last executing test programs:

2m34.8453713s ago: executing program 2 (id=1281):
syz_mount_image$iso9660(&(0x7f0000000040), &(0x7f0000000180)='./file1\x00', 0x2000c12, &(0x7f00000007c0)=ANY=[], 0x1, 0xa2f, &(0x7f00000018c0)="$eJzs3c1vXFdfB/DvHduJH/chydOGUqK2nqQkdVvj2A5NiLooiT1JXPyCbEdqxKIpjYOiGAotSG2F1FRCrFqBBGIBu4oVq0rdUBaoGwQ7umKBhPovVKzCyujOjO2xPeNxjGO76edjzcx9+d1zfnfuy/HM3JkTflxWjm8YW1mp33Y5fvMf9yFjDrGrk99/+dUX5e2zBzmSnrxe/FPSn6Sa9CZ5LumbmJyfm+lS0P3kdpJvkyLJ0TQed+R2ir/Mz9fHv03x92W9HR3Zacl0s8JP2kHvfwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcBgVE5Ojo2PFkUzN3ny72pBUt5iYnJ8rsrKydc7qMg3f1Hv9Lr7pWm9SlLf096929f3cyfXZzyapnsnzjbHn6x2Spz+fPPXsiTee6a2sLt8pm/+Xozsv9sOPP7n/7vLy0gdt5xbFHmZ1yDT2keu12amFuamZK9dr1amFuerlixdHz9+4tlC9NjVdW7i1sFibqU7M164szs1XhyZeqY5dvnyhWhu5NXdz9vrkyHRtdeKlXx8fHb1YfWvkd2pX5hfmZs+/NbIwcWNqenpq9no9ppxdxlwqd8TfnlqsLtauzFSrd+8tL13YlFlPNu2/ZdBYt/Upg8a7BY2Pjo+PjY2Pj33W7D17bcLF1y+/fml0tHd0k2yJeEw7LYfLzzpv5r0/icMuVRrtfzKdqczmZt5Ote3fRCYzn7nMdJjftNr+nz1f27batLT/zVa+t2X+qfLuTF5sjvZ3aP875LJ/fx/m43yS+3k3y1nOUj448Iz29+96apnNVBYyl6nM5Ep9SrU5pZrLuZiLGc07uZHBLKQ31zKV6dSykFtZyGJq9T1qIvOp5UoWM5f5VDOUibySasZyOZdzIdXUMpJbmcvNzOZ6JnOlXsrd3Ks/7xe2yXEtaGwnQePbBG1pzB+5/a9t/ueEJ1Bl2638GM7isDsrzfb/SPfQoYn9SAgAAADYc7/67zl28ul/+++kyAv1z+WvTU3XRg86LQAAAGAP1S/Xe7586CuHXkjh9T8AAAA8aYr6d+yKJAMZbAytfhPKmwAAAADwhKh//v9iisH1CV7/AwAAwBOm+2/sd40ohld//rd6p/F4pxnRGCsGrk1N10Ym5qbfGMu5+q8M1L9psKW0nqToq3/94NWcbkSdHmg8DqyXWNbZX0aNjbwxlldzprkiQy+VDy8NtYkcb0S+3Ih8uTWyJxsiL5SRAPCkO7NNe7zT9v/VDDcihk/Vm/zeUxva4J56yzqqZQWAw2Ktj53/bXZp1qb9b0a82Kn9/41tXv+XEU/n7mDjkoKRvJf3s5w7GU7zioPBdqWu9kbQuAxhuMu7AQPNSxa+u1TJ8Jb3A/rX1rU1dinjGW77jkBLucVqDhcacT2PZxsAwH47s207vNb+927X/g9v//q/pc11SSEAHAZrPdg/6sDgzoMPeh0BgI200gAAAAAAAAAAAAAAAAAAAAAAAAAAALD3dvQD/v9xLlleXkp221lAm4Hv/vWff6ljzOdPJf2PkuH2A5XsTc6Hf6AnyUHV/mYeealyGx+Wp87AxoEDPjEBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwL4qkp930SnI0yWiS8/uf1ePz4KAT2CvV3S1WPMzDfJRje50OAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMBPXfP3/ytpPD7VmJTeSnI2ye0kv3vQOT6K/i7zH+5THofPH9TvW37/v5L0ZaVIb2Ozp+ibmJyfmyl3heJoOf/7L7/6orx1LPLT1YGtvSqUBZQ1bOhcollDy5S+jUv9or7UwOTSh/f/5P0/qk5ere+YVxevTU/OXJ//rfXAZ4uvG10gtHaDsJrvn539l79qmXykWfnX5Zq2t7nea/V6J7fW+yvtlu5Q7w7cW14aL2tarL29+Kd/WGmd9XROJy8NJUMba/r98tahptObn8+Nih+KvyiO5W9zu779y2ejWCnKTXS8vv4/u3tveWnkvfeX76zl9Om9j1oKOJHBJHc2HmVdchqsn0/aqu91lb6y1tF6UHl3skt522opcWz9ed2wDr+o7zIDj7QO1c7rUNfleW9mdGFzRivlQfLXf/xMzm27pY+2KfFclxrbKn4o/qu4kf/Mn7f0/1Ept//ZtD062xRRj2zZU1rnbTi8KmfX13y8dcY7m8vseFTyGHye38tvrm3/Ssv5v7mtOhw3a+ejN1smdjhuVg+tbY6Llhq3HBdN3Y6LrUfqPxzf0qKsqx9GJze1SM2zT6dlmnmebER1yPOX81rSe+qRziivdTmjdFt+t8f/3xVD+Z880P8PAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABw+BVJT7vpleRskhNJjpfj1WRlc8yDXdRXGSh2k+ae2U3OPz5FxxUtHuZhPsqx/c4IAAAAAAAAgMfj6uT3X371RXmrfx7fk1+rNOdUk94kJ4q/6ZuYnJ+b6VJQX3J79SP9/vYhHSbndnn38/Xxb8ux57rUd7CXDwDAj9r/BQAA//+CGm1g")
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000)=0x2eb4, 0x2000007ff)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)

2m34.744752219s ago: executing program 2 (id=1282):
r0 = syz_open_dev$video4linux(&(0x7f0000000100), 0x2, 0x100)
ioctl$VIDIOC_SUBDEV_S_SELECTION(r0, 0xc040563e, &(0x7f0000000140)={0x1, 0x0, 0x0, 0x1, {0x7, 0x6, 0xfc53, 0xa39b}})

2m34.744444179s ago: executing program 2 (id=1283):
bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb3, 0x7f}, 0x48)
r0 = socket(0x10, 0x803, 0x0)
sendmsg$SMC_PNETID_GET(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0)
getsockname$packet(r0, &(0x7f0000000180)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000b80)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="6c0000001000370403000000ffffffff00000000", @ANYRES32=r1, @ANYBLOB="0b1b0500000000004c0012800b00010069703667726500003c00028008000100", @ANYRES32=r1, @ANYBLOB="14000600fe80000000000000000000000000003614000700fe"], 0x6c}, 0x1, 0x0, 0x0, 0x48800}, 0x4000014)

2m34.680359954s ago: executing program 2 (id=1284):
syz_mount_image$ext4(&(0x7f0000000380)='ext4\x00', &(0x7f0000000280)='./mnt\x00', 0x840, &(0x7f0000000140)={[{@test_dummy_encryption_v1}, {@max_dir_size_kb={'max_dir_size_kb', 0x3d, 0x2}}]}, 0x1, 0x241, &(0x7f0000000540)="$eJzs3U9oFFccB/DfzO42TbKUtL0UCm2hlNIGQnor9JJeWgiUEEoptIUUES9KIsQEb4knLx70rJKTlyDejB4ll+BFETxFzSFeBA0eDB70sDI7iUSz/oGJO+J8PjC7M7vvze8Ns983exkmgMoaiIiRiKhFxGBENCIi2dngm3wZ2Npc6F2ZiGi1/nyYtNvl27ntfv0RMR8RP0fEcprEwXrE7NK/649Xf//+xEzju3NL//R29SC3bKyv/bF5duz4xdGfZq/fvD+WxEg0XziuvZd0+KyeRHz2Loq9J5J62SPgbYwfvXAry/3nEfFtO/+NSCM/eSenP1puxI9nXtX31IMbX3ZzrMDea7Ua2TVwvgVUThoRzUjSoYjI19N0aCj/D3+71pcempo+MnhgamZyf9kzFbBXmhFrv13uudT/Uv7v1fL8Ax+uLP9/jS/eydY3a2WPBuimLP+D/8/9EPIPlSP/UF3yD9Ul/1Bdr8t/WtKYgO5w/Yfqkn+oLvmH6pJ/qC75h+ramX8AoFpaPWXfgQyUpez5BwAAAAAAAAAAAAAAAAAA2G2hd2Vie+lWzaunIzZ+jYh6p/q1recQfNx+7XuUZM2eS/Juhfz3dcEdFHS+5LuvP7lbbv1rX5Vbf24yYv5YRAzX67t/f0nh52B8+obvG/sKFijol7/Lrf90sdz6o6sRV7L5Z7jT/JPGF+33zvNPMzt/BesfflJwBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHTNswAAAP//ceptKw==")
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./lower1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./lower2\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./upper\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./work\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mnt\x00', 0x1ff)
mount(0x0, &(0x7f00000002c0)='./mnt\x00', &(0x7f0000000340)='overlay\x00', 0x0, &(0x7f0000000380)='lowerdir=lower1:lower2,upperdir=upper,workdir=work,index=on,nfs_export=on,uuid=off\x00')

2m34.531546757s ago: executing program 2 (id=1285):
syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f010400000009058303"], 0x0)

2m34.020475308s ago: executing program 2 (id=1286):
r0 = syz_open_dev$video4linux(&(0x7f0000000000), 0xfa86, 0xe2182)
ioctl$VIDIOC_SUBDEV_S_FMT(r0, 0xc0585605, &(0x7f0000000140)={0x1, 0x0, {0xfffffffd, 0xb77, 0x1011, 0x0, 0xa, 0x9, 0x0, 0xa4de36948e08189d}})

2m33.849527788s ago: executing program 32 (id=1286):
r0 = syz_open_dev$video4linux(&(0x7f0000000000), 0xfa86, 0xe2182)
ioctl$VIDIOC_SUBDEV_S_FMT(r0, 0xc0585605, &(0x7f0000000140)={0x1, 0x0, {0xfffffffd, 0xb77, 0x1011, 0x0, 0xa, 0x9, 0x0, 0xa4de36948e08189d}})

1m53.97210129s ago: executing program 1 (id=1723):
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$PIO_UNIMAP(r0, 0x4b67, 0x0)

1m53.971401648s ago: executing program 1 (id=1724):
syz_mount_image$minix(&(0x7f00000000c0), &(0x7f0000000600)='./file1\x00', 0x800000, &(0x7f0000000100)=ANY=[], 0xfc, 0x234, &(0x7f0000000640)="$eJzs279rE2Ecx/HPXS7pNdpWrDqIQlGsLjb+mBxE3Tr1H+hU2qjFE6tVsEWwWdRB6OTm4iQIDo4idRMn/wAHwU0pdgg4OfTkzvvR5JLmB5ecpO/X0ueez/Pkee7oJd82iQDsWVc1IUOGCt7BMfvA+riR9ZYA9Ikb/Ny23JgZhgAG282RrHcAIBtb16SXp6Rf1UfzyhXCssCrAL5tStqYfKo1Bbk5JOn1F8mK6oetinTUCnLD1nB9ffFKOh3ON4q14UNbqkjFKN+3IxyWKq7/+GdOhuvv14hGNZb38oMaD9ZfiOYfaVnvWJ2XSAAADBxDU63yXQeYur7olM81zfN+fr5pXvDzCy3yi9HxUNSafTHz4IN7edvLp+bvOAu7bRNAA2YX9//X43E71+L+t5rc//V/JwDov+WV1VtzjuM+lvxG+V7QEzTC/wjEPbnEmFQa4XsObQwO36FMRN5j7OjJJaevTybPPb2zMOONjUnqzYX6jxtqEH2f/ndNoh6zF1e+pnHi558nS8/fvW9n8NsOlzCj37rZjXK1boxMqYfnNZG4C+Ycu73pxprrdrhow6eL+MMBdtrPRAD6rXT/9lJpeWX17GJO0o1yPnzBn/6x6Vf2pZr6Pp/dTgGkLX7Rb5RWEj1u7eHMp8+/q5fePOti5SuSPha7mAgAAAAAAAAAAAAAAOoc0uGstwAAAACgT5Lf/rk7mvZXl7I+RwAAAAAAAAAAAAAAAAAABs3fAAAA///PtQqI")
truncate(&(0x7f0000000940)='./file1\x00', 0x2fffffd)

1m53.889031046s ago: executing program 1 (id=1725):
r0 = socket(0xa, 0x3, 0x3a)
setsockopt$MRT6_ADD_MFC(r0, 0x29, 0xcc, &(0x7f0000000280)={{0xa, 0x0, 0x0, @loopback}, {0xa, 0x0, 0x0, @mcast2}, 0x0, {[0x1, 0x0, 0x0, 0x0, 0x9]}}, 0x5c)

1m53.888818784s ago: executing program 1 (id=1726):
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x400000000004, 0x7, &(0x7f0000006680))
inotify_init()

1m53.814020243s ago: executing program 1 (id=1728):
bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x3, 0xc, &(0x7f0000000400)=@raw=[@generic={0xb7, 0x2, 0x0, 0x0, 0x2}, @generic={0x73, 0xa, 0x2, 0xffc0}, @generic={0x18, 0x2, 0x0, 0x0, 0x100000a}, @generic, @generic={0x18, 0x2, 0x0, 0x0, 0x100000a}, @generic, @generic={0xbf, 0x2, 0xa}, @generic={0x7, 0x2, 0x0, 0x0, 0xffffffc0}, @generic={0xb7, 0x3, 0x0, 0x0, 0x40}, @generic={0xb7, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x45}, @generic={0x95}], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

1m53.813873789s ago: executing program 1 (id=1729):
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x1ff, 0x1501)
ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0xe1, &(0x7f00000004c0)={0x20, 0x3, 0x16, 0x2}, 0x8, 0x1, 0x8, 0x0, 0x0, 0xfffffffe, 0x0})
ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0)

1m37.692113419s ago: executing program 33 (id=1729):
r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x1ff, 0x1501)
ioctl$USBDEVFS_SUBMITURB(r0, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0xe1, &(0x7f00000004c0)={0x20, 0x3, 0x16, 0x2}, 0x8, 0x1, 0x8, 0x0, 0x0, 0xfffffffe, 0x0})
ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550d, 0x0)

1m17.977708971s ago: executing program 3 (id=2112):
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x72, 0x0, 0x7fff0000}]})
close_range(r0, 0xffffffffffffffff, 0x0)
r1 = syz_create_resource$binfmt(&(0x7f00000001c0)='./file0\x00')
openat$binfmt(0xffffffffffffff9c, r1, 0x42, 0x1ff)
r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
truncate(&(0x7f0000000180)='./file0\x00', 0x8fff5)
sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x4044000)
bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000240)=[0x4, 0x8], 0x0, 0x0, 0x12, 0x1}}, 0x40)
mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x8, 0x10012, r0, 0x0)

1m17.913594176s ago: executing program 3 (id=2113):
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./sys/bus/usb/devices/usb2/power/autosuspend_delay_ms\x00', 0x1, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
write$binfmt_format(r0, &(0x7f00000000c0)='0\x00', 0x2)

1m17.913391103s ago: executing program 3 (id=2114):
syz_mount_image$vfat(&(0x7f0000000100), &(0x7f0000000780)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x17f18a1, 0x0, 0x83, 0x0, &(0x7f0000000480))

1m17.8393569s ago: executing program 3 (id=2115):
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4)
sendto$inet(r0, 0x0, 0x0, 0xc806, &(0x7f0000000180)={0x2, 0x4e1d, @dev={0xac, 0x14, 0x14, 0x34}}, 0x10)
sendto$inet(r0, &(0x7f0000000100)='J', 0xfdbe, 0x4004084, 0x0, 0x11000a00)

1m17.839219365s ago: executing program 3 (id=2116):
ppoll(0x0, 0x0, &(0x7f0000000140)={0x7fffffffffffffff}, 0x0, 0x4a)

1m16.897299715s ago: executing program 3 (id=2129):
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$TIOCGSOFTCAR(r0, 0x5414, &(0x7f0000000040))

1m0.833558032s ago: executing program 34 (id=2129):
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$TIOCGSOFTCAR(r0, 0x5414, &(0x7f0000000040))

51.818211634s ago: executing program 4 (id=2365):
inotify_init1(0x80000)
select(0x40, &(0x7f0000000680)={0x7, 0x800, 0x80, 0x6, 0xfffffffffffffffb, 0x34, 0x3}, 0x0, &(0x7f0000000700)={0xf, 0x8, 0x40, 0x5, 0x1, 0xac, 0xed6f, 0xe21}, &(0x7f0000000740)={0x0, 0xea60})

51.731993361s ago: executing program 4 (id=2370):
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e)
sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0)
pselect6(0x40, &(0x7f0000000100)={0x0, 0xd, 0x0, 0x1, 0x800, 0xffffffff}, 0x0, &(0x7f0000000240)={0x1f, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000738000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000530000/0x3000)=nil, 0x0, 0x0, r1}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x400c804)
r2 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1})
pselect6(0x40, &(0x7f0000000100), &(0x7f0000000000)={0x1f}, 0x0, 0x0, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1a00000004"], 0x50)
io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0)

50.779423353s ago: executing program 4 (id=2390):
r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x5dc0, 0x48502)
r1 = syz_open_dev$usbmon(&(0x7f0000000380), 0xffffffffffffdffb, 0x101000)
dup3(r1, r0, 0x0)

50.705852795s ago: executing program 4 (id=2394):
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0)
mount$bind(&(0x7f0000000040)='.\x00', &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x2a05404, 0x0)
mount$bind(&(0x7f0000000200)='.\x00', &(0x7f0000000500)='./file0/../file0/file0\x00', 0x0, 0x2127099, 0x0)
mount$bind(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x84000, 0x0)

50.640634196s ago: executing program 4 (id=2397):
openat$panthor(0xffffffffffffff9c, &(0x7f0000002bc0), 0x2, 0x0)
r0 = syz_io_uring_setup(0xefd, &(0x7f0000000400)={0x0, 0x1000595f, 0x10000, 0xfffffffe, 0x51}, &(0x7f00000000c0)=<r1=>0x0, &(0x7f0000000000)=<r2=>0x0, &(0x7f0000000080)=<r3=>0x0)
syz_io_uring_submit(r1, r2, r3, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10, 0x0, {0x0, 0x0, 0x0, '\x00', 0x0}})
io_uring_enter(r0, 0x2000, 0x1, 0x9, 0x0, 0x0)

50.246512474s ago: executing program 4 (id=2408):
r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
setsockopt$WPAN_SECURITY(r0, 0x0, 0x1, &(0x7f0000000080)=0x1, 0x4)
getsockopt$WPAN_SECURITY(r0, 0x0, 0x1, 0x0, &(0x7f0000000040))

50.166130803s ago: executing program 35 (id=2408):
r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
setsockopt$WPAN_SECURITY(r0, 0x0, 0x1, &(0x7f0000000080)=0x1, 0x4)
getsockopt$WPAN_SECURITY(r0, 0x0, 0x1, 0x0, &(0x7f0000000040))

42.413169745s ago: executing program 6 (id=2482):
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0xe97, &(0x7f0000001080))
brk(0x800000000002)

42.281968767s ago: executing program 6 (id=2483):
timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=<r0=>0x0)
r1 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0)
sendfile(r1, r2, 0x0, 0x20000023896)
ioctl$TCSETSF(r1, 0x5404, &(0x7f0000000000)={0xf, 0x3e, 0x6, 0x3, 0x2, "a0e1c601283700"})
close(0x3)
fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5})
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1)
timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0)

42.208414014s ago: executing program 6 (id=2486):
r0 = socket$kcm(0x2, 0x200000000000001, 0x106)
sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000240)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004081)
setsockopt$sock_attach_bpf(r0, 0x6, 0xd, &(0x7f00000000c0), 0x4)
setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0x4)

42.098169818s ago: executing program 6 (id=2487):
r0 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r0, 0x80045530, 0x0)

