f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f0000001080)) 14:15:15 executing program 4: syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, 0x0, 0x4014) socket(0xa, 0x5, 0x2b1b) [ 422.561814] vfat: Unknown parameter 'obj_user' [ 422.571357] loop0: detected capacity change from 0 to 264192 [ 422.585420] vfat: Unknown parameter 'obj_user' [ 422.646585] kmemleak: Found object by alias at 0x607f1a638234 [ 422.646616] CPU: 0 UID: 0 PID: 5775 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 422.646649] Tainted: [W]=WARN [ 422.646656] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 422.646668] Call Trace: [ 422.646675] [ 422.646683] dump_stack_lvl+0xca/0x120 [ 422.646724] __lookup_object+0x94/0xb0 [ 422.646753] delete_object_full+0x27/0x70 [ 422.646781] free_percpu+0x30/0x1160 [ 422.646810] ? arch_uprobe_clear_state+0x16/0x140 [ 422.646845] futex_hash_free+0x38/0xc0 [ 422.646870] mmput+0x2d3/0x390 [ 422.646903] do_exit+0x79d/0x2970 [ 422.646927] ? signal_wake_up_state+0x85/0x120 [ 422.646954] ? zap_other_threads+0x2b9/0x3a0 [ 422.646983] ? __pfx_do_exit+0x10/0x10 [ 422.647006] ? do_group_exit+0x1c3/0x2a0 [ 422.647030] ? lock_release+0xc8/0x290 [ 422.647060] do_group_exit+0xd3/0x2a0 [ 422.647087] __x64_sys_exit_group+0x3e/0x50 [ 422.647112] x64_sys_call+0x18c5/0x18d0 [ 422.647139] do_syscall_64+0xbf/0x360 [ 422.647160] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 422.647180] RIP: 0033:0x7f94594c7b19 [ 422.647196] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 422.647205] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 422.647225] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 422.647239] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 422.647252] RBP: 0000000000000000 R08: 0000001b2cd21edc R09: 0000000000000000 [ 422.647264] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 422.647276] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 422.647305] [ 422.647311] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 422.647323] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 422.647335] kmemleak: min_count = 1 [ 422.647342] kmemleak: count = 1 [ 422.647349] kmemleak: flags = 0x21 [ 422.647355] kmemleak: checksum = 0 [ 422.647362] kmemleak: backtrace: [ 422.647368] pcpu_alloc_noprof+0x87a/0x1170 [ 422.647395] fib_nh_common_init+0x30/0xd0 [ 422.647417] fib6_nh_init+0x968/0x1a00 [ 422.647434] ip6_route_info_create_nh+0x530/0xf80 [ 422.647453] ip6_route_add.part.0+0x59/0x170 [ 422.647484] ip6_route_add+0x48/0x60 [ 422.647500] addrconf_add_mroute+0x12d/0x190 [ 422.647520] addrconf_add_dev+0x148/0x1c0 [ 422.647545] addrconf_dev_config+0x1e9/0x430 [ 422.647572] addrconf_notify+0xa70/0x1920 [ 422.647600] notifier_call_chain+0xc0/0x360 [ 422.647618] call_netdevice_notifiers_info+0xbe/0x140 [ 422.647638] netif_state_change+0x157/0x330 [ 422.647654] linkwatch_do_dev+0x111/0x150 [ 422.647673] __linkwatch_run_queue+0x2ab/0x710 [ 422.647691] linkwatch_event+0x4e/0x70 14:15:15 executing program 4: syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, 0x0, 0x4014) socket(0xa, 0x5, 0x2b1b) 14:15:15 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:15:15 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x12600110}, 0xc, &(0x7f0000000a00)={&(0x7f0000000640)={0x3bc, 0x0, 0x20, 0x70bd26, 0x25dfdbfc, {}, [{{0x8}, {0x168, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x80000001}}, {0x8}}}, {0x74, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x44, 0x4, [{0xa0, 0x2, 0x1f, 0x4}, {0x915, 0x1f, 0x40, 0xe42}, {0xe050, 0x68, 0x1, 0x7584}, {0x5, 0xff, 0xfe, 0x2}, {0x7fff, 0x20, 0x4, 0x4}, {0x5, 0x1f, 0x76, 0x401}, {0x4, 0x9, 0xf8, 0x3}, {0x401, 0x8, 0x8, 0x9}]}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x230, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x200}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xbc}}}, {0x84, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x54, 0x4, [{0x5, 0x1, 0x3, 0x9}, {0x4, 0x1a, 0x5}, {0x800, 0x3, 0x1f, 0x7f}, {0x5, 0x3f, 0x3, 0x3}, {0x1ff, 0x7, 0x9, 0x905}, {0xecfd, 0xf7, 0x10, 0x4}, {0x8001, 0xff, 0x1}, {0x5, 0x0, 0x4, 0x797d}, {0x1, 0x2, 0x3f, 0x83}, {0x97, 0x3, 0x6, 0xffffffff}]}}}, {0x84, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x54, 0x4, [{0x6, 0xeb, 0x7, 0x1ff}, {0x2, 0x81, 0x0, 0x10000}, {0x2, 0x4, 0x6, 0x3c}, {0x300, 0x3, 0x20, 0x4}, {0x0, 0x5, 0xcd, 0xffff0001}, {0x4, 0x1f, 0x1, 0x77}, {0x6, 0x6, 0x7, 0x6427}, {0x89af, 0x4, 0x4, 0x8}, {0x6, 0x80, 0x3, 0x6}, {0xfff9, 0x2, 0x9, 0x7}]}}}]}}]}, 0x3bc}, 0x1, 0x0, 0x0, 0x10000000}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:15:15 executing program 7: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000880)={0xb0, 0x0, 0x0, 0x0, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_SEC_LEVEL={0x4c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x9}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0xff}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_SEC_LEVEL={0x1c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x7}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5}]}, @NL802154_ATTR_SEC_LEVEL={0xc, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x4}, 0x4014) socket(0xa, 0x5, 0x2b1b) [ 422.874786] loop0: detected capacity change from 0 to 264192 [ 422.885537] vfat: Unknown parameter 'obj_user' [ 422.894179] loop2: detected capacity change from 0 to 264192 14:15:15 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x300, 0x70bd25, 0x6, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:15:15 executing program 6: sendmsg$NL802154_CMD_GET_SEC_LEVEL(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x300, 0x70bd25, 0x6, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4094) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)) 14:15:15 executing program 3: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x300, 0x70bd25, 0x6, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f0000001080)) [ 422.906086] vfat: Unknown parameter 'obj_user' 14:15:15 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0), 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:15:15 executing program 4: syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, 0x0, 0x4014) socket(0xa, 0x5, 0x2b1b) [ 422.980499] kmemleak: Found object by alias at 0x607f1a638234 [ 422.980527] CPU: 1 UID: 0 PID: 5802 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 422.980557] Tainted: [W]=WARN [ 422.980563] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 422.980581] Call Trace: [ 422.980588] [ 422.980595] dump_stack_lvl+0xca/0x120 [ 422.980631] __lookup_object+0x94/0xb0 [ 422.980658] delete_object_full+0x27/0x70 [ 422.980684] free_percpu+0x30/0x1160 [ 422.980710] ? arch_uprobe_clear_state+0x16/0x140 [ 422.980742] futex_hash_free+0x38/0xc0 [ 422.980765] mmput+0x2d3/0x390 [ 422.980795] do_exit+0x79d/0x2970 [ 422.980824] ? __pfx_do_exit+0x10/0x10 [ 422.980846] ? trace_irq_enable.constprop.0+0x26/0x100 [ 422.980867] ? _raw_spin_unlock_irq+0x23/0x40 [ 422.980896] do_group_exit+0xd3/0x2a0 [ 422.980921] __x64_sys_exit_group+0x3e/0x50 [ 422.980943] x64_sys_call+0x18c5/0x18d0 [ 422.980968] do_syscall_64+0xbf/0x360 [ 422.980988] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 422.981006] RIP: 0033:0x7f94594c7b19 [ 422.981021] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 422.981029] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 422.981048] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 422.981060] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 422.981072] RBP: 0000000000000000 R08: 0000001b2cd23820 R09: 0000000000000000 14:15:15 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, 0x0, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 422.981083] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 422.981094] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 422.981121] [ 422.981127] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 422.981138] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 422.981149] kmemleak: min_count = 1 [ 422.981155] kmemleak: count = 1 [ 422.981162] kmemleak: flags = 0x21 [ 422.981168] kmemleak: checksum = 0 [ 422.981174] kmemleak: backtrace: [ 422.981179] pcpu_alloc_noprof+0x87a/0x1170 [ 422.981203] fib_nh_common_init+0x30/0xd0 [ 422.981223] fib6_nh_init+0x968/0x1a00 [ 422.981239] ip6_route_info_create_nh+0x530/0xf80 [ 422.981256] ip6_route_add.part.0+0x59/0x170 [ 422.981272] ip6_route_add+0x48/0x60 [ 422.981287] addrconf_add_mroute+0x12d/0x190 [ 422.981304] addrconf_add_dev+0x148/0x1c0 [ 422.981325] addrconf_dev_config+0x1e9/0x430 [ 422.981348] addrconf_notify+0xa70/0x1920 [ 422.981374] notifier_call_chain+0xc0/0x360 [ 422.981391] call_netdevice_notifiers_info+0xbe/0x140 [ 422.981409] netif_state_change+0x157/0x330 [ 422.981424] linkwatch_do_dev+0x111/0x150 [ 422.981441] __linkwatch_run_queue+0x2ab/0x710 [ 422.981457] linkwatch_event+0x4e/0x70 14:15:15 executing program 7: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000880)={0xb0, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_SEC_LEVEL={0x4c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x9}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0xff}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_SEC_LEVEL={0x1c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x7}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5}]}, @NL802154_ATTR_SEC_LEVEL={0xc, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x2}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x4}, 0x4014) socket(0xa, 0x5, 0x2b1b) 14:15:15 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x0, &(0x7f0000000d80), 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:15:15 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, 0x0, 0x4014) socket(0xa, 0x5, 0x2b1b) [ 423.140884] loop0: detected capacity change from 0 to 264192 [ 423.161477] vfat: Unknown parameter 'obj_user' 14:15:15 executing program 7: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000880)={0xa4, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_SEC_LEVEL={0x4c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x9}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0xff}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}, @NL802154_ATTR_SEC_LEVEL={0x1c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x7}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x4}, 0x4014) socket(0xa, 0x5, 0x2b1b) 14:15:15 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0), 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:15:16 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, 0x0, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 423.243415] vfat: Unknown parameter 'obj_user' 14:15:16 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x300, 0x70bd25, 0x6, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:15:16 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, 0x0, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 423.336043] kmemleak: Found object by alias at 0x607f1a638234 [ 423.336067] CPU: 1 UID: 0 PID: 5828 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 423.336091] Tainted: [W]=WARN [ 423.336096] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 423.336106] Call Trace: [ 423.336111] [ 423.336117] dump_stack_lvl+0xca/0x120 [ 423.336151] __lookup_object+0x94/0xb0 [ 423.336172] delete_object_full+0x27/0x70 [ 423.336193] free_percpu+0x30/0x1160 [ 423.336214] ? arch_uprobe_clear_state+0x16/0x140 [ 423.336240] futex_hash_free+0x38/0xc0 [ 423.336259] mmput+0x2d3/0x390 [ 423.336283] do_exit+0x79d/0x2970 [ 423.336300] ? signal_wake_up_state+0x85/0x120 [ 423.336321] ? zap_other_threads+0x2b9/0x3a0 [ 423.336341] ? __pfx_do_exit+0x10/0x10 [ 423.336358] ? do_group_exit+0x1c3/0x2a0 [ 423.336376] ? lock_release+0xc8/0x290 [ 423.336398] do_group_exit+0xd3/0x2a0 [ 423.336417] __x64_sys_exit_group+0x3e/0x50 [ 423.336435] x64_sys_call+0x18c5/0x18d0 [ 423.336455] do_syscall_64+0xbf/0x360 [ 423.336470] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 423.336491] RIP: 0033:0x7f94594c7b19 [ 423.336502] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 423.336509] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 423.336524] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 423.336534] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 423.336543] RBP: 0000000000000000 R08: 0000001b2cd231dc R09: 0000000000000000 [ 423.336553] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 423.336562] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 423.336582] [ 423.336587] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 423.336596] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 423.336605] kmemleak: min_count = 1 [ 423.336610] kmemleak: count = 1 [ 423.336615] kmemleak: flags = 0x21 [ 423.336620] kmemleak: checksum = 0 [ 423.336625] kmemleak: backtrace: [ 423.336629] pcpu_alloc_noprof+0x87a/0x1170 [ 423.336649] fib_nh_common_init+0x30/0xd0 [ 423.336665] fib6_nh_init+0x968/0x1a00 [ 423.336678] ip6_route_info_create_nh+0x530/0xf80 [ 423.336691] ip6_route_add.part.0+0x59/0x170 [ 423.336704] ip6_route_add+0x48/0x60 [ 423.336716] addrconf_add_mroute+0x12d/0x190 [ 423.336730] addrconf_add_dev+0x148/0x1c0 [ 423.336747] addrconf_dev_config+0x1e9/0x430 [ 423.336765] addrconf_notify+0xa70/0x1920 [ 423.336786] notifier_call_chain+0xc0/0x360 [ 423.336800] call_netdevice_notifiers_info+0xbe/0x140 [ 