/syz-executor" sig=0 arch=c000003e syscall=66 compat=0 ip=0x7fe4aa98ec29 code=0x7ffc0000
[  279.547291][   T33] audit: type=1326 audit(1759351349.396:139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12876 comm="syz.7.2828" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4aa98ec29 code=0x7ffc0000
[  279.556751][   T33] audit: type=1326 audit(1759351349.396:140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12876 comm="syz.7.2828" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4aa98ec29 code=0x7ffc0000
[  283.247760][T12933] 9pnet_fd: Insufficient options for proto=fd
[  283.517895][ T5851] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[  283.521786][ T5851] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[  283.524736][ T5851] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[  283.527442][ T5851] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[  283.532381][ T5851] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[  283.792153][ T5744] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  283.810879][T12943] chnl_net:caif_netlink_parms(): no params data found
[  283.897770][ T5744] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  283.927778][T12943] bridge0: port 1(bridge_slave_0) entered blocking state
[  283.931766][T12943] bridge0: port 1(bridge_slave_0) entered disabled state
[  283.934837][T12943] bridge_slave_0: entered allmulticast mode
[  283.937959][T12943] bridge_slave_0: entered promiscuous mode
[  283.942928][T12943] bridge0: port 2(bridge_slave_1) entered blocking state
[  283.946041][T12943] bridge0: port 2(bridge_slave_1) entered disabled state
[  283.949258][T12943] bridge_slave_1: entered allmulticast mode
[  283.957055][T12943] bridge_slave_1: entered promiscuous mode
[  283.986598][ T5744] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  284.037511][T12943] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  284.054348][ T5744] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  284.063528][T12943] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  284.067270][T12977] (unnamed net_device) (uninitialized): ARP target 9.0.0.0 is already present
[  284.071335][T12977] (unnamed net_device) (uninitialized): option arp_ip_target: invalid value (9)
[  284.104928][T12943] team0: Port device team_slave_0 added
[  284.108144][T12943] team0: Port device team_slave_1 added
[  284.137765][T12943] batman_adv: batadv0: Adding interface: batadv_slave_0
[  284.140141][T12943] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  284.153659][T12943] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  284.171688][T12943] batman_adv: batadv0: Adding interface: batadv_slave_1
[  284.174018][T12943] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  284.184727][T12943] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  284.257829][T12943] hsr_slave_0: entered promiscuous mode
[  284.260670][T12943] hsr_slave_1: entered promiscuous mode
[  284.263616][T12943] debugfs: 'hsr0' already exists in 'hsr'
[  284.263780][T12984] overlayfs: failed to clone lowerpath
[  284.266140][T12943] Cannot create hsr debugfs directory
[  284.276808][ T5744] bridge_slave_1: left allmulticast mode
[  284.278862][ T5744] bridge_slave_1: left promiscuous mode
[  284.281135][ T5744] bridge0: port 2(bridge_slave_1) entered disabled state
[  284.287453][ T5744] bridge_slave_0: left allmulticast mode
[  284.289494][ T5744] bridge_slave_0: left promiscuous mode
[  284.291598][ T5744] bridge0: port 1(bridge_slave_0) entered disabled state
[  284.296186][T12984] overlayfs: failed to clone upperpath
[  285.246236][ T5744] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  285.253824][ T5744] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  285.258862][ T5744] bond0 (unregistering): Released all slaves
[  285.764170][T12943] netdevsim netdevsim8 netdevsim0: renamed from eth0
[  285.778535][T12943] netdevsim netdevsim8 netdevsim1: renamed from eth1
[  285.796371][T12943] netdevsim netdevsim8 netdevsim2: renamed from eth2
[  285.813274][ T5851] Bluetooth: hci2: command tx timeout
[  285.815487][T12943] netdevsim netdevsim8 netdevsim3: renamed from eth3
[  285.832986][ T5744] hsr_slave_0: left promiscuous mode
[  285.840881][ T5744] hsr_slave_1: left promiscuous mode
[  285.848662][ T5744] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  285.852693][ T5744] batman_adv: batadv0: Removing interface: batadv_slave_0
[  285.855729][ T5744] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  285.859144][ T5744] batman_adv: batadv0: Removing interface: batadv_slave_1
[  285.874213][ T5744] veth1_macvtap: left promiscuous mode