42.097672467s ago: executing program 6 (id=2489):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000280)=0x1, 0x4)
connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x2000000, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c)
sendmmsg$inet6(r0, &(0x7f0000005640)=[{{0x0, 0x0, &(0x7f0000004140)=[{&(0x7f00000007c0)="4b000ffd096c1b77cd99b1000009c4b82100375ca9411e734cc8e9627df29e9b97a002d7f15ea9f42bd71401384ed6b5772b5c618c35c4aab72b1d515ceada9e64d7a35fd435e98f06243fcd53966c196ff3f47537912a1a5dec7e8e1fbf4543d1a6c80467d6ba3d241e3fd22efa09c638c98b4ce9fbe6d2053fcfa334eaee64efad2d349f048afb2635ae06c05697746fe073ed230c9c091f7d276305424c1c7eaa3ee09891995a607de26be9abcd2b65a4f9093da8a07eea61b1ff21ea3b323b191f95b997cfdface3dc21a664e38896f9f689bc06f4800d5c977102358770b0d8425f098be9383b5e487e7165e847191d5e95233e971edd0eb9ae865614e2164f43b968c29910de437d051b7e7bd337f3aa414bda48049ba94d11ba32326eb56575bd72b747591396f7c26b28036952ef6cf8adae9acb1649d599f573f089df51d558fdba120e63db65ec3945f1e9e191ce966eb5693281d9c878f6a27ffef79481510bdd44e7cea15a670a713ea3ee8a488a42e0f63a852d23a37f4146e53829ff02555faf815eedb5ce5af9c2de0ab1e4e32b6d31ab4e98a078908ab5d046e4a6196ffe5c55010a4bb8b80dc993c8f94a9fda", 0x1b5}, {&(0x7f0000000380)="5f62f632763c84825847145170282f67ba6d5dadf0baf135d503e93a17ee5604080000005f0de32b0e53e4d26d04c825d923318fd574b1924b09ebb91d5be30b532a2fb95030c6be2a14ccfbce6eef05ea88cf1b612298d2413dc3fc0ae8a2e071f8764a4843611ae28b340100ddefa8ffed32420677397aa63e880adc56d03d8799429f33741886bd6c4065bba5005d74f67508dc3434165b51bf8f73bf1a7c158d8905e519e8", 0xa7}, {&(0x7f0000000440)="0b0ec2a1e3fc84788983f461fec27348bd54a57f68a85a0200ad43c367bae5f7bd6c1e1d9017109e232e5b1f1b8b9acdc89d4d5725350a9ec9303e53def89bcb6bb6ea83324927b43749f25be60c4f8707382b8e3062032c28dcccbd55e05bf1cca4db828a5be79e518cf55a88e130609528b8437cdf76d793584aad3f751172c449fb00"/154, 0x9a}, {&(0x7f00000024c0)="a66554178426362975b882a7d6b43fe537b6b0036a966a05363793ec2f6830cc5b81e514b9cbe4c27c3f3a581556b832100a4233e3e80fda14dd84611893300a863a8a6f6d8e0c7633e168ad7e25d4bd14ba6812101488e9444165b8100d576a996fec019ae11a03498329bcbacd0e8a206bd0de0c7e09f64a57d56974599f09aa148b4224dcffe1b5a1e55bbc1fdae8bf2f72437cf399c4cda11554b21158e3ddb00ddb71a1bd1daa50d631b027238397d692214223af1d685e7a3318da65c9233eba674ff72097411ef3ee19b892b1b36eeb925a6698f4d455b02163a3504ee6accffad7aaf9d19763d886272559ef0501594ea2d11397d2b33ad100d3753d45a43e13bba05d7d332750ce5d9d3b37d234f46464fcc5f495e0fae02a24efd67db315c92f9483196bd38b38b3675bc0de5873f9d7b01ee5c564f5573b474e3c9f3b955929d9112007049e4245d68b93f365a90d35c837cc13999f2d6a23be87786e4234d74b1160669c7962b3b413201192565fb93252c153dd735e280e01d13dc34468f67684a4308c7dbe07687e0f56fa54f44b0141895ad75781ca026d813e8c17794b9d87d97136d29aced71b1f526dfab6301b78f1deab7949c97cce6616f4afd46a331e2fb54342dd1964c70a2717f4239c9e5157ac93c42d05f230da440a9227f0f82ee95cc79ca2d3da3f889b37f85f50d75711a910a57d213edb4b981cde33e01ec960885f31511ed7f8e01ddd36d76e1b1e40e81cd21ef9c34134400fdd94e34e5d77f4b7ca3612663e0f6b364be4a9dc775f3b12386ec04960524a9a5e6879e50db657c89a7dc7ec1f919ba8c77e926538599e7969868a5ef3e92817a3402c13de0efcb9fef445ee49f4b0ed26c5dbadff51459d5229661e4b7d2548c9ea4ce89b828daf5f5873e1d9e693ba037fc00ccc3dd74096c0f1ea508ee96ad7d85664947193e011e2f037917af7716d7f27cac25c9785f13baddfeba40997af5f6f4029cf5b781b654a635ee8696078d99025012cbad5af13bc26e2d100726fc98c11f8f16057a8506f29cf30bcf9ab7883ad1708d11bf70ee54fced84c69d90eb302e8aff586c0b25893e09868426cb4649145ede32035c47360fba7fe863cb00b86f583090c5b8d8549ba62cb822ed182fc07f029a826b5c86dccd603408bfc060c80c8ae21be086998f45923e1fe36eea10a66a55cc9f3cb6a296535dabc831fefe26b80ee47c723c596c51e1d7c073df20874eef79a291934c4c6a7c6b656595fc76b25d0d50590c1df29d59842a19a6acd60e783069aa0c21d792129132d590da18e30a70a330e7b05aebf09e93aa545ca382a29f810e8a4efc0fffd3660f76892c2027daccfd743734c359bacaec86e4f15ca31b83894b67b3a3539cb5567bbcacd9a52c9b8d87252ddab0acd3b4fbe21997754874d1c0dbdd373f7150b87893fa4b6c5e6016f2146471f092a2cf4c75b6ed08a2f27f9f68d1817d7e782c0fa3026fd4e283b6b23bff2a9d84f5cdea217ce396080b623fe6d5da91fcab0e563b8c54af99007f6680efc9fdcd35d1d2ad8539ee04744e38c750114de55b80192c5d6aee8cbc34a47426bb22a9e3e2fcb87530c418a65fad7d5fbb15f569a69fc2cb92dad8f574330fdf2aa6033d1be037d5e3e964ff01329c43401bc86a72025288100ce86c053b922e9a7a692912bca4dabfc0e3a8966a65c96d3a420809c2d600928546a4ea26ff7100081f3ca8a70c64b3a4fc33b3e2546ff4a43502d448f2c0b274a244d32c955b02d897b1c53a2724ff886a1ccc91ea3a22dbd1f5f3f2e33db9ac9aae458a27e2a529ac2d8671f0e30df63a5d1a579b8f5a68f4a53fb4f3f76d41bee8e10635606f2a7fde9af7bd0df3ab9750b0c6c962fbc36e9474e3efac01ea98a4fe6e0f819d62dcde2b9b77fb0d430495ee042d1e70a52debb0d13b09906f77327dd4ccfe2b6796f9aa5e5b2fa9b2249c66b49cd7e1cbdb194c239d7e2e0928a45c8c55904cd345c5d8b92a5526ff5135c2e477089eeb16cb3996c243c66a82f4349370ac26bef5d900ec582f274cc38b0258993de6cc79574fdacb895721fd4d04f84c4d89e109629f48a24fb3241882f154a35ae6659e0bb35af409c51cb11a26413be88a1e5ae1e8d2b1333a6c80c42c654f269dd875aa7f19517f62b8e031f11bdb11bafcf4b4f06496142579f7769ee41dd24701cd3ed016030f7d5cf24a4cfdcd9b05e7442bdc81b68b36495b5f4aa44d7c2fdea8703849a17f7d3327086355ca3b36c10eb38556bf95b3575ba32b97f268af1f1347ed28368828124361f6c1e6b64e6ba9efc3094d50bb049c35db5ea2b3c76576b1a8f37da0711436048ae443523032497e542c04458f04cfffd11c53c431065c20e8add72c0c31caeec12d0bf391fa1c0a75e23d39c31da409083f768f545090b05c54084ffc5d7fd85cea725807638f4ab0026204452a8c198cc60133ce00e9a2b9ebeb30d7f33a1bb25cb2948bf44288cce43b6ac13012d8860fce83d9a0f6f1886723f41130466186ac56d5384bfd04fe87c67528996c1ee1ad8e551dda563e75d5dc8ac6a47990a62c915dc23f4ae6596dcfdb44661de969aec7f6d3fa8f05e106a8db7abeb3682bdc8e87aefbb09e642b2cef2919ddc55ded8dbce0606d3c4a0747a293a991b8cd832381c30813b887a22c2df569c12c430cf7471578eb787acab65b54569bece6921805af9ac41b268ce329a25bacdb02f8f3c4ef930f1799ff940f42c21955ddd5496234d62447d1c9d8e0cc7bb8fd5ca5e9fa2ef99105a4d44d6ce37532407fcccc4e71103baa0c7ff1767e05762424d9301294daa95523792cb73b348c41ec713d19c2b917a4dc50be3f0742762e5055cd6ebb3afa2b89a94c6a921e039ddaee98fc7a961a5e415322bd4b333d83768ee8945f29556f94372a16285cb1ff103640d93b837861f1d0d9e65fe35583b6f76889e7d09a2cdf3c2ef305a0f6d205deedee94ac602974fa58284e33aee55947a7a042abf0759ec8c1410493114454320b5003f23dac1c600a471ff09bdbf5bb40be87a69d388592241d9989f0435eeede193e6994b80a2145eca4afb5e691341e37e4580b0c54d7fc506cc9641020cd342a85fe56946e49854756ae6534edd03de881481e11701851f0f30fedbfcf335c3855c8d9541ef234f8718fbb0d9f127093a3e7c1d49d8a20729ab41a0118683b7044ee490d7137bebbbbfb245d5e30356e102eda0052a37cca70c221475b5c596f68c745701dc6e31f7846270bcd516ded5d0b4666b249a32f0acb1b8a7de8e6f007ee740561f64b7f30b4764ec5116a1eda1526225ddd01b1d999ff17d0798be47e3a5957011aa6e03318897ce1c452b78f9badf89098fe696894953581b01ceffc4fa0eefd654df9ea70b1f2f1e287192a5a20a381e8fad0fb99814208970902fdd28cf6a6457d7873a76359e226e5b203bd6f85bea30cb06b5817e1b32fbbbd33a4e67f3771b7256a3a9ec20dae8a248af32a909bb5ec28f0f85722b81151f0f0a500a5c39c36476ac42c30bcb68a61a13141541ec54d895f0d7ca1afb728202e77f2f85170a3c2de378f1cfa0c2d1b0353f5d2fd0537017dc5510232a7a27a444476bbca2b84394639cf8ded35568868f9dcfa445b33c694aa8696d899afdf0d98a542e6a3c0212480ef3063ae0b8bcaa133978e9ebd76a3ccf652b0022b3cc7f1c9f2731c1c08f45fc84f7dade8471f6855e3005d75390e36a6646b8ac0dd5da9f9ef4bc35639ac96280bc47a547c0941af4516278b66469c7fc22932cbb2ac92cc12745bdf4ab4411d48396120f0e397ff6c22c54873296a897928d0158a5e63e6d48016cb4af44a3d71296acffe59241a8537f8b2cbc88b8ee2f4090e8e16b8af4700a60d0c199cc45cedf8dfe9a78ddd8637f7a9cfc16b078b1f9acfb8cb35f94b7564b1e23904e40dd5bdef1c78397457c05dd1108c3257bfda2e36b31969e8642c825c9dafe2fa4ee2708023c26255e6c41c2c873923e98eb1397dbc51324dfbec7943a5564fa815b9492d53c6cf6d42cd07165ae54e81f7989f2e406a13bea4df4d4a6971d81a4492e5703b6ba1f21ca5ffd68cdb15a713abd70d411e64d873b9f36ced7f354273c5c9782dd8a410ac28fee250f4b82095f4ab7a5c5a7d57114b6196cc2accdb44e39351a5d7c2c519ff861db8e4a368fdc1c5459f2b4cef0076d9b57b9ba2e76b3d8b87a515fc5c777d7e8023ef898fcf31365abc3e0a1307fa8", 0xbd5}, {&(0x7f0000000500)="a405df87c6e89abd7ae7e6b8550f9923917c9d38e14a4e9ace3100b805b34d0056282b7ed43e9c6efe6245152417b356ca23162493370e9055e9320279b93aa8f7231ef5c2928c6284654a2204c4c4f8ffdda3684a000000809658c07e3a7c75d219403b0be9379f7b017bd850fd4c3a18d59f735980d1520b641a6fc2a58ba15bce382460c95db8299b404b8d0d5821a4604f59cfa04cd0d4496fc41b951e7f8ed2a6ac350002000000000000babffca7484a82e2b3bd3e55b4a6f01587e997359498ac5b57e8b86fbf5327519ebc68cb81762ebdada6dca6eaee8ac113c10eead6548244be72d5e261f0084329890a01da108431ece9146f6a5f6214c44e05a9750f872bb69b2ac0386c26b78819c32bec4043042e0c8cfc589a077c5e3b062fd0f5a277056779ea21", 0x12a}, {&(0x7f00000030c0)="8ce8c35d7b1affb769fccf", 0xb}], 0x6}}], 0x1, 0xc004041)
mmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r0, 0x604ab000)
getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, &(0x7f0000001380)=""/4080, 0xfffffffffffffdcc, 0x0, 0x0, 0xffffffffffffff87}, &(0x7f0000000000)=0x40)

42.013561906s ago: executing program 6 (id=2492):
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x541c, &(0x7f0000000040))

25.890772196s ago: executing program 36 (id=2492):
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$TIOCL_GETMOUSEREPORTING(r0, 0x541c, &(0x7f0000000040))

13.469513034s ago: executing program 0 (id=2816):
bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x1f, 0x4, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000c500000095"], &(0x7f00000000c0)='GPL\x00', 0x1, 0x0, 0x0, 0x40f00, 0x32, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)

13.340210286s ago: executing program 0 (id=2817):
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@can_delroute={0x48, 0x19, 0x1, 0x0, 0x0, {}, [@CGW_LIM_HOPS={0x5, 0xd, 0x1}, @CGW_MOD_OR={0x15, 0x2, {{{}, 0x0, 0x0, 0x0, 0x0, "03ef7506ecbef970"}, 0x3}}, @CGW_FILTER={0xc}, @CGW_MOD_UID={0x8}]}, 0x48}}, 0x0)

13.340082405s ago: executing program 5 (id=2818):
brk(0x200000ffa000)

13.233419921s ago: executing program 0 (id=2819):
r0 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000040)='ns/uts\x00')
ioctl$NS_GET_USERNS(r0, 0xb701, 0x0)

13.125518193s ago: executing program 0 (id=2820):
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc_mnt\x00', 0x1ff)
mount(0x0, &(0x7f0000000080)='./proc_mnt\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801)
move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0)

13.042765192s ago: executing program 5 (id=2821):
r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x1, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0)
ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000003c0)={'aio_aio12_8\x00', [0x140, 0x0, 0xd, 0x0, 0x2, 0x4, 0x4, 0x2, 0x7, 0x2c731, 0x4000004, 0x7, 0x2009, 0x8, 0x4ce, 0x9e9b, 0x103, 0x80000006, 0x6, 0x0, 0x7, 0x2, 0x2f, 0x81, 0xffd, 0x6, 0xab, 0x1, 0x283, 0x8001, 0x400006]})

13.042636151s ago: executing program 0 (id=2822):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8)

12.98457412s ago: executing program 5 (id=2823):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ac1e0001000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008ffffffff0000000001000601000000004400050000000000000080010000000000000001000000003c00000002000000ac1414aa0000000000000000000000000600000004"], 0xfc}, 0x1, 0x0, 0x0, 0x4008001}, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
sendmsg$inet6(r1, &(0x7f0000000000)={&(0x7f00000001c0)={0xa, 0x4e20, 0x88000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000980)=[@hoplimit={{0x14, 0x29, 0x34, 0x3}}], 0x18}, 0x4ff97)

12.893063757s ago: executing program 5 (id=2824):
r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000300)={<r1=>0xffffffffffffffff}, 0x111, 0x3}}, 0x5c)
write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {r1, 0x2000000a}}, 0x10)

12.892911675s ago: executing program 5 (id=2825):
r0 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41)
ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r0, 0x40146f2c, &(0x7f00000000c0)={0x1, 0x0, 0x0, 0x3, 0x4})
ioctl$DVB_DEMUX_DMX_REMOVE_PID(r0, 0x40026f34, &(0x7f0000000040)=0x1)
ioctl$DVB_DEMUX_DMX_ADD_PID(r0, 0x40026f33, &(0x7f0000000140)=0xc0)

12.749144133s ago: executing program 0 (id=2826):
syz_mount_image$nilfs2(&(0x7f0000000140), &(0x7f0000000f00)='./file1\x00', 0x208800, &(0x7f0000003100)=ANY=[], 0x6, 0xf11, &(0x7f0000001e80)="$eJzs3U9sHNX9APA3a6/txCZeAz8w8COk0IpAwQ5JpKa3IFCPiEvvoJDQCENRQw9E/Ak9ICohioQ4VRyouFAqpUitBKpUoZ7anvrn1hPqhUpVKgX10EZKXNl+b7374mHXY3t27f18pK/fvnmz8/2O13FmxrNvAzCyGqtfjx+fL0J499N3Hn35qeLXK8vuaq9xaPVrEXutEEKzo19k2/s8Lrh6+aVTG7VFOLr6NfXDY5faz50OIVwIh8JnoRU+Wlz68sP3Hjn88etTt7x1/plXdmj32/L9AACAvejiH5f+dt8//vDA3JWLB0+GyfbydHzeiv3peNx/JB4op+PlRujuFx3RaSJbbyxGI1tvLFtvPMszXpKvmW2nWbLeRI98Yx3LNtpPAAAA2I3SeW0rFI2Frn6jsbCwdt6/4vPZiWLhubNLZ84NqFAAAACgsn+/unrTrRBCCCGEqDWaQ1CDEEKIUYrl2UFfgQAAAABGTT5f2HUubO9MXe2ttfrLf+nhxsbPh21Q98+//Lsr/wev+Y0DAEB1e/VoMu1XOo5O8xjk8wiOZc/b7PF/I9vO+CbrLJtXsGt5MbwvU1n9+fd1WJXVv9nXcVDK6s/nwxxWZfXn83QOq7L6J2uuo6qy+qdqrqOqsvr31VxHVWX176+5jqrK6p+uuY6qyuqfqbmOqsrqv6HmOqoqq/9AzXVUVVb/brmttqz+Vs11VFVW/1zNdVRVVv+NNddRVVn9N9VcR1Vl9d9ccx2Dcmds0/fhYDbeef6cn9PtlnM8AAAAGHX/Nf+fEEIIcV2s3gcxBHUIsbejGIIaxFdF++99Q1CLEGLr8epArz4AAAAAwyC9LyC9AX05SuNjPcbH43uJVsen1ldI480ez5/oMT7ZYxwAAAAI4TdvnLnt7WL9ff5bnQ+vY96oa6HCPEb5RHebzb/Vec+2mn+3zFsGAADAaCm+89m1+x99/4W5KxcPnuw4+70Wz3fTPKDj8drAJ7Gf7guYyfpFOoc+2Z2nUbJefn3ghrLtPb7FHQUAAIARls7fW6FoLHScd7dCo7GwsH4+Ph+axZmzS6ePxH76fJbfzzYnV5Y/VHPdAAAAQP/Wz/c3Pv9Pn+M7HyaKhefOLp05t9afaS9vNjqvC8yuLy86rwu0suVHS5Yfi/30+Z3fm923unzh1PeXntrunQcAAIARce7F8888ubR0+gceeOCBB+0Hg/7NBAAAbLcvvnin+cNjM79de///+vx36f3/h2K/Fef2+1NcId0nkN4HcN379Z/ozjNbtt7z3eu1svXGYkxmdU91bGfFvux5c2X5Wt3bmSjJN53lm8ny5fMUjGfrp3wHsuX5/IRpvdlseT4P43iWo8jy3x0AAACg3OILzz6/eO7F8w+effbJp08/ffq5Y0dPfPvEiSMPfeuhxdX7+hc77+4HAAAAdqP1m34HXQkAAAAAAAAAAAAAAAAAAACMrjo+TmzQ+wgAAACj7l+vhhAuCCFE5VieHHwNQgghhBBC7JpY/Wz3+vM2Bn39AQAAABg9Vy+/dCqEqRDCSruBC8W25mtvrbV6RSRcu7yWN7UzD/51biXSapceHut6/v5trYZRdzX+3KW221+2/ed/c/m3/9+f/JvL/8Fr25t/Kj1orTW9f/9ll4xPVst77+LP5zvz3z7eZ/58/x+vlv9wlv/e0F/+5fez/E9Uy39fln9/n/mv2//nq+W/P+afj/3D9/Sbv/v1n4xt2o99feb/Zrb/T4V+82f73+ozYeaBmB8ARtFevQEgHSWk4+jp2E/7Gw83w1j2vM0e/zey7YxvufLu7abjoFtjPx0vzWR5k83WP51t74aKdebyuoZVWf3b9TrutLL6mzXXUVVZ/RM111FVWf2TNddRVVn9UzXXUVVZ/f2ehw5aWf275bpyWf3TNddRVVn9MzXXUVVZ/Zv9f3xQyuo/UHMdVZXVP1tzHVWV1V/xslrtyuqfq7mOqsrqv7HmOqoqq/+mmuuoqqz+m2uuY1DuiG3Z+XA6/5yNY6nfyvqTG3wv9+q1BQAAANht/jmy8//FKx0Dr0MIIYQQuzWmhv1YItmR7Y/v8PZF3fGf5TWDrkMIsXOxvFz3FQeGyc6+mxmAYeX3/2jz+o82r/9o8/rzVdI9/EXWT8Z6jI/3GG/2GJ/IxvOf18ke4zdl211O1zWjm3uM/1+P8QM9xm/tMT7fY/y2HuO39xi/o8c4AAAAo+GW2Do/BAAAgL3r5V988uav7n3i8tyViwdPhonr5p0/EvuT8W/rb8R+Pu990ox/8/9R7P8str+L7d+z9d1/AgAAADsvfU6Mv/8DAADA3pU+p9T5PwAAAOxdc7F1/g8AAAB7142xdf4PAAAAe1gxtfHi2KbrAnfHtt95/QCA4ff/sb0ztgdje1dsvxbbdBxwT2y/XlN9AMD2+el3f3zi7WJ9vv9j2fjVuDy117mwdqWgaHTP5L8vtvtj+40+68k/D6Df/MmBPvPsVP7ZLeYHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPaOxurX48fnixDe/fSdR38y8eafV5bd1V7j0OrXIvZaIYRm+3lpdL3/y7ji1csvnepsr8W2CEdDEYr28vDYpXam6RDChXAofBZa4aPFpS8/fO+Rwx+/PnXLW+efeWUHvwVd+wcAAAB70f8CAAD///o5H8E=")
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0)
syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000001040)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x10010, 0x0, 0x1, 0x0, &(0x7f0000000080))
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x115)
fsync(r0)

12.747270337s ago: executing program 37 (id=2826):
syz_mount_image$nilfs2(&(0x7f0000000140), &(0x7f0000000f00)='./file1\x00', 0x208800, &(0x7f0000003100)=ANY=[], 0x6, 0xf11, &(0x7f0000001e80)="$eJzs3U9sHNX9APA3a6/txCZeAz8w8COk0IpAwQ5JpKa3IFCPiEvvoJDQCENRQw9E/Ak9ICohioQ4VRyouFAqpUitBKpUoZ7anvrn1hPqhUpVKgX10EZKXNl+b7374mHXY3t27f18pK/fvnmz8/2O13FmxrNvAzCyGqtfjx+fL0J499N3Hn35qeLXK8vuaq9xaPVrEXutEEKzo19k2/s8Lrh6+aVTG7VFOLr6NfXDY5faz50OIVwIh8JnoRU+Wlz68sP3Hjn88etTt7x1/plXdmj32/L9AACAvejiH5f+dt8//vDA3JWLB0+GyfbydHzeiv3peNx/JB4op+PlRujuFx3RaSJbbyxGI1tvLFtvPMszXpKvmW2nWbLeRI98Yx3LNtpPAAAA2I3SeW0rFI2Frn6jsbCwdt6/4vPZiWLhubNLZ84NqFAAAACgsn+/unrTrRBCCCGEqDWaQ1CDEEKIUYrl2UFfgQAAAABGTT5f2HUubO9MXe2ttfrLf+nhxsbPh21Q98+//Lsr/wev+Y0DAEB1e/VoMu1XOo5O8xjk8wiOZc/b7PF/I9vO+CbrLJtXsGt5MbwvU1n9+fd1WJXVv9nXcVDK6s/nwxxWZfXn83QOq7L6J2uuo6qy+qdqrqOqsvr31VxHVWX176+5jqrK6p+uuY6qyuqfqbmOqsrqv6HmOqoqq/9AzXVUVVb/brmttqz+Vs11VFVW/1zNdVRVVv+NNddRVVn9N9VcR1Vl9d9ccx2Dcmds0/fhYDbeef6cn9PtlnM8AAAAGHX/Nf+fEEIIcV2s3gcxBHUIsbejGIIaxFdF++99Q1CLEGLr8epArz4AAAAAwyC9LyC9AX05SuNjPcbH43uJVsen1ldI480ez5/oMT7ZYxwAAAAI4TdvnLnt7WL9ff5bnQ+vY96oa6HCPEb5RHebzb/Vec+2mn+3zFsGAADAaCm+89m1+x99/4W5KxcPnuw4+70Wz3fTPKDj8drAJ7Gf7guYyfpFOoc+2Z2nUbJefn3ghrLtPb7FHQUAAIARls7fW6FoLHScd7dCo7GwsH4+Ph+axZmzS6ePxH76fJbfzzYnV5Y/VHPdAAAAQP/Wz/c3Pv9Pn+M7HyaKhefOLp05t9afaS9vNjqvC8yuLy86rwu0suVHS5Yfi/30+Z3fm923unzh1PeXntrunQcAAIARce7F8888ubR0+gceeOCBB+0Hg/7NBAAAbLcvvnin+cNjM79de///+vx36f3/h2K/Fef2+1NcId0nkN4HcN379Z/ozjNbtt7z3eu1svXGYkxmdU91bGfFvux5c2X5Wt3bmSjJN53lm8ny5fMUjGfrp3wHsuX5/IRpvdlseT4P43iWo8jy3x0AAACg3OILzz6/eO7F8w+effbJp08/ffq5Y0dPfPvEiSMPfeuhxdX7+hc77+4HAAAAdqP1m34HXQkAAAAAAAAAAAAAAAAAAACMrjo+TmzQ+wgAAACj7l+vhhAuCCFE5VieHHwNQgghhBBC7JpY/Wz3+vM2Bn39AQAAABg9Vy+/dCqEqRDCSruBC8W25mtvrbV6RSRcu7yWN7UzD/51biXSapceHut6/v5trYZRdzX+3KW221+2/ed/c/m3/9+f/JvL/8Fr25t/Kj1orTW9f/9ll4xPVst77+LP5zvz3z7eZ/58/x+vlv9wlv/e0F/+5fez/E9Uy39fln9/n/mv2//nq+W/P+afj/3D9/Sbv/v1n4xt2o99feb/Zrb/T4V+82f73+ozYeaBmB8ARtFevQEgHSWk4+jp2E/7Gw83w1j2vM0e/zey7YxvufLu7abjoFtjPx0vzWR5k83WP51t74aKdebyuoZVWf3b9TrutLL6mzXXUVVZ/RM111FVWf2TNddRVVn9UzXXUVVZ/f2ehw5aWf275bpyWf3TNddRVVn9MzXXUVVZ/Zv9f3xQyuo/UHMdVZXVP1tzHVWV1V/xslrtyuqfq7mOqsrqv7HmOqoqq/+mmuuoqqz+m2uuY1DuiG3Z+XA6/5yNY6nfyvqTG3wv9+q1BQAAANht/jmy8//FKx0Dr0MIIYQQuzWmhv1YItmR7Y/v8PZF3fGf5TWDrkMIsXOxvFz3FQeGyc6+mxmAYeX3/2jz+o82r/9o8/rzVdI9/EXWT8Z6jI/3GG/2GJ/IxvOf18ke4zdl211O1zWjm3uM/1+P8QM9xm/tMT7fY/y2HuO39xi/o8c4AAAAo+GW2Do/BAAAgL3r5V988uav7n3i8tyViwdPhonr5p0/EvuT8W/rb8R+Pu990ox/8/9R7P8str+L7d+z9d1/AgAAADsvfU6Mv/8DAADA3pU+p9T5PwAAAOxdc7F1/g8AAAB7142xdf4PAAAAe1gxtfHi2KbrAnfHtt95/QCA4ff/sb0ztgdje1dsvxbbdBxwT2y/XlN9AMD2+el3f3zi7WJ9vv9j2fjVuDy117mwdqWgaHTP5L8vtvtj+40+68k/D6Df/MmBPvPsVP7ZLeYHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPaOxurX48fnixDe/fSdR38y8eafV5bd1V7j0OrXIvZaIYRm+3lpdL3/y7ji1csvnepsr8W2CEdDEYr28vDYpXam6RDChXAofBZa4aPFpS8/fO+Rwx+/PnXLW+efeWUHvwVd+wcAAAB70f8CAAD///o5H8E=")
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0)
syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000001040)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x10010, 0x0, 0x1, 0x0, &(0x7f0000000080))
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x115)
fsync(r0)

12.745910991s ago: executing program 5 (id=2829):
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
r1 = dup(r0)
ioctl$TCXONC(r0, 0x540a, 0x0)
write$6lowpan_control(r1, &(0x7f0000000380)='disconnect aa:aa:aa:aa:aa:11 1', 0x1e)
ioctl$TCXONC(r1, 0x540a, 0x3)
ioctl$TCXONC(r1, 0x540a, 0x1)

555.751631ms ago: executing program 8 (id=2918):
syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=@ipv4_delroute={0x2c, 0x19, 0x1, 0x71bd2b, 0x0, {0x2, 0x18, 0x80, 0x0, 0x0, 0x0, 0xff, 0x0, 0x1000}, [@RTA_DST={0x8, 0x1, @dev}, @RTA_PREFSRC={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0x38}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000040)

490.184584ms ago: executing program 7 (id=2919):
r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x3, 0x2)
ioctl$vim2m_VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f0000000300)={0xfffffffd, 0x8, 0x4, {0x2, @pix={0x6800000, 0x0, 0x3247504d, 0x9, 0x3, 0x4, 0x8, 0x3, 0x0, 0x1, 0x3, 0x7}}})
ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000000)=0x2)

437.427415ms ago: executing program 8 (id=2920):
mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x90b0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f0000000080)=ANY=[], 0x10)
getsockopt$inet6_opts(r0, 0x29, 0x37, 0x0, &(0x7f0000000000)=0xffffffffffffffe6)

437.293685ms ago: executing program 7 (id=2921):
r0 = syz_open_dev$sg(&(0x7f0000000080), 0x6f5e, 0x0)
capset(&(0x7f0000000080)={0x20080522}, &(0x7f00000000c0)={0x200000, 0x200000, 0x7})
ioctl$SG_IO(r0, 0x2285, &(0x7f0000000340)={0x53, 0xfffffffffffffffc, 0x6, 0x4, @buffer={0x0, 0x0, 0x0}, &(0x7f00000001c0)="8a88fa25ba07", 0x0, 0x100004, 0x10026, 0x23, 0x0})

320.3517ms ago: executing program 8 (id=2922):
io_setup(0x7, 0x0)
prlimit64(0x0, 0x0, &(0x7f0000000140)={0x0, 0xfffffffffffffffd}, 0x0)
setitimer(0x2, &(0x7f0000000040)={{0x0, 0x2710}, {0x0, 0x2710}}, 0x0)
setitimer(0x2, 0x0, 0x0)

320.176782ms ago: executing program 8 (id=2923):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=@getsa={0x28, 0x12, 0x1, 0x70bd27, 0x25dfdbfe, {@in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x4d0, 0x2, 0x32}}, 0x28}, 0x1, 0x0, 0x0, 0x240408c0}, 0x0)