423.336814] netif_state_change+0x157/0x330 [ 423.336826] linkwatch_do_dev+0x111/0x150 [ 423.336841] __linkwatch_run_queue+0x2ab/0x710 [ 423.336856] linkwatch_event+0x4e/0x70 [ 423.425362] loop0: detected capacity change from 0 to 264192 [ 423.439179] vfat: Unknown parameter 'obj_user' 14:15:25 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x300, 0x70bd25, 0x6, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:15:25 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, 0x0, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:15:25 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, 0x0, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:15:25 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, 0x0, 0x4014) socket(0xa, 0x5, 0x2b1b) 14:15:25 executing program 7: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000880)={0x88, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_SEC_LEVEL={0x4c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x9}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0xff}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x88}, 0x1, 0x0, 0x0, 0x4}, 0x4014) socket(0xa, 0x5, 0x2b1b) 14:15:25 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x0, &(0x7f0000000d80), 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:15:25 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0), 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:15:25 executing program 6: sendmsg$NL802154_CMD_GET_SEC_LEVEL(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x300, 0x70bd25, 0x6, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4094) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r0) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)) [ 433.199785] loop0: detected capacity change from 0 to 264192 [ 433.210835] vfat: Unknown parameter 'obj_user' [ 433.262096] vfat: Unknown parameter 'obj_user' 14:15:26 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000640)={0x3bc, 0x0, 0x20, 0x70bd26, 0x25dfdbfc, {}, [{{0x8}, {0x168, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x80000001}}, {0x8}}}, {0x74, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x44, 0x4, [{0xa0, 0x2, 0x1f, 0x4}, {0x915, 0x1f, 0x40, 0xe42}, {0xe050, 0x68, 0x1, 0x7584}, {0x5, 0xff, 0xfe, 0x2}, {0x7fff, 0x20, 0x4, 0x4}, {0x5, 0x1f, 0x76, 0x401}, {0x4, 0x9, 0xf8, 0x3}, {0x401, 0x8, 0x8, 0x9}]}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x230, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x200}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xbc}}}, {0x84, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x54, 0x4, [{0x5, 0x1, 0x3, 0x9}, {0x4, 0x1a, 0x5}, {0x800, 0x3, 0x1f, 0x7f}, {0x5, 0x3f, 0x3, 0x3}, {0x1ff, 0x7, 0x9, 0x905}, {0xecfd, 0xf7, 0x10, 0x4}, {0x8001, 0xff, 0x1}, {0x5, 0x0, 0x4, 0x797d}, {0x1, 0x2, 0x3f, 0x83}, {0x97, 0x3, 0x6, 0xffffffff}]}}}, {0x84, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x54, 0x4, [{0x6, 0xeb, 0x7, 0x1ff}, {0x2, 0x81, 0x0, 0x10000}, {0x2, 0x4, 0x6, 0x3c}, {0x300, 0x3, 0x20, 0x4}, {0x0, 0x5, 0xcd, 0xffff0001}, {0x4, 0x1f, 0x1, 0x77}, {0x6, 0x6, 0x7, 0x6427}, {0x89af, 0x4, 0x4, 0x8}, {0x6, 0x80, 0x3, 0x6}, {0xfff9, 0x2, 0x9, 0x7}]}}}]}}]}, 0x3bc}, 0x1, 0x0, 0x0, 0x10000000}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 433.416399] kmemleak: Found object by alias at 0x607f1a638234 [ 433.416432] CPU: 1 UID: 0 PID: 5864 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 433.416467] Tainted: [W]=WARN [ 433.416474] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 433.416488] Call Trace: [ 433.416495] [ 433.416504] dump_stack_lvl+0xca/0x120 [ 433.416545] __lookup_object+0x94/0xb0 [ 433.416584] delete_object_full+0x27/0x70 [ 433.416615] free_percpu+0x30/0x1160 [ 433.416646] ? arch_uprobe_clear_state+0x16/0x140 [ 433.416684] futex_hash_free+0x38/0xc0 [ 433.416710] mmput+0x2d3/0x390 [ 433.416745] do_exit+0x79d/0x2970 [ 433.416771] ? signal_wake_up_state+0x85/0x120 [ 433.416801] ? zap_other_threads+0x2b9/0x3a0 [ 433.416831] ? __pfx_do_exit+0x10/0x10 [ 433.416856] ? do_group_exit+0x1c3/0x2a0 [ 433.416883] ? lock_release+0xc8/0x290 [ 433.416915] do_group_exit+0xd3/0x2a0 [ 433.416957] __x64_sys_exit_group+0x3e/0x50 [ 433.416998] x64_sys_call+0x18c5/0x18d0 [ 433.417040] do_syscall_64+0xbf/0x360 [ 433.417063] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.417085] RIP: 0033:0x7f94594c7b19 [ 433.417102] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 433.417112] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 433.417134] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 433.417149] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 433.417163] RBP: 0000000000000000 R08: 0000001b2cd2327c R09: 0000000000000000 [ 433.417177] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 433.417190] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 433.417220] [ 433.417227] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 433.417240] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 433.417254] kmemleak: min_count = 1 [ 433.417262] kmemleak: count = 1 [ 433.417269] kmemleak: flags = 0x21 [ 433.417276] kmemleak: checksum = 0 [ 433.417283] kmemleak: backtrace: [ 433.417289] pcpu_alloc_noprof+0x87a/0x1170 [ 433.417319] fib_nh_common_init+0x30/0xd0 [ 433.417341] fib6_nh_init+0x968/0x1a00 [ 433.417360] ip6_route_info_create_nh+0x530/0xf80 [ 433.417380] ip6_route_add.part.0+0x59/0x170 [ 433.417399] ip6_route_add+0x48/0x60 [ 433.417417] addrconf_add_mroute+0x12d/0x190 [ 433.417438] addrconf_add_dev+0x148/0x1c0 [ 433.417463] addrconf_dev_config+0x1e9/0x430 [ 433.417490] addrconf_notify+0xa70/0x1920 [ 433.417521] notifier_call_chain+0xc0/0x360 [ 433.417540] call_netdevice_notifiers_info+0xbe/0x140 [ 433.417562] netif_state_change+0x157/0x330 [ 433.417580] linkwatch_do_dev+0x111/0x150 [ 433.417599] __linkwatch_run_queue+0x2ab/0x710 [ 433.417619] linkwatch_event+0x4e/0x70 [ 433.420946] loop0: detected capacity change from 0 to 264192 [ 433.511308] vfat: Unknown parameter 'obj_user' 14:15:35 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000640)={0x3bc, 0x0, 0x20, 0x70bd26, 0x25dfdbfc, {}, [{{0x8}, {0x168, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x80000001}}, {0x8}}}, {0x74, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x44, 0x4, [{0xa0, 0x2, 0x1f, 0x4}, {0x915, 0x1f, 0x40, 0xe42}, {0xe050, 0x68, 0x1, 0x7584}, {0x5, 0xff, 0xfe, 0x2}, {0x7fff, 0x20, 0x4, 0x4}, {0x5, 0x1f, 0x76, 0x401}, {0x4, 0x9, 0xf8, 0x3}, {0x401, 0x8, 0x8, 0x9}]}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x230, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x200}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xbc}}}, {0x84, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x54, 0x4, [{0x5, 0x1, 0x3, 0x9}, {0x4, 0x1a, 0x5}, {0x800, 0x3, 0x1f, 0x7f}, {0x5, 0x3f, 0x3, 0x3}, {0x1ff, 0x7, 0x9, 0x905}, {0xecfd, 0xf7, 0x10, 0x4}, {0x8001, 0xff, 0x1}, {0x5, 0x0, 0x4, 0x797d}, {0x1, 0x2, 0x3f, 0x83}, {0x97, 0x3, 0x6, 0xffffffff}]}}}, {0x84, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x54, 0x4, [{0x6, 0xeb, 0x7, 0x1ff}, {0x2, 0x81, 0x0, 0x10000}, {0x2, 0x4, 0x6, 0x3c}, {0x300, 0x3, 0x20, 0x4}, {0x0, 0x5, 0xcd, 0xffff0001}, {0x4, 0x1f, 0x1, 0x77}, {0x6, 0x6, 0x7, 0x6427}, {0x89af, 0x4, 0x4, 0x8}, {0x6, 0x80, 0x3, 0x6}, {0xfff9, 0x2, 0x9, 0x7}]}}}]}}]}, 0x3bc}, 0x1, 0x0, 0x0, 0x10000000}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:15:35 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, 0x0, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:15:35 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:15:35 executing program 7: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000880)={0x7c, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_SEC_LEVEL={0x4c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x9}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0xff}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}]}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x7c}, 0x1, 0x0, 0x0, 0x4}, 0x4014) socket(0xa, 0x5, 0x2b1b) 14:15:35 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x0, &(0x7f0000000d80), 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:15:35 executing program 6: sendmsg$NL802154_CMD_GET_SEC_LEVEL(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x300, 0x70bd25, 0x6, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4094) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)) 14:15:35 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:15:35 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, 0x0, 0x4014) socket(0xa, 0x5, 0x2b1b) [ 442.951349] loop0: detected capacity change from 0 to 264192 [ 442.952096] vfat: Unknown parameter 'obj_user' [ 442.967206] vfat: Unknown parameter 'obj_user' [ 443.040991] kmemleak: Found object by alias at 0x607f1a638234 [ 443.041020] CPU: 0 UID: 0 PID: 5892 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 443.041046] Tainted: [W]=WARN [ 443.041052] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 443.041062] Call Trace: [ 443.041068] [ 443.041075] dump_stack_lvl+0xca/0x120 [ 443.041108] __lookup_object+0x94/0xb0 [ 443.041132] delete_object_full+0x27/0x70 [ 443.041156] free_percpu+0x30/0x1160 [ 443.041179] ? arch_uprobe_clear_state+0x16/0x140 [ 443.041208] futex_hash_free+0x38/0xc0 [ 443.041229] mmput+0x2d3/0x390 [ 443.041256] do_exit+0x79d/0x2970 [ 443.041276] ? signal_wake_up_state+0x85/0x120 [ 443.041299] ? zap_other_threads+0x2b9/0x3a0 [ 443.041322] ? __pfx_do_exit+0x10/0x10 [ 443.041341] ? do_group_exit+0x1c3/0x2a0 [ 443.041361] ? lock_release+0xc8/0x290 [ 443.041386] do_group_exit+0xd3/0x2a0 [ 443.041408] __x64_sys_exit_group+0x3e/0x50 [ 443.041428] x64_sys_call+0x18c5/0x18d0 [ 443.041450] do_syscall_64+0xbf/0x360 [ 443.041467] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.041484] RIP: 0033:0x7f94594c7b19 [ 443.041496] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 443.041504] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 443.041521] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 443.041532] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 443.041542] RBP: 0000000000000000 R08: 0000001b2cd23234 R09: 0000000000000000 [ 443.041552] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 443.041562] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 443.041591] [ 443.041597] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 443.041606] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 443.041617] kmemleak: min_count = 1 [ 443.041622] kmemleak: count = 1 [ 443.041628] kmemleak: flags = 0x21 [ 443.041633] kmemleak: checksum = 0 [ 443.041638] kmemleak: backtrace: [ 443.041643] pcpu_alloc_noprof+0x87a/0x1170 [ 443.041665] fib_nh_common_init+0x30/0xd0 [ 443.041683] fib6_nh_init+0x968/0x1a00 [ 443.041697] ip6_route_info_create_nh+0x530/0xf80 [ 443.041712] ip6_route_add.part.0+0x59/0x170 [ 443.041727] ip6_route_add+0x48/0x60 [ 443.041741] addrconf_add_mroute+0x12d/0x190 [ 443.041757] addrconf_add_dev+0x148/0x1c0 [ 443.041776] addrconf_dev_config+0x1e9/0x430 [ 443.041797] addrconf_notify+0xa70/0x1920 [ 443.041820] notifier_call_chain+0xc0/0x360 [ 443.041835] call_netdevice_notifiers_info+0xbe/0x140 [ 443.041851] netif_state_change+0x157/0x330 [ 443.041864] linkwatch_do_dev+0x111/0x150 [ 443.041880] __linkwatch_run_queue+0x2ab/0x710 [ 443.041894] linkwatch_event+0x4e/0x70 14:15:35 executing program 7: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000880)={0x74, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_SEC_LEVEL={0x4c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x9}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0xff}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}]}, @NL802154_ATTR_IFINDEX={0x8}]}, 0x74}, 0x1, 0x0, 0x0, 0x4}, 0x4014) socket(0xa, 0x5, 0x2b1b) 14:15:35 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, 0x0, 0x4014) socket(0xa, 0x5, 0x2b1b) 14:15:35 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000640)={0x3bc, 0x0, 0x20, 0x70bd26, 0x25dfdbfc, {}, [{{0x8}, {0x168, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x80000001}}, {0x8}}}, {0x74, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x44, 0x4, [{0xa0, 0x2, 0x1f, 0x4}, {0x915, 0x1f, 0x40, 0xe42}, {0xe050, 0x68, 0x1, 0x7584}, {0x5, 0xff, 0xfe, 0x2}, {0x7fff, 0x20, 0x4, 0x4}, {0x5, 0x1f, 0x76, 0x401}, {0x4, 0x9, 0xf8, 0x3}, {0x401, 0x8, 0x8, 0x9}]}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x230, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x200}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xbc}}}, {0x84, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x54, 0x4, [{0x5, 0x1, 0x3, 0x9}, {0x4, 0x1a, 0x5}, {0x800, 0x3, 0x1f, 0x7f}, {0x5, 0x3f, 0x3, 0x3}, {0x1ff, 0x7, 0x9, 0x905}, {0xecfd, 0xf7, 0x10, 0x4}, {0x8001, 0xff, 0x1}, {0x5, 0x0, 0x4, 0x797d}, {0x1, 0x2, 0x3f, 0x83}, {0x97, 0x3, 0x6, 0xffffffff}]}}}, {0x84, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x54, 0x4, [{0x6, 0xeb, 0x7, 0x1ff}, {0x2, 0x81, 0x0, 0x10000}, {0x2, 0x4, 0x6, 0x3c}, {0x300, 0x3, 0x20, 0x4}, {0x0, 0x5, 0xcd, 0xffff0001}, {0x4, 0x1f, 0x1, 0x77}, {0x6, 0x6, 0x7, 0x6427}, {0x89af, 0x4, 0x4, 0x8}, {0x6, 0x80, 0x3, 0x6}, {0xfff9, 0x2, 0x9, 0x7}]}}}]}}]}, 0x3bc}, 0x1, 0x0, 0x0, 0x10000000}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:15:35 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:15:35 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:15:35 