[  285.876159][ T5744] veth0_macvtap: left promiscuous mode
[  285.879984][ T5744] veth1_vlan: left promiscuous mode
[  285.881872][ T5744] veth0_vlan: left promiscuous mode
[  286.287794][ T5744] team0 (unregistering): Port device team_slave_1 removed
[  286.326291][ T5744] team0 (unregistering): Port device team_slave_0 removed
[  286.624981][   T33] audit: type=1326 audit(1759351355.953:141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13028 comm="syz.7.2887" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4aa98ec29 code=0x7ffc0000
[  286.646355][   T33] audit: type=1326 audit(1759351355.953:142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13028 comm="syz.7.2887" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4aa98ec29 code=0x7ffc0000
[  286.669251][   T33] audit: type=1326 audit(1759351355.971:143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13028 comm="syz.7.2887" exe="/syz-executor" sig=0 arch=c000003e syscall=76 compat=0 ip=0x7fe4aa98ec29 code=0x7ffc0000
[  286.684840][   T33] audit: type=1326 audit(1759351355.971:144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13028 comm="syz.7.2887" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4aa98ec29 code=0x7ffc0000
[  286.694089][   T33] audit: type=1326 audit(1759351355.971:145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13028 comm="syz.7.2887" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe4aa98ec29 code=0x7ffc0000
[  286.879633][T12943] 8021q: adding VLAN 0 to HW filter on device bond0
[  286.911183][T12943] 8021q: adding VLAN 0 to HW filter on device team0
[  286.919793][ T3405] bridge0: port 1(bridge_slave_0) entered blocking state
[  286.922118][ T3405] bridge0: port 1(bridge_slave_0) entered forwarding state
[  286.932612][ T3405] bridge0: port 2(bridge_slave_1) entered blocking state
[  286.934975][ T3405] bridge0: port 2(bridge_slave_1) entered forwarding state
[  287.059875][T12943] 8021q: adding VLAN 0 to HW filter on device batadv0
[  287.235223][T12943] veth0_vlan: entered promiscuous mode
[  287.244809][T12943] veth1_vlan: entered promiscuous mode
[  287.269541][T12943] veth0_macvtap: entered promiscuous mode
[  287.276891][T12943] veth1_macvtap: entered promiscuous mode
[  287.296225][T12943] batman_adv: batadv0: Interface activated: batadv_slave_0
[  287.306200][T12943] batman_adv: batadv0: Interface activated: batadv_slave_1
[  287.314642][ T5744] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  287.321236][ T5744] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  287.324332][ T5744] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  287.327297][ T5744] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  287.535182][ T3551] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  287.538428][ T3551] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  287.582337][ T3551] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  287.585956][ T3551] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  288.065686][ T5851] Bluetooth: hci2: command tx timeout
[  288.692750][T13092] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2896'.
[  288.986044][    T9] usb 9-1: new high-speed USB device number 2 using dummy_hcd
[  289.159356][    T9] usb 9-1: Using ep0 maxpacket: 16
[  289.161844][    T9] usb 9-1: too many configurations: 25, using maximum allowed: 8
[  289.173933][    T9] usb 9-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice= 3.06
[  289.177186][    T9] usb 9-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3
[  289.180191][    T9] usb 9-1: Product: syz
[  289.183021][    T9] usb 9-1: SerialNumber: syz
[  289.188158][    T9] r8152-cfgselector 9-1: Unknown version 0x0000
[  289.417177][    T9] r8152-cfgselector 9-1: USB disconnect, device number 2
[  290.319693][ T5851] Bluetooth: hci2: command tx timeout
[  290.405948][T13114] loop8: detected capacity change from 0 to 512
[  290.422963][T13114] EXT4-fs error (device loop8): ext4_orphan_get:1392: inode #15: comm syz.8.2903: casefold flag without casefold feature
[  290.433835][T13114] EXT4-fs error (device loop8): ext4_orphan_get:1397: comm syz.8.2903: couldn't read orphan inode 15 (err -117)
[  290.442402][T13114] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  290.476023][T12943] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  290.520696][T13118] loop8: detected capacity change from 0 to 2048
[  290.559196][T12939] Dev loop8: RDB in block 1 has bad checksum
[  290.564535][T13118] Dev loop8: RDB in block 1 has bad checksum
[  290.962667][T13143] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2915'.