320.011714ms ago: executing program 7 (id=2924):
syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x0, &(0x7f00000001c0)={[{@usrquota}, {@grpjquota}, {@nodelalloc}]}, 0x1, 0x4bc, &(0x7f0000000a40)="$eJzs3ctvW1UaAPDPdpMmaWb6mNGo7UjTSh2p81DjPDRqMjObWc3MotJoKrEBqYTEDSVOHMVOaaIuUth1wQKBQEIs2PMXsKErKiTEGvaIBSqCEiRAQjK613abOHGwII1p7u8n3ebch/2dU+s7Ovf4Xt8AMuts8k8uYjgiPoyIo43VrQecbfzZuH9zJllyUa9f/iKXHpestw5tve5IRKxHxEBE/P/fEc/ktsetrq7NT5fLpeXmerG2sFSsrq5duLYwPVeaKy2OTV6cmpocnRif2rO23n7puduX3vlv/9vfvHjv7svvvZtUa7i5b3M79lKj6X1xfNO2QxHxz0cRrAcKzfYM9roi/CTJ5/ebiDiX5v/RKKSfJpAF9Xq9/n39cKfd63XgwMqnY+BcfiQiGuV8fmSkMYb/bQzly5Vq7a9XKyuLs42x8rHoy1+9Vi6NNs8VjkVfLlkfS8sP18fb1ici0jHwK4XBdH1kplKe3d+uDmhzpC3/vy408h/ICKf8kF3yH7JL/kN2yX/ILvkP2SX/IbvkP2SX/Ifskv+QXfIfskv+Qyb979KlZKm37n+fvb66Ml+5fmG2VJ0fWViZGZmpLC+NzFUqc+k9Ows/9n7lSmVp7G+xcqNYK1Vrxerq2pWFyspi7Up6X/+VUt++tAroxvEzdz7ORcT63wfTJdHf3CdX4WCr13PR63uQgd4o9LoDAnrG1B9kl3N8oP0netvHBQOdXrj0cL4QeLzke10BoGfOn/L9H2SV+X/ILvP/kF3G+MAOj+jbYrf5f+DxZP4fsmu4w/O/frXp2V2jEfHriPio0He49awv4CDIf5Zrjv/PH/3jcPve/ty36VcE/RHx/BuXX7sxXastjyXbv3ywvfZ6c/v4phd2PGEAeqWVp608BgCya+P+zZnWsp9xP/9X4yKE7fEPNecmB9LvKIc2cluuVcjt0bUL67ci4uRO8XPN5503TmSGNgrb4p9o/s013iKt76H0uen7E//Upvh/2BT/9M/+X4FsuJP0P6M75V8+zel4kH9b+5/hPbp2onP/l3/Q/xU69H9nuozx7JsvfNox/q2I0zvGb8UbSGO1x0/qdr7L+PeeeuJ3nfbV32q8z07xW5JSsbawVKyurl1If0durrQ4NnlxampydGJ8qpjOURdbM9Xb/ePkB3d3a/9Qh/i7tT/Z9ucu2//d799/8uwu8f90bufP/8Qu8Qcj4i9dxv9q/JOnO+1L4s92aH9+l/jJtoku41df/c/hLg8FAPZBdXVtfrpcLi0rKCj0pHDrl1GNtkKveybgUauuJqfmSdL3uiYAAAAAAAAAAABAt/bjcuJetxEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4CD4IQAA//9HcdTQ")
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f00000001c0)='./bus\x00', 0x204b82f, 0x0, 0x3, 0x0, &(0x7f0000000240))
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0)
unlinkat(r0, &(0x7f0000000040)='./bus\x00', 0x200)

319.902476ms ago: executing program 8 (id=2925):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000007580), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_DEL_ADDR(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="e4000000", @ANYRES16=r1, @ANYBLOB="010025bd7000ffdbdf250200000040000180060001000a000000050002000400000014000400ff020000000000000000000000000001060005"], 0xe4}, 0x1, 0x0, 0x0, 0x801}, 0x40000)

191.1231ms ago: executing program 8 (id=2926):
r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0)
ioctl$TCSBRKP(r0, 0x5425, 0x2)
r1 = epoll_create(0x1)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000001080)={0x20000009})

95.172423ms ago: executing program 7 (id=2927):
bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xe, 0xe, &(0x7f0000001540)=ANY=[@ANYBLOB="b7020000f53f6314bfa300000000000024020000fffeff7f7a03f0fff0ffffff79a4f0ff00000000b7060000fffffff02e64050000000000750afaff07cd02020404000000247d60b7030000030a00006a0a00fe0000000c850000000c000000b70000000000002995000000000000001da5ad3548ebb63d18c5071c7e821c9b767ac8308fbcd5c5e4a5ad1065b572c2c9ff215ac60c2ceaea4c0ec908abb6e7325ec1956bd8660bf3664148a2c96752fe2bb328dff1a15750ab9a780001000000000000d4bf20c2bd152d814f01f2cd519e078d4ffab418e4682b2aec5e4a35629e8ef040c50287c37a7f4182f32333b08c6e497687e10a4daea5cac0ceafdbb126eb02a1f5104d16ddb64963d84d91814cd5817e0b8f6f5e6ee7a39e180b5a18ed786b782ab1321ea5e82ae5ba2c42a5e23ea6253d5df768d0cb9f35e4f41a6211e52bb3598e9b5d4f22d8c19f958e8b34de35949a7a48ce18799ee53da177a81ea65e652c1d71b7ee86a75b0100000042127a8f84538a9a311c757f7169f006f3f5c95177fbd0b14b36259e2905ef911785c88a16aae46084d676d8ef8aa6ecc2d32e3f4ee367c5a769c0a606636c9f4a4413c098f4fcc96623b7c373b0ef04d55b846b094bf97e2ef5987b6e09a6a7cab79bffda141f65e7d9ebe3be70c436432b70a80cce69df30d3d67d84ccf3f9db9b690111de2ddc4b153c989ef100bbf76063d3f6ffffb73d70e9c3d7b90aecf48e7565efff2dbbb512218c98442406333c890923a797e00b75481739952fe87fde27ce81893f54ec0ea8e792414f639bc9ce1fea3f6ac0d7025759d4b45576c205c70631e8ad585951950e521f4e210b6494e3c52d927195737945cc03d5668483151710de246420a1b6c55b73876a6ed7fd0d9338923789a1edcd8043fe83919088383268324a25df14010c8ed6b8d43400eaa00ff9bc46e1cfecbdc0e451ac53b409d04544d3a7edd4d447d2fb431e226ae182b8dcc86fe09b404e0b7c723d3b19c3dc382fa91fb0fb8f9f3f13296bb1758b24aad0922091d49e2bc408a5a37deee7a60b903d2d9fe9d451cafcc8dc389671c2d08b6e264150a6b9445b00cee4585af04fa69e0380be0d66649dcf3bf8a906b029faca75ce34c41aec7aa86e596119109ea8b3f7c65c902499227c087301643baab1c95bb22cedd913b22dcaa197ccc34586dc50bd9f4628e3e77a0de32e356521df06f995cb57f97052fc4158250ccecfb67ea8faf509593fadc7eafb613327b052397af1ede94d87590ce90a0a7579766f0e5eb09d38ac46e99e7ec4fcd3cb0b1a8c531724d5ef6b334803cedaa9cedf16dc3af6e0b67f62a83a256474c97c925d9d447175b535c87dbdeb0dcca5303eed6689ea91e1665c691df736368dde47e6672e93a314c5f60e7b68c2242bd0f0d8c66449d8687dcf2d0f76668b2b9bf8b32b99b7daf34b2d825d192ade90a1162acfe9749d516d014cef5f99126324ea02baea5808c430985749901b09e4902a6f5addc0103756b894418e4591c624a9b206abbfb888d413d923b0d7c9d997d6d8e64787c4d397f57a15b6e0b4212b6cb55b9c207bbe08f483b1bea05f41b9a1d3af087047c568ae6ebfc0bb5ec10b6290dc757a4903a88fb2c035b2349b6d2f0c051b8b7718384eebd5fc19928cea713ff09e179c308fbe9bd64374d96ef2447a2a4af5ca0c39e7ca2e801e57560a55e9cfa095cf3f74398219ad1030a79517a88de7596429a20793e12616aa32b3e720c6521fbe93963e9536d16f3db211fca7dd99c0a0125ff8ef534b93dcb34e1da2c008a9f2a29e30823bf0ec3639cadaf9be9608358e1e5ab17eea477b1754f78f45468c9568471667f82f5e250b979b9f2bd0d1b6bc03d11811ac6eec9a3ecd9e3c3299ee5eb3c6cac8fbd06514b7ee743ece79c04566d02a08fd5fcabbab3d129c0cced3ce11dafa380700000000000000c114d0b423e64c6157fac5e4e2168f33541daeff9983d0e488a78bef538f870b84798272b2101e0abf1cd64500b79e01e11d727389653bd80a39d5bbe2e23d2f5ff10047423429981bd9b4ce680e174c266391e3e7689452654e5cd5ada6e025327a1942b5a068f15fa58eaa267d4e0881783dddbdd777f8be0824ffdf6d06c621880dbbe9534f15e8c2e364d3ec67deb6ab9f2a0f03212972dbd38500000008173553a67be48633103809eee0be51d67d7ce230b389607b4c3b18da1c48f3180f2e0d79e54565fdd9a099b5b5ba2761905b88b7cbfc39c35dd153609da3da263438f12769602c2195245ff83e249119d4f6cabfbdef84ada19ef4a67ed66d7043036515d0be5a231f99e71aba5d5ae04676eff3e85f0844c41bbcfde7a931d1ec55c01f703bfd1b97756bfe55a91f6b379f34a018906339771157c66dbd7471d1beec7f029ef552cf5e92a1a0db21b59355763967ce26a577bc514b6d22a09c385c5ba6caf524e1688fc0f29f8bb35ae7bc8eb5ba51aebdf7d972c3267cedbe77ed70d9c539bc455a6f88b39196c8a224b0acf4d796fea59a07baa34cc270fb096ef330fbebdf872d7d0bc4f9a963355c554abc5cdb91464faabcd09cd9a53f5d1b2ea7e96f428f7cd6735c19c61dc9942d30bf29ef85ed01c2fcd6060aa40eeff971477b4fde48507b7bad95a496540adff7e4a72fd1f94d7c703ab1525c946c54e0da3d7ebfcc8cea2e84c3b310aaea5a1627df898c00a9aaf2d88a36afa4c5b1816384310600001c33125ad7f7970beeb256aec06e39fc6c66544e1d1dc5fea4b68a82e3568ca30aea9a1d097f06f11dc362f4bae5ef57c67686a15855cd351bf26f40fb1348cfce79897682228e6d9643530c81bab27bf7b1c4a76a5be180bb830cf06827c3f38a9c9c580c732c30aaceda78b0297de35a922b1375b129655beb31899e26052cc216f832fdb0a0015f93c9cff77f59cda1ec5f3e358848756cebb074266a47e39ae26e80e8c65aaf73c24925458520a9ca98760d1005c9f81846459ae6d5baa4f02807939ddc29c3520f7c58ed9bc5a569c7a1bc33cf4f330a18276ffb4550b9166c3939e8041094bec034aa0ec6638b74fe34f0f1ec6903a1135808d5d8d26c9203c3f87e66c407b7c5c0888d4558dd657cc0213efad68e76fdd7b23e68064fd4b271ed79c50abacdd2871b0c1f8c971df59a5a1901ddf804bed43e391f882d2a45c51cdbba86b2a1b7c0c4923642a731ea4dcbad2b6ebbebe787a8e28e781d75beee924b3b1e390750f316648133922c021f98fd2d5d71a7a3679397ef6cf432837b7e264831ec01c4c3146ba0caac3b13d55945ec00e978a1c1712cd51187936200606c9cd6877b2f72125295c54721f8e15df2ae282a8becb99a726fd92acc92141e1f574b4b0b3c992a61af3372d0d9217776b1a42cd2cee816a70bf1ddd69b590d53e28ba356e74b38e23e50d898e95cdc7cc809e462c884b53f672aab1411ecfd4c91e7a9782fc6763f0efd4bcbaf1fc3a00000000000000000000000000000000500000000000000000000000048e510340087caf22439d5304bd704a6a78a512269a9b1cbd13bea78c807bbc73853ae187cbb768673e9d1bf74a3b0a6c234accd8506adf314f4c5e08174540b69d3c0da660052b43b86baf49e7ac64d9c21598b1e01dc1e1b5a53626b090496dbf7af441e397016c3c094d5c91ffe0a7ceacfd225ed9a6c905f79ad7052747dd6cceef4c310e0e935311118bc6bf0e5ca6c7cca7d5c03be570308da8a40578b4db14961fbccf6e2f2d56e9509c434126515b56d032e20c12e830d1bc64826fc9b318da5911e466878dbb81edeff69363fb75af5cd80536f14d2eaa7764db23acdbd394bbbbccfd8b129258bb0a93cee1d44f8665172c06933d20f184b78b435462c52a85149451ffd564c56a7cbf11a1127c77242915e43b2bc"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x200000, 0x10, &(0x7f0000000000), 0x143}, 0x48)

141.242µs ago: executing program 7 (id=2928):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSETELEM={0x2c, 0xc, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x4}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x74}}, 0x20050800)

0s ago: executing program 7 (id=2929):
r0 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$VIDIOC_CREATE_BUFS(r0, 0xc100565c, &(0x7f00000003c0)={0x3, 0x6, 0x2, {0xc, @pix_mp={0x6, 0x9, 0x20363159, 0x9, 0x0, [{0x2776463d, 0x7}, {0xfffffffc, 0x7f}, {0xffffffff, 0xffff}, {0x1, 0x42}, {0x7, 0x310cb2b8}, {0x7fffffff, 0x80}, {0x614, 0xfffffffc}, {0x9, 0x6}], 0xa0, 0x7f, 0x7, 0x2, 0x7}}, 0x8})

kernel console output (not intermixed with test programs):

764][ T8402] usb 4-1: config 0 has no interface number 0
[  210.257027][ T8402] usb 4-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023
[  210.261366][ T8402] usb 4-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  210.270519][ T8402] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  210.274187][ T8402] usb 4-1: Product: syz
[  210.276920][ T8402] usb 4-1: Manufacturer: syz
[  210.276970][ T8402] usb 4-1: SerialNumber: syz
[  210.283200][ T8402] usb 4-1: config 0 descriptor??
[  210.286194][T10597] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22
[  210.287121][ T4995] Bluetooth: hci3: command tx timeout
[  210.293179][ T8402] cyberjack 4-1:0.69: Reiner SCT Cyberjack USB card reader converter detected
[  210.312308][ T8402] usb 4-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0
[  210.350880][   T25] usb 5-1: Using ep0 maxpacket: 32
[  210.351413][   T25] usb 5-1: New USB device found, idVendor=056a, idProduct=0014, bcdDevice= 0.00
[  210.352688][   T25] usb 5-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30
[  210.352706][   T25] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 254
[  210.352724][   T25] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  210.354923][   T25] usb 5-1: config 0 descriptor??
[  210.400524][T10618] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode.
[  210.509309][ T5598] ocfs2: Unmounting device (7,0) on (node local)
[  210.529349][    C0] cyberjack ttyUSB0: cyberjack_read_int_callback - failed resubmitting read urb, error -22
[  210.751426][ T2248] usb 4-1: USB disconnect, device number 15
[  210.759136][ T2248] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0
[  210.760049][ T2248] cyberjack 4-1:0.69: device disconnected
[  210.801765][   T25] wacom 0003:056A:0014.000C: ignoring exceeding usage max
[  210.803224][   T25] hid_parser_main: 301 callbacks suppressed
[  210.803239][   T25] wacom 0003:056A:0014.000C: unknown main item tag 0x2
[  211.034567][ T8402] usb 5-1: USB disconnect, device number 2
[  211.451325][T10628] set_capacity_and_notify: 2 callbacks suppressed
[  211.451408][T10628] loop3: detected capacity change from 0 to 512
[  211.555638][T10632] ./cgroup: Can't lookup blockdev
[  211.821637][ T5869] IPVS: starting estimator thread 0...
[  211.944345][T10645] IPVS: using max 91 ests per chain, 218400 per kthread
[  211.961192][T10649] loop3: detected capacity change from 0 to 736
[  212.066206][T10653] loop3: detected capacity change from 0 to 2048
[  212.091491][T10653] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  212.124523][T10662] loop0: detected capacity change from 0 to 8
[  212.134040][ T8826] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  212.145615][T10662] SQUASHFS error: lzo decompression failed, data probably corrupt
[  212.145680][T10662] SQUASHFS error: Failed to read block 0x91: -5
[  212.145714][T10662] SQUASHFS error: Unable to read metadata cache entry [8f]
[  212.145745][T10662] SQUASHFS error: Unable to read inode 0x11f
[  212.510511][ T4995] Bluetooth: hci3: command tx timeout
[  212.650110][T10686] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1999'.
[  213.495963][T10707] loop3: detected capacity change from 0 to 32768
[  214.118913][ T4995] Bluetooth: hci0: Unexpected cc 0x0000 with no status
[  214.290147][T10740] loop4: detected capacity change from 0 to 32768
[  214.290980][T10740] BTRFS warning: v1 space cache is deprecated, falling back to no space cache
[  214.308098][T10740] BTRFS: device fsid 24c7a497-3402-47dd-bef8-82358f5f30e0 devid 1 transid 8 /dev/loop4 (7:4) scanned by syz.4.2021 (10740)
[  214.566303][T10740] BTRFS info (device loop4): first mount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0
[  214.566360][T10740] BTRFS info (device loop4): using crc32c checksum algorithm
[  214.705165][T10740] BTRFS info (device loop4): rebuilding free space tree
[  214.709427][T10767] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2027'.
[  214.745974][T10740] BTRFS info (device loop4): disabling free space tree
[  214.747053][T10740] BTRFS info (device loop4): clearing compat-ro feature flag for FREE_SPACE_TREE (0x1)
[  214.747109][T10740] BTRFS info (device loop4): clearing compat-ro feature flag for FREE_SPACE_TREE_VALID (0x2)
[  214.759244][T10740] BTRFS info (device loop4): enabling ssd optimizations
[  214.759265][T10740] BTRFS info (device loop4): turning on async discard
[  214.759276][T10740] BTRFS info (device loop4): force clearing of disk cache
[  214.759288][T10740] BTRFS info (device loop4): use zstd compression, level 3
[  215.380530][T10786] loop3: detected capacity change from 0 to 1024
[  215.447593][T10324] BTRFS info (device loop4): last unmount of filesystem 24c7a497-3402-47dd-bef8-82358f5f30e0
[  215.926716][T10811] loop3: detected capacity change from 0 to 8
[  215.968241][T10811] SQUASHFS error: Failed to read block 0x6e6: -5
[  215.968290][T10811] SQUASHFS error: Unable to read metadata cache entry [6e4]
[  215.968329][T10811] SQUASHFS error: Unable to read directory block [6e4:0]
[  216.052571][   T34] audit: type=1326 audit(1788505726.127:70): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10814 comm="syz.3.2048" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff67179e159 code=0x7ffc0000
[  216.064268][   T34] audit: type=1326 audit(1788505726.145:71): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10814 comm="syz.3.2048" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff67179e159 code=0x7ffc0000
[  216.076713][   T34] audit: type=1326 audit(1788505726.155:72): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10814 comm="syz.3.2048" exe="/syz-executor" sig=0 arch=c000003e syscall=284 compat=0 ip=0x7ff67179e159 code=0x7ffc0000
[  216.076818][   T34] audit: type=1326 audit(1788505726.155:73): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10814 comm="syz.3.2048" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff67179e159 code=0x7ffc0000
[  216.076853][   T34] audit: type=1326 audit(1788505726.155:74): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10814 comm="syz.3.2048" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff67179e159 code=0x7ffc0000
[  216.106549][T10817] loop4: detected capacity change from 0 to 128
[  216.465635][T10828] loop4: detected capacity change from 0 to 32768
[  216.467206][T10828] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop4 (7:4) scanned by syz.4.2054 (10828)
[  216.481979][T10828] BTRFS info (device loop4): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  216.482050][T10828] BTRFS info (device loop4): using sha256 checksum algorithm
[  216.567459][T10828] BTRFS info (device loop4): enabling ssd optimizations
[  216.567527][T10828] BTRFS info (device loop4): turning on sync discard
[  216.567567][T10828] BTRFS info (device loop4): enabling free space tree
[  216.583591][   T34] audit: type=1800 audit(1788505726.622:75): pid=10828 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2054" name="file1" dev="loop4" ino=260 res=0 errno=0
[  216.616100][ T8402] usb 4-1: new high-speed USB device number 16 using dummy_hcd
[  216.664534][T10324] BTRFS info (device loop4): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  216.800186][ T8402] usb 4-1: New USB device found, idVendor=0b48, idProduct=1008, bcdDevice= 1.00
[  216.804323][ T8402] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  216.804387][ T8402] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5
[  216.804422][ T8402] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  216.992309][T10855] loop0: detected capacity change from 0 to 1024
[  217.059534][ T8402] ttusb_dec_send_command: result bulk message failed: error -22
[  217.071395][ T8402] ttusb-dec 4-1:1.0: probe with driver ttusb-dec failed with error -22
[  217.097518][ T8402] usb 4-1: USB disconnect, device number 16