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{0x0, 0x0, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:15:35 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x300, 0x70bd25, 0x6, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 443.210498] loop0: detected capacity change from 0 to 264192 14:15:35 executing program 6: sendmsg$NL802154_CMD_GET_SEC_LEVEL(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x300, 0x70bd25, 0x6, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4094) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)) [ 443.230447] vfat: Unknown parameter 'obj_user' 14:15:35 executing program 7: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000880)={0x6c, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}, @NL802154_ATTR_SEC_LEVEL={0x4c, 0x22, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8, 0x3, 0x9}, @NL802154_SECLEVEL_ATTR_CMD_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_FRAME={0x8, 0x2, 0x1}, @NL802154_SECLEVEL_ATTR_FRAME={0x8}, @NL802154_SECLEVEL_ATTR_LEVELS={0x5, 0x1, 0xff}, @NL802154_SECLEVEL_ATTR_DEV_OVERRIDE={0x5, 0x4, 0x1}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4}, 0x4014) socket(0xa, 0x5, 0x2b1b) 14:15:36 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, 0x0, 0x4014) socket(0xa, 0x5, 0x2b1b) [ 443.265981] loop2: detected capacity change from 0 to 264192 [ 443.278056] vfat: Unknown parameter 'obj_user' [ 443.340973] kmemleak: Found object by alias at 0x607f1a638234 [ 443.340995] CPU: 0 UID: 0 PID: 5928 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 443.341016] Tainted: [W]=WARN [ 443.341020] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 443.341029] Call Trace: [ 443.341034] [ 443.341039] dump_stack_lvl+0xca/0x120 [ 443.341067] __lookup_object+0x94/0xb0 [ 443.341087] delete_object_full+0x27/0x70 [ 443.341106] free_percpu+0x30/0x1160 [ 443.341126] ? arch_uprobe_clear_state+0x16/0x140 [ 443.341150] futex_hash_free+0x38/0xc0 [ 443.341166] mmput+0x2d3/0x390 [ 443.341188] do_exit+0x79d/0x2970 [ 443.341209] ? __pfx_do_exit+0x10/0x10 [ 443.341226] ? find_held_lock+0x2b/0x80 [ 443.341247] ? get_signal+0x835/0x2340 [ 443.341271] do_group_exit+0xd3/0x2a0 [ 443.341289] get_signal+0x2315/0x2340 [ 443.341310] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 443.341329] ? __pfx_get_signal+0x10/0x10 [ 443.341349] ? __schedule+0xe91/0x3590 [ 443.341372] arch_do_signal_or_restart+0x80/0x790 [ 443.341393] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 443.341412] ? __x64_sys_futex+0x1c9/0x4d0 [ 443.341427] ? __x64_sys_futex+0x1d2/0x4d0 [ 443.341442] ? exc_page_fault+0xb0/0x180 [ 443.341462] ? __pfx___x64_sys_futex+0x10/0x10 [ 443.341484] exit_to_user_mode_loop+0x8b/0x110 [ 443.341499] do_syscall_64+0x2f7/0x360 [ 443.341513] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 443.341527] RIP: 0033:0x7f94594c7b19 [ 443.341540] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 443.341547] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 443.341563] RAX: 0000000000000001 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 443.341577] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f94595daf6c [ 443.341586] RBP: 00007f94595daf60 R08: 0000000000000058 R09: 0000000000000000 [ 443.341594] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007f94595daf6c [ 443.341602] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 443.341621] [ 443.341626] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 443.341634] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 443.341642] kmemleak: min_count = 1 [ 443.341647] kmemleak: count = 1 [ 443.341651] kmemleak: flags = 0x21 [ 443.341655] kmemleak: checksum = 0 [ 443.341660] kmemleak: backtrace: [ 443.341664] pcpu_alloc_noprof+0x87a/0x1170 [ 443.341682] fib_nh_common_init+0x30/0xd0 [ 443.341697] fib6_nh_init+0x968/0x1a00 [ 443.341709] ip6_route_info_create_nh+0x530/0xf80 [ 443.341721] ip6_route_add.part.0+0x59/0x170 [ 443.341733] ip6_route_add+0x48/0x60 [ 443.341744] addrconf_add_mroute+0x12d/0x190 [ 443.341756] addrconf_add_dev+0x148/0x1c0 [ 443.341772] addrconf_dev_config+0x1e9/0x430 [ 443.341789] addrconf_notify+0xa70/0x1920 [ 443.341808] notifier_call_chain+0xc0/0x360 [ 443.341819] call_netdevice_notifiers_info+0xbe/0x140 [ 443.341833] netif_state_change+0x157/0x330 [ 443.341844] linkwatch_do_dev+0x111/0x150 [ 443.341857] __linkwatch_run_queue+0x2ab/0x710 [ 443.341868] linkwatch_event+0x4e/0x70 14:15:44 executing program 7: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000880)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x4014) socket(0xa, 0x5, 0x2b1b) 14:15:44 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, 0x0, 0x4014) socket(0xa, 0x5, 0x2b1b) 14:15:44 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:15:44 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:15:44 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={&(0x7f0000000640)={0x3bc, 0x0, 0x20, 0x70bd26, 0x25dfdbfc, {}, [{{0x8}, {0x168, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x80000001}}, {0x8}}}, {0x74, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x44, 0x4, [{0xa0, 0x2, 0x1f, 0x4}, {0x915, 0x1f, 0x40, 0xe42}, {0xe050, 0x68, 0x1, 0x7584}, {0x5, 0xff, 0xfe, 0x2}, {0x7fff, 0x20, 0x4, 0x4}, {0x5, 0x1f, 0x76, 0x401}, {0x4, 0x9, 0xf8, 0x3}, {0x401, 0x8, 0x8, 0x9}]}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x230, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x200}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xbc}}}, {0x84, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x54, 0x4, [{0x5, 0x1, 0x3, 0x9}, {0x4, 0x1a, 0x5}, {0x800, 0x3, 0x1f, 0x7f}, {0x5, 0x3f, 0x3, 0x3}, {0x1ff, 0x7, 0x9, 0x905}, {0xecfd, 0xf7, 0x10, 0x4}, {0x8001, 0xff, 0x1}, {0x5, 0x0, 0x4, 0x797d}, {0x1, 0x2, 0x3f, 0x83}, {0x97, 0x3, 0x6, 0xffffffff}]}}}, {0x84, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x54, 0x4, [{0x6, 0xeb, 0x7, 0x1ff}, {0x2, 0x81, 0x0, 0x10000}, {0x2, 0x4, 0x6, 0x3c}, {0x300, 0x3, 0x20, 0x4}, {0x0, 0x5, 0xcd, 0xffff0001}, {0x4, 0x1f, 0x1, 0x77}, {0x6, 0x6, 0x7, 0x6427}, {0x89af, 0x4, 0x4, 0x8}, {0x6, 0x80, 0x3, 0x6}, {0xfff9, 0x2, 0x9, 0x7}]}}}]}}]}, 0x3bc}, 0x1, 0x0, 0x0, 0x10000000}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:15:44 executing program 6: sendmsg$NL802154_CMD_GET_SEC_LEVEL(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x300, 0x70bd25, 0x6, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4094) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)) 14:15:44 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{0x0, 0x0, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:15:44 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x300, 0x70bd25, 0x6, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:15:44 executing program 7: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000880)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x4014) socket(0xa, 0x5, 0x2b1b) [ 451.678571] loop0: detected capacity change from 0 to 264192 [ 451.685079] vfat: Unknown parameter 'obj_user' [ 451.715324] loop2: detected capacity change from 0 to 264192 [ 451.740416] vfat: Unknown parameter 'obj_user' 14:15:44 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={&(0x7f0000000640)={0x3bc, 0x0, 0x20, 0x70bd26, 0x25dfdbfc, {}, [{{0x8}, {0x168, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x80000001}}, {0x8}}}, {0x74, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x44, 0x4, [{0xa0, 0x2, 0x1f, 0x4}, {0x915, 0x1f, 0x40, 0xe42}, {0xe050, 0x68, 0x1, 0x7584}, {0x5, 0xff, 0xfe, 0x2}, {0x7fff, 0x20, 0x4, 0x4}, {0x5, 0x1f, 0x76, 0x401}, {0x4, 0x9, 0xf8, 0x3}, {0x401, 0x8, 0x8, 0x9}]}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x230, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x200}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xbc}}}, {0x84, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x54, 0x4, [{0x5, 0x1, 0x3, 0x9}, {0x4, 0x1a, 0x5}, {0x800, 0x3, 0x1f, 0x7f}, {0x5, 0x3f, 0x3, 0x3}, {0x1ff, 0x7, 0x9, 0x905}, {0xecfd, 0xf7, 0x10, 0x4}, {0x8001, 0xff, 0x1}, {0x5, 0x0, 0x4, 0x797d}, {0x1, 0x2, 0x3f, 0x83}, {0x97, 0x3, 0x6, 0xffffffff}]}}}, {0x84, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x54, 0x4, [{0x6, 0xeb, 0x7, 0x1ff}, {0x2, 0x81, 0x0, 0x10000}, {0x2, 0x4, 0x6, 0x3c}, {0x300, 0x3, 0x20, 0x4}, {0x0, 0x5, 0xcd, 0xffff0001}, {0x4, 0x1f, 0x1, 0x77}, {0x6, 0x6, 0x7, 0x6427}, {0x89af, 0x4, 0x4, 0x8}, {0x6, 0x80, 0x3, 0x6}, {0xfff9, 0x2, 0x9, 0x7}]}}}]}}]}, 0x3bc}, 0x1, 0x0, 0x0, 0x10000000}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 451.812403] loop0: detected capacity change from 0 to 264192 [ 451.821388] vfat: Unknown parameter 'obj_user' [ 451.841504] kmemleak: Found object by alias at 0x607f1a638234 [ 451.841536] CPU: 0 UID: 0 PID: 5966 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 451.841569] Tainted: [W]=WARN [ 451.841584] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 451.841596] Call Trace: [ 451.841603] [ 451.841611] dump_stack_lvl+0xca/0x120 [ 451.841651] __lookup_object+0x94/0xb0 [ 451.841680] delete_object_full+0x27/0x70 [ 451.841708] free_percpu+0x30/0x1160 [ 451.841737] ? arch_uprobe_clear_state+0x16/0x140 [ 451.841772] futex_hash_free+0x38/0xc0 [ 451.841797] mmput+0x2d3/0x390 [ 451.841830] do_exit+0x79d/0x2970 [ 451.841854] ? lock_release+0xc8/0x290 [ 451.841884] ? __pfx_do_exit+0x10/0x10 [ 451.841910] ? find_held_lock+0x2b/0x80 [ 451.841940] ? get_signal+0x835/0x2340 [ 451.841976] do_group_exit+0xd3/0x2a0 [ 451.842002] get_signal+0x2315/0x2340 [ 451.842043] ? __pfx_get_signal+0x10/0x10 [ 451.842072] ? do_futex+0x135/0x370 [ 451.842097] ? __pfx_do_futex+0x10/0x10 [ 451.842124] arch_do_signal_or_restart+0x80/0x790 [ 451.842155] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 451.842184] ? __x64_sys_futex+0x1c9/0x4d0 [ 451.842206] ? __x64_sys_futex+0x1d2/0x4d0 [ 451.842230] ? exc_page_fault+0xb0/0x180 [ 451.842260] ? __pfx___x64_sys_futex+0x10/0x10 [ 451.842293] exit_to_user_mode_loop+0x8b/0x110 [ 451.842316] do_syscall_64+0x2f7/0x360 [ 451.842337] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 451.842358] RIP: 0033:0x7f94594c7b19 [ 451.842374] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 451.842383] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 451.842403] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 451.842417] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 451.842430] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 451.842442] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 451.842454] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 451.842483] [ 451.842490] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 451.842502] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 451.842514] kmemleak: min_count = 1 [ 451.842521] kmemleak: count = 1 [ 451.842528] kmemleak: flags = 0x21 [ 451.842534] kmemleak: checksum = 0 [ 451.842541] kmemleak: backtrace: [ 451.842547] pcpu_alloc_noprof+0x87a/0x1170 [ 451.842574] fib_nh_common_init+0x30/0xd0 [ 451.842595] fib6_nh_init+0x968/0x1a00 [ 451.842613] ip6_route_info_create_nh+0x530/0xf80 [ 451.842632] ip6_route_add.part.0+0x59/0x170 [ 451.842649] ip6_route_add+0x48/0x60 [ 451.842666] addrconf_add_mroute+0x12d/0x190 [ 451.842685] addrconf_add_dev+0x148/0x1c0 [ 451.842708] addrconf_dev_config+0x1e9/0x430 [ 451.842734] addrconf_notify+0xa70/0x1920 [ 451.842762] notifier_call_chain+0xc0/0x360 [ 451.842780] call_netdevice_notifiers_info+0xbe/0x140 [ 451.842800] netif_state_change+0x157/0x330 [ 451.842816] linkwatch_do_dev+0x111/0x150 [ 451.842835] __linkwatch_run_queue+0x2ab/0x710 [ 451.842853] linkwatch_event+0x4e/0x70 14:15:54 executing program 6: sendmsg$NL802154_CMD_GET_SEC_LEVEL(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x300, 0x70bd25, 0x6, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4094) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)) 14:15:54 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{0x0, 0x0, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:15:54 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={&(0x7f0000000640)={0x3bc, 0x0, 0x20, 0x70bd26, 0x25dfdbfc, {}, [{{0x8}, {0x168, 0x2, 0x0, 0x1, [{0x40, 0x1, @priority={{{0x24}, {0x5}, {0x8, 0x4, 0x80000001}}, {0x8}}}, {0x74, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x44, 0x4, [{0xa0, 0x2, 0x1f, 0x4}, {0x915, 0x1f, 0x40, 0xe42}, {0xe050, 0x68, 0x1, 0x7584}, {0x5, 0xff, 0xfe, 0x2}, {0x7fff, 0x20, 0x4, 0x4}, {0x5, 0x1f, 0x76, 0x401}, {0x4, 0x9, 0xf8, 0x3}, {0x401, 0x8, 0x8, 0x9}]}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24}, {0x5}, {0x8}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}]}}, {{0x8}, {0x230, 0x2, 0x0, 0x1, [{0x40, 0x1, @lb_hash_stats={{{0x24}, {0x5}, {0x8, 0x4, 0x200}}, {0x8}}}, {0x38, 0x1, @activeport={{0x24}, {0x5}, {0x8}}}, {0x3c, 0x1, @user_linkup={{{0x24}, {0x5}, {0x4}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24}, {0x5}, {0x8, 0x4, 0xffffffff}}}, {0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0xbc}}}, {0x84, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x54, 0x4, [{0x5, 0x1, 0x3, 0x9}, {0x4, 0x1a, 0x5}, {0x800, 0x3, 0x1f, 0x7f}, {0x5, 0x3f, 0x3, 0x3}, {0x1ff, 0x7, 0x9, 0x905}, {0xecfd, 0xf7, 0x10, 0x4}, {0x8001, 0xff, 0x1}, {0x5, 0x0, 0x4, 0x797d}, {0x1, 0x2, 0x3f, 0x83}, {0x97, 0x3, 0x6, 0xffffffff}]}}}, {0x84, 0x1, @bpf_hash_func={{0x24}, {0x5}, {0x54, 0x4, [{0x6, 0xeb, 0x7, 