[  292.118518][T13185] loop8: detected capacity change from 0 to 256
[  292.132450][T13185] exFAT-fs (loop8): failed to load upcase table (idx : 0x000104d0, chksum : 0x60d18cac, utbl_chksum : 0xe619d30d)
[  292.138384][T13185] exFAT-fs (loop8): failed to load alloc-bitmap
[  292.141110][T13185] exFAT-fs (loop8): failed to recognize exfat type
[  292.217158][    T9] kernel read not supported for file /vcsu (pid: 9 comm: kworker/0:0)
[  292.347529][T13198] loop8: detected capacity change from 0 to 2048
[  292.361951][T13199] NILFS (loop8): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  292.581123][ T5851] Bluetooth: hci2: command tx timeout
[  293.076619][T13249] fuse: Bad value for 'fd'
[  293.620678][T13255] loop8: detected capacity change from 0 to 512
[  293.636312][T13255] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  293.640746][T13255] ext4 filesystem being mounted at /29/bus supports timestamps until 2038-01-19 (0x7fffffff)
[  293.686793][T12943] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  294.096926][   T47] usb 9-1: new full-speed USB device number 3 using dummy_hcd
[  294.284426][   T47] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0
[  294.288365][   T47] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x4 has an invalid bInterval 0, changing to 10
[  294.293515][   T47] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid maxpacket 255, setting to 64
[  294.298291][   T47] usb 9-1: New USB device found, idVendor=0cf3, idProduct=9375, bcdDevice=1a.de
[  294.301542][   T47] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  294.307354][   T47] usb 9-1: config 0 descriptor??
[  294.318081][T13267] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22
[  294.802515][   T47] ath6kl: Failed to submit usb control message: -71
[  294.828317][   T47] ath6kl: unable to send the bmi data to the device: -71
[  294.831453][   T47] ath6kl: Unable to send get target info: -71
[  294.835506][   T47] ath6kl: Failed to init ath6kl core: -71
[  294.843493][   T47] ath6kl_usb 9-1:0.0: probe with driver ath6kl_usb failed with error -71
[  294.850995][   T47] usb 9-1: USB disconnect, device number 3
[  295.352838][T13303] ALSA: seq fatal error: cannot create timer (-19)
[  295.618254][T13314] nfs4: Bad value for 'source'
[  295.760107][T13329] netlink: 6 bytes leftover after parsing attributes in process `syz.0.2999'.
[  295.980000][T13356] /dev/nullb0: Can't lookup blockdev
[  296.909707][T13367] ceph: No mds server is up or the cluster is laggy
[  297.092490][T13404] netlink: 'syz.7.3032': attribute type 16 has an invalid length.
[  297.096462][T13404] netlink: 156 bytes leftover after parsing attributes in process `syz.7.3032'.
[  297.186729][T13408] netlink: 'syz.0.3034': attribute type 21 has an invalid length.
[  297.229713][T13411] overlayfs: failed to clone upperpath
[  297.233694][T13411] overlayfs: failed to clone upperpath
[  297.624928][T13423] netlink: 'syz.0.3040': attribute type 83 has an invalid length.
[  297.793606][T13435] netlink: 12 bytes leftover after parsing attributes in process `syz.8.3046'.
[  298.368783][T13449] fuse: Bad value for 'fd'
[  299.075979][T13465] tipc: Enabling of bearer <udp:syz0> rejected, already enabled
[  299.080986][T13465] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3054'.
[  299.084701][T13465] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3054'.
[  299.352531][T13469] netlink: 4 bytes leftover after parsing attributes in process `syz.8.3060'.
[  299.605931][T13473] loop8: detected capacity change from 0 to 32768
[  299.640339][T13483] netlink: 28 bytes leftover after parsing attributes in process `syz.7.3067'.