syzkaller
syzkaller login: [  217.337277][T10862] loop4: detected capacity change from 0 to 32768
[  217.429279][T10862] XFS (loop4): Mounting V5 Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  217.450985][T10862] XFS (loop4): Torn write (CRC failure) detected at log block 0x30. Truncating head block from 0x51.
[  217.466001][T10862] XFS (loop4): Starting recovery (logdev: internal)
[  217.479674][T10862] XFS (loop4): Ending recovery (logdev: internal)
[  217.502713][T10324] XFS (loop4): Unmounting Filesystem c496e05e-540d-4c72-b591-04d79d8b4eeb
[  217.807572][T10875] loop3: detected capacity change from 0 to 32768
[  217.809720][T10860] loop0: detected capacity change from 0 to 131072
[  217.810432][T10860] xfs: Deprecated parameter 'ikeep'
[  217.810443][T10860] XFS: ikeep mount option is deprecated.
[  217.895044][T10860] XFS (loop0): Mounting V5 Filesystem b93a8937-ccd4-41a2-86c7-66a1570a2846
[  217.898048][T10875] XFS (loop3): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  217.933362][T10875] XFS (loop3): Ending clean mount
[  217.944211][T10860] XFS (loop0): Starting recovery (logdev: internal)
[  217.962367][T10860] XFS (loop0): Ending recovery (logdev: internal)
[  217.978248][   T34] audit: type=1800 audit(1788505727.932:76): pid=10860 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.2061" name="file2" dev="loop0" ino=39 res=0 errno=0
[  218.038387][ T5598] XFS (loop0): Unmounting Filesystem b93a8937-ccd4-41a2-86c7-66a1570a2846
[  218.235832][ T8826] XFS (loop3): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  218.289817][T10904] loop4: detected capacity change from 0 to 4096
[  218.325157][T10904] ntfs3(loop4): Different NTFS sector size (2048) and media sector size (512).
[  218.404324][T10904] ntfs3(loop4): Failed to load $BadClus (-22).
[  218.415966][T10906] random: crng reseeded on system resumption
[  218.821773][T10925] loop3: detected capacity change from 0 to 32768
[  218.823970][T10925] BTRFS: device fsid db05bf05-c4f4-4d41-ba1f-eb57295b561b devid 1 transid 8 /dev/loop3 (7:3) scanned by syz.3.2077 (10925)
[  218.834444][T10925] BTRFS info (device loop3): first mount of filesystem db05bf05-c4f4-4d41-ba1f-eb57295b561b
[  218.834495][T10925] BTRFS info (device loop3): using xxhash64 checksum algorithm
[  218.910253][T10925] BTRFS info (device loop3): enabling ssd optimizations
[  218.910323][T10925] BTRFS info (device loop3): turning on async discard
[  218.910642][T10925] BTRFS info (device loop3): enabling free space tree
[  218.944310][ T8826] BTRFS info (device loop3): last unmount of filesystem db05bf05-c4f4-4d41-ba1f-eb57295b561b
[  219.455598][T10956] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  219.457527][T10956] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  219.651790][   T13] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  219.660308][   T13] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  219.664397][   T13] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  219.668331][   T13] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  220.366171][T10970] loop3: detected capacity change from 0 to 32768
[  220.389479][T10970] ocfs2: Mounting device (7,3) on (node local, slot 0) with ordered data mode.
[  220.436871][ T8826] ocfs2: Unmounting device (7,3) on (node local)
[  220.719489][T10986] loop3: detected capacity change from 0 to 256
[  220.723406][T10986] exfat: Deprecated parameter 'utf8'
[  220.727496][T10986] exfat: Deprecated parameter 'namecase'
[  220.740401][T10986] exFAT-fs (loop3): failed to load upcase table (idx : 0x0001fe89, chksum : 0x3fccd927, utbl_chksum : 0xe619d30d)
[  221.028823][T10994] loop3: detected capacity change from 0 to 40427
[  221.032550][T10994] F2FS-fs (loop3): Wrong NAT boundary, start(2560) end(3584) blocks(15872)
[  221.032856][T10994] F2FS-fs (loop3): Can't find valid F2FS filesystem in 2th superblock
[  221.081714][T10994] F2FS-fs (loop3): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  221.092800][T10994] F2FS-fs (loop3): Try to recover 2th superblock, ret: 0
[  221.092866][T10994] F2FS-fs (loop3): Mounted with checkpoint version = 48b305e5
[  221.114741][T10994] syz.3.2096: attempt to access beyond end of device
[  221.114741][T10994] loop3: rw=2049, sector=53248, nr_sectors = 8 limit=40427
[  221.143898][ T8826] syz-executor: attempt to access beyond end of device
[  221.143898][ T8826] loop3: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  221.148180][ T8826] CPU: 1 UID: 0 PID: 8826 Comm: syz-executor Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  221.148205][ T8826] Tainted: [L]=SOFTLOCKUP
[  221.148230][ T8826] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  221.148238][ T8826] Call Trace:
[  221.148243][ T8826]  <TASK>
[  221.148248][ T8826]  dump_stack_lvl+0xe8/0x150
[  221.148270][ T8826]  f2fs_stop_checkpoint+0x3f6/0x5d0
[  221.148294][ T8826]  f2fs_write_end_bio+0x1211/0x16e0
[  221.148310][ T8826]  ? blkg_put+0x22/0x240
[  221.148337][ T8826]  __submit_merged_bio+0x258/0x6a0
[  221.148354][ T8826]  ? rcu_is_watching+0x16/0xb0
[  221.148372][ T8826]  __submit_merged_write_cond+0x3c9/0x4e0
[  221.148397][ T8826]  ? __pfx___submit_merged_write_cond+0x10/0x10
[  221.148431][ T8826]  f2fs_write_data_pages+0x2a27/0x36f0
[  221.148469][ T8826]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  221.148513][ T8826]  ? __pfx_hlock_conflict+0x10/0x10
[  221.148526][ T8826]  ? __bfs+0x153/0x290
[  221.148537][ T8826]  ? __pfx_hlock_conflict+0x10/0x10
[  221.148562][ T8826]  ? lockdep_unlock+0x5c/0xd0
[  221.148578][ T8826]  ? __lock_acquire+0x14b9/0x2e50
[  221.148603][ T8826]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  221.148617][ T8826]  do_writepages+0x338/0x560
[  221.148651][ T8826]  ? do_raw_spin_unlock+0x4d/0x200
[  221.148672][ T8826]  filemap_fdatawrite+0x1e9/0x2f0
[  221.148717][ T8826]  ? __pfx_filemap_fdatawrite+0x10/0x10
[  221.148760][ T8826]  ? do_raw_spin_unlock+0x4d/0x200
[  221.148780][ T8826]  f2fs_sync_dirty_inodes+0x30e/0x830
[  221.148806][ T8826]  f2fs_write_checkpoint+0xa3d/0x2710
[  221.148820][ T8826]  ? __lock_acquire+0x6df/0x2e50
[  221.148854][ T8826]  ? __pfx_f2fs_write_checkpoint+0x10/0x10
[  221.148904][ T8826]  kill_f2fs_super+0x2dd/0x700
[  221.148925][ T8826]  ? __pfx_kill_f2fs_super+0x10/0x10
[  221.148947][ T8826]  ? call_rcu+0x64d/0x8b0
[  221.148961][ T8826]  ? lockdep_hardirqs_on+0x7b/0x110
[  221.148985][ T8826]  deactivate_locked_super+0xbc/0x110
[  221.149001][ T8826]  cleanup_mnt+0x3d3/0x460
[  221.149021][ T8826]  task_work_run+0x1d9/0x270
[  221.149037][ T8826]  ? __pfx_task_work_run+0x10/0x10
[  221.149057][ T8826]  exit_to_user_mode_loop+0x204/0x770
[  221.149070][ T8826]  ? rcu_is_watching+0x16/0xb0
[  221.149087][ T8826]  do_syscall_64+0x328/0x520
[  221.149101][ T8826]  ? trace_irq_disable+0x3b/0x140
[  221.149113][ T8826]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.149129][ T8826]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  221.149140][ T8826] RIP: 0033:0x7ff67179f397
[  221.149153][ T8826] Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
[  221.149164][ T8826] RSP: 002b:00007ffccf7cf508 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[  221.149179][ T8826] RAX: 0000000000000000 RBX: 00007ff671834474 RCX: 00007ff67179f397
[  221.149188][ T8826] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffccf7cf5c0
[  221.149196][ T8826] RBP: 00007ffccf7cf5c0 R08: 00007ffccf7d05c0 R09: 00000000ffffffff
[  221.149204][ T8826] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffccf7d0650
[  221.149212][ T8826] R13: 00007ff671834474 R14: 00000000000354d4 R15: 00007ffccf7d0690
[  221.149232][ T8826]  </TASK>
[  221.149421][ T8826] F2FS-fs (loop3): Stopped filesystem due to reason: 3
[  221.757759][ T8402] usb 4-1: new high-speed USB device number 17 using dummy_hcd
[  221.923047][ T8402] usb 4-1: New USB device found, idVendor=1d50, idProduct=614d, bcdDevice= 1.00
[  221.928493][ T8402] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  221.932988][ T8402] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0
[  221.933009][ T8402] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0
[  221.933023][ T8402] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  221.933054][ T8402] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  222.182962][T11015] loop4: detected capacity change from 0 to 2048
[  222.211485][T11016] NILFS (loop4): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  222.245235][   T34] audit: type=1800 audit(1788505731.917:77): pid=11015 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2104" name="dev" dev="loop4" ino=19 res=0 errno=0
[  222.269477][T11016] NILFS (loop4): vblocknr = 23 has abnormal lifetime: start cno (= 4294967298) > current cno (= 3)
[  222.269529][T11016] NILFS error (device loop4): nilfs_bmap_propagate: broken bmap (inode number=4)
[  222.281325][T11016] Remounting filesystem read-only
[  222.284307][T10324] NILFS (loop4): disposed unprocessed dirty file(s) when stopping log writer
[  222.318557][T11018] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2105'.
[  222.322457][T11018] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2105'.
[  222.377213][ T8402] gud 4-1:1.0: probe with driver gud failed with error -71
[  222.383494][ T8402] usb 4-1: USB disconnect, device number 17
[  222.613175][T10965] usb 5-1: new high-speed USB device number 3 using dummy_hcd
[  222.775976][T10965] usb 5-1: unable to get BOS descriptor or descriptor too short
[  222.776054][T10965] usb 5-1: New USB device found, idVendor=0582, idProduct=004c, bcdDevice= 0.40
[  222.783804][T10965] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  222.783866][T10965] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3
[  222.784039][T10965] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7
[  222.791548][T10965] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  222.791566][T10965] usb 5-1: Product: syz
[  222.791576][T10965] usb 5-1: Manufacturer: syz
[  222.791585][T10965] usb 5-1: SerialNumber: syz
[  222.964774][T11022] dlm: no locking on control device
[  223.025891][T10965] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found
[  223.090066][T10965] usb 5-1: USB disconnect, device number 3
[  223.135243][T10857] udevd[10857]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  223.196809][T11030] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2111'.
[  223.659720][T11051] loop4: detected capacity change from 0 to 128
[  223.664252][T11051] ufs: ufs_fill_super(): fragment size 3263967611 is not a power of 2
[  224.209934][T11064] loop4: detected capacity change from 0 to 512
[  224.241735][T11064] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  224.241854][T11064] ext4 filesystem being mounted at /89/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  224.292586][T10324] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  224.681772][T11073] loop4: detected capacity change from 0 to 32768
[  224.687837][T11073] BTRFS: device fsid ed167579-eb65-4e76-9a50-61ac97e9b59d devid 1 transid 8 /dev/loop4 (7:4) scanned by syz.4.2130 (11073)
[  224.739457][T11073] BTRFS info (device loop4): first mount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d
[  224.739532][T11073] BTRFS info (device loop4): using sha256 checksum algorithm
[  224.802586][T11073] BTRFS info (device loop4): enabling ssd optimizations
[  224.802661][T11073] BTRFS info (device loop4): turning on async discard
[  224.802714][T11073] BTRFS info (device loop4): enabling free space tree
[  225.169441][   T25] usb 5-1: new high-speed USB device number 4 using dummy_hcd
[  225.360645][   T25] usb 5-1: Using ep0 maxpacket: 8
[  225.362994][   T25] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23
[  225.366478][   T25] usb 5-1: config 0 has no interfaces?
[  225.366521][   T25] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  225.372708][   T25] usb 5-1: config 0 descriptor??
[  225.552308][T11073] syz.4.2130 (11073): drop_caches: 2
[  225.622823][   T34] audit: type=1800 audit(1788505735.078:78): pid=11073 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2130" name="file1" dev="loop4" ino=260 res=0 errno=0
[  225.677790][T10965] usb 5-1: USB disconnect, device number 4
[  226.248860][T10324] BTRFS info (device loop4): last unmount of filesystem ed167579-eb65-4e76-9a50-61ac97e9b59d
[  226.900106][T10965] usb 5-1: new high-speed USB device number 5 using dummy_hcd
[  227.071644][T10965] usb 5-1: New USB device found, idVendor=0c45, idProduct=6005, bcdDevice=b5.55
[  227.074721][T10965] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  227.074781][T10965] usb 5-1: Product: syz
[  227.074813][T10965] usb 5-1: Manufacturer: syz
[  227.074823][T10965] usb 5-1: SerialNumber: syz
[  227.082849][T10965] usb 5-1: config 0 descriptor??
[  227.089336][T10965] gspca_main: sonixb-2.14.0 probing 0c45:6005
[  227.308877][T10965] sonixb 5-1:0.0: Error reading register 00: -71
[  227.317922][T10965] usb 5-1: USB disconnect, device number 5
[  227.964891][T11110] netlink: 260 bytes leftover after parsing attributes in process `syz.4.2140'.
[  227.978666][   T34] audit: type=1326 audit(1788505737.277:79): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11107 comm="syz.0.2139" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85dd19e159 code=0x7ffc0000
[  227.989186][   T34] audit: type=1326 audit(1788505737.277:80): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11107 comm="syz.0.2139" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85dd19e159 code=0x7ffc0000
[  227.989276][   T34] audit: type=1326 audit(1788505737.277:81): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11107 comm="syz.0.2139" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85dd19e159 code=0x7ffc0000
[  227.989329][   T34] audit: type=1326 audit(1788505737.277:82): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11107 comm="syz.0.2139" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85dd19e159 code=0x7ffc0000
[  227.989378][   T34] audit: type=1326 audit(1788505737.295:83): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11107 comm="syz.0.2139" exe="/syz-executor" sig=0 arch=c000003e syscall=39 compat=0 ip=0x7f85dd19e159 code=0x7ffc0000
[  227.989427][   T34] audit: type=1326 audit(1788505737.295:84): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11107 comm="syz.0.2139" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85dd19e159 code=0x7ffc0000
[  227.989483][   T34] audit: type=1326 audit(1788505737.295:85): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11107 comm="syz.0.2139" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85dd19e159 code=0x7ffc0000
[  228.010821][   T34] audit: type=1326 audit(1788505737.295:86): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11107 comm="syz.0.2139" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85dd19e159 code=0x7ffc0000
[  228.010858][   T34] audit: type=1326 audit(1788505737.295:87): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11107 comm="syz.0.2139" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f85dd19e159 code=0x7ffc0000
[  228.010886][   T34] audit: type=1326 audit(1788505737.305:88): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11107 comm="syz.0.2139" exe="/syz-executor" sig=0 arch=c000003e syscall=434 compat=0 ip=0x7f85dd19e159 code=0x7ffc0000
[  228.093242][T11114] XFS (nbd0): no-recovery mounts must be read-only.
[  228.390603][T11124] loop0: detected capacity change from 0 to 512
[  228.426494][T11124] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem
[  228.451869][T11124] EXT4-fs error (device loop0): ext4_iget_extra_inode:5210: inode #15: comm syz.0.2147: corrupted in-inode xattr: e_value size too large
[  228.457805][T11124] loop0: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117
[  228.461580][    C1] EXT4-fs (loop0): initial error at time 1788505737: ext4_iget_extra_inode:5210: inode 15
[  228.461678][    C1] EXT4-fs (loop0): last error at time 1788505737: ext4_iget_extra_inode:5210: inode 15
[  228.484810][T11124] EXT4-fs error (device loop0): ext4_orphan_get:1408: comm syz.0.2147: couldn't read orphan inode 15 (err -117)
[  228.498414][T11124] loop0: lost filesystem error report for type 5 error -117
[  228.511658][T11124] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  228.595041][ T5598] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  229.118834][T11140] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2153'.
[  229.192190][ T4995] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201'
[  229.192993][ T4995] CPU: 0 UID: 0 PID: 4995 Comm: kworker/u11:1 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  229.193017][ T4995] Tainted: [L]=SOFTLOCKUP
[  229.193022][ T4995] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  229.193039][ T4995] Workqueue: hci3 hci_rx_work
[  229.193059][ T4995] Call Trace:
[  229.193065][ T4995]  <TASK>
[  229.193072][ T4995]  dump_stack_lvl+0xe8/0x150
[  229.193094][ T4995]  sysfs_create_dir_ns+0x271/0x2a0
[  229.193112][ T4995]  ? __pfx_sysfs_create_dir_ns+0x10/0x10
[  229.193129][ T4995]  ? do_raw_spin_unlock+0x4d/0x200
[  229.193150][ T4995]  kobject_add_internal+0x622/0xcd0
[  229.193173][ T4995]  kobject_add+0x163/0x240
[  229.193193][ T4995]  ? __pfx_kobject_add+0x10/0x10
[  229.193214][ T4995]  ? get_device_parent+0x366/0x3a0
[  229.193231][ T4995]  device_add+0x3fa/0xb80
[  229.193248][ T4995]  hci_conn_add_sysfs+0xd5/0x210
[  229.193264][ T4995]  le_conn_complete_evt+0xfe3/0x16d0
[  229.193286][ T4995]  ? __pfx_le_conn_complete_evt+0x10/0x10
[  229.193303][ T4995]  ? __mutex_unlock_slowpath+0x731/0x900
[  229.193322][ T4995]  ? skb_pull_data+0xf0/0x200
[  229.193339][ T4995]  hci_le_conn_complete_evt+0x187/0x470
[  229.193360][ T4995]  hci_event_packet+0x67a/0xf10
[  229.193379][ T4995]  ? __pfx_hci_le_meta_evt+0x10/0x10
[  229.193393][ T4995]  ? __pfx_hci_event_packet+0x10/0x10
[  229.193410][ T4995]  ? grow_tree_refs+0x100/0x140
[  229.193428][ T4995]  ? hci_send_to_monitor+0xe2/0x590
[  229.193468][ T4995]  hci_rx_work+0x3ee/0x1020
[  229.193488][ T4995]  ? process_scheduled_works+0x97a/0x1630
[  229.193506][ T4995]  process_scheduled_works+0xc3d/0x1630
[  229.193565][ T4995]  ? __pfx_process_scheduled_works+0x10/0x10
[  229.193589][ T4995]  ? assign_work+0x3cf/0x5d0
[  229.193609][ T4995]  worker_thread+0xa47/0xfb0
[  229.193636][ T4995]  ? __kthread_parkme+0x71/0x1f0
[  229.193662][ T4995]  kthread+0x38b/0x480
[  229.193675][ T4995]  ? __pfx_worker_thread+0x10/0x10
[  229.193691][ T4995]  ? __pfx_kthread+0x10/0x10
[  229.193704][ T4995]  ret_from_fork+0x514/0xb70
[  229.193721][ T4995]  ? __pfx_ret_from_fork+0x10/0x10
[  229.193733][ T4995]  ? __switch_to+0xc89/0x1420
[  229.193752][ T4995]  ? __pfx_kthread+0x10/0x10
[  229.193765][ T4995]  ret_from_fork_asm+0x1a/0x30
[  229.193788][ T4995]  </TASK>
[  229.195537][ T4995] kobject: kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory.
[  229.195597][ T4995] Bluetooth: hci3: failed to register connection device
[  229.371341][T11152] loop4: detected capacity change from 0 to 4096
[  229.374392][T11152] ntfs3(loop4): Primary boot: invalid bytes per sector 0.
[  229.377456][T11152] ntfs3(loop4): try to read out of volume at offset 0x1ffe00
[  229.487628][T11156] loop4: detected capacity change from 0 to 256
[  229.703910][T11158] loop4: detected capacity change from 0 to 16
[  229.705484][T11158] erofs (device loop4): mounted with root inode @ nid 36.
[  229.715616][T11158] syz.4.2159: attempt to access beyond end of device
[  229.715616][T11158] loop4: rw=524288, sector=8, nr_sectors = 24 limit=16
[  229.725721][T11158] erofs (device loop4): failed to decompress (lz4) corrupted compressed data @ pa 4096 size 4096 => 4096
[  229.725792][T11158] erofs (device loop4): read error -117 @ 0 of nid 89
[  229.736238][T11158] syz.4.2159: attempt to access beyond end of device
[  229.736238][T11158] loop4: rw=524288, sector=16, nr_sectors = 40 limit=16
[  229.736465][T11158] erofs (device loop4): failed to decompress (lz4) corrupted compressed data @ pa 4096 size 4096 => 4096
[  229.740592][T11158] erofs (device loop4): failed to decompress (lz4) corrupted compressed data @ pa 4096 size 4096 => 8192
[  229.740618][T11158] erofs (device loop4): read error -117 @ 1 of nid 89
[  229.740831][T11158] erofs (device loop4): failed to decompress (lz4) corrupted compressed data @ pa 4096 size 4096 => 8192
[  229.740847][T11158] erofs (device loop4): read error -117 @ 1 of nid 89
[  229.747384][T11158] syz.4.2159: attempt to access beyond end of device
[  229.747384][T11158] loop4: rw=0, sector=16, nr_sectors = 8 limit=16
[  229.747491][T11158] erofs (device loop4): failed to decompress (lz4) corrupted compressed data @ pa 4096 size 4096 => 9000
[  229.747511][T11158] erofs (device loop4): read error -5 @ 2 of nid 89
[  229.749569][T11158] syz.4.2159: attempt to access beyond end of device
[  229.749569][T11158] loop4: rw=0, sector=16, nr_sectors = 8 limit=16
[  229.749747][T11158] erofs (device loop4): failed to decompress (lz4) corrupted compressed data @ pa 4096 size 4096 => 9000
[  229.749766][T11158] erofs (device loop4): read error -5 @ 2 of nid 89
[  229.749871][T11158] syz.4.2159: attempt to access beyond end of device
[  229.749871][T11158] loop4: rw=0, sector=16, nr_sectors = 8 limit=16
[  229.749941][T11158] erofs (device loop4): failed to decompress (lz4) corrupted compressed data @ pa 4096 size 4096 => 9000
[  229.749958][T11158] erofs (device loop4): read error -5 @ 2 of nid 89
[  229.750041][T11158] syz.4.2159: attempt to access beyond end of device
[  229.750041][T11158] loop4: rw=0, sector=16, nr_sectors = 8 limit=16
[  229.750112][T11158] erofs (device loop4): failed to decompress (lz4) corrupted compressed data @ pa 4096 size 4096 => 9000
[  229.750128][T11158] erofs (device loop4): read error -5 @ 2 of nid 89
[  229.833067][T11160] netlink: ct family unspecified
[  230.342465][T10965] usb 5-1: new high-speed USB device number 6 using dummy_hcd
[  230.554646][T10965] usb 5-1: unable to get BOS descriptor or descriptor too short
[  230.554726][T10965] usb 5-1: New USB device found, idVendor=1235, idProduct=0010, bcdDevice= 0.40
[  230.554781][T10965] usb 5-1: no configurations
[  230.554788][T10965] usb 5-1: can't read configurations, error -22
[  231.257931][T11177] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2168'.
[  231.258004][T11177] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2168'.
[  231.754526][T10965] usb 5-1: new high-speed USB device number 8 using dummy_hcd
[  231.913824][T10965] usb 5-1: Using ep0 maxpacket: 16
[  231.914611][T10965] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00
[  231.915831][T10965] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  231.915849][T10965] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  231.915863][T10965] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9
[  231.915890][T10965] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  231.925076][T10965] usb 5-1: config 0 descriptor??
[  232.380616][T10965] input: HID 045e:07da as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:045E:07DA.000D/input/input17
[  232.478318][T10965] microsoft 0003:045E:07DA.000D: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.4-1/input0
[  232.579220][T10965] usb 5-1: USB disconnect, device number 8
[  232.829477][T11191] loop0: detected capacity change from 0 to 32768
[  232.849362][T11191] XFS (loop0): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  232.859202][T11191] XFS (loop0): Ending clean mount
[  232.905331][ T5598] XFS (loop0): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  233.166864][T11209] loop4: detected capacity change from 0 to 512
[  233.193843][T11209] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=a846e02c, mo2=0002]
[  233.193975][T11209] System zones: 1-12
[  233.218213][T11209] EXT4-fs error (device loop4): dx_probe:791: inode #2: comm syz.4.2179: Directory hole found for htree index block 0
[  233.218285][T11209] loop4: lost file I/O error report for ino 2 type 5 pos 0x0 len 0x0 error -117
[  233.228744][    C1] EXT4-fs (loop4): error count since last fsck: 1
[  233.228804][    C1] EXT4-fs (loop4): initial error at time 1788505742: dx_probe:791: inode 2
[  233.228907][    C1] EXT4-fs (loop4): last error at time 1788505742: dx_probe:791: inode 2
[  233.250652][T11209] EXT4-fs (loop4): Remounting filesystem read-only
[  233.251184][T11209] EXT4-fs (loop4): Cannot turn on journaled quota: type 0: error -117
[  233.251248][T11209] EXT4-fs (loop4): Cannot turn on journaled quota: type 1: error -117
[  233.252532][T11209] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  233.289456][T10324] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  233.582857][ T2412] pvrusb2: request_firmware fatal error with code=-110
[  233.582911][ T2412] pvrusb2: Failure uploading firmware1
[  233.582948][ T2412] pvrusb2: Device initialization was not successful.
[  233.582982][ T2412] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it.
[  233.583010][ T2412] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover.
[  233.583132][ T2412] pvrusb2: Failed to submit write-control URB status=-19
[  233.584377][ T2412] usb 1-1: Direct firmware load for v4l-pvrusb2-29xxx-01.fw failed with error -2
[  233.584418][ T2412] usb 1-1: Falling back to sysfs fallback for: v4l-pvrusb2-29xxx-01.fw
[  233.621317][   T10] pvrusb2: Device being rendered inoperable
[  234.297995][T10963] usb 5-1: new high-speed USB device number 9 using dummy_hcd
[  234.468882][T10963] usb 5-1: Using ep0 maxpacket: 32
[  234.473676][T10963] usb 5-1: New USB device found, idVendor=05ac, idProduct=0504, bcdDevice= 0.00
[  234.477997][T10963] usb 5-1: too many endpoints for config 0 interface 0 altsetting 6: 255, using maximum allowed: 30
[  234.478041][T10963] usb 5-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  234.478083][T10963] usb 5-1: config 0 interface 0 altsetting 6 has 1 endpoint descriptor, different from the interface descriptor's value: 255
[  234.478111][T10963] usb 5-1: config 0 interface 0 has no altsetting 0
[  234.478142][T10963] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  234.503901][T10963] usb 5-1: config 0 descriptor??
[  234.961050][T10963] input: HID 05ac:0504 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:05AC:0504.000E/input/input18
[  235.070605][T10963] hid-generic 0003:05AC:0504.000E: input,hidraw0: USB HID vd.8f Joystick [HID 05ac:0504] on usb-dummy_hcd.4-1/input0
[  235.187037][   T25] usb 5-1: USB disconnect, device number 9
[  235.784429][ T5600] Bluetooth: hci3: command 0x0406 tx timeout