0x1ff}, {0x2, 0x81, 0x0, 0x10000}, {0x2, 0x4, 0x6, 0x3c}, {0x300, 0x3, 0x20, 0x4}, {0x0, 0x5, 0xcd, 0xffff0001}, {0x4, 0x1f, 0x1, 0x77}, {0x6, 0x6, 0x7, 0x6427}, {0x89af, 0x4, 0x4, 0x8}, {0x6, 0x80, 0x3, 0x6}, {0xfff9, 0x2, 0x9, 0x7}]}}}]}}]}, 0x3bc}, 0x1, 0x0, 0x0, 0x10000000}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:15:54 executing program 7: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000880)={0x14}, 0x14}}, 0x4014) socket(0xa, 0x5, 0x2b1b) 14:15:54 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, 0x0, 0x4014) socket(0xa, 0x5, 0x2b1b) 14:15:54 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:15:54 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:15:54 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 461.461298] loop2: detected capacity change from 0 to 264192 [ 461.465299] vfat: Unknown parameter 'obj_user' [ 461.499471] kmemleak: Found object by alias at 0x607f1a638234 [ 461.499489] CPU: 0 UID: 0 PID: 5984 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 461.499507] Tainted: [W]=WARN [ 461.499510] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 461.499517] Call Trace: [ 461.499521] [ 461.499526] dump_stack_lvl+0xca/0x120 [ 461.499551] __lookup_object+0x94/0xb0 [ 461.499572] delete_object_full+0x27/0x70 [ 461.499588] free_percpu+0x30/0x1160 [ 461.499604] ? arch_uprobe_clear_state+0x16/0x140 [ 461.499624] futex_hash_free+0x38/0xc0 [ 461.499638] mmput+0x2d3/0x390 [ 461.499657] do_exit+0x79d/0x2970 [ 461.499674] ? __pfx_do_exit+0x10/0x10 [ 461.499688] ? find_held_lock+0x2b/0x80 [ 461.499706] ? get_signal+0x835/0x2340 [ 461.499726] do_group_exit+0xd3/0x2a0 [ 461.499740] get_signal+0x2315/0x2340 [ 461.499758] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 461.499776] ? __pfx_get_signal+0x10/0x10 [ 461.499795] ? __schedule+0xe91/0x3590 [ 461.499815] arch_do_signal_or_restart+0x80/0x790 [ 461.499832] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 461.499848] ? __x64_sys_futex+0x1c9/0x4d0 [ 461.499860] ? __x64_sys_futex+0x1d2/0x4d0 [ 461.499875] ? __pfx___x64_sys_futex+0x10/0x10 [ 461.499893] exit_to_user_mode_loop+0x8b/0x110 [ 461.499905] do_syscall_64+0x2f7/0x360 [ 461.499917] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 461.499929] RIP: 0033:0x7f94594c7b19 [ 461.499937] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 461.499942] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 461.499953] RAX: 0000000000000001 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 461.499961] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f94595daf6c [ 461.499967] RBP: 00007f94595daf60 R08: 0000000000000058 R09: 0000000000000000 [ 461.499974] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007f94595daf6c [ 461.499981] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 461.499996] [ 461.500000] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 461.500007] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 461.500013] kmemleak: min_count = 1 [ 461.500017] kmemleak: count = 1 [ 461.500021] kmemleak: flags = 0x21 [ 461.500024] kmemleak: checksum = 0 [ 461.500028] kmemleak: backtrace: [ 461.500031] pcpu_alloc_noprof+0x87a/0x1170 [ 461.500046] fib_nh_common_init+0x30/0xd0 [ 461.500059] fib6_nh_init+0x968/0x1a00 [ 461.500069] ip6_route_info_create_nh+0x530/0xf80 [ 461.500079] ip6_route_add.part.0+0x59/0x170 [ 461.500088] ip6_route_add+0x48/0x60 [ 461.500097] addrconf_add_mroute+0x12d/0x190 [ 461.500122] addrconf_add_dev+0x148/0x1c0 [ 461.500135] addrconf_dev_config+0x1e9/0x430 [ 461.500149] addrconf_notify+0xa70/0x1920 [ 461.500165] notifier_call_chain+0xc0/0x360 [ 461.500174] call_netdevice_notifiers_info+0xbe/0x140 [ 461.500186] netif_state_change+0x157/0x330 [ 461.500195] linkwatch_do_dev+0x111/0x150 [ 461.500205] __linkwatch_run_queue+0x2ab/0x710 [ 461.500215] linkwatch_event+0x4e/0x70 [ 461.525419] loop0: detected capacity change from 0 to 264192 [ 461.544303] vfat: Unknown parameter 'obj_user' 14:15:54 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:15:54 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40), 0x0, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:15:54 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, 0x0, 0x4014) socket(0xa, 0x5, 0x2b1b) 14:15:54 executing program 7: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000880)={0x14}, 0x14}}, 0x0) socket(0xa, 0x5, 0x2b1b) 14:15:54 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0, 0x1, 0x0, 0x0, 0x10000000}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 461.697696] loop2: detected capacity change from 0 to 264192 14:15:54 executing program 6: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)) [ 461.743458] vfat: Unknown parameter 'obj_user' 14:15:54 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:15:54 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, 0x0, 0x4014) socket(0xa, 0x5, 0x2b1b) [ 461.795340] loop0: detected capacity change from 0 to 264192 14:15:54 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) [ 461.812885] vfat: Unknown parameter 'obj_user' 14:15:54 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 461.847488] kmemleak: Found object by alias at 0x607f1a638234 [ 461.847517] CPU: 1 UID: 0 PID: 6009 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 461.847551] Tainted: [W]=WARN [ 461.847558] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 461.847577] Call Trace: [ 461.847585] [ 461.847593] dump_stack_lvl+0xca/0x120 [ 461.847644] __lookup_object+0x94/0xb0 [ 461.847674] delete_object_full+0x27/0x70 [ 461.847707] free_percpu+0x30/0x1160 [ 461.847742] ? arch_uprobe_clear_state+0x16/0x140 [ 461.847780] futex_hash_free+0x38/0xc0 [ 461.847806] mmput+0x2d3/0x390 [ 461.847841] do_exit+0x79d/0x2970 [ 461.847866] ? lock_release+0xc8/0x290 [ 461.847898] ? __pfx_do_exit+0x10/0x10 [ 461.847925] ? find_held_lock+0x2b/0x80 [ 461.847958] ? get_signal+0x835/0x2340 [ 461.847995] do_group_exit+0xd3/0x2a0 [ 461.848024] get_signal+0x2315/0x2340 [ 461.848068] ? __pfx_get_signal+0x10/0x10 [ 461.848099] ? do_futex+0x135/0x370 [ 461.848141] ? __pfx_do_futex+0x10/0x10 [ 461.848171] arch_do_signal_or_restart+0x80/0x790 [ 461.848204] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 461.848235] ? __x64_sys_futex+0x1c9/0x4d0 [ 461.848259] ? __x64_sys_futex+0x1d2/0x4d0 [ 461.848285] ? exc_page_fault+0xb0/0x180 [ 461.848316] ? __pfx___x64_sys_futex+0x10/0x10 [ 461.848353] exit_to_user_mode_loop+0x8b/0x110 [ 461.848377] do_syscall_64+0x2f7/0x360 [ 461.848400] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 461.848423] RIP: 0033:0x7f94594c7b19 [ 461.848441] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 461.848451] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 461.848474] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 461.848488] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 461.848502] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 461.848515] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 461.848529] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 461.848560] [ 461.848567] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 461.848580] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 461.848593] kmemleak: min_count = 1 [ 461.848600] kmemleak: count = 1 [ 461.848609] kmemleak: flags = 0x21 [ 461.848619] kmemleak: checksum = 0 [ 461.848628] kmemleak: backtrace: [ 461.848635] pcpu_alloc_noprof+0x87a/0x1170 [ 461.848664] fib_nh_common_init+0x30/0xd0 [ 461.848687] fib6_nh_init+0x968/0x1a00 [ 461.848712] ip6_route_info_create_nh+0x530/0xf80 [ 461.848732] ip6_route_add.part.0+0x59/0x170 [ 461.848752] ip6_route_add+0x48/0x60 [ 461.848770] addrconf_add_mroute+0x12d/0x190 [ 461.848791] addrconf_add_dev+0x148/0x1c0 [ 461.848816] addrconf_dev_config+0x1e9/0x430 [ 461.848843] addrconf_notify+0xa70/0x1920 [ 461.848874] notifier_call_chain+0xc0/0x360 [ 461.848893] call_netdevice_notifiers_info+0xbe/0x140 [ 461.848915] netif_state_change+0x157/0x330 [ 461.848933] linkwatch_do_dev+0x111/0x150 [ 461.848953] __linkwatch_run_queue+0x2ab/0x710 [ 461.848973] linkwatch_event+0x4e/0x70 14:15:54 executing program 7: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000880)={0x14}, 0x14}}, 0x0) socket(0x0, 0x5, 0x2b1b) 14:15:54 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(0xffffffffffffffff, 0x0, 0x4014) socket(0xa, 0x5, 0x2b1b) 14:15:54 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40), 0x0, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:15:54 executing program 6: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair(0x0, 0x4, 0x3, &(0x7f0000001040)) 14:15:54 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0, 0x1, 0x0, 0x0, 0x10000000}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:15:54 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:15:54 executing program 7: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000880)={0x14}, 0x14}}, 0x0) socket(0x0, 0x5, 0x2b1b) [ 462.085914] loop0: detected capacity change from 0 to 264192 [ 462.102732] vfat: Unknown parameter 'obj_user' 14:15:54 executing program 6: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair(0x0, 0x4, 0x3, &(0x7f0000001040)) 14:15:54 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(0xffffffffffffffff, 0x0, 0x4014) socket(0xa, 0x5, 0x2b1b) [ 462.182181] kmemleak: Found object by alias at 0x607f1a638234 [ 462.182210] CPU: 1 UID: 0 PID: 6042 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 462.182245] Tainted: [W]=WARN [ 462.182252] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 462.182266] Call Trace: [ 462.182273] [ 462.182282] dump_stack_lvl+0xca/0x120 [ 462.182324] __lookup_object+0x94/0xb0 [ 462.182356] delete_object_full+0x27/0x70 [ 462.182386] free_percpu+0x30/0x1160 [ 462.182417] ? arch_uprobe_clear_state+0x16/0x140 [ 462.182455] futex_hash_free+0x38/0xc0 [ 462.182481] mmput+0x2d3/0x390 [ 462.182517] do_exit+0x79d/0x2970 [ 462.182543] ? signal_wake_up_state+0x85/0x120 [ 462.182580] ? zap_other_threads+0x2b9/0x3a0 [ 462.182611] ? __pfx_do_exit+0x10/0x10 [ 462.182636] ? do_group_exit+0x1c3/0x2a0 [ 462.182662] ? lock_release+0xc8/0x290 [ 462.182694] do_group_exit+0xd3/0x2a0 [ 462.182724] __x64_sys_exit_group+0x3e/0x50 [ 462.182751] x64_sys_call+0x18c5/0x18d0 [ 462.182783] do_syscall_64+0xbf/0x360 [ 462.182812] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 462.182834] RIP: 0033:0x7f94594c7b19 [ 462.182851] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 462.182861] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 462.182889] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 462.182904] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 462.182919] RBP: 0000000000000000 R08: 0000001b2cd22be4 R09: 0000000000000000 [ 462.182933] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 462.182946] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 462.182977] [ 462.182984] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 462.182997] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 462.183011] kmemleak: min_count = 1 [ 462.183018] kmemleak: count = 1 [ 462.183025] kmemleak: flags = 0x21 [ 462.183033] kmemleak: checksum = 0 [ 462.183040] kmemleak: backtrace: [ 462.183047] pcpu_alloc_noprof+0x87a/0x1170 [ 462.183076] fib_nh_common_init+0x30/0xd0 [ 462.183099] fib6_nh_init+0x968/0x1a00 [ 462.183118] ip6_route_info_create_nh+0x530/0xf80 [ 462.183138] ip6_route_add.part.0+0x59/0x170 [ 462.183158] ip6_route_add+0x48/0x60 [ 462.183175] addrconf_add_mroute+0x12d/0x190 [ 462.183196] addrconf_add_dev+0x148/0x1c0 [ 462.183221] addrconf_dev_config+0x1e9/0x430 [ 462.183249] addrconf_notify+0xa70/0x1920 [ 462.183280] notifier_call_chain+0xc0/0x360 [ 462.183299] call_netdevice_notifiers_info+0xbe/0x140 [ 462.183321] netif_state_change+0x157/0x330 [ 462.183339] linkwatch_do_dev+0x111/0x150 [ 462.183358] __linkwatch_run_queue+0x2ab/0x710 [ 462.183378] linkwatch_event+0x4e/0x70 14:16:02 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(0xffffffffffffffff, 0x0, 0x4014) socket(0xa, 0x5, 0x2b1b) 14:16:02 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:16:02 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={0x0}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:16:02 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40), 0x0, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:16:02 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:16:02 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0, 0x1, 0x0, 0x0, 0x10000000}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:16:02 executing program 7: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000880)={0x14}, 0x14}}, 0x0) socket(0x0, 0x5, 0x2b1b) 14:16:02 executing program 6: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair(0x0, 0x4, 0x3, &(0x7f0000001040)) 14:16:02 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, 0x0, 0x0) socket(0xa, 0x5, 0x2b1b) [ 469.840526] loop2: detected capacity change from 0 to 264192 [ 469.844997] loop0: detected capacity change from 0 to 264192 [ 469.858425] vfat: Unknown parameter 'obj_user' [ 469.868310] vfat: Unknown parameter 'obj_user' 14:16:02 executing program 6: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair(0x0, 0x0, 0x3, &(0x7f0000001040)) 14:16:02 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) [ 469.948688] kmemleak: Found object by alias at 0x607f1a638234 [ 469.948719] CPU: 1 UID: 0 PID: 6080 