[  299.809672][T13485] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3069'.
[  299.902088][T13493] (unnamed net_device) (uninitialized): (slave bond_slave_1): Device is not our slave
[  299.905956][T13493] (unnamed net_device) (uninitialized): option active_slave: invalid value (bond_slave_1)
[  299.958853][T13497] bridge0: entered promiscuous mode
[  299.962171][T13497] team0: entered promiscuous mode
[  299.964345][T13497] team_slave_0: entered promiscuous mode
[  299.967216][T13497] team_slave_1: entered promiscuous mode
[  299.969771][T13497] bond1: entered promiscuous mode
[  299.974702][T13497] hsr2: entered allmulticast mode
[  299.977051][T13497] bridge0: entered allmulticast mode
[  299.978843][T13497] team0: entered allmulticast mode
[  299.980987][T13497] team_slave_0: entered allmulticast mode
[  299.983179][T13497] team_slave_1: entered allmulticast mode
[  299.985131][T13497] bond1: entered allmulticast mode
[  300.084969][  T793] usb 9-1: new high-speed USB device number 4 using dummy_hcd
[  300.248806][  T793] usb 9-1: Using ep0 maxpacket: 32
[  300.255500][  T793] usb 9-1: config 0 interface 0 has no altsetting 0
[  300.264526][  T793] usb 9-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e
[  300.274134][  T793] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  300.283378][  T793] usb 9-1: Product: syz
[  300.286523][  T793] usb 9-1: Manufacturer: syz
[  300.289759][  T793] usb 9-1: SerialNumber: syz
[  300.297914][  T793] usb 9-1: config 0 descriptor??
[  300.748429][  T793] gs_usb 9-1:0.0: Configuring for 1 interfaces
[  301.185129][  T793] gs_usb 9-1:0.0: Disabling termination support for channel 0 (-EPROTO)
[  301.240317][  T793] usb 9-1: USB disconnect, device number 4
[  301.462992][T13569] syz_tun: entered allmulticast mode
[  301.468267][T13567] syz_tun: left allmulticast mode
[  302.215321][T13600] can: request_module (can-proto-5) failed.
[  302.221436][ T5851] Bluetooth: hci0: unexpected cc 0x0809 length: 31 > 4
[  302.689585][T13633] overlayfs: failed to clone lowerpath
[  302.727175][T13633] overlayfs: failed to clone upperpath
[  302.957876][T13635] bridge1: entered allmulticast mode
[  302.964341][T13635] team0: Port device bridge1 added
[  302.975278][T13635] netlink: 24 bytes leftover after parsing attributes in process `syz.7.3126'.
[  303.045999][T13639] vlan2: entered allmulticast mode
[  304.291530][   T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  304.389352][   T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  304.471773][   T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  304.562021][   T13] netdevsim netdevsim0 netdevsim0 (unregistering): left promiscuous mode
[  304.566475][   T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  304.636483][   T56] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  304.644538][   T56] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  304.652846][   T56] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  304.658353][   T56] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  304.661124][   T56] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  304.757785][   T13] bridge_slave_1: left allmulticast mode
[  304.760309][   T13] bridge_slave_1: left promiscuous mode
[  304.763227][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[  304.770450][   T13] bridge_slave_0: left allmulticast mode
[  304.772902][   T13] bridge_slave_0: left promiscuous mode
[  304.776213][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[  304.995216][   T13] bond_slave_0: left promiscuous mode
[  304.997384][   T13] bond_slave_1: left promiscuous mode
[  305.156614][   T13] bridge0 (unregistering): left promiscuous mode
[  305.399740][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  305.407214][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  305.413190][   T13] bond0 (unregistering): Released all slaves
[  305.546921][   T13] bond1 (unregistering): left promiscuous mode
[  305.549188][   T13] bond1 (unregistering): left allmulticast mode
[  305.552542][   T13] team0: Port device bond1 removed
[  305.557542][   T13] bond1 (unregistering): Released all slaves