[  235.893090][T11284] autofs4:pid:11284:check_dev_ioctl_version: ioctl control interface version mismatch: kernel(1.1), user(1701064494.1685270390), cmd(0xc0189374)
[  235.898423][T11284] autofs4:pid:11284:validate_dev_ioctl: invalid device control module version supplied for cmd(0xc0189374)
[  235.972511][T11286] loop4: detected capacity change from 0 to 164
[  236.017574][T11286] iso9660: Corrupted directory entry in block 2 of inode 1920
[  236.388556][T11294] loop4: detected capacity change from 0 to 40427
[  236.394389][T11294] F2FS-fs (loop4): Invalid SB checksum offset: 0
[  236.394486][T11294] F2FS-fs (loop4): Can't find valid F2FS filesystem in 2th superblock
[  236.396379][T11294] F2FS-fs (loop4): invalid crc value
[  236.447358][T11294] F2FS-fs (loop4): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  236.452846][T11294] F2FS-fs (loop4): Try to recover 2th superblock, ret: 0
[  236.452921][T11294] F2FS-fs (loop4): Mounted with checkpoint version = 48b305e5
[  236.630296][T11301] fuse: Bad value for 'fd'
[  236.724084][T11302] syz.4.2218: attempt to access beyond end of device
[  236.724084][T11302] loop4: rw=10241, sector=53248, nr_sectors = 8 limit=40427
[  237.117572][T10324] syz-executor: attempt to access beyond end of device
[  237.117572][T10324] loop4: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  237.129342][T10324] CPU: 1 UID: 0 PID: 10324 Comm: syz-executor Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  237.129388][T10324] Tainted: [L]=SOFTLOCKUP
[  237.129394][T10324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  237.129401][T10324] Call Trace:
[  237.129408][T10324]  <TASK>
[  237.129439][T10324]  dump_stack_lvl+0xe8/0x150
[  237.129463][T10324]  f2fs_stop_checkpoint+0x3f6/0x5d0
[  237.129487][T10324]  f2fs_write_end_bio+0x1211/0x16e0
[  237.129505][T10324]  ? blkg_put+0x22/0x240
[  237.129532][T10324]  __submit_merged_bio+0x258/0x6a0
[  237.129551][T10324]  ? rcu_is_watching+0x16/0xb0
[  237.129571][T10324]  __submit_merged_write_cond+0x3c9/0x4e0
[  237.129595][T10324]  ? __pfx___submit_merged_write_cond+0x10/0x10
[  237.129628][T10324]  f2fs_write_data_pages+0x2a27/0x36f0
[  237.129643][T10324]  ? __lock_acquire+0x6df/0x2e50
[  237.129676][T10324]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  237.129718][T10324]  ? __pfx_hlock_conflict+0x10/0x10
[  237.129731][T10324]  ? __bfs+0x153/0x290
[  237.129744][T10324]  ? __pfx_hlock_conflict+0x10/0x10
[  237.129769][T10324]  ? lockdep_unlock+0x5c/0xd0
[  237.129785][T10324]  ? __lock_acquire+0x14b9/0x2e50
[  237.129814][T10324]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  237.129831][T10324]  do_writepages+0x338/0x560
[  237.129856][T10324]  ? do_raw_spin_unlock+0x4d/0x200
[  237.129876][T10324]  filemap_fdatawrite+0x1e9/0x2f0
[  237.129891][T10324]  ? __pfx_filemap_fdatawrite+0x10/0x10
[  237.129940][T10324]  ? do_raw_spin_unlock+0x4d/0x200
[  237.129961][T10324]  f2fs_sync_dirty_inodes+0x30e/0x830
[  237.130005][T10324]  f2fs_write_checkpoint+0xa3d/0x2710
[  237.130020][T10324]  ? __lock_acquire+0x6df/0x2e50
[  237.130051][T10324]  ? __pfx_f2fs_write_checkpoint+0x10/0x10
[  237.130099][T10324]  kill_f2fs_super+0x2dd/0x700
[  237.130120][T10324]  ? __pfx_kill_f2fs_super+0x10/0x10
[  237.130142][T10324]  ? call_rcu+0x64d/0x8b0
[  237.130156][T10324]  ? lockdep_hardirqs_on+0x7b/0x110
[  237.130180][T10324]  deactivate_locked_super+0xbc/0x110
[  237.130197][T10324]  cleanup_mnt+0x3d3/0x460
[  237.130216][T10324]  task_work_run+0x1d9/0x270
[  237.130234][T10324]  ? __pfx_task_work_run+0x10/0x10
[  237.130253][T10324]  exit_to_user_mode_loop+0x204/0x770
[  237.130267][T10324]  ? rcu_is_watching+0x16/0xb0
[  237.130284][T10324]  do_syscall_64+0x328/0x520
[  237.130298][T10324]  ? trace_irq_disable+0x3b/0x140
[  237.130311][T10324]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  237.130327][T10324]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  237.130339][T10324] RIP: 0033:0x7ff49999f397
[  237.130354][T10324] Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
[  237.130365][T10324] RSP: 002b:00007ffc51e919e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[  237.130380][T10324] RAX: 0000000000000000 RBX: 00007ff499a34474 RCX: 00007ff49999f397
[  237.130388][T10324] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc51e91aa0
[  237.130395][T10324] RBP: 00007ffc51e91aa0 R08: 00007ffc51e92aa0 R09: 00000000ffffffff
[  237.130404][T10324] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc51e92b30
[  237.130435][T10324] R13: 00007ff499a34474 R14: 0000000000038f1f R15: 00007ffc51e92b70
[  237.130456][T10324]  </TASK>
[  237.262525][T10324] F2FS-fs (loop4): Stopped filesystem due to reason: 3
[  237.610566][T11307] tipc: Enabling of bearer <eth:syzkaller0> rejected, failed to enable media
[  237.691731][T11318] loop4: detected capacity change from 0 to 512
[  237.706095][T11318] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode
[  237.717122][T11318] EXT4-fs error (device loop4): mb_free_blocks:2049: group 0, inode 11: block 198:freeing already freed block (bit 197); block bitmap corrupt.
[  237.722966][    C1] EXT4-fs (loop4): error count since last fsck: 1
[  237.722984][    C1] EXT4-fs (loop4): initial error at time 1788505746: mb_free_blocks:2049: inode 11: block 198
[  237.723007][    C1] EXT4-fs (loop4): last error at time 1788505746: mb_free_blocks:2049: inode 11: block 198
[  237.737060][T11318] EXT4-fs (loop4): Remounting filesystem read-only
[  237.737196][T11318] EXT4-fs (loop4): 1 truncate cleaned up
[  237.738511][T11318] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  237.765519][T10324] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  237.987968][T11324] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[  238.024504][T11327] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+
[  238.024669][T11327] block device autoloading is deprecated and will be removed.
[  238.865848][T11340] netlink: 'syz.4.2232': attribute type 4 has an invalid length.
[  238.869856][T11340] netlink: 224 bytes leftover after parsing attributes in process `syz.4.2232'.
[  240.573805][ T4995] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[  240.582451][ T4995] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[  240.592668][ T4995] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[  240.596580][ T4995] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[  240.600529][ T4995] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[  242.012838][T11391] bridge0: port 1(bridge_slave_0) entered blocking state
[  242.012944][T11391] bridge0: port 1(bridge_slave_0) entered disabled state
[  242.013067][T11391] bridge_slave_0: entered allmulticast mode
[  242.013854][T11391] bridge_slave_0: entered promiscuous mode
[  242.015547][T11391] bridge0: port 2(bridge_slave_1) entered blocking state
[  242.015611][T11391] bridge0: port 2(bridge_slave_1) entered disabled state
[  242.015759][T11391] bridge_slave_1: entered allmulticast mode
[  242.016936][T11391] bridge_slave_1: entered promiscuous mode
[  242.032797][T11391] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  242.033999][T11391] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  242.047711][T11391] team0: Port device team_slave_0 added
[  242.049594][T11391] team0: Port device team_slave_1 added
[  242.068121][T11391] batman_adv: batadv0: Adding interface: batadv_slave_0
[  242.068219][T11391] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  242.068510][T11391] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  242.069365][T11391] batman_adv: batadv0: Adding interface: batadv_slave_1
[  242.069371][T11391] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  242.069381][T11391] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  242.295902][T11391] hsr_slave_0: entered promiscuous mode
[  242.296879][T11391] hsr_slave_1: entered promiscuous mode
[  242.306844][T11391] debugfs: 'hsr0' already exists in 'hsr'
[  242.307062][T11391] Cannot create hsr debugfs directory
[  242.798759][ T5600] Bluetooth: hci4: command tx timeout
[  243.043306][T11391] netdevsim netdevsim5 netdevsim0: renamed from eth0
[  243.048019][T11391] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  243.051393][T11391] netdevsim netdevsim5 netdevsim1: renamed from eth1
[  243.060661][T11391] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  243.063993][T11391] netdevsim netdevsim5 netdevsim2: renamed from eth2
[  243.075991][T11391] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  243.085778][T11391] netdevsim netdevsim5 netdevsim3: renamed from eth3
[  243.093013][T11391] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  243.187398][T11391] 8021q: adding VLAN 0 to HW filter on device bond0
[  243.196535][T11391] 8021q: adding VLAN 0 to HW filter on device team0
[  243.203580][   T28] bridge0: port 1(bridge_slave_0) entered blocking state
[  243.203651][   T28] bridge0: port 1(bridge_slave_0) entered forwarding state
[  243.213193][   T28] bridge0: port 2(bridge_slave_1) entered blocking state
[  243.213265][   T28] bridge0: port 2(bridge_slave_1) entered forwarding state
[  243.725180][T11391] 8021q: adding VLAN 0 to HW filter on device batadv0
[  243.779421][T11460] loop4: detected capacity change from 0 to 512
[  243.782771][T11460] EXT4-fs: Ignoring removed i_version option
[  243.849068][T11460] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode
[  243.881128][T11460] EXT4-fs error (device loop4): ext4_free_branches:1023: inode #16: comm syz.4.2273: invalid indirect mapped block 32768 (level 2)
[  243.888766][T11460] loop4: lost file I/O error report for ino 16 type 5 pos 0x0 len 0x0 error -117
[  243.899468][    C1] EXT4-fs (loop4): error count since last fsck: 1
[  243.899519][    C1] EXT4-fs (loop4): initial error at time 1788505752: ext4_free_branches:1023: inode 16
[  243.899583][    C1] EXT4-fs (loop4): last error at time 1788505752: ext4_free_branches:1023: inode 16
[  243.925179][T11460] EXT4-fs (loop4): 1 orphan inode deleted
[  243.925249][T11460] EXT4-fs (loop4): 1 truncate cleaned up
[  243.926774][T11460] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  243.930648][T11460] EXT4-fs error (device loop4): ext4_read_inline_dir:1512: inode #12: block 7: comm syz.4.2273: path /151/file0/file0: bad entry in directory: directory entry overrun - offset=24, inode=13, rec_len=784, size=60 fake=0
[  243.964853][T10324] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  243.999254][T11391] veth0_vlan: entered promiscuous mode
[  244.020022][T11391] veth1_vlan: entered promiscuous mode
[  244.065883][T11391] veth0_macvtap: entered promiscuous mode
[  244.075684][T11391] veth1_macvtap: entered promiscuous mode
[  244.103944][T11391] batman_adv: batadv0: Interface activated: batadv_slave_0
[  244.116517][T11391] batman_adv: batadv0: Interface activated: batadv_slave_1
[  244.168926][   T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  244.169237][   T12] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  244.169441][   T12] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  244.169608][   T12] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  244.378192][ T5867] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  244.378257][ T5867] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  244.425789][ T5867] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  244.425851][ T5867] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  244.662050][T11491] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff)
[  244.867838][T11499] loop4: detected capacity change from 0 to 512
[  244.874900][T11499] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode
[  244.886533][T11499] EXT4-fs error (device loop4): ext4_orphan_get:1429: comm syz.4.2287: bad orphan inode 11
[  244.886590][T11499] loop4: lost filesystem error report for type 5 error -117
[  244.902018][T11499] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  244.946236][T11499] EXT4-fs error (device loop4): __ext4_new_inode:1083: comm syz.4.2287: reserved inode found cleared - inode=18
[  244.971992][T11499] CacheFiles: mkdir cache failed with error -28
[  244.974128][T11499] CacheFiles: Failed to register: -28
[  244.990580][T11504] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check.
[  245.008691][T10324] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  245.010060][ T5600] Bluetooth: hci4: command tx timeout
[  245.480296][ T2248] usb 5-1: new high-speed USB device number 10 using dummy_hcd
[  245.652694][ T2248] usb 5-1: Using ep0 maxpacket: 8
[  245.655601][ T2248] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23
[  245.660629][ T2248] usb 5-1: config index 0 descriptor too short (expected 301, got 45)
[  245.660763][ T2248] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0
[  245.660823][ T2248] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0
[  245.660862][ T2248] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32
[  245.660900][ T2248] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  245.660951][ T2248] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  245.739182][T11531] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2302'.
[  245.907212][ T2248] usb 5-1: usb_control_msg returned -32
[  245.909322][ T2248] usbtmc 5-1:16.0: can't read capabilities
[  246.128341][ T8402] usb 5-1: USB disconnect, device number 10
[  246.441174][T11548] syzkaller1: entered allmulticast mode
[  246.938314][T11553] netlink: 'syz.4.2312': attribute type 39 has an invalid length.
[  247.234128][ T5600] Bluetooth: hci4: command tx timeout
[  247.460897][T11562] loop4: detected capacity change from 0 to 128
[  247.547052][T11561] EXT4-fs (sda1): re-mounted b4773fba-1738-4da0-8a90-0fe043d0a496.
[  248.383461][T11606] loop4: detected capacity change from 0 to 256
[  248.577040][T11614] netlink: 'syz.0.2339': attribute type 2 has an invalid length.
[  248.876395][T11634] loop4: detected capacity change from 0 to 128
[  249.084905][T11652] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2356'.
[  249.225458][T11663] loop4: detected capacity change from 0 to 512
[  249.232407][T11663] EXT4-fs (loop4): ext4_check_descriptors: Checksum for group 0 failed (17031!=33349)
[  249.241661][T11663] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=32, mo=8842e02c, mo2=0002]
[  249.244734][T11663] EXT4-fs (loop4): orphan cleanup on readonly fs
[  249.248334][T11663] EXT4-fs error (device loop4): ext4_clear_blocks:876: inode #11: comm syz.4.2362: attempt to clear invalid blocks 1024 len 1
[  249.248378][T11663] loop4: lost file I/O error report for ino 11 type 5 pos 0x0 len 0x0 error -117
[  249.254159][T11663] EXT4-fs (loop4): Remounting filesystem read-only
[  249.261474][T11663] EXT4-fs (loop4): 1 truncate cleaned up
[  249.262464][T11663] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000007 ro without journal. Quota mode: none.
[  249.305058][T10324] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000007.
[  249.336922][T11667] syzkaller0: entered promiscuous mode
[  249.336963][T11667] syzkaller0: entered allmulticast mode
[  249.457164][ T5600] Bluetooth: hci4: command tx timeout
[  250.408615][ T1290] usb 6-1: new full-speed USB device number 2 using dummy_hcd
[  250.570255][ T1290] usb 6-1: New USB device found, idVendor=0df6, idProduct=0056, bcdDevice=d2.4b
[  250.573995][ T1290] usb 6-1: config 127 has an invalid interface number: 57 but max is 0
[  250.574050][ T1290] usb 6-1: config 127 has no interface number 0
[  250.574091][ T1290] usb 6-1: config 127 interface 57 altsetting 0 endpoint 0xC has invalid maxpacket 1023, setting to 64
[  250.585301][ T1290] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  250.585338][ T1290] usb 6-1: Product: syz
[  250.585380][ T1290] usb 6-1: Manufacturer: syz
[  250.585404][ T1290] usb 6-1: SerialNumber: syz
[  250.598369][T11714] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22
[  250.837606][ T1290] asix 6-1:127.57: probe with driver asix failed with error -71
[  250.845783][ T1290] usb 6-1: USB disconnect, device number 2
[  251.054674][   T13] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  251.180983][ T4995] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[  251.187363][ T4995] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[  251.202757][ T4995] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[  251.206118][ T4995] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[  251.211526][ T4995] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[  251.272398][   T13] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  251.450726][   T13] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  251.491785][T11778] loop5: detected capacity change from 0 to 256
[  251.520062][T11778] FAT-fs (loop5): error, allocated dir entry found after end-of-directory marker (i_pos 1)
[  251.520115][T11778] FAT-fs (loop5): Filesystem has been set read-only
[  251.587497][   T13] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  251.707803][T11791] loop5: detected capacity change from 0 to 24
[  251.727424][T11791] romfs: read error for inode 0x8000
[  252.506103][   T13] bridge_slave_1: left allmulticast mode
[  252.506217][   T13] bridge_slave_1: left promiscuous mode
[  252.506971][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[  252.522895][   T13] bridge_slave_0: left allmulticast mode
[  252.522939][   T13] bridge_slave_0: left promiscuous mode
[  252.528404][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[  253.237748][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  253.258882][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  253.270588][   T13] bond0 (unregistering): Released all slaves
[  253.328092][T11812] veth0_virt_wifi: entered promiscuous mode
[  253.481864][ T4995] Bluetooth: hci3: command tx timeout
[  253.542695][T11765] bridge0: port 1(bridge_slave_0) entered blocking state
[  253.542764][T11765] bridge0: port 1(bridge_slave_0) entered disabled state
[  253.542846][T11765] bridge_slave_0: entered allmulticast mode
[  253.564389][T11765] bridge_slave_0: entered promiscuous mode
[  253.666851][T11765] bridge0: port 2(bridge_slave_1) entered blocking state
[  253.666920][T11765] bridge0: port 2(bridge_slave_1) entered disabled state
[  253.667032][T11765] bridge_slave_1: entered allmulticast mode
[  253.675890][T11765] bridge_slave_1: entered promiscuous mode
[  253.684980][ T5340] 8021q: adding VLAN 0 to HW filter on device eth6
[  253.748189][T11765] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  253.782231][T11765] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  253.891886][T11765] team0: Port device team_slave_0 added
[  253.897099][T11765] team0: Port device team_slave_1 added
[  253.913928][T11765] batman_adv: batadv0: Adding interface: batadv_slave_0
[  253.913965][T11765] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  253.920401][T11765] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  253.921656][T11765] batman_adv: batadv0: Adding interface: batadv_slave_1
[  253.921692][T11765] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  253.921729][T11765] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  254.249995][   T13] hsr_slave_0: left promiscuous mode
[  254.252858][   T13] hsr_slave_1: left promiscuous mode
[  254.257847][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  254.257894][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[  254.265179][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  254.265222][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[  254.318477][   T13] veth1_macvtap: left promiscuous mode
[  254.318619][   T13] veth0_macvtap: left promiscuous mode
[  254.318730][   T13] veth1_vlan: left promiscuous mode
[  254.318868][   T13] veth0_vlan: left promiscuous mode
[  254.651632][   T13] team0 (unregistering): Port device team_slave_1 removed
[  254.668301][   T13] team0 (unregistering): Port device team_slave_0 removed
[  254.753226][T11765] hsr_slave_0: entered promiscuous mode
[  254.753685][T11765] hsr_slave_1: entered promiscuous mode
[  254.753949][T11765] debugfs: 'hsr0' already exists in 'hsr'
[  254.753958][T11765] Cannot create hsr debugfs directory
[  255.133143][   T13] IPVS: stop unused estimator thread 0...
[  255.191187][ T5340] 8021q: adding VLAN 0 to HW filter on device eth8
[  255.283604][ T1290] usb 6-1: new high-speed USB device number 3 using dummy_hcd
[  255.455607][ T1290] usb 6-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00
[  255.463480][ T1290] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  255.463553][ T1290] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 0
[  255.463602][ T1290] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  255.495319][ T1290] opticon 6-1:1.0: opticon converter detected
[  255.510436][ T1290] usb 6-1: opticon converter now attached to ttyUSB0
[  255.539729][T11765] netdevsim netdevsim6 netdevsim0: renamed from eth0
[  255.549086][T11765] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  255.549667][T11765] netdevsim netdevsim6 netdevsim1: renamed from eth1
[  255.562857][T11765] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  255.564774][T11765] netdevsim netdevsim6 netdevsim2: renamed from eth2
[  255.587965][T11765] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  255.588510][T11765] netdevsim netdevsim6 netdevsim3: renamed from eth3
[  255.601427][T11765] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  255.705496][ T4995] Bluetooth: hci3: command tx timeout
[  255.729483][T11765] 8021q: adding VLAN 0 to HW filter on device bond0
[  255.745339][T11765] 8021q: adding VLAN 0 to HW filter on device team0
[  255.749959][ T5869] bridge0: port 1(bridge_slave_0) entered blocking state
[  255.750046][ T5869] bridge0: port 1(bridge_slave_0) entered forwarding state
[  255.756010][  T144] bridge0: port 2(bridge_slave_1) entered blocking state
[  255.756051][  T144] bridge0: port 2(bridge_slave_1) entered forwarding state
[  255.765171][ T5340] 8021q: adding VLAN 0 to HW filter on device eth7
[  255.772816][T10962] usb 6-1: USB disconnect, device number 3
[  255.798781][T11899] FAULT_INJECTION: forcing a failure.
[  255.798781][T11899] name fail_futex, interval 1, probability 0, space 0, times 1
[  255.801236][T10962] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0
[  255.801743][T10962] opticon 6-1:1.0: device disconnected
[  255.811216][T11899] CPU: 1 UID: 0 PID: 11899 Comm: syz.0.2449 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  255.811260][T11899] Tainted: [L]=SOFTLOCKUP
[  255.811266][T11899] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  255.811275][T11899] Call Trace:
[  255.811280][T11899]  <TASK>
[  255.811287][T11899]  dump_stack_lvl+0xe8/0x150
[  255.811311][T11899]  should_fail_ex+0x410/0x560
[  255.811332][T11899]  get_futex_key+0x1b4/0x1580
[  255.811350][T11899]  ? __lock_acquire+0x6df/0x2e50
[  255.811366][T11899]  ? __pfx_get_futex_key+0x10/0x10
[  255.811382][T11899]  ? __cgroup_account_cputime+0xe8/0x120
[  255.811405][T11899]  futex_wait_setup+0x4a/0x590
[  255.811428][T11899]  ? __futex_wait+0xdf/0x400
[  255.811449][T11899]  __futex_wait+0x15f/0x400
[  255.811471][T11899]  ? __pfx___futex_wait+0x10/0x10
[  255.811491][T11899]  ? __pfx_futex_wake_mark+0x10/0x10
[  255.811511][T11899]  ? try_to_wake_up+0x8c5/0x14d0
[  255.811533][T11899]  futex_wait+0x121/0x390
[  255.811554][T11899]  ? __pfx_futex_wait+0x10/0x10
[  255.811575][T11899]  ? do_raw_spin_unlock+0x4d/0x200
[  255.811598][T11899]  do_futex+0x3e7/0x4e0
[  255.811617][T11899]  ? __pfx_do_futex+0x10/0x10
[  255.811632][T11899]  ? put_files_struct+0x24f/0x350
[  255.811648][T11899]  __se_sys_futex+0x3a8/0x450
[  255.811668][T11899]  ? __pfx___se_sys_futex+0x10/0x10
[  255.811684][T11899]  ? rcu_is_watching+0x16/0xb0
[  255.811704][T11899]  ? __x64_sys_futex+0x21/0xf0
[  255.811722][T11899]  do_syscall_64+0x166/0x520
[  255.811737][T11899]  ? trace_irq_disable+0x3b/0x140
[  255.811749][T11899]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  255.811766][T11899]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  255.811779][T11899] RIP: 0033:0x7f85dd19e159
[  255.811793][T11899] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  255.811805][T11899] RSP: 002b:00007f85ddfb50e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[  255.811821][T11899] RAX: ffffffffffffffda RBX: 00007f85dd425fa8 RCX: 00007f85dd19e159
[  255.811830][T11899] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f85dd425fa8
[  255.811838][T11899] RBP: 00007f85dd425fa0 R08: 0000000000000000 R09: 0000000000000000
[  255.811847][T11899] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  255.811874][T11899] R13: 00007f85dd426038 R14: 00007fff76070f60 R15: 00007fff76071048
[  255.811897][T11899]  </TASK>
[  256.338018][ T5340] 8021q: adding VLAN 0 to HW filter on device eth5
[  256.563553][T11765] 8021q: adding VLAN 0 to HW filter on device batadv0
[  256.650554][T11936] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2457'.
[  256.926697][T11765] veth0_vlan: entered promiscuous mode
[  256.942186][T11765] veth1_vlan: entered promiscuous mode
[  257.003120][T11765] veth0_macvtap: entered promiscuous mode
[  257.014530][T11765] veth1_macvtap: entered promiscuous mode
[  257.084477][T11765] batman_adv: batadv0: Interface activated: batadv_slave_0
[  257.098928][T11765] batman_adv: batadv0: Interface activated: batadv_slave_1
[  257.105026][T11939] loop5: detected capacity change from 0 to 32768
[  257.115387][T11939] find_entry called with index = 0
[  257.120714][T11939] read_mapping_page failed!
[  257.123542][T11939] ERROR: (device loop5): txCommit: 
[  257.123542][T11939] 
[  257.126508][T11939] ERROR: (device loop5): remounting filesystem as read-only
[  257.230947][ T5658] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  257.231026][ T5658] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  257.231104][ T5658] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  257.231148][ T5658] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  257.453501][ T1112] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  257.453633][ T1112] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  257.515422][   T28] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  257.515461][   T28] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  257.639164][T11965] loop6: detected capacity change from 0 to 1024
[  257.702639][T11965] hfsplus: catalog record size mismatch (type 2, got 88, expected 248)
[  257.935024][ T4995] Bluetooth: hci3: command tx timeout
[  258.339986][T11973] loop6: detected capacity change from 0 to 32768
[  258.348481][T11973] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop6 (7:6) scanned by syz.6.2471 (11973)