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 469.948754] Tainted: [W]=WARN [ 469.948761] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 469.948775] Call Trace: [ 469.948788] [ 469.948797] dump_stack_lvl+0xca/0x120 [ 469.948839] __lookup_object+0x94/0xb0 [ 469.948869] delete_object_full+0x27/0x70 [ 469.948900] free_percpu+0x30/0x1160 [ 469.948930] ? arch_uprobe_clear_state+0x16/0x140 [ 469.948969] futex_hash_free+0x38/0xc0 [ 469.948994] mmput+0x2d3/0x390 [ 469.949030] do_exit+0x79d/0x2970 [ 469.949055] ? signal_wake_up_state+0x85/0x120 [ 469.949085] ? zap_other_threads+0x2b9/0x3a0 [ 469.949116] ? __pfx_do_exit+0x10/0x10 [ 469.949141] ? do_group_exit+0x1c3/0x2a0 [ 469.949167] ? lock_release+0xc8/0x290 [ 469.949199] do_group_exit+0xd3/0x2a0 [ 469.949228] __x64_sys_exit_group+0x3e/0x50 [ 469.949255] x64_sys_call+0x18c5/0x18d0 [ 469.949285] do_syscall_64+0xbf/0x360 [ 469.949307] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 469.949329] RIP: 0033:0x7f94594c7b19 [ 469.949346] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 469.949356] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 469.949378] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 469.949393] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 469.949408] RBP: 0000000000000000 R08: 0000001b2cd231e8 R09: 0000000000000000 [ 469.949421] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 469.949435] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 469.949466] [ 469.949473] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 469.949486] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 469.949499] kmemleak: min_count = 1 [ 469.949507] kmemleak: count = 1 [ 469.949514] kmemleak: flags = 0x21 [ 469.949522] kmemleak: checksum = 0 [ 469.949529] kmemleak: backtrace: [ 469.949535] pcpu_alloc_noprof+0x87a/0x1170 [ 469.949564] fib_nh_common_init+0x30/0xd0 [ 469.949587] fib6_nh_init+0x968/0x1a00 [ 469.949607] ip6_route_info_create_nh+0x530/0xf80 [ 469.949627] ip6_route_add.part.0+0x59/0x170 [ 469.949646] ip6_route_add+0x48/0x60 [ 469.949664] addrconf_add_mroute+0x12d/0x190 [ 469.949685] addrconf_add_dev+0x148/0x1c0 [ 469.949711] addrconf_dev_config+0x1e9/0x430 [ 469.949741] addrconf_notify+0xa70/0x1920 [ 469.949771] notifier_call_chain+0xc0/0x360 [ 469.949791] call_netdevice_notifiers_info+0xbe/0x140 [ 469.949812] netif_state_change+0x157/0x330 [ 469.949830] linkwatch_do_dev+0x111/0x150 [ 469.949850] __linkwatch_run_queue+0x2ab/0x710 [ 469.949870] linkwatch_event+0x4e/0x70 14:16:02 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}, 0x1, 0x0, 0x0, 0x10000000}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:16:02 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, 0x0, 0x0) socket(0x0, 0x5, 0x2b1b) [ 470.095537] loop0: detected capacity change from 0 to 264192 [ 470.106248] vfat: Unknown parameter 'obj_user' 14:16:11 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, 0x0, 0x0) socket(0x0, 0x5, 0x2b1b) 14:16:11 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}, 0x1, 0x0, 0x0, 0x10000000}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:16:11 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:16:11 executing program 6: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair(0x0, 0x0, 0x0, &(0x7f0000001040)) 14:16:11 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e892", 0x25, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:16:11 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:16:11 executing program 7: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000880)={0x14}, 0x14}}, 0x0) socket(0xa, 0x0, 0x2b1b) 14:16:11 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x0, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 478.511829] loop2: detected capacity change from 0 to 264192 [ 478.514175] loop0: detected capacity change from 0 to 264192 [ 478.534405] vfat: Unknown parameter 'obj_user' [ 478.536022] vfat: Unknown parameter 'obj_user' [ 478.633324] kmemleak: Found object by alias at 0x607f1a638234 [ 478.633355] CPU: 1 UID: 0 PID: 6114 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 478.633391] Tainted: [W]=WARN [ 478.633398] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 478.633412] Call Trace: [ 478.633419] [ 478.633428] dump_stack_lvl+0xca/0x120 [ 478.633470] __lookup_object+0x94/0xb0 [ 478.633502] delete_object_full+0x27/0x70 [ 478.633534] free_percpu+0x30/0x1160 [ 478.633565] ? arch_uprobe_clear_state+0x16/0x140 [ 478.633612] futex_hash_free+0x38/0xc0 [ 478.633639] mmput+0x2d3/0x390 [ 478.633675] do_exit+0x79d/0x2970 [ 478.633701] ? signal_wake_up_state+0x85/0x120 [ 478.633731] ? zap_other_threads+0x2b9/0x3a0 [ 478.633763] ? __pfx_do_exit+0x10/0x10 [ 478.633788] ? do_group_exit+0x1c3/0x2a0 [ 478.633815] ? lock_release+0xc8/0x290 [ 478.633847] do_group_exit+0xd3/0x2a0 [ 478.633877] __x64_sys_exit_group+0x3e/0x50 [ 478.633905] x64_sys_call+0x18c5/0x18d0 [ 478.633935] do_syscall_64+0xbf/0x360 [ 478.633957] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 478.633979] RIP: 0033:0x7f94594c7b19 [ 478.633996] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 478.634006] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 478.634028] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 478.634044] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 478.634057] RBP: 0000000000000000 R08: 0000001b2cd23768 R09: 0000000000000000 [ 478.634072] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 478.634086] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 478.634118] [ 478.634126] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 478.634139] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 478.634152] kmemleak: min_count = 1 [ 478.634160] kmemleak: count = 1 [ 478.634167] kmemleak: flags = 0x21 [ 478.634174] kmemleak: checksum = 0 [ 478.634182] kmemleak: backtrace: [ 478.634188] pcpu_alloc_noprof+0x87a/0x1170 [ 478.634218] fib_nh_common_init+0x30/0xd0 [ 478.634241] fib6_nh_init+0x968/0x1a00 [ 478.634260] ip6_route_info_create_nh+0x530/0xf80 [ 478.634281] ip6_route_add.part.0+0x59/0x170 [ 478.634300] ip6_route_add+0x48/0x60 [ 478.634318] addrconf_add_mroute+0x12d/0x190 [ 478.634339] addrconf_add_dev+0x148/0x1c0 [ 478.634365] addrconf_dev_config+0x1e9/0x430 [ 478.634393] addrconf_notify+0xa70/0x1920 [ 478.634425] notifier_call_chain+0xc0/0x360 [ 478.634445] call_netdevice_notifiers_info+0xbe/0x140 [ 478.634467] netif_state_change+0x157/0x330 [ 478.634484] linkwatch_do_dev+0x111/0x150 [ 478.634504] __linkwatch_run_queue+0x2ab/0x710 [ 478.634524] linkwatch_event+0x4e/0x70 14:16:19 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, 0x0, 0x0) socket(0x0, 0x5, 0x2b1b) 14:16:19 executing program 7: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000880)={0x14}, 0x14}}, 0x0) socket(0xa, 0x0, 0x2b1b) 14:16:19 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:16:19 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:16:19 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:16:19 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x0, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:16:19 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:16:19 executing program 6: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair(0x0, 0x0, 0x0, &(0x7f0000001040)) [ 486.872273] loop0: detected capacity change from 0 to 264192 [ 486.875131] vfat: Unknown parameter 'obj_user' [ 486.947053] loop2: detected capacity change from 0 to 264192 14:16:19 executing program 7: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000880)={0x14}, 0x14}}, 0x0) socket(0xa, 0x0, 0x2b1b) [ 486.972311] vfat: Unknown parameter 'obj_user' 14:16:19 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:16:19 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:16:19 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, 0x0, 0x0) socket(0xa, 0x0, 0x2b1b) [ 487.055804] kmemleak: Found object by alias at 0x607f1a638234 [ 487.055825] CPU: 0 UID: 0 PID: 6162 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 487.055844] Tainted: [W]=WARN [ 487.055848] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 487.055856] Call Trace: [ 487.055860] [ 487.055865] dump_stack_lvl+0xca/0x120 [ 487.055894] __lookup_object+0x94/0xb0 [ 487.055912] delete_object_full+0x27/0x70 [ 487.055929] free_percpu+0x30/0x1160 [ 487.055945] ? arch_uprobe_clear_state+0x16/0x140 [ 487.055966] futex_hash_free+0x38/0xc0 [ 487.055981] mmput+0x2d3/0x390 [ 487.056000] do_exit+0x79d/0x2970 [ 487.056014] ? lock_release+0xc8/0x290 [ 487.056031] ? __pfx_do_exit+0x10/0x10 [ 487.056045] ? find_held_lock+0x2b/0x80 [ 487.056062] ? get_signal+0x835/0x2340 [ 487.056082] do_group_exit+0xd3/0x2a0 [ 487.056097] get_signal+0x2315/0x2340 [ 487.056119] ? __pfx_get_signal+0x10/0x10 [ 487.056136] ? do_futex+0x135/0x370 [ 487.056150] ? __pfx_do_futex+0x10/0x10 [ 487.056165] arch_do_signal_or_restart+0x80/0x790 [ 487.056183] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 487.056199] ? __x64_sys_futex+0x1c9/0x4d0 [ 487.056211] ? __x64_sys_futex+0x1d2/0x4d0 [ 487.056224] ? exc_page_fault+0xb0/0x180 [ 487.056242] ? __pfx___x64_sys_futex+0x10/0x10 [ 487.056260] exit_to_user_mode_loop+0x8b/0x110 [ 487.056274] do_syscall_64+0x2f7/0x360 [ 487.056286] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.056299] RIP: 0033:0x7f94594c7b19 [ 487.056308] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 487.056313] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 487.056325] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 487.056333] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 487.056340] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 487.056348] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 487.056355] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 487.056371] [ 487.056376] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 487.056382] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 487.056389] kmemleak: min_count = 1 [ 487.056393] kmemleak: count = 1 [ 487.056397] kmemleak: flags = 0x21 [ 487.056401] kmemleak: checksum = 0 [ 487.056405] kmemleak: backtrace: [ 487.056409] pcpu_alloc_noprof+0x87a/0x1170 [ 487.056424] fib_nh_common_init+0x30/0xd0 [ 487.056437] fib6_nh_init+0x968/0x1a00 [ 487.056447] ip6_route_info_create_nh+0x530/0xf80 [ 487.056457] ip6_route_add.part.0+0x59/0x170 [ 487.056467] ip6_route_add+0x48/0x60 [ 487.056476] addrconf_add_mroute+0x12d/0x190 [ 487.056487] addrconf_add_dev+0x148/0x1c0 [ 487.056501] addrconf_dev_config+0x1e9/0x430 [ 487.056522] addrconf_notify+0xa70/0x1920 [ 487.056542] notifier_call_chain+0xc0/0x360 [ 487.056553] call_netdevice_notifiers_info+0xbe/0x140 [ 487.056565] netif_state_change+0x157/0x330 [ 487.056574] linkwatch_do_dev+0x111/0x150 [ 487.056585] __linkwatch_run_queue+0x2ab/0x710 [ 487.056595] linkwatch_event+0x4e/0x70 14:16:19 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40), 0x0, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:16:19 executing program 6: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair(0x0, 0x0, 0x0, 0x0) 14:16:19 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, 0x0, 0x0) socket(0xa, 0x0, 0x2b1b) [ 487.162614] loop0: detected capacity change from 0 to 264192 [ 487.177031] vfat: Unknown parameter 'obj_user' 14:16:19 executing program 7: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000880)={0x14}, 0x14}}, 0x0) socket(0xa, 0x5, 0x0) 14:16:19 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:16:19 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x0, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:16:20 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 487.257511] loop2: detected capacity change from 0 to 264192 14:16:20 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 487.289070] vfat: Unknown parameter 'obj_user' [ 487.378891] kmemleak: Found object by alias at 0x607f1a638234 [ 487.378911] CPU: 0 UID: 0 PID: 6182 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 487.378931] Tainted: [W]=WARN [ 487.378935] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 487.378943] Call Trace: [ 487.378947] [ 487.378952] dump_stack_lvl+0xca/0x120 [ 487.378982] __lookup_object+0x94/0xb0 [ 487.379000] delete_object_full+0x27/0x70 [ 487.379017] free_percpu+0x30/0x1160 [ 487.379034] ? arch_uprobe_clear_state+0x16/0x140 [ 487.379054] futex_hash_free+0x38/0xc0 [ 487.379074] mmput+0x2d3/0x390 [ 487.379092] do_exit+0x79d/0x2970 [ 487.379106] ? signal_wake_up_state+0x85/0x120 [ 487.379122] ? zap_other_threads+0x2b9/0x3a0 [ 487.379138] ? __pfx_do_exit+0x10/0x10 [ 487.379151] ? do_group_exit+0x1c3/0x2a0 [ 487.379164] ? lock_release+0xc8/0x290 [ 487.379182] do_group_exit+0xd3/0x2a0 [ 487.379196] __x64_sys_exit_group+0x3e/0x50 [ 487.379210] x64_sys_call+0x18c5/0x18d0 [ 487.379226] do_syscall_64+0xbf/0x360 [ 487.379238] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 487.379250] RIP: 0033:0x7f94594c7b19 [ 487.379259] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 487.379265] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 487.379277] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 487.379285] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 487.379292] RBP: 0000000000000000 R08: 0000001b2cd232c4 R09: 0000000000000000 [ 487.379300] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 487.379307] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 487.379323] [ 