[  305.574432][   T13] bond2 (unregistering): Released all slaves
[  305.591425][   T13] bond3 (unregistering): Released all slaves
[  305.602461][   T13] bond4 (unregistering): Released all slaves
[  305.712081][   T13] tipc: Disabling bearer <udp:syz0>
[  305.719031][   T13] tipc: Disabling bearer <eth:veth1_macvtap>
[  305.731422][   T13] tipc: Left network mode
[  305.795251][T13697] chnl_net:caif_netlink_parms(): no params data found
[  305.838792][   T47] usb 9-1: new high-speed USB device number 5 using dummy_hcd
[  305.997551][   T47] usb 9-1: Using ep0 maxpacket: 32
[  306.007676][   T47] usb 9-1: New USB device found, idVendor=084f, idProduct=0001, bcdDevice=e0.b8
[  306.014670][T13697] bridge0: port 1(bridge_slave_0) entered blocking state
[  306.015100][   T47] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  306.017144][T13697] bridge0: port 1(bridge_slave_0) entered disabled state
[  306.025647][T13697] bridge_slave_0: entered allmulticast mode
[  306.028767][T13697] bridge_slave_0: entered promiscuous mode
[  306.035776][   T13] team0: left promiscuous mode
[  306.038154][   T13] team_slave_0: left promiscuous mode
[  306.041831][   T13] team_slave_1: left promiscuous mode
[  306.042025][   T47] usb 9-1: Product: syz
[  306.046173][   T13] dummy0: left promiscuous mode
[  306.049285][   T47] usb 9-1: Manufacturer: syz
[  306.053133][   T47] usb 9-1: SerialNumber: syz
[  306.056597][   T13] hsr_slave_0: left promiscuous mode
[  306.062029][   T47] empeg 9-1:1.0: empeg converter detected
[  306.066346][   T13] hsr_slave_1: left promiscuous mode
[  306.068890][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  306.072079][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[  306.080265][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  306.082554][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[  306.097514][   T13] veth1_macvtap: left promiscuous mode
[  306.099527][   T13] veth0_macvtap: left promiscuous mode
[  306.101747][   T13] veth1_vlan: left promiscuous mode
[  306.103597][   T13] veth0_vlan: left promiscuous mode
[  306.287026][   T47] empeg 9-1:1.0: probe with driver empeg failed with error -71
[  306.299590][   T47] usb 9-1: USB disconnect, device number 5
[  306.608661][   T13] team_slave_1 (unregistering): left allmulticast mode
[  306.613529][   T13] team0 (unregistering): Port device team_slave_1 removed
[  306.653491][   T13] team_slave_0 (unregistering): left allmulticast mode
[  306.657339][   T13] team0 (unregistering): Port device team_slave_0 removed
[  306.869661][   T56] Bluetooth: hci1: command tx timeout
[  306.980162][T13731] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3168'.
[  306.996939][T13731] netlink: 336 bytes leftover after parsing attributes in process `syz.7.3168'.
[  307.456145][T13697] bridge0: port 2(bridge_slave_1) entered blocking state
[  307.459417][T13697] bridge0: port 2(bridge_slave_1) entered disabled state
[  307.462660][T13697] bridge_slave_1: entered allmulticast mode
[  307.466846][T13697] bridge_slave_1: entered promiscuous mode
[  307.474882][T13747] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3175'.
[  307.530298][T13697] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  307.536910][T13697] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  307.592458][T13697] team0: Port device team_slave_0 added
[  307.596504][T13697] team0: Port device team_slave_1 added
[  307.642753][T13697] batman_adv: batadv0: Adding interface: batadv_slave_0
[  307.656039][T13697] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  307.675674][T13697] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  307.682099][T13697] batman_adv: batadv0: Adding interface: batadv_slave_1
[  307.684551][T13697] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  307.702597][T13697] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  307.779981][T13697] hsr_slave_0: entered promiscuous mode
[  307.782910][T13697] hsr_slave_1: entered promiscuous mode
[  307.785646][T13761] sctp: [Deprecated]: syz.7.3178 (pid 13761) Use of int in max_burst socket option.