[  258.354472][T11973] BTRFS info (device loop6 state S): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  258.354524][T11973] BTRFS info (device loop6 state S): using crc32c checksum algorithm
[  258.388945][   T28] BTRFS warning (device loop6 state ES): checksum verify failed on logical 1052672 mirror 1 wanted 0x37e030f7 found 0xf6479a7e level 0, ignored
[  258.399258][ T1112] BTRFS warning (device loop6 state ES): checksum verify failed on logical 5332992 mirror 1 wanted 0x0a5e5d25 found 0x13388982 level 0, ignored
[  258.404228][ T1112] BTRFS warning (device loop6 state ES): checksum verify failed on logical 5337088 mirror 1 wanted 0xe63dbdda found 0x28b693f7 level 0, ignored
[  258.424754][T11973] BTRFS error (device loop6 state ES): failed to load root free space
[  258.475934][ T1112] BTRFS warning (device loop6 state ES): checksum verify failed on logical 5267456 mirror 1 wanted 0x22fa3277 found 0x0d9b21b0 level 0, ignored
[  258.481006][T11973] BTRFS info (device loop6 state ES): enabling ssd optimizations
[  258.483567][T11973] BTRFS info (device loop6 state ES): enabling free space tree
[  258.486447][T11973] BTRFS info (device loop6 state ES): ignoring bad roots
[  258.488968][T11973] BTRFS info (device loop6 state ES): ignoring meta csums
[  258.491801][T11973] BTRFS info (device loop6 state ES): force zlib compression, level 3
[  258.584359][T11765] BTRFS info (device loop6 state ES): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  259.523090][T12043] loop5: detected capacity change from 0 to 32768
[  260.160439][ T4995] Bluetooth: hci3: command tx timeout
[  260.929496][ T1382] ieee802154 phy0 wpan0: encryption failed: -22
[  260.929584][ T1382] ieee802154 phy1 wpan1: encryption failed: -22
[  261.104930][T12078] netlink: 'syz.5.2512': attribute type 30 has an invalid length.
[  261.231756][T12084] loop5: detected capacity change from 0 to 128
[  261.235169][T12084] UDF-fs: error (device loop5): udf_read_tagged: read failed, block=256, location=256
[  261.240037][T12084] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[  261.250990][T12084] overlayfs: upper fs needs to support d_type.
[  261.255638][T12084] overlayfs: upper fs does not support tmpfile.
[  261.559826][T10964] usb 6-1: new high-speed USB device number 4 using dummy_hcd
[  261.719300][T10964] usb 6-1: Using ep0 maxpacket: 16
[  261.721758][T10964] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= f.89
[  261.726377][T10964] usb 6-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config
[  261.726434][T10964] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3
[  261.735686][T10964] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
[  261.735732][T10964] usb 6-1: SerialNumber: syz
[  261.740716][T10964] usb 6-1: 0:2 : does not exist
[  261.912468][T12090] i2c i2c-0: new_device: Instantiated device rtl2832 at 0x01
[  261.967631][T10964] usb 6-1: 5:0: failed to get current value for ch 0 (-22)
[  261.974802][T10964] usb 6-1: 5:0: cannot get min/max values for control 4 (id 5)
[  261.978529][T10964] usb 6-1: 5:0: cannot get min/max values for control 5 (id 5)
[  261.983131][T10964] usb 6-1: 5:0: cannot get min/max values for control 5 (id 5)
[  261.995683][T10964] usb 6-1: 5:0: cannot get min/max values for control 5 (id 5)
[  262.008688][T10964] usb 6-1: USB disconnect, device number 4
[  262.026170][T10857] udevd[10857]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  262.732299][T12099] loop5: detected capacity change from 0 to 1024
[  263.296737][T12116] loop5: detected capacity change from 0 to 32768
[  263.356650][T12116] ERROR: (device loop5): jfs_readdir: JFS:Dtree error: ino = 2, bn=0, index = 4
[  263.356650][T12116] 
[  263.364780][T12116] ERROR: (device loop5): remounting filesystem as read-only
[  263.505865][   T34] kauditd_printk_skb: 11 callbacks suppressed
[  263.505945][   T34] audit: type=1326 audit(1788505770.521:100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12118 comm="syz.5.2528" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f8caa19e159 code=0x0
[  264.523015][T12138] loop5: detected capacity change from 0 to 512
[  264.537086][T12138] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode
[  264.544613][T12138] EXT4-fs (loop5): 1 truncate cleaned up
[  264.549479][T12138] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  264.601871][T12138] EXT4-fs error (device loop5): __ext4_expand_extra_isize:6537: inode #15: comm syz.5.2534: bad extra_isize 62 (inode size 256)
[  264.610460][T12138] EXT4-fs (loop5): Remounting filesystem read-only
[  264.646690][T11391] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  266.111587][T12192] loop5: detected capacity change from 0 to 1024
[  266.131174][T12192] EXT4-fs (loop5): mounted filesystem 00000000-0000-0006-0000-000000000000 r/w without journal. Quota mode: none.
[  266.142805][T12192] ext4 filesystem being mounted at /70/file1 supports timestamps until 2038-01-19 (0x7fffffff)
[  266.158808][T12192] EXT4-fs warning (device loop5): ext4_empty_dir:3106: inode #12: comm syz.5.2559: directory missing '..'
[  266.200701][T11391] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0006-0000-000000000000.
[  266.498072][T10965] usb 6-1: new high-speed USB device number 5 using dummy_hcd
[  266.658316][T10965] usb 6-1: Using ep0 maxpacket: 8
[  266.661104][T10965] usb 6-1: New USB device found, idVendor=077d, idProduct=627a, bcdDevice= 0.10
[  266.666273][T10965] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0xE has invalid wMaxPacketSize 0
[  266.666325][T10965] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xB3, changing to 0x83
[  266.666354][T10965] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0
[  266.684044][T10965] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  266.684103][T10965] usb 6-1: Product: syz
[  266.684134][T10965] usb 6-1: Manufacturer: syz
[  266.684158][T10965] usb 6-1: SerialNumber: syz
[  266.689281][T10965] usb 6-1: config 0 descriptor??
[  266.694914][T10965] radioshark2 6-1:0.0: Invalid radioSHARK2 device
[  266.694961][T10965] radioshark2 6-1:0.0: probe with driver radioshark2 failed with error -22
[  266.695102][T10965] usbhid 6-1:0.0: couldn't find an input interrupt endpoint
[  266.944697][   T25] usb 6-1: USB disconnect, device number 5
[  267.425200][T12212] netlink: 276 bytes leftover after parsing attributes in process `syz.0.2565'.
[  267.430068][T12212] netlink: 276 bytes leftover after parsing attributes in process `syz.0.2565'.
[  267.642481][T12223] loop5: detected capacity change from 0 to 1024
[  267.741898][T12229] loop5: detected capacity change from 0 to 128
[  267.747625][T12229] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only
[  267.747779][T12229] hpfs: filesystem error: improperly stopped
[  267.747787][T12229] hpfs: filesystem error: warning: spare dnodes used, try chkdsk
[  267.747792][T12229] hpfs: You really don't want any checks? You are crazy...
[  267.750261][T12229] hpfs: hpfs_map_sector(): read error
[  267.750271][T12229] hpfs: code page support is disabled
[  267.772441][T12229] hpfs: hpfs_map_4sectors(): unaligned read
[  267.772878][T12229] hpfs: hpfs_map_4sectors(): unaligned read
[  267.772884][T12229] hpfs: filesystem error: unable to find root dir
[  267.801819][T12229] hpfs: hpfs_map_4sectors(): unaligned read
[  267.802755][T12229] hpfs: hpfs_map_sector(): read error
[  267.888302][T12234] FAULT_INJECTION: forcing a failure.
[  267.888302][T12234] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  267.888358][T12234] CPU: 0 UID: 0 PID: 12234 Comm: syz.5.2576 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  267.888394][T12234] Tainted: [L]=SOFTLOCKUP
[  267.888400][T12234] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  267.888407][T12234] Call Trace:
[  267.888412][T12234]  <TASK>
[  267.888417][T12234]  dump_stack_lvl+0xe8/0x150
[  267.888439][T12234]  should_fail_ex+0x410/0x560
[  267.888459][T12234]  _copy_from_iter+0x1d3/0x1660
[  267.888475][T12234]  ? __alloc_skb+0x27a/0x7a0
[  267.888493][T12234]  ? __alloc_skb+0x27a/0x7a0
[  267.888510][T12234]  ? __alloc_skb+0x27a/0x7a0
[  267.888525][T12234]  ? __pfx__copy_from_iter+0x10/0x10
[  267.888540][T12234]  ? kmem_cache_alloc_node_noprof+0x1f9/0x610
[  267.888555][T12234]  ? __alloc_skb+0x27a/0x7a0
[  267.888569][T12234]  ? __alloc_skb+0x27a/0x7a0
[  267.888587][T12234]  ? netlink_sendmsg+0x650/0xb40
[  267.888598][T12234]  ? skb_put+0x112/0x210
[  267.888610][T12234]  netlink_sendmsg+0x6c0/0xb40
[  267.888621][T12234]  ? __pfx_netlink_sendmsg+0x10/0x10
[  267.888631][T12234]  ? apparmor_socket_sendmsg+0x98/0x360
[  267.888641][T12234]  ? __pfx_netlink_sendmsg+0x10/0x10
[  267.888648][T12234]  sock_sendmsg_nosec+0x13a/0x180
[  267.888657][T12234]  __sys_sendto+0x408/0x5a0
[  267.888669][T12234]  ? __pfx___sys_sendto+0x10/0x10
[  267.888688][T12234]  ? do_user_addr_fault+0xc4c/0x1340
[  267.888697][T12234]  __x64_sys_sendto+0xde/0x100
[  267.888708][T12234]  do_syscall_64+0x166/0x520
[  267.888716][T12234]  ? trace_irq_disable+0x3b/0x140
[  267.888723][T12234]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  267.888732][T12234]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  267.888740][T12234] RIP: 0033:0x7f8caa15e98e
[  267.888748][T12234] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[  267.888755][T12234] RSP: 002b:00007f8cab0e5e88 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[  267.888764][T12234] RAX: ffffffffffffffda RBX: 00007f8cab0e76c0 RCX: 00007f8caa15e98e
[  267.888770][T12234] RDX: 0000000000000028 RSI: 00007f8cab0e6000 RDI: 0000000000000004
[  267.888775][T12234] RBP: 0000000000000000 R08: 00007f8cab0e5f04 R09: 000000000000000c
[  267.888780][T12234] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004
[  267.888785][T12234] R13: 00007f8cab0e5f58 R14: 00007f8cab0e6000 R15: 0000000000000000
[  267.888796][T12234]  </TASK>
[  268.025362][T12243] loop5: detected capacity change from 0 to 4096
[  268.032417][T12243] EXT4-fs (loop5): Test dummy encryption mode enabled
[  268.050295][T12243] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  268.113411][T11391] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  268.216139][T12251] loop5: detected capacity change from 0 to 128
[  268.226795][T12251] ufs: ufstype=openstep is supported read-only
[  268.243492][T12251] ufs: this is not a 44bsd filesystem
[  268.448207][T12258] loop5: detected capacity change from 0 to 1024
[  268.450821][T12258] EXT4-fs: Ignoring removed bh option
[  268.453285][T12258] EXT4-fs (loop5): stripe (5) is not aligned with cluster size (16), stripe is disabled
[  268.485073][T12258] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  268.726335][T11391] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  269.077777][T12276] xt_CHECKSUM: CHECKSUM should be avoided.  If really needed, restrict with "-p udp" and only use in OUTPUT
[  269.082168][T12271] loop5: detected capacity change from 0 to 40427
[  269.098121][T12271] F2FS-fs (loop5): invalid crc value
[  269.188694][T12271] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  269.235790][T12271] F2FS-fs (loop5): f2fs_disable_checkpoint starts, unusable: 0
[  269.235851][T12271] F2FS-fs (loop5): f2fs_disable_checkpoint: call f2fs_write_checkpoint(), meta: 0, node: 0, data: 0
[  269.235985][T12271] F2FS-fs (loop5): Start checkpoint disabled!
[  269.274976][T12271] F2FS-fs (loop5): f2fs_disable_checkpoint finishes, err:0
[  269.279549][T12271] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e6
[  269.304015][ T5862] kworker/u9:4: attempt to access beyond end of device
[  269.304015][ T5862] loop5: rw=2049, sector=45096, nr_sectors = 16 limit=40427
[  269.322958][ T5862] CPU: 0 UID: 0 PID: 5862 Comm: kworker/u9:4 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  269.322988][ T5862] Tainted: [L]=SOFTLOCKUP
[  269.322992][ T5862] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  269.322998][ T5862] Workqueue: writeback wb_workfn (flush-7:5)
[  269.323016][ T5862] Call Trace:
[  269.323020][ T5862]  <TASK>
[  269.323024][ T5862]  dump_stack_lvl+0xe8/0x150
[  269.323038][ T5862]  f2fs_stop_checkpoint+0x3f6/0x5d0
[  269.323051][ T5862]  f2fs_write_end_bio+0x1211/0x16e0
[  269.323061][ T5862]  ? blkg_put+0x22/0x240
[  269.323078][ T5862]  __submit_merged_bio+0x258/0x6a0
[  269.323088][ T5862]  ? rcu_is_watching+0x16/0xb0
[  269.323100][ T5862]  __submit_merged_write_cond+0x3c9/0x4e0
[  269.323114][ T5862]  ? __pfx___submit_merged_write_cond+0x10/0x10
[  269.323133][ T5862]  f2fs_write_data_pages+0x2a27/0x36f0
[  269.323153][ T5862]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  269.323166][ T5862]  ? __pfx_f2fs_available_free_memory+0x10/0x10
[  269.323186][ T5862]  ? __pfx_f2fs_balance_fs_bg+0x10/0x10
[  269.323199][ T5862]  ? __lock_acquire+0x6df/0x2e50
[  269.323214][ T5862]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  269.323222][ T5862]  do_writepages+0x338/0x560
[  269.323238][ T5862]  ? reacquire_held_locks+0x117/0x1a0
[  269.323246][ T5862]  ? writeback_sb_inodes+0x450/0x1b00
[  269.323255][ T5862]  __writeback_single_inode+0x136/0x1220
[  269.323264][ T5862]  ? do_raw_spin_unlock+0x4d/0x200
[  269.323275][ T5862]  writeback_sb_inodes+0x9de/0x1b00
[  269.323281][ T5862]  ? __lock_acquire+0x6df/0x2e50
[  269.323299][ T5862]  ? lock_acquire+0x115/0x350
[  269.323309][ T5862]  ? __pfx_writeback_sb_inodes+0x10/0x10
[  269.323331][ T5862]  ? rcu_is_watching+0x16/0xb0
[  269.323339][ T5862]  ? queue_io+0x2d3/0x470
[  269.323347][ T5862]  wb_writeback+0x41c/0xad0
[  269.323355][ T5862]  ? queue_io+0x1e1/0x470
[  269.323364][ T5862]  ? __pfx_wb_writeback+0x10/0x10
[  269.323370][ T5862]  ? do_raw_spin_lock+0x12b/0x2f0
[  269.323385][ T5862]  wb_workfn+0x431/0x10f0
[  269.323401][ T5862]  ? __pfx_wb_workfn+0x10/0x10
[  269.323411][ T5862]  ? rcu_is_watching+0x16/0xb0
[  269.323419][ T5862]  ? trace_hrtimer_start+0x82/0x200
[  269.323432][ T5862]  ? do_raw_spin_lock+0x12b/0x2f0
[  269.323445][ T5862]  ? lock_acquire+0x115/0x350
[  269.323455][ T5862]  ? rcu_is_watching+0x16/0xb0
[  269.323464][ T5862]  ? process_scheduled_works+0x97a/0x1630
[  269.323473][ T5862]  process_scheduled_works+0xc3d/0x1630
[  269.323494][ T5862]  ? __pfx_process_scheduled_works+0x10/0x10
[  269.323505][ T5862]  ? assign_work+0x3cf/0x5d0
[  269.323516][ T5862]  worker_thread+0xa47/0xfb0
[  269.323536][ T5862]  kthread+0x38b/0x480
[  269.323544][ T5862]  ? __pfx_worker_thread+0x10/0x10
[  269.323553][ T5862]  ? __pfx_kthread+0x10/0x10
[  269.323560][ T5862]  ret_from_fork+0x514/0xb70
[  269.323569][ T5862]  ? __pfx_ret_from_fork+0x10/0x10
[  269.323576][ T5862]  ? __switch_to+0xc89/0x1420
[  269.323587][ T5862]  ? __pfx_kthread+0x10/0x10
[  269.323595][ T5862]  ret_from_fork_asm+0x1a/0x30
[  269.323608][ T5862]  </TASK>
[  269.323672][ T5862] F2FS-fs (loop5): Stopped filesystem due to reason: 3
[  269.323746][ T5862] CPU: 0 UID: 0 PID: 5862 Comm: kworker/u9:4 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  269.323757][ T5862] Tainted: [L]=SOFTLOCKUP
[  269.323760][ T5862] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  269.323764][ T5862] Workqueue: writeback wb_workfn (flush-7:5)
[  269.323776][ T5862] Call Trace:
[  269.323779][ T5862]  <TASK>
[  269.323782][ T5862]  dump_stack_lvl+0xe8/0x150
[  269.323795][ T5862]  f2fs_stop_checkpoint+0x3f6/0x5d0
[  269.323814][ T5862]  f2fs_write_end_bio+0x1211/0x16e0
[  269.323839][ T5862]  __submit_merged_bio+0x258/0x6a0
[  269.323853][ T5862]  ? rcu_is_watching+0x16/0xb0
[  269.323867][ T5862]  __submit_merged_write_cond+0x3c9/0x4e0
[  269.323918][ T5862]  ? __pfx___submit_merged_write_cond+0x10/0x10
[  269.323949][ T5862]  f2fs_write_data_pages+0x2a27/0x36f0
[  269.323981][ T5862]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  269.324000][ T5862]  ? __pfx_f2fs_available_free_memory+0x10/0x10
[  269.324035][ T5862]  ? __pfx_f2fs_balance_fs_bg+0x10/0x10
[  269.324059][ T5862]  ? __lock_acquire+0x6df/0x2e50
[  269.324086][ T5862]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  269.324100][ T5862]  do_writepages+0x338/0x560
[  269.324124][ T5862]  ? reacquire_held_locks+0x117/0x1a0
[  269.324138][ T5862]  ? writeback_sb_inodes+0x450/0x1b00
[  269.324154][ T5862]  __writeback_single_inode+0x136/0x1220
[  269.324167][ T5862]  ? do_raw_spin_unlock+0x4d/0x200
[  269.324184][ T5862]  writeback_sb_inodes+0x9de/0x1b00
[  269.324195][ T5862]  ? __lock_acquire+0x6df/0x2e50
[  269.324216][ T5862]  ? lock_acquire+0x115/0x350
[  269.324230][ T5862]  ? __pfx_writeback_sb_inodes+0x10/0x10
[  269.324253][ T5862]  ? rcu_is_watching+0x16/0xb0
[  269.324262][ T5862]  ? queue_io+0x2d3/0x470
[  269.324271][ T5862]  wb_writeback+0x41c/0xad0
[  269.324279][ T5862]  ? queue_io+0x1e1/0x470
[  269.324294][ T5862]  ? __pfx_wb_writeback+0x10/0x10
[  269.324300][ T5862]  ? do_raw_spin_lock+0x12b/0x2f0
[  269.324316][ T5862]  wb_workfn+0x431/0x10f0
[  269.324333][ T5862]  ? __pfx_wb_workfn+0x10/0x10
[  269.324343][ T5862]  ? rcu_is_watching+0x16/0xb0
[  269.324352][ T5862]  ? trace_hrtimer_start+0x82/0x200
[  269.324364][ T5862]  ? do_raw_spin_lock+0x12b/0x2f0
[  269.324377][ T5862]  ? lock_acquire+0x115/0x350
[  269.324412][ T5862]  ? rcu_is_watching+0x16/0xb0
[  269.324427][ T5862]  ? process_scheduled_works+0x97a/0x1630
[  269.324442][ T5862]  process_scheduled_works+0xc3d/0x1630
[  269.324479][ T5862]  ? __pfx_process_scheduled_works+0x10/0x10
[  269.324500][ T5862]  ? assign_work+0x3cf/0x5d0
[  269.324519][ T5862]  worker_thread+0xa47/0xfb0
[  269.324554][ T5862]  kthread+0x38b/0x480
[  269.324567][ T5862]  ? __pfx_worker_thread+0x10/0x10
[  269.324581][ T5862]  ? __pfx_kthread+0x10/0x10
[  269.324594][ T5862]  ret_from_fork+0x514/0xb70
[  269.324608][ T5862]  ? __pfx_ret_from_fork+0x10/0x10
[  269.324620][ T5862]  ? __switch_to+0xc89/0x1420
[  269.324638][ T5862]  ? __pfx_kthread+0x10/0x10
[  269.324651][ T5862]  ret_from_fork_asm+0x1a/0x30
[  269.324675][ T5862]  </TASK>
[  269.325399][ T5862] F2FS-fs (loop5): Stopped filesystem due to reason: 3
[  270.040501][T12308] loop5: detected capacity change from 0 to 32768
[  270.067484][T12308] XFS (loop5): Mounting V5 Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  270.077651][T12308] XFS (loop5): Ending clean mount
[  270.088176][   T34] audit: type=1800 audit(1788505776.666:101): pid=12308 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.2599" name="file1" dev="loop5" ino=4426 res=0 errno=0
[  270.108918][T11391] XFS (loop5): Unmounting Filesystem 986211a9-7d00-4ebf-a576-e3de63fa2cbd
[  270.296050][T12320] loop5: detected capacity change from 0 to 8
[  270.298139][T12320] SQUASHFS error: xz decompression failed, data probably corrupt
[  270.298160][T12320] SQUASHFS error: Failed to read block 0x108: -5
[  270.298170][T12320] SQUASHFS error: Unable to read metadata cache entry [106]
[  270.298177][T12320] SQUASHFS error: Unable to read inode 0x3
[  270.427949][T12322] loop5: detected capacity change from 0 to 8192
[  270.641233][T12333] ip6_tables: ip6tables: counters copy to user failed while replacing table
[  271.115833][   T34] audit: type=1326 audit(1788505777.630:102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12362 comm="syz.5.2621" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8caa19e159 code=0x7ffc0000
[  271.116086][   T34] audit: type=1326 audit(1788505777.630:103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12362 comm="syz.5.2621" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8caa19e159 code=0x7ffc0000
[  271.118442][   T34] audit: type=1326 audit(1788505777.639:104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12362 comm="syz.5.2621" exe="/syz-executor" sig=0 arch=c000003e syscall=315 compat=0 ip=0x7f8caa19e159 code=0x7ffc0000
[  271.118598][   T34] audit: type=1326 audit(1788505777.639:105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12362 comm="syz.5.2621" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8caa19e159 code=0x7ffc0000
[  271.118718][   T34] audit: type=1326 audit(1788505777.639:106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12362 comm="syz.5.2621" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8caa19e159 code=0x7ffc0000
[  271.152017][T12365] netlink: NAT attributes may be specified only when CT COMMIT flag is also specified.
[  271.152038][T12365] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  271.390007][T12373] loop5: detected capacity change from 0 to 32768
[  271.393569][T12373] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop5 (7:5) scanned by syz.5.2626 (12373)
[  271.418724][T12373] BTRFS info (device loop5): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  271.418769][T12373] BTRFS info (device loop5): using sha256 checksum algorithm
[  271.483505][T12373] BTRFS info (device loop5): enabling ssd optimizations
[  271.483546][T12373] BTRFS info (device loop5): turning on async discard
[  271.483577][T12373] BTRFS info (device loop5): enabling free space tree
[  271.556816][T11391] BTRFS info (device loop5): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d
[  271.732492][T12393] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2628'.
[  271.765584][T12395] loop5: detected capacity change from 0 to 256
[  271.840394][T12401] fuse: Bad value for 'fd'
[  272.294101][T12414] loop5: detected capacity change from 0 to 32768
[  272.367362][T12414] BTRFS: device fsid c9fe44da-de57-406a-8241-57ec7d4412cf devid 1 transid 8 /dev/loop5 (7:5) scanned by syz.5.2636 (12414)
[  272.383822][T12414] BTRFS info (device loop5): first mount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  272.383909][T12414] BTRFS info (device loop5): using crc32c checksum algorithm
[  272.427731][T12414] BTRFS info (device loop5): enabling ssd optimizations
[  272.427772][T12414] BTRFS info (device loop5): turning on flush-on-commit
[  272.427804][T12414] BTRFS info (device loop5): enabling free space tree
[  272.427849][T12414] BTRFS info (device loop5): enabling auto defrag
[  272.427873][T12414] BTRFS info (device loop5): use lzo compression, level 1
[  272.427899][T12414] BTRFS info (device loop5): max_inline set to 4096
[  272.543616][T12435] Bluetooth: MGMT ver 1.23
[  272.585403][T11391] BTRFS info (device loop5): last unmount of filesystem c9fe44da-de57-406a-8241-57ec7d4412cf
[  272.907598][T12446] loop5: detected capacity change from 0 to 512
[  272.931131][T12446] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  272.931206][T12446] ext4 filesystem being mounted at /110/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  272.959507][T12446] EXT4-fs error (device loop5): ext4_validate_block_bitmap:445: comm syz.5.2643: bg 0: block 264: padding at end of block bitmap is not set
[  273.008982][T12446] Quota error (device loop5): write_blk: dquota write failed
[  273.024352][T12446] Quota error (device loop5): find_free_dqentry: Can't write quota data block 5
[  273.030429][T12446] Quota error (device loop5): qtree_write_dquot: Error -28 occurred while creating quota
[  273.030496][T12446] EXT4-fs error (device loop5): ext4_acquire_dquot:7069: comm syz.5.2643: Failed to acquire dquot type 1
[  273.071773][T11391] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  273.441107][T12470] Bluetooth: hci0: invalid length 0, exp 2 for type 19
[  274.062950][T12499] Bluetooth: hci1: Opcode 0x0c1a failed: -4
[  274.078716][T12499] Bluetooth: hci1: Error when powering off device on rfkill (-4)
[  274.202641][T12499] Bluetooth: hci0: Opcode 0x0c1a failed: -4
[  274.202702][T12499] Bluetooth: hci0: Error when powering off device on rfkill (-4)
[  274.227372][T12499] Bluetooth: hci4: Opcode 0x0c1a failed: -4
[  274.227431][T12499] Bluetooth: hci4: Error when powering off device on rfkill (-4)
[  274.264995][T12499] Bluetooth: hci3: Opcode 0x0c1a failed: -4
[  274.265058][T12499] Bluetooth: hci3: Error when powering off device on rfkill (-4)
[  274.644487][T10964] usb 6-1: new full-speed USB device number 6 using dummy_hcd
[  274.805473][T10964] usb 6-1: New USB device found, idVendor=04b4, idProduct=861f, bcdDevice=db.82
[  274.810841][T10964] usb 6-1: config 43 interface 0 has no altsetting 0
[  274.816992][T10964] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  274.820686][T10964] usb 6-1: Product: syz
[  274.824993][T10964] usb 6-1: Manufacturer: syz
[  274.829515][T10964] usb 6-1: SerialNumber: syz
[  275.064063][T10964] usb 6-1: dvb_usb_v2: found a 'Anysee' in warm state
[  275.067687][T10964] usb 6-1: dvb_usb_v2: usb_bulk_msg() failed=-22
[  275.075027][T10964] dvb_usb_anysee 6-1:43.0: probe with driver dvb_usb_anysee failed with error -22
[  275.084255][T10964] usb 6-1: USB disconnect, device number 6
[  275.128972][T12512] FAULT_INJECTION: forcing a failure.
[  275.128972][T12512] name fail_page_alloc, interval 1, probability 0, space 0, times 0
[  275.134408][T12512] CPU: 0 UID: 0 PID: 12512 Comm: syz.0.2672 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  275.134450][T12512] Tainted: [L]=SOFTLOCKUP
[  275.134455][T12512] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  275.134462][T12512] Call Trace:
[  275.134471][T12512]  <TASK>
[  275.134477][T12512]  dump_stack_lvl+0xe8/0x150
[  275.134500][T12512]  should_fail_ex+0x410/0x560
[  275.134519][T12512]  prepare_alloc_pages+0x223/0x600
[  275.134539][T12512]  __alloc_frozen_pages_noprof+0x185/0x5a0
[  275.134555][T12512]  ? __pfx___alloc_frozen_pages_noprof+0x10/0x10
[  275.134569][T12512]  ? __pfx_policy_nodemask+0x10/0x10
[  275.134593][T12512]  alloc_pages_mpol+0x21e/0x390
[  275.134613][T12512]  folio_alloc_mpol_noprof+0x39/0x160
[  275.134628][T12512]  shmem_alloc_and_add_folio+0x43e/0xf60
[  275.134647][T12512]  ? filemap_get_entry+0xcd/0x3f0
[  275.134666][T12512]  ? filemap_map_pages+0x1c3/0x22b0
[  275.134681][T12512]  ? __pfx_filemap_get_entry+0x10/0x10
[  275.134696][T12512]  ? __pfx_shmem_alloc_and_add_folio+0x10/0x10
[  275.134712][T12512]  ? shmem_allowable_huge_orders+0x628/0x6c0
[  275.134732][T12512]  shmem_get_folio_gfp+0x599/0x1330
[  275.134756][T12512]  shmem_fault+0x179/0x390
[  275.134777][T12512]  __do_fault+0x147/0x410
[  275.134823][T12512]  ? do_pte_missing+0x1480/0x3550
[  275.134841][T12512]  do_pte_missing+0x217e/0x3550
[  275.134868][T12512]  ? handle_mm_fault+0xf1/0x3750
[  275.134886][T12512]  handle_mm_fault+0x1a53/0x3750
[  275.134910][T12512]  ? handle_mm_fault+0xf1/0x3750
[  275.134933][T12512]  ? __pfx_handle_mm_fault+0x10/0x10
[  275.134957][T12512]  ? __lock_acquire+0x6df/0x2e50
[  275.134975][T12512]  ? lock_mm_and_find_vma+0xa7/0x340
[  275.134993][T12512]  do_user_addr_fault+0x746/0x1340
[  275.135018][T12512]  exc_page_fault+0x6a/0xc0
[  275.135034][T12512]  asm_exc_page_fault+0x26/0x30
[  275.135047][T12512] RIP: 0010:__get_user_8+0x14/0x40