487.379327] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 487.379334] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 487.379341] kmemleak: min_count = 1 [ 487.379345] kmemleak: count = 1 [ 487.379348] kmemleak: flags = 0x21 [ 487.379352] kmemleak: checksum = 0 [ 487.379356] kmemleak: backtrace: [ 487.379360] pcpu_alloc_noprof+0x87a/0x1170 [ 487.379375] fib_nh_common_init+0x30/0xd0 [ 487.379387] fib6_nh_init+0x968/0x1a00 [ 487.379398] ip6_route_info_create_nh+0x530/0xf80 [ 487.379408] ip6_route_add.part.0+0x59/0x170 [ 487.379418] ip6_route_add+0x48/0x60 [ 487.379427] addrconf_add_mroute+0x12d/0x190 [ 487.379438] addrconf_add_dev+0x148/0x1c0 [ 487.379451] addrconf_dev_config+0x1e9/0x430 [ 487.379465] addrconf_notify+0xa70/0x1920 [ 487.379481] notifier_call_chain+0xc0/0x360 [ 487.379492] call_netdevice_notifiers_info+0xbe/0x140 [ 487.379504] netif_state_change+0x157/0x330 [ 487.379513] linkwatch_do_dev+0x111/0x150 [ 487.379524] __linkwatch_run_queue+0x2ab/0x710 [ 487.379534] linkwatch_event+0x4e/0x70 [ 487.412462] loop0: detected capacity change from 0 to 264192 [ 487.422018] vfat: Unknown parameter 'obj_user' 14:16:29 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40), 0x0, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:16:29 executing program 7: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000880)={0x14}, 0x14}}, 0x0) socket(0xa, 0x5, 0x0) 14:16:29 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:16:29 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:16:29 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x0, 0x70bd25, 0x6, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:16:29 executing program 6: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair(0x0, 0x0, 0x0, 0x0) 14:16:29 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x0, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:16:29 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, 0x0, 0x0) socket(0xa, 0x0, 0x2b1b) [ 496.400018] loop0: detected capacity change from 0 to 264192 [ 496.406495] vfat: Unknown parameter 'obj_user' [ 496.410387] loop2: detected capacity change from 0 to 264192 [ 496.426650] vfat: Unknown parameter 'obj_user' 14:16:29 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:16:29 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x0, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 496.514871] loop0: detected capacity change from 0 to 264192 [ 496.522768] vfat: Unknown parameter 'obj_user' 14:16:29 executing program 6: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair(0x0, 0x0, 0x0, 0x0) [ 496.553552] kmemleak: Found object by alias at 0x607f1a638234 [ 496.553572] CPU: 0 UID: 0 PID: 6211 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 496.553590] Tainted: [W]=WARN [ 496.553594] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 496.553601] Call Trace: [ 496.553605] [ 496.553610] dump_stack_lvl+0xca/0x120 [ 496.553635] __lookup_object+0x94/0xb0 [ 496.553651] delete_object_full+0x27/0x70 [ 496.553667] free_percpu+0x30/0x1160 [ 496.553683] ? arch_uprobe_clear_state+0x16/0x140 [ 496.553703] futex_hash_free+0x38/0xc0 [ 496.553717] mmput+0x2d3/0x390 [ 496.553735] do_exit+0x79d/0x2970 [ 496.553749] ? signal_wake_up_state+0x85/0x120 [ 496.553764] ? zap_other_threads+0x2b9/0x3a0 [ 496.553780] ? __pfx_do_exit+0x10/0x10 [ 496.553792] ? do_group_exit+0x1c3/0x2a0 [ 496.553806] ? lock_release+0xc8/0x290 [ 496.553822] do_group_exit+0xd3/0x2a0 [ 496.553837] __x64_sys_exit_group+0x3e/0x50 [ 496.553852] x64_sys_call+0x18c5/0x18d0 [ 496.553868] do_syscall_64+0xbf/0x360 [ 496.553882] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.553894] RIP: 0033:0x7f94594c7b19 [ 496.553903] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 496.553908] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 496.553920] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 496.553927] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 496.553934] RBP: 0000000000000000 R08: 0000001b2cd232ac R09: 0000000000000000 [ 496.553941] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 496.553948] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 496.553963] [ 496.553967] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 496.553974] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 496.553981] kmemleak: min_count = 1 [ 496.553984] kmemleak: count = 1 [ 496.553988] kmemleak: flags = 0x21 [ 496.553992] kmemleak: checksum = 0 [ 496.553996] kmemleak: backtrace: [ 496.553999] pcpu_alloc_noprof+0x87a/0x1170 [ 496.554014] fib_nh_common_init+0x30/0xd0 [ 496.554026] fib6_nh_init+0x968/0x1a00 [ 496.554037] ip6_route_info_create_nh+0x530/0xf80 [ 496.554047] ip6_route_add.part.0+0x59/0x170 [ 496.554057] ip6_route_add+0x48/0x60 [ 496.554066] addrconf_add_mroute+0x12d/0x190 [ 496.554077] addrconf_add_dev+0x148/0x1c0 [ 496.554089] addrconf_dev_config+0x1e9/0x430 [ 496.554103] addrconf_notify+0xa70/0x1920 [ 496.554119] notifier_call_chain+0xc0/0x360 [ 496.554129] call_netdevice_notifiers_info+0xbe/0x140 [ 496.554141] netif_state_change+0x157/0x330 [ 496.554150] linkwatch_do_dev+0x111/0x150 [ 496.554160] __linkwatch_run_queue+0x2ab/0x710 [ 496.554171] linkwatch_event+0x4e/0x70 14:16:29 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:16:29 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, 0x0, 0x0) socket(0xa, 0x5, 0x0) 14:16:29 executing program 7: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, &(0x7f0000000980)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000880)={0x14}, 0x14}}, 0x0) socket(0xa, 0x5, 0x0) [ 496.661536] loop0: detected capacity change from 0 to 264192 [ 496.667204] vfat: Unknown parameter 'obj_user' 14:16:29 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40), 0x0, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:16:29 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x0, 0x70bd25, 0x6, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:16:29 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:16:29 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 496.744075] loop2: detected capacity change from 0 to 264192 [ 496.752773] vfat: Unknown parameter 'obj_user' [ 496.777837] loop0: detected capacity change from 0 to 264192 [ 496.803309] kmemleak: Found object by alias at 0x607f1a638234 [ 496.803326] CPU: 0 UID: 0 PID: 6252 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 496.803347] Tainted: [W]=WARN [ 496.803351] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 496.803360] Call Trace: [ 496.803365] [ 496.803370] dump_stack_lvl+0xca/0x120 [ 496.803395] __lookup_object+0x94/0xb0 [ 496.803411] delete_object_full+0x27/0x70 [ 496.803427] free_percpu+0x30/0x1160 [ 496.803444] ? arch_uprobe_clear_state+0x16/0x140 [ 496.803468] futex_hash_free+0x38/0xc0 [ 496.803482] mmput+0x2d3/0x390 [ 496.803500] do_exit+0x79d/0x2970 [ 496.803513] ? signal_wake_up_state+0x85/0x120 [ 496.803529] ? zap_other_threads+0x2b9/0x3a0 [ 496.803545] ? __pfx_do_exit+0x10/0x10 [ 496.803558] ? do_group_exit+0x1c3/0x2a0 [ 496.803571] ? lock_release+0xc8/0x290 [ 496.803588] do_group_exit+0xd3/0x2a0 [ 496.803602] __x64_sys_exit_group+0x3e/0x50 [ 496.803616] x64_sys_call+0x18c5/0x18d0 [ 496.803631] do_syscall_64+0xbf/0x360 [ 496.803643] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 496.803654] RIP: 0033:0x7f94594c7b19 [ 496.803663] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 496.803668] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 496.803679] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 496.803687] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 496.803694] RBP: 0000000000000000 R08: 0000001b2cd23250 R09: 0000000000000000 [ 496.803701] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 496.803707] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 496.803723] [ 496.803727] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 496.803733] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 496.803740] kmemleak: min_count = 1 [ 496.803744] kmemleak: count = 1 [ 496.803748] kmemleak: flags = 0x21 [ 496.803751] kmemleak: checksum = 0 [ 496.803755] kmemleak: backtrace: [ 496.803759] pcpu_alloc_noprof+0x87a/0x1170 [ 496.803774] fib_nh_common_init+0x30/0xd0 [ 496.803785] fib6_nh_init+0x968/0x1a00 [ 496.803796] ip6_route_info_create_nh+0x530/0xf80 [ 496.803806] ip6_route_add.part.0+0x59/0x170 [ 496.803815] ip6_route_add+0x48/0x60 [ 496.803824] addrconf_add_mroute+0x12d/0x190 [ 496.803835] addrconf_add_dev+0x148/0x1c0 [ 496.803848] addrconf_dev_config+0x1e9/0x430 [ 496.803862] addrconf_notify+0xa70/0x1920 [ 496.803878] notifier_call_chain+0xc0/0x360 [ 496.803888] call_netdevice_notifiers_info+0xbe/0x140 [ 496.803900] netif_state_change+0x157/0x330 [ 496.803909] linkwatch_do_dev+0x111/0x150 [ 496.803920] __linkwatch_run_queue+0x2ab/0x710 [ 496.803930] linkwatch_event+0x4e/0x70 14:16:38 executing program 6: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair(0x0, 0x0, 0x0, 0x0) 14:16:38 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:16:38 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x0, 0x0, 0x6, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:16:38 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:16:38 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:16:38 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:16:38 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x0, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:16:38 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, 0x0, 0x0) socket(0xa, 0x5, 0x0) 14:16:38 executing program 6: socketpair(0x0, 0x0, 0x0, 0x0) [ 506.213363] loop7: detected capacity change from 0 to 264192 [ 506.220927] loop0: detected capacity change from 0 to 264192 [ 506.225843] vfat: Unknown parameter 'obj_user' [ 506.330330] kmemleak: Found object by alias at 0x607f1a638234 14:16:39 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 506.330364] CPU: 0 UID: 0 PID: 6281 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 506.330403] Tainted: [W]=WARN [ 506.330411] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 506.330426] Call Trace: [ 506.330434] [ 506.330443] dump_stack_lvl+0xca/0x120 [ 506.330489] __lookup_object+0x94/0xb0 [ 506.330522] delete_object_full+0x27/0x70 [ 506.330556] free_percpu+0x30/0x1160 [ 506.330598] ? arch_uprobe_clear_state+0x16/0x140 [ 506.330639] futex_hash_free+0x38/0xc0 [ 506.330666] mmput+0x2d3/0x390 [ 506.330705] do_exit+0x79d/0x2970 [ 506.330733] ? signal_wake_up_state+0x85/0x120 [ 506.330764] ? zap_other_threads+0x2b9/0x3a0 [ 506.330798] ? __pfx_do_exit+0x10/0x10 [ 506.330825] ? do_group_exit+0x1c3/0x2a0 [ 506.330854] ? lock_release+0xc8/0x290 [ 506.330889] do_group_exit+0xd3/0x2a0 [ 506.330920] __x64_sys_exit_group+0x3e/0x50 [ 506.330950] x64_sys_call+0x18c5/0x18d0 [ 506.330981] do_syscall_64+0xbf/0x360 [ 506.331005] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 506.331029] RIP: 0033:0x7f94594c7b19 [ 506.331047] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 506.331058] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 506.331083] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 506.331099] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 506.331114] RBP: 0000000000000000 R08: 0000001b2cd2366c R09: 0000000000000000 [ 506.331129] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 506.331143] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 506.331176] [ 506.331184] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 506.331198] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 506.331213] kmemleak: min_count = 1 [ 506.331222] kmemleak: count = 1 [ 506.331230] kmemleak: flags = 0x21 [ 506.331238] kmemleak: checksum = 0 [ 506.331246] kmemleak: backtrace: [ 506.331252] pcpu_alloc_noprof+0x87a/0x1170 [ 506.331284] fib_nh_common_init+0x30/0xd0 [ 506.331309] fib6_nh_init+0x968/0x1a00 [ 506.331331] ip6_route_info_create_nh+0x530/0xf80 [ 506.331353] ip6_route_add.part.0+0x59/0x170 [ 506.331373] ip6_route_add+0x48/0x60 [ 506.331393] addrconf_add_mroute+0x12d/0x190 [ 506.331415] addrconf_add_dev+0x148/0x1c0 [ 506.331442] addrconf_dev_config+0x1e9/0x430 [ 506.331472] addrconf_notify+0xa70/0x1920 [ 506.331506] notifier_call_chain+0xc0/0x360 [ 506.331526] call_netdevice_notifiers_info+0xbe/0x140 [ 506.331550] netif_state_change+0x157/0x330 [ 506.331569] linkwatch_do_dev+0x111/0x150 [ 506.331590] __linkwatch_run_queue+0x2ab/0x710 [ 506.331612] linkwatch_event+0x4e/0x70 14:16:48 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:16:48 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:16:48 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:16:48 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000800), r0) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r0, 0x0, 0x0) socket(0xa, 0x5, 0x0) 14:16:48 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(0x0, r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:16:48 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:16:48 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 515.720085] loop7: detected capacity change from 0 to 264192 [ 515.720966] loop0: detected capacity change from 0 to 264192 14:16:48 executing program 6: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 515.769052] vfat: Unknown parameter 'obj_user' 14:16:48 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), 0x0, 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 