[  307.785646][T13761] Use struct sctp_assoc_value instead
[  307.863344][   T13] ------------[ cut here ]------------
[  307.865174][   T13] WARNING: net/ipv6/xfrm6_tunnel.c:341 at xfrm6_tunnel_net_exit+0x7e/0x100, CPU#0: kworker/u8:1/13
[  307.869154][   T13] Modules linked in:
[  307.871495][   T13] CPU: 0 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full) 
[  307.876021][   T13] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  307.879371][   T13] Workqueue: netns cleanup_net
[  307.881386][   T13] RIP: 0010:xfrm6_tunnel_net_exit+0x7e/0x100
[  307.883568][   T13] Code: 38 97 d4 f7 4b 83 3c 2c 00 75 19 e8 ac ee 6e f7 49 81 fd f8 07 00 00 74 1d e8 9e ee 6e f7 49 83 c5 08 eb c9 e8 93 ee 6e f7 90 <0f> 0b 90 49 81 fd f8 07 00 00 75 e3 48 81 c3 00 08 00 00 45 31 f6
[  307.890983][   T13] RSP: 0018:ffffc90000107890 EFLAGS: 00010293
[  307.893651][   T13] RAX: ffffffff8a516d6d RBX: ffff88802a0d8000 RCX: ffff88801ceb0000
[  307.896378][   T13] RDX: 0000000000000000 RSI: ffffffff8db9fc34 RDI: ffff88802a0d8000
[  307.898981][   T13] RBP: ffffc90000107990 R08: ffffffff8fc35977 R09: 1ffffffff1f86b2e
[  307.901950][   T13] R10: dffffc0000000000 R11: fffffbfff1f86b2f R12: ffff88802a0d8000
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[  307.904699][   T13] R13: 0000000000000000 R14: ffff888024aa0000 R15: dffffc0000000000
[  307.907650][   T13] FS:  0000000000000000(0000) GS:ffff8880b83fc000(0000) knlGS:0000000000000000
[  307.911076][   T13] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  307.913410][   T13] CR2: 000055c65570f000 CR3: 000000003b254000 CR4: 00000000000006f0
[  307.916436][   T13] Call Trace:
[  307.917739][   T13]  <TASK>
[  307.918814][   T13]  ops_undo_list+0x49a/0x990
[  307.920825][   T13]  ? __pfx_ops_undo_list+0x10/0x10
[  307.923035][   T13]  ? do_raw_spin_unlock+0x4d/0x240
[  307.925289][   T13]  cleanup_net+0x4d8/0x820
[  307.927293][   T13]  ? __pfx_cleanup_net+0x10/0x10
[  307.929444][   T13]  ? _raw_spin_unlock_irq+0x23/0x50
[  307.931688][   T13]  ? process_scheduled_works+0x9ef/0x17b0
[  307.934102][   T13]  ? process_scheduled_works+0x9ef/0x17b0
[  307.936663][   T13]  process_scheduled_works+0xae1/0x17b0
[  307.938963][   T13]  ? __pfx_process_scheduled_works+0x10/0x10
[  307.941471][   T13]  worker_thread+0x8a0/0xda0
[  307.943486][   T13]  kthread+0x711/0x8a0
[  307.945243][   T13]  ? __pfx_worker_thread+0x10/0x10
[  307.947600][   T13]  ? __pfx_kthread+0x10/0x10
[  307.949567][   T13]  ? _raw_spin_unlock_irq+0x23/0x50
[  307.951758][   T13]  ? lockdep_hardirqs_on+0x9c/0x150
[  307.954159][   T13]  ? __pfx_kthread+0x10/0x10
[  307.956457][   T13]  ret_from_fork+0x4bc/0x870
[  307.958822][   T13]  ? __pfx_ret_from_fork+0x10/0x10
[  307.960990][   T13]  ? __switch_to_asm+0x39/0x70
[  307.962924][   T13]  ? __switch_to_asm+0x33/0x70
[  307.964906][   T13]  ? __pfx_kthread+0x10/0x10
[  307.966708][   T13]  ret_from_fork_asm+0x1a/0x30
[  307.968696][   T13]  </TASK>
[  307.970049][   T13] Kernel panic - not syncing: kernel: panic_on_warn set ...