[  275.135059][T12512] Code: 00 c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 ba 00 f0 ff ff ff 7f 00 00 48 39 d0 48 0f 47 c2 0f 1f 00 <48> 8b 10 31 c0 0f 1f 00 c3 cc cc cc cc 90 90 90 90 90 90 90 90 90
[  275.135071][T12512] RSP: 0018:ffffc90008237eb8 EFLAGS: 00010283
[  275.135083][T12512] RAX: 0000200000001440 RBX: 0000200000001440 RCX: 0000000000000046
[  275.135092][T12512] RDX: 00007ffffffff000 RSI: ffffffff8e7023ce RDI: ffffffff8c6dcc80
[  275.135102][T12512] RBP: ffffc90008237f38 R08: a600000000000000 R09: 0000000000000000
[  275.135111][T12512] R10: 0000000000000000 R11: ffff8881763a03b8 R12: 00000000000000ce
[  275.135119][T12512] R13: ffff88811bca8000 R14: 000000000000007f R15: 0000000000000000
[  275.135138][T12512]  __se_sys_io_setup+0x2d/0x1d0
[  275.135157][T12512]  do_syscall_64+0x166/0x520
[  275.135170][T12512]  ? trace_irq_disable+0x3b/0x140
[  275.135184][T12512]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  275.135205][T12512]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  275.135218][T12512] RIP: 0033:0x7f85dd19e159
[  275.135229][T12512] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  275.135240][T12512] RSP: 002b:00007f85ddfb5028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ce
[  275.135252][T12512] RAX: ffffffffffffffda RBX: 00007f85dd425fa0 RCX: 00007f85dd19e159
[  275.135263][T12512] RDX: 0000000000000000 RSI: 0000200000001440 RDI: 000000000000007f
[  275.135270][T12512] RBP: 00007f85dd235024 R08: 0000000000000000 R09: 0000000000000000
[  275.135278][T12512] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  275.135287][T12512] R13: 00007f85dd426038 R14: 00007f85dd425fa0 R15: 00007fff76071048
[  275.135306][T12512]  </TASK>
[  275.463609][ T5600] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[  275.475934][ T5600] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[  275.483527][ T5600] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[  275.487484][ T5600] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[  275.496140][ T5600] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[  275.532654][ T4995] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1
[  275.534814][ T4995] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9
[  275.535014][ T4995] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9
[  275.535900][ T4995] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4
[  275.536444][ T4995] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2
[  276.303436][T12518] bridge0: port 1(bridge_slave_0) entered blocking state
[  276.303546][T12518] bridge0: port 1(bridge_slave_0) entered disabled state
[  276.303865][T12518] bridge_slave_0: entered allmulticast mode
[  276.304670][T12518] bridge_slave_0: entered promiscuous mode
[  276.308048][T12518] bridge0: port 2(bridge_slave_1) entered blocking state
[  276.308114][T12518] bridge0: port 2(bridge_slave_1) entered disabled state
[  276.308167][T12518] bridge_slave_1: entered allmulticast mode
[  276.308905][T12518] bridge_slave_1: entered promiscuous mode
[  276.330369][T12518] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  276.331897][T12518] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  276.346201][T12518] team0: Port device team_slave_0 added
[  276.347524][T12518] team0: Port device team_slave_1 added
[  276.367525][T12518] batman_adv: batadv0: Adding interface: batadv_slave_0
[  276.367569][T12518] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  276.367604][T12518] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  276.368589][T12518] batman_adv: batadv0: Adding interface: batadv_slave_1
[  276.368595][T12518] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  276.368605][T12518] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  276.429863][T12518] hsr_slave_0: entered promiscuous mode
[  276.431936][T12518] hsr_slave_1: entered promiscuous mode
[  276.433402][T12518] debugfs: 'hsr0' already exists in 'hsr'
[  276.433412][T12518] Cannot create hsr debugfs directory
[  276.819519][T12556] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2682'.
[  276.890807][T12518] netdevsim netdevsim7 netdevsim0: renamed from eth0
[  276.911119][T12518] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  276.912647][T12518] netdevsim netdevsim7 netdevsim1: renamed from eth1
[  276.945446][T12518] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  276.946823][T12518] netdevsim netdevsim7 netdevsim2: renamed from eth2
[  276.988220][T12518] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  276.994622][T12518] netdevsim netdevsim7 netdevsim3: renamed from eth3
[  277.044217][T12518] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  277.146010][T12518] bridge0: port 2(bridge_slave_1) entered blocking state
[  277.146143][T12518] bridge0: port 2(bridge_slave_1) entered forwarding state
[  277.146344][T12518] bridge0: port 1(bridge_slave_0) entered blocking state
[  277.146422][T12518] bridge0: port 1(bridge_slave_0) entered forwarding state
[  277.372710][ T1109] bridge0: port 1(bridge_slave_0) entered disabled state
[  277.376861][ T1109] bridge0: port 2(bridge_slave_1) entered disabled state
[  277.441989][T12518] 8021q: adding VLAN 0 to HW filter on device bond0
[  277.466053][T12518] 8021q: adding VLAN 0 to HW filter on device team0
[  277.476256][ T1112] bridge0: port 1(bridge_slave_0) entered blocking state
[  277.476366][ T1112] bridge0: port 1(bridge_slave_0) entered forwarding state
[  277.486787][ T1112] bridge0: port 2(bridge_slave_1) entered blocking state
[  277.486972][ T1112] bridge0: port 2(bridge_slave_1) entered forwarding state
[  277.767634][ T4995] Bluetooth: hci5: command tx timeout
[  278.080875][T12518] 8021q: adding VLAN 0 to HW filter on device batadv0
[  278.142928][T12588] loop5: detected capacity change from 0 to 40427
[  278.147242][T12588] F2FS-fs (loop5): Invalid SB checksum offset: 0
[  278.147296][T12588] F2FS-fs (loop5): Can't find valid F2FS filesystem in 2th superblock
[  278.148674][T12588] F2FS-fs (loop5): invalid crc_offset: 1
[  278.243082][T12588] F2FS-fs (loop5): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  278.276533][T12588] F2FS-fs (loop5): Try to recover 2th superblock, ret: 0
[  278.276603][T12588] F2FS-fs (loop5): Mounted with checkpoint version = 48b305e5
[  278.386578][T12518] veth0_vlan: entered promiscuous mode
[  278.408124][T12518] veth1_vlan: entered promiscuous mode
[  278.433023][T12518] veth0_macvtap: entered promiscuous mode
[  278.440576][T12518] veth1_macvtap: entered promiscuous mode
[  278.464231][T12518] batman_adv: batadv0: Interface activated: batadv_slave_0
[  278.477496][T12518] batman_adv: batadv0: Interface activated: batadv_slave_1
[  278.510602][   T13] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  278.510678][   T13] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  278.510773][   T13] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  278.510817][   T13] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  278.772774][  T144] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  278.772821][  T144] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  278.828387][  T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  278.828440][  T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  278.857281][T12623] loop5: detected capacity change from 0 to 32768
[  278.862838][T12623] (syz.5.2698,12623,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC.
[  278.863015][T12623] (syz.5.2698,12623,1):ocfs2_block_check_validate:402 ERROR: CRC32 failed: stored: 0xb3775c19, computed 0x2dd1c265. Applying ECC.
[  278.882274][T12623] JBD2: Ignoring recovery information on journal
[  278.917132][T12623] ocfs2: Mounting device (7,5) on (node local, slot 0) with ordered data mode.
[  278.987759][   T34] audit: type=1800 audit(1788505785.001:107): pid=12623 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.2698" name="file1" dev="loop5" ino=16978 res=0 errno=0
[  279.114691][T11391] ocfs2: Unmounting device (7,5) on (node local)
[  279.338787][T12639] loop5: detected capacity change from 0 to 1764
[  279.347379][T12639] ISOFS: Unable to identify CD-ROM format.
[  279.952751][T12658] loop5: detected capacity change from 0 to 1024
[  279.990357][ T4995] Bluetooth: hci5: command tx timeout
[  280.294789][T12669] loop5: detected capacity change from 0 to 256
[  280.523360][T12677] SET target dimension over the limit!
[  281.096180][T12693] tmpfs: Bad value for 'mpol'
[  282.288044][ T4995] Bluetooth: hci5: command tx timeout
[  283.026488][T12737] loop5: detected capacity change from 0 to 1024
[  283.042906][T12737] hfsplus: (loop5): Attributes File (cnid 0x8) map record invalid or bitmap corruption detected, forcing read-only.
[  283.042961][T12737] hfsplus: Run fsck.hfsplus to repair.
[  283.115987][T12737] hfsplus: inconsistency in B*Tree (0,1,255,1,0)
[  283.116040][T12737] hfsplus: xattr search failed
[  283.383755][T12749] loop5: detected capacity change from 0 to 512
[  283.386249][T12747] loop7: detected capacity change from 0 to 1024
[  283.412715][T12749] EXT4-fs (loop5): revision level too high, forcing read-only mode
[  283.412818][T12749] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=c014e018, mo2=0002]
[  283.412998][T12749] EXT4-fs (loop5): orphan cleanup on readonly fs
[  283.448165][T12749] EXT4-fs error (device loop5): ext4_validate_block_bitmap:436: comm syz.5.2757: bg 0: block 15: invalid block bitmap
[  283.448218][T12749] loop5: lost filesystem error report for type 5 error -117
[  283.454365][    C0] EXT4-fs (loop5): error count since last fsck: 1
[  283.454382][    C0] EXT4-fs (loop5): initial error at time 1788505789: ext4_validate_block_bitmap:436
[  283.454397][    C0] EXT4-fs (loop5): last error at time 1788505789: ext4_validate_block_bitmap:436
[  283.473076][T12749] EXT4-fs error (device loop5) in ext4_mb_clear_bb:6680: Corrupt filesystem
[  283.473123][T12749] loop5: lost filesystem error report for type 5 error -117
[  283.478810][T12749] EXT4-fs warning (device loop5): ext4_evict_inode:196: inode #16: comm syz.5.2757: data will be lost
[  283.478943][T12749] EXT4-fs (loop5): 1 truncate cleaned up
[  283.515510][T12749] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback.
[  283.544843][T11391] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  283.779231][T12758] netlink: 'syz.5.2761': attribute type 63 has an invalid length.
[  283.888734][T12752] loop7: detected capacity change from 0 to 32768
[  284.298353][T12771] loop5: detected capacity change from 0 to 4096
[  284.301236][T12771] ntfs3(loop5): ino=0, mi_enum_attr
[  284.304719][T12771] ntfs3(loop5): ino=0, mi_enum_attr
[  284.304767][T12771] ntfs3(loop5): Mark volume as dirty due to NTFS errors
[  284.305031][T12771] ntfs3(loop5): ino=0, mi_enum_attr
[  284.436825][ T4995] Bluetooth: hci5: command tx timeout
[  284.633432][T12781] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2766'.
[  284.633489][T12781] netlink: 144 bytes leftover after parsing attributes in process `syz.7.2766'.
[  284.634408][T12781] netlink: 64 bytes leftover after parsing attributes in process `syz.7.2766'.
[  284.811262][T12794] bond0: (slave virt_wifi0): The slave device specified does not support setting the MAC address
[  284.811401][T12794] bond0: (slave virt_wifi0): Error -95 calling set_mac_address
[  285.174662][ T2248] usb 8-1: new full-speed USB device number 2 using dummy_hcd
[  285.325313][T12800] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2779'.
[  285.347580][ T2248] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00
[  285.349370][ T2248] usb 8-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  285.349382][ T2248] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 3
[  285.352726][ T2248] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3
[  285.352738][ T2248] usb 8-1: SerialNumber: syz
[  285.369193][ T2248] usb 8-1: 0:2 : does not exist
[  285.586154][ T8402] usb 8-1: USB disconnect, device number 2
[  285.826770][ T2248] usb 6-1: new high-speed USB device number 7 using dummy_hcd
[  285.987008][ T2248] usb 6-1: Using ep0 maxpacket: 16
[  285.987757][ T2248] usb 6-1: New USB device found, idVendor=07ab, idProduct=fc01, bcdDevice=8d.90
[  285.988960][ T2248] usb 6-1: config index 0 descriptor too short (expected 17170, got 18)
[  285.988977][ T2248] usb 6-1: config 0 has too many interfaces: 63, using maximum allowed: 32
[  285.988990][ T2248] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 63
[  285.991313][ T2248] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  285.991328][ T2248] usb 6-1: Product: syz
[  285.991336][ T2248] usb 6-1: Manufacturer: syz
[  285.991346][ T2248] usb 6-1: SerialNumber: syz
[  285.995729][ T2248] usb 6-1: config 0 descriptor??
[  286.003671][ T2248] ums-freecom 6-1:0.0: USB Mass Storage device detected
[  286.232514][ T2248] usb 6-1: USB disconnect, device number 7
[  286.588662][T12835] loop7: detected capacity change from 0 to 256
[  286.936435][T12839] netlink: 40 bytes leftover after parsing attributes in process `syz.7.2797'.
[  287.118399][T12847] fuse: Bad value for 'fd'
[  287.147750][T12849] loop7: detected capacity change from 0 to 128
[  287.154636][T12849] EXT4-fs (loop7): ext4_check_descriptors: Checksum for group 0 failed (30846!=65535)
[  287.158390][T12845] loop5: detected capacity change from 0 to 8192
[  287.165239][T12845] FAT-fs (loop5): Volume was not properly unmounted. Some data may be corrupt. Please run fsck.
[  287.190377][T12849] EXT4-fs (loop7): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 ro without journal. Quota mode: none.
[  287.219150][T12849] EXT4-fs (loop7): ext4_remount: Checksum for group 0 failed (30846!=65535)
[  287.240456][T12852] openvswitch: netlink: Flow actions may not be safe on all matching packets.
[  287.274832][T12518] EXT4-fs (loop7): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09.
[  287.301855][T12854] binder: 12853:12854 ioctl c0306201 2000000001c0 returned -14
[  287.811986][T12876] loop5: detected capacity change from 0 to 32768
[  287.847979][T12876] 
[  287.847979][T12876]  ... Log Wrap ... Log Wrap ... Log Wrap ...
[  287.847979][T12876] 
[  287.899513][ T5869] ERROR: (device loop5): diWrite: ixpxd invalid
[  287.899513][ T5869] 
[  287.927904][ T5869] ERROR: (device loop5): txCommit: 
[  287.927904][ T5869] 
[  287.935595][ T5869] jfs_write_inode: jfs_commit_inode failed!
[  287.938149][T11391] 
[  287.938149][T11391]  ... Log Wrap ... Log Wrap ... Log Wrap ...
[  287.938149][T11391] 
[  287.959057][T11391] 
[  287.959057][T11391]  ... Log Wrap ... Log Wrap ... Log Wrap ...
[  287.959057][T11391] 
[  288.512049][T12900] loop7: detected capacity change from 0 to 16
[  288.512548][T12900] MTD: Attempt to mount non-MTD device "/dev/loop7"
[  288.612504][ T5600] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[  288.626637][ T5600] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[  288.638856][ T5600] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[  288.643211][ T5600] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[  288.647612][ T5600] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[  288.709438][T12909] fuse: Unknown parameter ''
[  289.153784][T12902] bridge0: port 1(bridge_slave_0) entered blocking state
[  289.153873][T12902] bridge0: port 1(bridge_slave_0) entered disabled state
[  289.153960][T12902] bridge_slave_0: entered allmulticast mode
[  289.154387][T12920] loop7: detected capacity change from 0 to 40427
[  289.157484][T12920] F2FS-fs (loop7): Small segment_count (9 < 1 * 24)
[  289.157503][T12920] F2FS-fs (loop7): Can't find valid F2FS filesystem in 1th superblock
[  289.159070][T12920] F2FS-fs (loop7): invalid crc value
[  289.172127][T12902] bridge_slave_0: entered promiscuous mode
[  289.177933][T12902] bridge0: port 2(bridge_slave_1) entered blocking state
[  289.180574][T12902] bridge0: port 2(bridge_slave_1) entered disabled state
[  289.183164][T12902] bridge_slave_1: entered allmulticast mode
[  289.186321][T12902] bridge_slave_1: entered promiscuous mode
[  289.227341][T12902] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  289.231787][T12902] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  289.248294][T12902] team0: Port device team_slave_0 added
[  289.251487][T12902] team0: Port device team_slave_1 added
[  289.270171][T12902] batman_adv: batadv0: Adding interface: batadv_slave_0
[  289.273080][T12902] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  289.282178][T12902] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  289.288172][T12902] batman_adv: batadv0: Adding interface: batadv_slave_1
[  289.291841][T12902] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  289.300038][T12902] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  289.325705][T12902] hsr_slave_0: entered promiscuous mode
[  289.328049][T12902] hsr_slave_1: entered promiscuous mode
[  289.330339][T12902] debugfs: 'hsr0' already exists in 'hsr'
[  289.332351][T12902] Cannot create hsr debugfs directory
[  289.377797][T12920] F2FS-fs (loop7): f2fs_recover_fsync_data: recovery fsync data, check_only: 0
[  289.422728][T12920] F2FS-fs (loop7): Try to recover 1th superblock, ret: 0
[  289.422792][T12920] F2FS-fs (loop7): Mounted with checkpoint version = 48b305e5
[  289.515510][T12902] netdevsim netdevsim8 netdevsim0: renamed from eth0
[  289.517110][T12518] syz-executor: attempt to access beyond end of device
[  289.517110][T12518] loop7: rw=2049, sector=45096, nr_sectors = 8 limit=40427
[  289.527799][T12902] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  289.530763][T12902] netdevsim netdevsim8 netdevsim1: renamed from eth1
[  289.531054][T12518] CPU: 1 UID: 0 PID: 12518 Comm: syz-executor Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  289.531071][T12518] Tainted: [L]=SOFTLOCKUP
[  289.531074][T12518] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  289.531085][T12518] Call Trace:
[  289.531089][T12518]  <TASK>
[  289.531094][T12518]  dump_stack_lvl+0xe8/0x150
[  289.531116][T12518]  f2fs_stop_checkpoint+0x3f6/0x5d0
[  289.531137][T12518]  f2fs_write_end_bio+0x1211/0x16e0
[  289.531152][T12518]  ? blkg_put+0x22/0x240
[  289.531178][T12518]  __submit_merged_bio+0x258/0x6a0
[  289.531195][T12518]  ? rcu_is_watching+0x16/0xb0
[  289.531213][T12518]  __submit_merged_write_cond+0x3c9/0x4e0
[  289.531235][T12518]  ? __pfx___submit_merged_write_cond+0x10/0x10
[  289.531266][T12518]  f2fs_write_data_pages+0x2a27/0x36f0
[  289.531278][T12518]  ? is_bpf_text_address+0x292/0x2b0
[  289.531314][T12518]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  289.531325][T12518]  ? is_bpf_text_address+0x26/0x2b0
[  289.531342][T12518]  ? arch_stack_walk+0xfb/0x150
[  289.531372][T12518]  ? add_lock_to_list+0xc7/0x100
[  289.531387][T12518]  ? lockdep_unlock+0x5c/0xd0
[  289.531403][T12518]  ? __lock_acquire+0x14b9/0x2e50
[  289.531431][T12518]  ? do_raw_spin_lock+0x12b/0x2f0
[  289.531453][T12518]  ? do_raw_spin_unlock+0x4d/0x200
[  289.531468][T12518]  ? __pfx_f2fs_write_data_pages+0x10/0x10
[  289.531481][T12518]  do_writepages+0x338/0x560
[  289.531506][T12518]  ? do_raw_spin_unlock+0x4d/0x200
[  289.531524][T12518]  filemap_fdatawrite+0x1e9/0x2f0
[  289.531539][T12518]  ? __pfx_filemap_fdatawrite+0x10/0x10
[  289.531605][T12518]  ? do_raw_spin_unlock+0x4d/0x200
[  289.531624][T12518]  f2fs_sync_dirty_inodes+0x30e/0x830
[  289.531648][T12518]  f2fs_write_checkpoint+0xa3d/0x2710
[  289.531682][T12518]  ? __pfx_f2fs_write_checkpoint+0x10/0x10
[  289.531728][T12518]  kill_f2fs_super+0x2dd/0x700
[  289.531747][T12518]  ? __pfx_kill_f2fs_super+0x10/0x10
[  289.531768][T12518]  ? call_rcu+0x64d/0x8b0
[  289.531781][T12518]  ? lockdep_hardirqs_on+0x7b/0x110
[  289.531803][T12518]  deactivate_locked_super+0xbc/0x110
[  289.531818][T12518]  cleanup_mnt+0x3d3/0x460
[  289.531836][T12518]  task_work_run+0x1d9/0x270
[  289.531851][T12518]  ? __pfx_task_work_run+0x10/0x10
[  289.531870][T12518]  exit_to_user_mode_loop+0x204/0x770
[  289.531882][T12518]  ? rcu_is_watching+0x16/0xb0
[  289.531898][T12518]  do_syscall_64+0x328/0x520
[  289.531911][T12518]  ? trace_irq_disable+0x3b/0x140
[  289.531922][T12518]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  289.531938][T12518]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  289.531949][T12518] RIP: 0033:0x7ff0c4d9f397
[  289.531961][T12518] Code: a2 c7 05 5c 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
[  289.531972][T12518] RSP: 002b:00007ffe51da0d28 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[  289.531986][T12518] RAX: 0000000000000000 RBX: 00007ff0c4e34474 RCX: 00007ff0c4d9f397
[  289.531994][T12518] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe51da0de0
[  289.532001][T12518] RBP: 00007ffe51da0de0 R08: 00007ffe51da1de0 R09: 00000000ffffffff
[  289.532009][T12518] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe51da1e70
[  289.532016][T12518] R13: 00007ff0c4e34474 R14: 0000000000044e9d R15: 00007ffe51da1eb0
[  289.532036][T12518]  </TASK>
[  289.532041][T12518] F2FS-fs (loop7): Stopped filesystem due to reason: 3
[  289.651668][T12902] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  289.657490][T12902] netdevsim netdevsim8 netdevsim2: renamed from eth2
[  289.666390][T12902] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  289.667850][T12902] netdevsim netdevsim8 netdevsim3: renamed from eth3
[  289.676363][T12902] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  289.877871][T12902] 8021q: adding VLAN 0 to HW filter on device bond0
[  289.941455][T12902] 8021q: adding VLAN 0 to HW filter on device team0
[  289.962814][ T1106] bridge0: port 1(bridge_slave_0) entered blocking state
[  289.962931][ T1106] bridge0: port 1(bridge_slave_0) entered forwarding state
[  289.985009][ T1106] bridge0: port 2(bridge_slave_1) entered blocking state
[  289.985183][ T1106] bridge0: port 2(bridge_slave_1) entered forwarding state
[  290.066142][T12943] loop7: detected capacity change from 0 to 2048
[  290.092695][T12943] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000)
[  290.449105][T12947] loop7: detected capacity change from 0 to 32768
[  290.535463][T12902] 8021q: adding VLAN 0 to HW filter on device batadv0
[  290.723122][T12902] veth0_vlan: entered promiscuous mode
[  290.728425][T12902] veth1_vlan: entered promiscuous mode
[  290.751354][T12902] veth0_macvtap: entered promiscuous mode
[  290.754796][T12902] veth1_macvtap: entered promiscuous mode
[  290.770152][T12902] batman_adv: batadv0: Interface activated: batadv_slave_0
[  290.776080][T12902] batman_adv: batadv0: Interface activated: batadv_slave_1
[  290.821456][ T5658] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  290.821517][ T5658] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  290.821609][ T5658] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  290.821649][ T5658] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  290.853423][ T5600] Bluetooth: hci1: command tx timeout
[  290.969570][ T1106] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  290.969630][ T1106] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  291.015143][ T1106] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  291.015203][ T1106] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  291.431192][T12971] loop7: detected capacity change from 0 to 512
[  291.434133][T12971] EXT4-fs: Ignoring removed bh option
[  291.436318][T12971] EXT4-fs (loop7): Test dummy encryption mode enabled
[  291.438614][T12971] EXT4-fs (loop7): encrypted files will use data=ordered instead of data journaling mode
[  291.445551][T12971] EXT4-fs error (device loop7): ext4_orphan_get:1403: inode #15: comm syz.7.2841: inode has both inline data and extents flags
[  291.451592][T12971] loop7: lost file I/O error report for ino 15 type 5 pos 0x0 len 0x0 error -117
[  291.451944][T12971] EXT4-fs error (device loop7): ext4_orphan_get:1408: comm syz.7.2841: couldn't read orphan inode 15 (err -117)
[  291.458714][T12971] loop7: lost filesystem error report for type 5 error -117
[  291.461083][T12971] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
[  291.471338][ T5654] usb 9-1: new high-speed USB device number 2 using dummy_hcd
[  291.489131][T12518] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  291.632096][ T5654] usb 9-1: Using ep0 maxpacket: 32
[  291.634968][ T5654] usb 9-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40
[  291.645166][ T5654] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  291.645219][ T5654] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  291.645291][ T5654] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  291.663013][ T5654] usb 9-1: config 0 descriptor??
[  291.669704][ T5654] hub 9-1:0.0: USB hub found
[  292.286045][ T5654] hub 9-1:0.0: config failed, hub doesn't have any ports! (err -19)
[  292.501402][ T5654] usbhid 9-1:0.0: can't add hid device: -71
[  292.503461][ T5654] usbhid 9-1:0.0: probe with driver usbhid failed with error -71
[  292.519462][ T5654] usb 9-1: USB disconnect, device number 2
[  292.681375][T12983] loop7: detected capacity change from 0 to 4096
[  292.682347][T12983] NILFS (loop7): broken superblock, retrying with spare superblock (blocksize = 1024)
[  292.682362][T12983] NILFS (loop7): mounting unchecked fs
[  292.716206][T10857] udevd[10857]: incorrect nilfs2 checksum on /dev/loop7
[  292.728979][T10857] udevd[10857]: incorrect nilfs2 checksum on /dev/loop7
[  292.736819][T12983] NILFS (loop7): recovery complete
[  292.738054][T12984] NILFS (loop7): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds
[  293.075646][ T5600] Bluetooth: hci1: command tx timeout
[  293.230157][T13001] loop8: detected capacity change from 0 to 164
[  293.275422][T13001] rock: corrupted directory entry. extent=28, offset=16056320, size=0
[  293.287581][T13001] rock: corrupted directory entry. extent=28, offset=16056320, size=0
[  293.306283][T13001] Symlink component flag not implemented
[  293.308546][T13001] Symlink component flag not implemented (7)
[  293.753432][T13016] loop8: detected capacity change from 0 to 32768
[  293.865038][T13016] ocfs2: Mounting device (7,8) on (node local, slot 0) with ordered data mode.
[  293.906863][T13023] loop7: detected capacity change from 0 to 128
[  293.926241][T13023] befs: (loop7): blocksize(8192) cannot be larger than system pagesize(4096)
[  294.163860][T13016] syz.8.2860 (13016) used greatest stack depth: 18880 bytes left
[  294.230127][T12902] ocfs2: Unmounting device (7,8) on (node local)
[  294.483278][T13033] netlink: 88 bytes leftover after parsing attributes in process `syz.8.2867'.
[  294.591669][T13029] loop7: detected capacity change from 0 to 32768