515.803288] loop6: detected capacity change from 0 to 264192 14:16:48 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 515.866151] kmemleak: Found object by alias at 0x607f1a638234 [ 515.866177] CPU: 0 UID: 0 PID: 6315 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 515.866200] Tainted: [W]=WARN [ 515.866205] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 515.866214] Call Trace: [ 515.866219] [ 515.866225] dump_stack_lvl+0xca/0x120 [ 515.866254] __lookup_object+0x94/0xb0 [ 515.866275] delete_object_full+0x27/0x70 [ 515.866294] free_percpu+0x30/0x1160 [ 515.866314] ? arch_uprobe_clear_state+0x16/0x140 [ 515.866338] futex_hash_free+0x38/0xc0 [ 515.866356] mmput+0x2d3/0x390 [ 515.866378] do_exit+0x79d/0x2970 [ 515.866395] ? signal_wake_up_state+0x85/0x120 [ 515.866414] ? zap_other_threads+0x2b9/0x3a0 [ 515.866434] ? __pfx_do_exit+0x10/0x10 [ 515.866449] ? do_group_exit+0x1c3/0x2a0 [ 515.866466] ? lock_release+0xc8/0x290 [ 515.866487] do_group_exit+0xd3/0x2a0 [ 515.866505] __x64_sys_exit_group+0x3e/0x50 [ 515.866522] x64_sys_call+0x18c5/0x18d0 [ 515.866541] do_syscall_64+0xbf/0x360 [ 515.866555] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 515.866575] RIP: 0033:0x7f94594c7b19 [ 515.866586] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 515.866592] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 515.866606] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 515.866616] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 515.866625] RBP: 0000000000000000 R08: 0000001b2cd23704 R09: 0000000000000000 [ 515.866634] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 515.866642] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 515.866661] [ 515.866666] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 515.866674] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 515.866683] kmemleak: min_count = 1 [ 515.866687] kmemleak: count = 1 [ 515.866692] kmemleak: flags = 0x21 [ 515.866697] kmemleak: checksum = 0 [ 515.866701] kmemleak: backtrace: [ 515.866706] pcpu_alloc_noprof+0x87a/0x1170 [ 515.866724] fib_nh_common_init+0x30/0xd0 [ 515.866739] fib6_nh_init+0x968/0x1a00 [ 515.866751] ip6_route_info_create_nh+0x530/0xf80 [ 515.866764] ip6_route_add.part.0+0x59/0x170 [ 515.866776] ip6_route_add+0x48/0x60 [ 515.866787] addrconf_add_mroute+0x12d/0x190 [ 515.866800] addrconf_add_dev+0x148/0x1c0 [ 515.866816] addrconf_dev_config+0x1e9/0x430 [ 515.866833] addrconf_notify+0xa70/0x1920 [ 515.866853] notifier_call_chain+0xc0/0x360 [ 515.866865] call_netdevice_notifiers_info+0xbe/0x140 [ 515.866879] netif_state_change+0x157/0x330 [ 515.866890] linkwatch_do_dev+0x111/0x150 [ 515.866903] __linkwatch_run_queue+0x2ab/0x710 [ 515.866916] linkwatch_event+0x4e/0x70 [ 515.917825] loop0: detected capacity change from 0 to 264192 [ 515.936626] loop7: detected capacity change from 0 to 264192 14:16:48 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:16:48 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), 0x0, 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:16:48 executing program 6: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:16:48 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(0x0, r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:16:48 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:16:48 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) [ 516.053764] loop6: detected capacity change from 0 to 264192 [ 516.083456] loop7: detected capacity change from 0 to 264192 14:16:48 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 516.145337] kmemleak: Found object by alias at 0x607f1a638234 [ 516.145358] CPU: 0 UID: 0 PID: 6350 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 516.145377] Tainted: [W]=WARN [ 516.145381] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 516.145389] Call Trace: [ 516.145393] [ 516.145398] dump_stack_lvl+0xca/0x120 [ 516.145424] __lookup_object+0x94/0xb0 [ 516.145441] delete_object_full+0x27/0x70 [ 516.145457] free_percpu+0x30/0x1160 [ 516.145473] ? arch_uprobe_clear_state+0x16/0x140 [ 516.145493] futex_hash_free+0x38/0xc0 [ 516.145508] mmput+0x2d3/0x390 [ 516.145526] do_exit+0x79d/0x2970 [ 516.145540] ? lock_release+0xc8/0x290 [ 516.145556] ? __pfx_do_exit+0x10/0x10 [ 516.145575] ? find_held_lock+0x2b/0x80 [ 516.145592] ? get_signal+0x835/0x2340 [ 516.145612] do_group_exit+0xd3/0x2a0 [ 516.145627] get_signal+0x2315/0x2340 [ 516.145650] ? __pfx_get_signal+0x10/0x10 [ 516.145665] ? do_futex+0x135/0x370 [ 516.145679] ? __pfx_do_futex+0x10/0x10 [ 516.145694] arch_do_signal_or_restart+0x80/0x790 [ 516.145711] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 516.145727] ? __x64_sys_futex+0x1c9/0x4d0 [ 516.145740] ? __x64_sys_futex+0x1d2/0x4d0 [ 516.145753] ? exc_page_fault+0xb0/0x180 [ 516.145769] ? __pfx___x64_sys_futex+0x10/0x10 [ 516.145788] exit_to_user_mode_loop+0x8b/0x110 [ 516.145801] do_syscall_64+0x2f7/0x360 [ 516.145812] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 516.145824] RIP: 0033:0x7f94594c7b19 [ 516.145833] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 516.145839] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 516.145850] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 516.145858] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 516.145865] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 516.145872] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 516.145879] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 516.145895] [ 516.145899] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 516.145906] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 516.145913] kmemleak: min_count = 1 [ 516.145917] kmemleak: count = 1 [ 516.145921] kmemleak: flags = 0x21 [ 516.145925] kmemleak: checksum = 0 [ 516.145928] kmemleak: backtrace: [ 516.145932] pcpu_alloc_noprof+0x87a/0x1170 [ 516.145947] fib_nh_common_init+0x30/0xd0 [ 516.145960] fib6_nh_init+0x968/0x1a00 [ 516.145970] ip6_route_info_create_nh+0x530/0xf80 [ 516.145981] ip6_route_add.part.0+0x59/0x170 [ 516.145990] ip6_route_add+0x48/0x60 [ 516.145999] addrconf_add_mroute+0x12d/0x190 [ 516.146010] addrconf_add_dev+0x148/0x1c0 [ 516.146023] addrconf_dev_config+0x1e9/0x430 [ 516.146037] addrconf_notify+0xa70/0x1920 [ 516.146053] notifier_call_chain+0xc0/0x360 [ 516.146063] call_netdevice_notifiers_info+0xbe/0x140 [ 516.146075] netif_state_change+0x157/0x330 [ 516.146084] linkwatch_do_dev+0x111/0x150 [ 516.146095] __linkwatch_run_queue+0x2ab/0x710 [ 516.146105] linkwatch_event+0x4e/0x70 14:16:48 executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:16:48 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(0x0, r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:16:48 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), 0x0, 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:16:48 executing program 6: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:16:48 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) [ 516.254145] loop0: detected capacity change from 0 to 264192 14:16:49 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) [ 516.293080] loop6: detected capacity change from 0 to 264192 [ 516.307228] loop7: detected capacity change from 0 to 264192 [ 516.386977] kmemleak: Found object by alias at 0x607f1a638234 [ 516.386995] CPU: 0 UID: 0 PID: 6374 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 516.387013] Tainted: [W]=WARN [ 516.387017] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 516.387024] Call Trace: [ 516.387028] [ 516.387033] dump_stack_lvl+0xca/0x120 [ 516.387058] __lookup_object+0x94/0xb0 [ 516.387075] delete_object_full+0x27/0x70 [ 516.387091] free_percpu+0x30/0x1160 [ 516.387107] ? arch_uprobe_clear_state+0x16/0x140 [ 516.387127] futex_hash_free+0x38/0xc0 [ 516.387141] mmput+0x2d3/0x390 [ 516.387159] do_exit+0x79d/0x2970 [ 516.387176] ? __pfx_do_exit+0x10/0x10 [ 516.387190] ? find_held_lock+0x2b/0x80 [ 516.387207] ? get_signal+0x835/0x2340 [ 516.387228] do_group_exit+0xd3/0x2a0 [ 516.387244] get_signal+0x2315/0x2340 [ 516.387264] ? put_task_stack+0xd2/0x240 [ 516.387278] ? __pfx_get_signal+0x10/0x10 [ 516.387294] ? __schedule+0xe91/0x3590 [ 516.387314] arch_do_signal_or_restart+0x80/0x790 [ 516.387331] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 516.387347] ? __x64_sys_futex+0x1c9/0x4d0 [ 516.387360] ? __x64_sys_futex+0x1d2/0x4d0 [ 516.387373] ? exc_page_fault+0xb0/0x180 [ 516.387389] ? __pfx___x64_sys_futex+0x10/0x10 [ 516.387407] exit_to_user_mode_loop+0x8b/0x110 [ 516.387420] do_syscall_64+0x2f7/0x360 [ 516.387431] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 516.387444] RIP: 0033:0x7f94594c7b19 [ 516.387452] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 516.387457] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 516.387468] RAX: 0000000000000001 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 516.387476] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f94595daf6c [ 516.387482] RBP: 00007f94595daf60 R08: 0000000000000058 R09: 0000000000000000 [ 516.387489] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007f94595daf6c [ 516.387497] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 516.387512] [ 516.387516] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 516.387523] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 516.387530] kmemleak: min_count = 1 [ 516.387534] kmemleak: count = 1 [ 516.387537] kmemleak: flags = 0x21 [ 516.387541] kmemleak: checksum = 0 [ 516.387545] kmemleak: backtrace: [ 516.387548] pcpu_alloc_noprof+0x87a/0x1170 [ 516.387563] fib_nh_common_init+0x30/0xd0 [ 516.387579] fib6_nh_init+0x968/0x1a00 [ 516.387589] ip6_route_info_create_nh+0x530/0xf80 [ 516.387599] ip6_route_add.part.0+0x59/0x170 [ 516.387608] ip6_route_add+0x48/0x60 [ 516.387617] addrconf_add_mroute+0x12d/0x190 [ 516.387628] addrconf_add_dev+0x148/0x1c0 [ 516.387641] addrconf_dev_config+0x1e9/0x430 [ 516.387655] addrconf_notify+0xa70/0x1920 [ 516.387670] notifier_call_chain+0xc0/0x360 [ 516.387681] call_netdevice_notifiers_info+0xbe/0x140 [ 516.387692] netif_state_change+0x157/0x330 [ 516.387701] linkwatch_do_dev+0x111/0x150 [ 516.387711] __linkwatch_run_queue+0x2ab/0x710 [ 516.387721] linkwatch_event+0x4e/0x70 14:16:57 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:16:57 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:16:57 executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:16:57 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), 0xffffffffffffffff) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:16:57 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:16:57 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) 14:16:57 executing program 6: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) 14:16:57 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, 0x0) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) [ 525.175013] loop0: detected capacity change from 0 to 264192 [ 525.192488] kmemleak: Found object by alias at 0x607f1a638234 [ 525.192508] CPU: 0 UID: 0 PID: 6389 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 525.192526] Tainted: [W]=WARN [ 525.192530] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 525.192537] Call Trace: [ 525.192541] [ 525.192546] dump_stack_lvl+0xca/0x120 [ 525.192570] __lookup_object+0x94/0xb0 [ 525.192587] delete_object_full+0x27/0x70 [ 525.192602] free_percpu+0x30/0x1160 [ 525.192619] ? arch_uprobe_clear_state+0x16/0x140 [ 525.192638] futex_hash_free+0x38/0xc0 [ 525.192653] mmput+0x2d3/0x390 [ 525.192671] do_exit+0x79d/0x2970 [ 525.192684] ? signal_wake_up_state+0x85/0x120 [ 525.192700] ? zap_other_threads+0x2b9/0x3a0 [ 525.192715] ? __pfx_do_exit+0x10/0x10 [ 525.192728] ? do_group_exit+0x1c3/0x2a0 [ 525.192741] ? lock_release+0xc8/0x290 [ 525.192758] do_group_exit+0xd3/0x2a0 [ 525.192773] __x64_sys_exit_group+0x3e/0x50 [ 525.192786] x64_sys_call+0x18c5/0x18d0 [ 525.192801] do_syscall_64+0xbf/0x360 [ 525.192813] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 525.192824] RIP: 0033:0x7f94594c7b19 [ 525.192833] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 525.192839] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 525.192852] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 525.192861] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 525.192869] RBP: 0000000000000000 R08: 0000001b2cd26364 R09: 0000000000000000 [ 525.192875] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 525.192882] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 525.192897] [ 525.192901] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 525.192908] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 525.192914] kmemleak: min_count = 1 [ 525.192918] kmemleak: count = 1 [ 525.192922] kmemleak: flags = 0x21 [ 525.192925] kmemleak: checksum = 0 [ 525.192929] kmemleak: backtrace: [ 525.192933] pcpu_alloc_noprof+0x87a/0x1170 [ 525.192947] fib_nh_common_init+0x30/0xd0 [ 525.192959] fib6_nh_init+0x968/0x1a00 [ 525.192969] ip6_route_info_create_nh+0x530/0xf80 [ 525.192979] ip6_route_add.part.0+0x59/0x170 [ 525.192989] ip6_route_add+0x48/0x60 [ 525.192998] addrconf_add_mroute+0x12d/0x190 [ 525.193008] addrconf_add_dev+0x148/0x1c0 [ 525.193021] addrconf_dev_config+0x1e9/0x430 [ 525.193035] addrconf_notify+0xa70/0x1920 [ 525.193051] notifier_call_chain+0xc0/0x360 [ 525.193061] call_netdevice_notifiers_info+0xbe/0x140 [ 