[  307.973076][   T13] CPU: 0 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full) 
[  307.976827][   T13] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  307.980891][   T13] Workqueue: netns cleanup_net
[  307.982831][   T13] Call Trace:
[  307.984240][   T13]  <TASK>
[  307.985437][   T13]  dump_stack_lvl+0x99/0x250
[  307.987195][   T13]  ? __asan_memcpy+0x40/0x70
[  307.989168][   T13]  ? __pfx_dump_stack_lvl+0x10/0x10
[  307.991388][   T13]  ? __pfx__printk+0x10/0x10
[  307.993348][   T13]  vpanic+0x237/0x6d0
[  307.995046][   T13]  ? __pfx_vpanic+0x10/0x10
[  307.996985][   T13]  ? is_bpf_text_address+0x26/0x2b0
[  307.999144][   T13]  panic+0xb9/0xc0
[  308.000780][   T13]  ? __pfx_panic+0x10/0x10
[  308.002688][   T13]  __warn+0x334/0x4c0
[  308.004327][   T13]  ? xfrm6_tunnel_net_exit+0x7e/0x100
[  308.006554][   T13]  ? xfrm6_tunnel_net_exit+0x7e/0x100
[  308.008845][   T13]  report_bug+0x2be/0x4f0
[  308.010592][   T13]  ? xfrm6_tunnel_net_exit+0x7e/0x100
[  308.012787][   T13]  ? xfrm6_tunnel_net_exit+0x7e/0x100
[  308.015039][   T13]  ? xfrm6_tunnel_net_exit+0x80/0x100
[  308.017280][   T13]  handle_bug+0x84/0x160
[  308.019044][   T13]  exc_invalid_op+0x1a/0x50
[  308.020876][   T13]  asm_exc_invalid_op+0x1a/0x20
[  308.022812][   T13] RIP: 0010:xfrm6_tunnel_net_exit+0x7e/0x100
[  308.025209][   T13] Code: 38 97 d4 f7 4b 83 3c 2c 00 75 19 e8 ac ee 6e f7 49 81 fd f8 07 00 00 74 1d e8 9e ee 6e f7 49 83 c5 08 eb c9 e8 93 ee 6e f7 90 <0f> 0b 90 49 81 fd f8 07 00 00 75 e3 48 81 c3 00 08 00 00 45 31 f6
[  308.033019][   T13] RSP: 0018:ffffc90000107890 EFLAGS: 00010293
[  308.035600][   T13] RAX: ffffffff8a516d6d RBX: ffff88802a0d8000 RCX: ffff88801ceb0000
[  308.038833][   T13] RDX: 0000000000000000 RSI: ffffffff8db9fc34 RDI: ffff88802a0d8000
[  308.041969][   T13] RBP: ffffc90000107990 R08: ffffffff8fc35977 R09: 1ffffffff1f86b2e
[  308.045163][   T13] R10: dffffc0000000000 R11: fffffbfff1f86b2f R12: ffff88802a0d8000
[  308.048379][   T13] R13: 0000000000000000 R14: ffff888024aa0000 R15: dffffc0000000000
[  308.051546][   T13]  ? xfrm6_tunnel_net_exit+0x7d/0x100
[  308.053743][   T13]  ops_undo_list+0x49a/0x990
[  308.055617][   T13]  ? __pfx_ops_undo_list+0x10/0x10
[  308.057777][   T13]  ? do_raw_spin_unlock+0x4d/0x240
[  308.059977][   T13]  cleanup_net+0x4d8/0x820
[  308.061867][   T13]  ? __pfx_cleanup_net+0x10/0x10
[  308.063976][   T13]  ? _raw_spin_unlock_irq+0x23/0x50
[  308.066191][   T13]  ? process_scheduled_works+0x9ef/0x17b0
[  308.068527][   T13]  ? process_scheduled_works+0x9ef/0x17b0
[  308.070913][   T13]  process_scheduled_works+0xae1/0x17b0
[  308.073238][   T13]  ? __pfx_process_scheduled_works+0x10/0x10
[  308.075733][   T13]  worker_thread+0x8a0/0xda0
[  308.077682][   T13]  kthread+0x711/0x8a0
[  308.079392][   T13]  ? __pfx_worker_thread+0x10/0x10
[  308.081449][   T13]  ? __pfx_kthread+0x10/0x10
[  308.083312][   T13]  ? _raw_spin_unlock_irq+0x23/0x50
[  308.085397][   T13]  ? lockdep_hardirqs_on+0x9c/0x150
[  308.087527][   T13]  ? __pfx_kthread+0x10/0x10
[  308.089400][   T13]  ret_from_fork+0x4bc/0x870
[  308.091303][   T13]  ? __pfx_ret_from_fork+0x10/0x10
[  308.093382][   T13]  ? __switch_to_asm+0x39/0x70
[  308.095261][   T13]  ? __switch_to_asm+0x33/0x70
[  308.097158][   T13]  ? __pfx_kthread+0x10/0x10
[  308.099026][   T13]  ret_from_fork_asm+0x1a/0x30
[  308.100971][   T13]  </TASK>
[  308.103057][   T13] Kernel Offset: disabled
[  308.104884][   T13] Rebooting in 86400 seconds..