[  294.621233][T13029] XFS (loop7): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[  294.663648][T13029] XFS (loop7): Ending clean mount
[  294.813071][T12518] XFS (loop7): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d
[  295.005584][T13045] loop8: detected capacity change from 0 to 32768
[  295.298765][ T4995] Bluetooth: hci1: command tx timeout
[  295.349787][T13061] netlink: 'syz.7.2877': attribute type 9 has an invalid length.
[  295.377230][T13059] device-mapper: ioctl: Invalid ioctl structure: name ), dev 250414243444142
[  295.484964][T13065] 9p: Bad value for 'wfdno'
[  296.024344][T13075] loop8: detected capacity change from 0 to 128
[  296.071543][T13075] [EXT4 FS bs=1024, gc=1, bpg=8192, ipg=16, mo=a842c018, mo2=0002]
[  296.071607][T13075] System zones: 1-3, 19-19, 35-36
[  296.094384][T13075] EXT4-fs (loop8): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none.
[  296.102945][T13075] ext4 filesystem being mounted at /15/mnt supports timestamps until 2038-01-19 (0x7fffffff)
[  296.148830][T12902] EXT4-fs (loop8): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09.
[  296.289071][T13079] loop8: detected capacity change from 0 to 512
[  296.319772][T13079] EXT4-fs error (device loop8) in ext4_process_orphan:346: Corrupt filesystem
[  296.337857][T13079] loop8: lost filesystem error report for type 5 error -117
[  296.341063][T13079] EXT4-fs (loop8): 2 truncates cleaned up
[  296.343234][T13079] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  296.385154][T12902] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  296.438379][T13082] loop7: detected capacity change from 0 to 16
[  296.444408][T13082] MTD: Attempt to mount non-MTD device "/dev/loop7"
[  296.627570][ T4995] Bluetooth: hci5: unexpected Set CIG Parameters response data
[  296.829061][T13094] xt_hashlimit: size too large, truncated to 1048576
[  297.018586][T13100] loop7: detected capacity change from 0 to 16
[  297.033033][T13100] erofs (device loop7): DAX unsupported by block device. Turning off DAX.
[  297.038237][T13100] erofs (device loop7): rootino(nid 36) is not a directory(i_mode 143300)
[  297.131593][T13102] IPVS: set_ctl: invalid protocol: 0 100.1.1.0:2
[  297.522365][ T4995] Bluetooth: hci1: command tx timeout
[  297.710031][T13112] Invalid argument reading file caps for ./file0
[  298.013989][ T8402] usb 9-1: new high-speed USB device number 3 using dummy_hcd
[  298.176450][ T8402] usb 9-1: New USB device found, idVendor=0552, idProduct=5510, bcdDevice= 0.00
[  298.184705][ T8402] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[  298.184773][ T8402] usb 9-1: Product: syz
[  298.184806][ T8402] usb 9-1: Manufacturer: syz
[  299.018383][T13119] loop7: detected capacity change from 0 to 128
[  299.055594][T13119] FAT-fs (loop7): bogus sectors per cluster 0
[  299.055639][T13119] FAT-fs (loop7): Can't find a valid FAT filesystem
[  299.235987][ T2412] pvrusb2: request_firmware fatal error with code=-110
[  299.243805][ T2412] pvrusb2: Failure uploading firmware1
[  299.245795][ T2412] pvrusb2: Device initialization was not successful.
[  299.248308][ T2412] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it.
[  299.251723][ T2412] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover.
[  299.255455][   T10] pvrusb2: Device being rendered inoperable
[  299.312458][T13121] loop7: detected capacity change from 0 to 32768
[  299.344185][T13121] jfs_rename did not expect dtDelete to return rc = -2
[  299.348119][T13121] ERROR: (device loop7): jfs_rename: 
[  299.348119][T13121] 
[  299.358787][T13121] ERROR: (device loop7): remounting filesystem as read-only
[  299.501263][ T8402] usb 9-1: USB disconnect, device number 3
[  299.854547][ T5640] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  300.136775][ T5640] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  300.194198][T13134] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2908'.
[  300.300005][ T5640] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  300.404131][ T5640] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  300.574420][T13152] loop8: detected capacity change from 0 to 128
[  300.598526][   T34] audit: type=1800 audit(1788505805.215:108): pid=13152 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.8.2917" name="file1" dev="loop8" ino=1048720 res=0 errno=0
[  300.792176][ T5640] bridge_slave_1: left allmulticast mode
[  300.792229][ T5640] bridge_slave_1: left promiscuous mode
[  300.792411][ T5640] bridge0: port 2(bridge_slave_1) entered disabled state
[  300.806529][ T5640] bridge_slave_0: left allmulticast mode
[  300.806575][ T5640] bridge_slave_0: left promiscuous mode
[  300.806695][ T5640] bridge0: port 1(bridge_slave_0) entered disabled state
[  300.867996][T13166] syz.8.2922 calls setitimer() with new_value NULL pointer. Misfeature support will be removed
[  300.941124][T13171] netlink: 16 bytes leftover after parsing attributes in process `syz.8.2925'.
[  300.941174][T13171] netlink: 144 bytes leftover after parsing attributes in process `syz.8.2925'.
[  300.941208][T13171] netlink: 16 bytes leftover after parsing attributes in process `syz.8.2925'.
[  300.950171][ T4995] Bluetooth: hci5: Controller not accepting commands anymore: ncmd = 0
[  300.950205][ T4995] Bluetooth: hci5: Injecting HCI hardware error event
[  300.952755][ T5600] Bluetooth: hci5: hardware error 0x00
[  300.971576][T13174] loop7: detected capacity change from 0 to 512
[  300.981397][T13174] EXT4-fs: Journaled quota options ignored when QUOTA feature is enabled
[  301.010399][T13174] EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[  301.010483][T13174] ext4 filesystem being mounted at /89/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[  301.097321][T12518] EXT4-fs (loop7): unmounting filesystem 00000000-0000-0000-0000-000000000000.
[  301.257726][ T5640] bond0 (unregistering): (slave bridge0): Releasing backup interface
[  301.317929][ T5640] 
[  301.318779][ T5640] ======================================================
[  301.320974][ T5640] WARNING: possible circular locking dependency detected
[  301.323310][ T5640] syzkaller #0 Tainted: G             L     
[  301.325763][ T5640] ------------------------------------------------------
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[  301.327886][ T5640] kworker/u8:2/5640 is trying to acquire lock:
[  301.330532][ T5640] ffff888176d8ce70 (&dev_instance_lock_key#2){+.+.}-{4:4}, at: ipvlan_uninit+0x147/0x290
[  301.334311][ T5640] 
[  301.334311][ T5640] but task is already holding lock:
[  301.337139][ T5640] ffff88811cc6c8c0 (&port->pnodes_lock){+.+.}-{4:4}, at: ipvlan_device_event+0x489/0xfb0
[  301.341146][ T5640] 
[  301.341146][ T5640] which lock already depends on the new lock.
[  301.341146][ T5640] 
[  301.345127][ T5640] 
[  301.345127][ T5640] the existing dependency chain (in reverse order) is:
[  301.348632][ T5640] 
[  301.348632][ T5640] -> #1 (&port->pnodes_lock){+.+.}-{4:4}:
[  301.351780][ T5640]        __mutex_lock+0x19d/0x1550
[  301.353686][ T5640]        ipvlan_device_event+0x489/0xfb0
[  301.356033][ T5640]        notifier_call_chain+0x1a5/0x3d0
[  301.358133][ T5640]        call_netdevice_notifiers+0x90/0xd0
[  301.360408][ T5640]        xdp_set_features_flag+0x1a0/0x2a0
[  301.362680][ T5640]        bond_xdp_set_features+0x277/0x320
[  301.364888][ T5640]        bond_enslave+0x2c78/0x3b10
[  301.367029][ T5640]        do_set_master+0x563/0x720
[  301.369031][ T5640]        do_setlink+0xe7b/0x4670
[  301.370976][ T5640]        rtnl_newlink+0x15a3/0x1c30
[  301.372992][ T5640]        rtnetlink_rcv_msg+0x802/0xc00
[  301.375118][ T5640]        netlink_rcv_skb+0x226/0x4a0
[  301.377401][ T5640]        netlink_unicast+0x7bd/0x940
[  301.379690][ T5640]        netlink_sendmsg+0x813/0xb40
[  301.381878][ T5640]        sock_sendmsg_nosec+0x13a/0x180
[  301.383801][ T5640]        ____sys_sendmsg+0x54e/0x850
[  301.385678][ T5640]        ___sys_sendmsg+0x2a5/0x360
[  301.387437][ T5640]        __x64_sys_sendmsg+0x1b1/0x290
[  301.389311][ T5640]        do_syscall_64+0x166/0x520
[  301.391166][ T5640]        entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  301.393720][ T5640] 
[  301.393720][ T5640] -> #0 (&dev_instance_lock_key#2){+.+.}-{4:4}:
[  301.396730][ T5640]        __lock_acquire+0x15ff/0x2e50
[  301.398649][ T5640]        lock_acquire+0x115/0x350
[  301.400472][ T5640]        __mutex_lock+0x19d/0x1550
[  301.402337][ T5640]        ipvlan_uninit+0x147/0x290
[  301.404227][ T5640]        unregister_netdevice_many_notify+0x1acd/0x2140
[  301.406729][ T5640]        ipvlan_device_event+0xf1f/0xfb0
[  301.408758][ T5640]        notifier_call_chain+0x1a5/0x3d0
[  301.410784][ T5640]        unregister_netdevice_many_notify+0x17f9/0x2140
[  301.413122][ T5640]        ops_undo_list+0x391/0x8d0
[  301.414976][ T5640]        cleanup_net+0x572/0x810
[  301.416775][ T5640]        process_scheduled_works+0xc3d/0x1630
[  301.418971][ T5640]        worker_thread+0xa47/0xfb0
[  301.420802][ T5640]        kthread+0x38b/0x480
[  301.422436][ T5640]        ret_from_fork+0x514/0xb70
[  301.424231][ T5640]        ret_from_fork_asm+0x1a/0x30
[  301.426136][ T5640] 
[  301.426136][ T5640] other info that might help us debug this:
[  301.426136][ T5640] 
[  301.429714][ T5640]  Possible unsafe locking scenario:
[  301.429714][ T5640] 
[  301.432265][ T5640]        CPU0                    CPU1
[  301.434094][ T5640]        ----                    ----
[  301.436025][ T5640]   lock(&port->pnodes_lock);
[  301.437636][ T5640]                                lock(&dev_instance_lock_key#2);
[  301.440404][ T5640]                                lock(&port->pnodes_lock);
[  301.442907][ T5640]   lock(&dev_instance_lock_key#2);
[  301.444755][ T5640] 
[  301.444755][ T5640]  *** DEADLOCK ***
[  301.444755][ T5640] 
[  301.447608][ T5640] locks held by kworker/u8:2/5640: 5, last CPU#1:
[  301.449888][ T5640]  #0: ffff8881012d5940 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[  301.453641][ T5640]  #1: ffffc9000479fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
[  301.457381][ T5640]  #2: ffffffff90246e48 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810
[  301.460642][ T5640]  #3: ffffffff902556c0 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x28e/0x8d0
[  301.463886][ T5640]  #4: ffff88811cc6c8c0 (&port->pnodes_lock){+.+.}-{4:4}, at: ipvlan_device_event+0x489/0xfb0
[  301.467663][ T5640] 
[  301.467663][ T5640] stack backtrace:
[  301.469793][ T5640] CPU: 1 UID: 0 PID: 5640 Comm: kworker/u8:2 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  301.473575][ T5640] Tainted: [L]=SOFTLOCKUP
[  301.475110][ T5640] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[  301.478662][ T5640] Workqueue: netns cleanup_net
[  301.480426][ T5640] Call Trace:
[  301.481660][ T5640]  <TASK>
[  301.482752][ T5640]  dump_stack_lvl+0xe8/0x150
[  301.484448][ T5640]  print_circular_bug+0x2e2/0x300
[  301.486266][ T5640]  check_noncircular+0x12f/0x150
[  301.488026][ T5640]  __lock_acquire+0x15ff/0x2e50
[  301.489769][ T5640]  ? __lock_acquire+0x6df/0x2e50
[  301.491537][ T5640]  ? __pfx___schedule+0x10/0x10
[  301.493286][ T5640]  ? irqentry_exit+0x218/0x910
[  301.495042][ T5640]  ? irqentry_exit+0x218/0x910
[  301.496801][ T5640]  ? trace_irq_disable+0x3b/0x140
[  301.498646][ T5640]  lock_acquire+0x115/0x350
[  301.500309][ T5640]  ? ipvlan_uninit+0x147/0x290
[  301.502080][ T5640]  __mutex_lock+0x19d/0x1550
[  301.503774][ T5640]  ? ipvlan_uninit+0x147/0x290
[  301.505525][ T5640]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  301.507633][ T5640]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[  301.509725][ T5640]  ? ref_tracker_alloc+0x2d7/0x4b0
[  301.511584][ T5640]  ? ipvlan_uninit+0x147/0x290
[  301.513284][ T5640]  ? __pfx___mutex_lock+0x10/0x10
[  301.515117][ T5640]  ? notifier_call_chain+0x1a5/0x3d0
[  301.517032][ T5640]  ? cleanup_net+0x572/0x810
[  301.518716][ T5640]  ? process_scheduled_works+0xc3d/0x1630
[  301.520797][ T5640]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[  301.522866][ T5640]  ipvlan_uninit+0x147/0x290
[  301.524505][ T5640]  ? __pfx_ipvlan_uninit+0x10/0x10
[  301.526253][ T5640]  ? notifier_call_chain+0x3aa/0x3d0
[  301.528109][ T5640]  ? __pfx_ipvlan_uninit+0x10/0x10
[  301.529963][ T5640]  unregister_netdevice_many_notify+0x1acd/0x2140
[  301.532195][ T5640]  ? __pfx_unregister_netdevice_many_notify+0x10/0x10
[  301.534493][ T5640]  ? netdev_upper_dev_unlink+0x99/0xe0
[  301.536369][ T5640]  ? __pfx_netdev_upper_dev_unlink+0x10/0x10
[  301.538499][ T5640]  ? __ipvlan_link_delete+0x2eb/0x350
[  301.540421][ T5640]  ipvlan_device_event+0xf1f/0xfb0
[  301.542237][ T5640]  ? __pfx_bond_netdev_event+0x10/0x10
[  301.544173][ T5640]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[  301.546256][ T5640]  ? __pfx_ipvlan_device_event+0x10/0x10
[  301.548238][ T5640]  ? __local_bh_enable_ip+0xd6/0x140
[  301.550050][ T5640]  notifier_call_chain+0x1a5/0x3d0
[  301.551853][ T5640]  unregister_netdevice_many_notify+0x17f9/0x2140
[  301.554067][ T5640]  ? __pfx_unregister_netdevice_many_notify+0x10/0x10
[  301.556399][ T5640]  ? rtnl_is_locked+0x15/0x20
[  301.558002][ T5640]  ? nexthop_net_exit_rtnl+0x258/0x2a0
[  301.559937][ T5640]  ops_undo_list+0x391/0x8d0
[  301.561556][ T5640]  ? __pfx_ops_undo_list+0x10/0x10
[  301.563402][ T5640]  ? idr_destroy+0x227/0x290
[  301.565038][ T5640]  cleanup_net+0x572/0x810
[  301.566625][ T5640]  ? __pfx_cleanup_net+0x10/0x10
[  301.568377][ T5640]  ? rcu_is_watching+0x16/0xb0
[  301.570098][ T5640]  ? process_scheduled_works+0x97a/0x1630
[  301.572152][ T5640]  process_scheduled_works+0xc3d/0x1630
[  301.574187][ T5640]  ? __pfx_process_scheduled_works+0x10/0x10
[  301.576318][ T5640]  ? assign_work+0x3cf/0x5d0
[  301.577992][ T5640]  worker_thread+0xa47/0xfb0
[  301.579694][ T5640]  kthread+0x38b/0x480
[  301.581185][ T5640]  ? __pfx_worker_thread+0x10/0x10
[  301.583047][ T5640]  ? __pfx_kthread+0x10/0x10
[  301.584772][ T5640]  ret_from_fork+0x514/0xb70
[  301.586468][ T5640]  ? __pfx_ret_from_fork+0x10/0x10
[  301.588305][ T5640]  ? __switch_to+0xc89/0x1420
[  301.590013][ T5640]  ? __pfx_kthread+0x10/0x10
[  301.591626][ T5640]  ret_from_fork_asm+0x1a/0x30
[  301.593255][ T5640]  </TASK>
[  301.612389][T13188] loop7: detected capacity change from 0 to 128
[  301.667093][ T5640] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  301.706781][ T5640] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  301.736528][ T5640] bond0 (unregistering): Released all slaves
[  301.740185][ T5640] bond1 (unregistering): Released all slaves
[  301.759683][ T5340] 8021q: adding VLAN 0 to HW filter on device eth9
[  301.824244][ T5640] tipc: Disabling bearer <udp:syz2>
[  301.824364][ T5640] tipc: Left network mode
[  301.937617][ T5340] 8021q: adding VLAN 0 to HW filter on device eth10
[  302.024843][ T5640] hsr_slave_0: left promiscuous mode
[  302.027267][ T5640] hsr_slave_1: left promiscuous mode
[  302.027840][ T5640] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  302.027852][ T5640] batman_adv: batadv0: Removing interface: batadv_slave_0
[  302.030002][ T5640] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  302.030013][ T5640] batman_adv: batadv0: Removing interface: batadv_slave_1
[  302.037882][ T5640] veth1_vlan: left promiscuous mode
[  302.037934][ T5640] veth0_vlan: left promiscuous mode
[  302.109331][ T5640] team0 (unregistering): Port device team_slave_1 removed
[  302.114469][ T5640] team0 (unregistering): Port device team_slave_0 removed
[  302.165014][ T5340] 8021q: adding VLAN 0 to HW filter on device eth11
[  302.301048][ T5340] 8021q: adding VLAN 0 to HW filter on device eth12
[  302.377406][ T5640] sctp: sctp_close: sk:ffff88817503df00, timeout:0
[  302.379772][ T5640] sctp: sctp_destroy_sock: sk:ffff88817503df00
[  302.422878][ T5640] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  302.467081][ T5640] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  302.519522][ T5640] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  302.582867][ T5640] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  302.656766][ T5640] bridge_slave_1: left allmulticast mode
[  302.659404][ T5640] bridge_slave_1: left promiscuous mode
[  302.662372][ T5640] bridge0: port 2(bridge_slave_1) entered disabled state
[  302.668008][ T5640] bridge_slave_0: left allmulticast mode
[  302.671159][ T5640] bridge_slave_0: left promiscuous mode
[  302.674006][ T5640] bridge0: port 1(bridge_slave_0) entered disabled state
[  302.731866][ T5640] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  302.736948][ T5640] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  302.746466][ T5640] bond0 (unregistering): Released all slaves
[  302.872976][ T5340] 8021q: adding VLAN 0 to HW filter on device eth13
[  302.947608][ T5640] hsr_slave_0: left promiscuous mode
[  302.949841][ T5640] hsr_slave_1: left promiscuous mode
[  302.952147][ T5640] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  302.956610][ T5640] batman_adv: batadv0: Removing interface: batadv_slave_0
[  302.959377][ T5640] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  302.961892][ T5640] batman_adv: batadv0: Removing interface: batadv_slave_1
[  302.969165][ T5640] veth1_macvtap: left promiscuous mode
[  302.971124][ T5640] veth0_macvtap: left promiscuous mode
[  302.972963][ T5640] veth1_vlan: left promiscuous mode
[  302.974912][ T5640] veth0_vlan: left promiscuous mode
[  303.042051][ T5640] team0 (unregistering): Port device team_slave_1 removed
[  303.046780][ T5640] team0 (unregistering): Port device team_slave_0 removed
[  303.079860][ T5340] 8021q: adding VLAN 0 to HW filter on device eth14
[  303.215995][ T5340] 8021q: adding VLAN 0 to HW filter on device eth15
[  303.234933][ T5640] sctp: sctp_close: sk:ffff88811166f200, timeout:0
[  303.234972][ T5640] sctp: sctp_destroy_sock: sk:ffff88811166f200
[  303.252380][ T5600] Bluetooth: hci5: Opcode 0x0c03 failed: -110
[  303.325034][ T5340] 8021q: adding VLAN 0 to HW filter on device eth16
[  303.460344][ T5640] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  303.502505][ T5640] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  303.554961][ T5640] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  303.630764][ T5640] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  303.689784][ T5640] bridge_slave_1: left allmulticast mode
[  303.689836][ T5640] bridge_slave_1: left promiscuous mode
[  303.689962][ T5640] bridge0: port 2(bridge_slave_1) entered disabled state
[  303.702094][ T5640] bridge_slave_0: left allmulticast mode
[  303.705865][ T5640] bridge_slave_0: left promiscuous mode
[  303.708695][ T5640] bridge0: port 1(bridge_slave_0) entered disabled state
[  303.770817][ T5640] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  303.778930][ T5640] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  303.783594][ T5640] bond0 (unregistering): Released all slaves
[  303.937340][ T5340] 8021q: adding VLAN 0 to HW filter on device eth17
[  303.960995][ T5640] hsr_slave_0: left promiscuous mode
[  303.963833][ T5640] hsr_slave_1: left promiscuous mode
[  303.966801][ T5640] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  303.971194][ T5640] batman_adv: batadv0: Removing interface: batadv_slave_0
[  303.976092][ T5640] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  303.980116][ T5640] batman_adv: batadv0: Removing interface: batadv_slave_1
[  303.986340][ T5640] veth1_macvtap: left promiscuous mode
[  303.988959][ T5640] veth0_macvtap: left promiscuous mode
[  303.992135][ T5640] veth1_vlan: left promiscuous mode
[  303.992222][ T5640] veth0_vlan: left promiscuous mode
[  304.085785][ T5640] team0 (unregistering): Port device team_slave_1 removed
[  304.098684][ T5640] team0 (unregistering): Port device team_slave_0 removed
[  304.301902][ T5640] sctp: sctp_close: sk:ffff88817503cc00, timeout:0
[  304.302414][ T5340] 8021q: adding VLAN 0 to HW filter on device eth18
[  304.308518][ T5640] sctp: sctp_destroy_sock: sk:ffff88817503cc00
[  304.452406][ T5340] 8021q: adding VLAN 0 to HW filter on device eth19
[  304.569148][ T5340] 8021q: adding VLAN 0 to HW filter on device eth20
[  308.349510][ T5658] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  308.411625][ T5658] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  308.473877][ T5658] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  308.517205][ T5658] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  308.579891][ T5658] bridge_slave_1: left allmulticast mode
[  308.579936][ T5658] bridge_slave_1: left promiscuous mode
[  308.580034][ T5658] bridge0: port 2(bridge_slave_1) entered disabled state
[  308.585990][ T5658] bridge_slave_0: left allmulticast mode
[  308.586000][ T5658] bridge_slave_0: left promiscuous mode
[  308.586060][ T5658] bridge0: port 1(bridge_slave_0) entered disabled state
[  308.649197][ T5658] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  308.656187][ T5658] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  308.660957][ T5658] bond0 (unregistering): Released all slaves
[  308.786743][ T5340] 8021q: adding VLAN 0 to HW filter on device eth21
[  308.810048][ T5658] hsr_slave_0: left promiscuous mode
[  308.812637][ T5658] hsr_slave_1: left promiscuous mode
[  308.813088][ T5658] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  308.813100][ T5658] batman_adv: batadv0: Removing interface: batadv_slave_0
[  308.814995][ T5658] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  308.815007][ T5658] batman_adv: batadv0: Removing interface: batadv_slave_1
[  308.819618][ T5658] veth1_macvtap: left promiscuous mode
[  308.819638][ T5658] veth0_macvtap: left promiscuous mode
[  308.819721][ T5658] veth1_vlan: left promiscuous mode
[  308.819773][ T5658] veth0_vlan: left promiscuous mode
[  308.923657][ T5658] team0 (unregistering): Port device team_slave_1 removed
[  308.926937][ T5658] team0 (unregistering): Port device team_slave_0 removed
[  308.959375][ T5340] 8021q: adding VLAN 0 to HW filter on device eth22
[  309.081201][ T5658] sctp: sctp_close: sk:ffff88817503c280, timeout:0
[  309.081263][ T5658] sctp: sctp_destroy_sock: sk:ffff88817503c280
[  309.104851][ T5340] 8021q: adding VLAN 0 to HW filter on device eth23
[  309.116004][ T5658] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  309.158370][ T5658] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  309.177718][ T5658] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  309.209900][ T5340] 8021q: adding VLAN 0 to HW filter on device eth24
[  309.224349][ T5658] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  309.274095][ T5658] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  309.296665][ T5658] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  309.343362][ T5658] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  309.365771][ T5340] 8021q: adding VLAN 0 to HW filter on device eth25
[  309.391927][ T5658] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  309.461204][ T5340] 8021q: adding VLAN 0 to HW filter on device eth26
[  309.470794][ T5658] bridge_slave_1: left allmulticast mode
[  309.473310][ T5658] bridge_slave_1: left promiscuous mode
[  309.477571][ T5658] bridge0: port 2(bridge_slave_1) entered disabled state
[  309.481897][ T5658] bridge_slave_0: left allmulticast mode
[  309.484333][ T5658] bridge_slave_0: left promiscuous mode
[  309.485106][ T5658] bridge0: port 1(bridge_slave_0) entered disabled state
[  309.492930][ T5658] bridge_slave_1: left allmulticast mode
[  309.492986][ T5658] bridge_slave_1: left promiscuous mode
[  309.493337][ T5658] bridge0: port 2(bridge_slave_1) entered disabled state
[  309.498550][ T5658] bridge_slave_0: left allmulticast mode
[  309.498564][ T5658] bridge_slave_0: left promiscuous mode
[  309.498658][ T5658] bridge0: port 1(bridge_slave_0) entered disabled state
[  309.564097][ T5658] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  309.567532][ T5658] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  309.571079][ T5658] bond0 (unregistering): Released all slaves
[  309.573438][ T5658] bond1 (unregistering): Released all slaves
[  309.599299][ T5658] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[  309.610752][ T5658] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[  309.615313][ T5658] bond0 (unregistering): Released all slaves
[  309.714552][ T5340] 8021q: adding VLAN 0 to HW filter on device eth27
[  309.836783][ T5340] 8021q: adding VLAN 0 to HW filter on device eth28
[  309.871050][ T5658] hsr_slave_0: left promiscuous mode
[  309.873692][ T5658] hsr_slave_1: left promiscuous mode
[  309.874150][ T5658] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  309.874163][ T5658] batman_adv: batadv0: Removing interface: batadv_slave_0
[  309.884300][ T5658] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  309.884345][ T5658] batman_adv: batadv0: Removing interface: batadv_slave_1
[  309.896673][ T5658] hsr_slave_0: left promiscuous mode
[  309.898738][ T5658] hsr_slave_1: left promiscuous mode
[  309.898975][ T5658] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  309.898983][ T5658] batman_adv: batadv0: Removing interface: batadv_slave_0
[  309.907996][ T5658] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  309.912543][ T5658] batman_adv: batadv0: Removing interface: batadv_slave_1
[  309.921446][ T5658] veth1_macvtap: left promiscuous mode
[  309.921517][ T5658] veth0_macvtap: left promiscuous mode
[  309.921584][ T5658] veth1_vlan: left promiscuous mode
[  309.921641][ T5658] veth0_vlan: left promiscuous mode
[  309.931307][ T5658] veth1_macvtap: left promiscuous mode
[  309.931387][ T5658] veth0_macvtap: left promiscuous mode
[  309.931462][ T5658] veth1_vlan: left promiscuous mode
[  309.931494][ T5658] veth0_vlan: left promiscuous mode
[  310.056831][ T5658] team0 (unregistering): Port device team_slave_1 removed
[  310.060346][ T5658] team0 (unregistering): Port device team_slave_0 removed
[  310.131478][ T5658] team0 (unregistering): Port device team_slave_1 removed
[  310.134771][ T5658] team0 (unregistering): Port device team_slave_0 removed
[  310.168325][ T5340] 8021q: adding VLAN 0 to HW filter on device eth29
[  310.250152][ T5340] 8021q: adding VLAN 0 to HW filter on device eth30
[  310.393287][ T5340] 8021q: adding VLAN 0 to HW filter on device eth31
[  310.483437][ T5340] 8021q: adding VLAN 0 to HW filter on device eth32
[  310.504841][ T5658] sctp: sctp_close: sk:ffff88811431cc00, timeout:0
[  310.511196][ T5658] sctp: sctp_destroy_sock: sk:ffff88811431cc00
[  310.511353][ T5658] sctp: sctp_close: sk:ffff888196e38980, timeout:0
[  310.511387][ T5658] sctp: sctp_destroy_sock: sk:ffff888196e38980