VM DIAGNOSIS:
20:38:45  Registers:
info registers vcpu 0

CPU#0
RAX=1ffffffff3401e60 RBX=00000000000003fd RCX=0000000000000000 RDX=00000000000003fd
RSI=0000000000000000 RDI=0000000000000020 RBP=ffffffff9a00f830 RSP=ffffc90000106fd0
R8 =ffff888106b08237 R9 =1ffff11020d61046 R10=dffffc0000000000 R11=ffffffff8556ddd0
R12=dffffc0000000000 R13=0000000000000000 R14=ffffffff9a00f5a0 R15=0000000000000000
RIP=ffffffff8556de47 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 0000000000000000 ffffffff 00c00000
GS =0000 ffff8880b83fc000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000001000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000055c65570f000 CR3=000000003b254000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=06fc2dac79bf3350 31f9bb8ec8004f67
XMM02=00000000ea000000 0000000139001501 XMM03=83561c9bafe50ce5 5e8f066200000000
XMM04=98024f02400800ba 000003ff02ffff02 XMM05=fca9a681c6f99284 66541423d2de2363
XMM06=3ab6471b5a3ec6f3 51a94a17717f0005 XMM07=e6802a063905e9e9 98024f02400800ba
XMM08=000003ff02ffff02 83561c9bafe50ce5 XMM09=0000000000000000 00007f7895612fed
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
info registers vcpu 1

CPU#1
RAX=b4a3d6963c235e00 RBX=ffffffff90628001 RCX=b4a3d6963c235e00 RDX=0000000000000001
RSI=ffffffff8dd8de2b RDI=ffffffff8c03da60 RBP=ffff888112632858 RSP=ffffc90003c67748
R8 =ffffc90003c67e18 R9 =0000000000000000 R10=ffffc90003c67898 R11=fffff5200078cf15
R12=0000000000000001 R13=0000000000000001 R14=ffffffff8e33d320 R15=ffff888112631d00
RIP=ffffffff819e1015 RFL=00000282 [--S----] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 ffffffff 00c00000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 ffffffff 00c00000
FS =0000 00007f2945558380 ffffffff 00c00000
GS =0000 ffff8881a39fc000 ffffffff 00c00000
LDT=0000 0000000000000000 ffffffff 00c00000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe0000048000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000055c65570ee48 CR3=0000000113cfe000 CR4=000006f0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000600
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=0000000000000000 0000000000000000 XMM01=0000000000000000 0000000000000000
XMM02=0000000000000000 0000000000000000 XMM03=0000000000000000 0000000000000000
XMM04=ffff000000000000 0000000000ff0000 XMM05=0000000000000000 0000000000000000
XMM06=0000000000000000 0000000000000000 XMM07=0000000000000000 0000000000000000
XMM08=0000000000000000 0000000000000000 XMM09=0000000000000000 0000000000000000
XMM10=0000000000000000 0000000000000000 XMM11=0000000000000000 0000000000000000
XMM12=0000000000000000 0000000000000000 XMM13=0000000000000000 0000000000000000
XMM14=0000000000000000 0000000000000000 XMM15=0000000000000000 0000000000000000