525.193073] netif_state_change+0x157/0x330 [ 525.193082] linkwatch_do_dev+0x111/0x150 [ 525.193092] __linkwatch_run_queue+0x2ab/0x710 [ 525.193102] linkwatch_event+0x4e/0x70 [ 525.202690] loop7: detected capacity change from 0 to 264192 [ 525.226242] vfat: Unknown parameter 'obj_user' [ 525.276349] loop6: detected capacity change from 0 to 264192 14:17:06 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)={[], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:17:06 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x20, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:17:06 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), 0xffffffffffffffff) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:17:06 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:17:06 executing program 6: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) 14:17:06 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:17:06 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:17:06 executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 533.611658] loop6: detected capacity change from 0 to 264192 [ 533.619988] vfat: Unknown parameter 'obj_user' [ 533.639828] loop0: detected capacity change from 0 to 264192 [ 533.667817] vfat: Unknown parameter 'obj_user' [ 533.670152] loop7: detected capacity change from 0 to 264192 14:17:06 executing program 6: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) [ 533.720423] kmemleak: Found object by alias at 0x607f1a638234 [ 533.720452] CPU: 0 UID: 0 PID: 6424 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 533.720486] Tainted: [W]=WARN [ 533.720493] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 533.720507] Call Trace: [ 533.720514] [ 533.720522] dump_stack_lvl+0xca/0x120 [ 533.720572] __lookup_object+0x94/0xb0 [ 533.720603] delete_object_full+0x27/0x70 [ 533.720632] free_percpu+0x30/0x1160 [ 533.720662] ? arch_uprobe_clear_state+0x16/0x140 [ 533.720698] futex_hash_free+0x38/0xc0 [ 533.720724] mmput+0x2d3/0x390 [ 533.720757] do_exit+0x79d/0x2970 [ 533.720782] ? signal_wake_up_state+0x85/0x120 [ 533.720810] ? zap_other_threads+0x2b9/0x3a0 [ 533.720840] ? __pfx_do_exit+0x10/0x10 [ 533.720863] ? do_group_exit+0x1c3/0x2a0 [ 533.720888] ? lock_release+0xc8/0x290 [ 533.720918] do_group_exit+0xd3/0x2a0 [ 533.720945] __x64_sys_exit_group+0x3e/0x50 [ 533.720971] x64_sys_call+0x18c5/0x18d0 [ 533.720998] do_syscall_64+0xbf/0x360 [ 533.721019] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 533.721040] RIP: 0033:0x7f94594c7b19 [ 533.721056] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 533.721066] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 533.721086] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 533.721100] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 533.721113] RBP: 0000000000000000 R08: 0000001b2cd23764 R09: 0000000000000000 [ 533.721126] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 533.721139] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 533.721168] [ 533.721176] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 533.721188] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 533.721200] kmemleak: min_count = 1 [ 533.721208] kmemleak: count = 1 [ 533.721215] kmemleak: flags = 0x21 [ 533.721221] kmemleak: checksum = 0 [ 533.721228] kmemleak: backtrace: [ 533.721235] pcpu_alloc_noprof+0x87a/0x1170 [ 533.721277] fib_nh_common_init+0x30/0xd0 [ 533.721300] fib6_nh_init+0x968/0x1a00 [ 533.721318] ip6_route_info_create_nh+0x530/0xf80 [ 533.721337] ip6_route_add.part.0+0x59/0x170 [ 533.721355] ip6_route_add+0x48/0x60 [ 533.721371] addrconf_add_mroute+0x12d/0x190 [ 533.721392] addrconf_add_dev+0x148/0x1c0 [ 533.721416] addrconf_dev_config+0x1e9/0x430 [ 533.721441] addrconf_notify+0xa70/0x1920 [ 533.721470] notifier_call_chain+0xc0/0x360 [ 533.721490] call_netdevice_notifiers_info+0xbe/0x140 [ 533.721510] netif_state_change+0x157/0x330 [ 533.721527] linkwatch_do_dev+0x111/0x150 [ 533.721546] __linkwatch_run_queue+0x2ab/0x710 [ 533.721565] linkwatch_event+0x4e/0x70 14:17:06 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:17:06 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:17:06 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x20, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:17:06 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), 0xffffffffffffffff) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) [ 533.906366] loop0: detected capacity change from 0 to 264192 [ 533.916858] vfat: Unknown parameter 'obj_user' [ 533.921057] loop6: detected capacity change from 0 to 264192 14:17:06 executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)) 14:17:06 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:17:06 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:17:06 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x0, 0x0, 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 534.069912] loop7: detected capacity change from 0 to 264192 14:17:06 executing program 6: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) [ 534.152855] FAT-fs (loop2): invalid media value (0x08) [ 534.153835] FAT-fs (loop2): Can't find a valid FAT filesystem [ 534.250272] vfat: Unknown parameter 'obj_user' 14:17:07 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x20, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 534.315197] loop6: detected capacity change from 0 to 264192 [ 534.327020] kmemleak: Found object by alias at 0x607f1a638234 [ 534.327047] CPU: 1 UID: 0 PID: 6447 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 534.327079] Tainted: [W]=WARN [ 534.327086] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 534.327099] Call Trace: [ 534.327105] [ 534.327114] dump_stack_lvl+0xca/0x120 [ 534.327153] __lookup_object+0x94/0xb0 [ 534.327182] delete_object_full+0x27/0x70 [ 534.327211] free_percpu+0x30/0x1160 [ 534.327240] ? arch_uprobe_clear_state+0x16/0x140 [ 534.327275] futex_hash_free+0x38/0xc0 [ 534.327300] mmput+0x2d3/0x390 [ 534.327332] do_exit+0x79d/0x2970 [ 534.327357] ? signal_wake_up_state+0x85/0x120 [ 534.327385] ? zap_other_threads+0x2b9/0x3a0 [ 534.327414] ? __pfx_do_exit+0x10/0x10 [ 534.327437] ? do_group_exit+0x1c3/0x2a0 [ 534.327462] ? lock_release+0xc8/0x290 [ 534.327492] do_group_exit+0xd3/0x2a0 [ 534.327519] __x64_sys_exit_group+0x3e/0x50 [ 534.327545] x64_sys_call+0x18c5/0x18d0 [ 534.327580] do_syscall_64+0xbf/0x360 [ 534.327602] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 534.327623] RIP: 0033:0x7f94594c7b19 [ 534.327638] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 534.327648] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 534.327669] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 534.327683] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 534.327696] RBP: 0000000000000000 R08: 0000001b2cd214d4 R09: 0000000000000000 [ 534.327709] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 534.327722] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 534.327750] [ 534.327757] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 534.327769] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 534.327781] kmemleak: min_count = 1 [ 534.327788] kmemleak: count = 1 [ 534.327795] kmemleak: flags = 0x21 [ 534.327802] kmemleak: checksum = 0 [ 534.327809] kmemleak: backtrace: [ 534.327815] pcpu_alloc_noprof+0x87a/0x1170 [ 534.327842] fib_nh_common_init+0x30/0xd0 [ 534.327864] fib6_nh_init+0x968/0x1a00 [ 534.327882] ip6_route_info_create_nh+0x530/0xf80 [ 534.327900] ip6_route_add.part.0+0x59/0x170 [ 534.327918] ip6_route_add+0x48/0x60 [ 534.327935] addrconf_add_mroute+0x12d/0x190 [ 534.327954] addrconf_add_dev+0x148/0x1c0 [ 534.327977] addrconf_dev_config+0x1e9/0x430 [ 534.328003] addrconf_notify+0xa70/0x1920 [ 534.328032] notifier_call_chain+0xc0/0x360 [ 534.328049] call_netdevice_notifiers_info+0xbe/0x140 [ 534.328070] netif_state_change+0x157/0x330 [ 534.328086] linkwatch_do_dev+0x111/0x150 [ 534.328104] __linkwatch_run_queue+0x2ab/0x710 [ 534.328122] linkwatch_event+0x4e/0x70 14:17:07 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:17:07 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x0, 0x0, 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:17:07 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 534.563694] vfat: Unknown parameter 'obj_user' 14:17:14 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:17:14 executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) 14:17:14 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:17:14 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x0, 0x0, 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:17:14 executing program 6: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:17:14 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:17:15 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:17:15 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) [ 542.276996] loop6: detected capacity change from 0 to 264192 [ 542.303599] FAT-fs (loop2): invalid media value (0x08) [ 542.304063] FAT-fs (loop2): Can't find a valid FAT filesystem [ 542.314840] kmemleak: Found object by alias at 0x607f1a638234 [ 542.314855] CPU: 1 UID: 0 PID: 6496 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 542.314876] Tainted: [W]=WARN [ 542.314879] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 542.314887] Call Trace: [ 542.314891] [ 542.314895] dump_stack_lvl+0xca/0x120 [ 542.314919] __lookup_object+0x94/0xb0 [ 542.314935] delete_object_full+0x27/0x70 [ 542.314950] free_percpu+0x30/0x1160 [ 542.314966] ? arch_uprobe_clear_state+0x16/0x140 [ 542.314986] futex_hash_free+0x38/0xc0 [ 542.315000] mmput+0x2d3/0x390 [ 542.315018] do_exit+0x79d/0x2970 [ 542.315031] ? signal_wake_up_state+0x85/0x120 [ 542.315048] ? zap_other_threads+0x2b9/0x3a0 [ 542.315063] ? __pfx_do_exit+0x10/0x10 [ 542.315076] ? do_group_exit+0x1c3/0x2a0 [ 542.315089] ? lock_release+0xc8/0x290 [ 542.315106] do_group_exit+0xd3/0x2a0 [ 542.315120] __x64_sys_exit_group+0x3e/0x50 [ 542.315134] x64_sys_call+0x18c5/0x18d0 [ 542.315149] do_syscall_64+0xbf/0x360 [ 542.315161] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 542.315172] RIP: 0033:0x7f94594c7b19 [ 542.315181] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 542.315186] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 542.315197] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 542.315205] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 542.315212] RBP: 0000000000000000 R08: 0000001b2cd25454 R09: 0000000000000000 [ 542.315219] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 542.315226] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 542.315241] [ 542.315245] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 542.315252] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 542.315258] kmemleak: min_count = 1 [ 542.315262] kmemleak: count = 1 [ 542.315266] kmemleak: flags = 0x21 [ 542.315269] kmemleak: checksum = 0 [ 542.315273] kmemleak: backtrace: [ 542.315277] pcpu_alloc_noprof+0x87a/0x1170 [ 542.315291] fib_nh_common_init+0x30/0xd0 [ 542.315304] fib6_nh_init+0x968/0x1a00 [ 542.315314] ip6_route_info_create_nh+0x530/0xf80 [ 542.315324] ip6_route_add.part.0+0x59/0x170 [ 542.315333] ip6_route_add+0x48/0x60 [ 542.315342] addrconf_add_mroute+0x12d/0x190 [ 542.315353] addrconf_add_dev+0x148/0x1c0 [ 542.315366] addrconf_dev_config+0x1e9/0x430 [ 542.315379] addrconf_notify+0xa70/0x1920 [ 542.315395] notifier_call_chain+0xc0/0x360 [ 542.315405] call_netdevice_notifiers_info+0xbe/0x140 [ 542.315417] netif_state_change+0x157/0x330 [ 542.315425] linkwatch_do_dev+0x111/0x150 [ 542.315436] __linkwatch_run_queue+0x2ab/0x710 [ 542.315446] linkwatch_event+0x4e/0x70 [ 542.320058] loop7: detected capacity change from 0 to 264192 [ 542.357166] vfat: Unknown parameter 'obj_user' 14:17:15 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) r0 = openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:17:15 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:17:15 executing program 6: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:17:15 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:17:15 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440), 0x0) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:17:15 executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) [ 542.512736] FAT-fs (loop2): invalid media value (0x08) [ 542.513216] FAT-fs (loop2): Can't find a valid FAT filesystem 14:17:15 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 542.568778] loop7: detected capacity change from 0 to 264192 14:17:15 executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x1c, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4094) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) [ 542.603789] loop6: detected capacity change from 0 to 264192 [ 542.640038] loop0: detected capacity change from 0 to 264192 14:17:15 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:17:15 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) [ 542.664100] vfat: Unknown parameter 'obj_user' [ 542.668113] kmemleak: Found object by alias at 0x607f1a638234 [ 542.668140] CPU: 0 UID: 0 PID: 6518 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 542.668175] Tainted: [W]=WARN [ 542.668183] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 542.668196] Call Trace: [ 542.668203] [ 542.668212] dump_stack_lvl+0xca/0x120 [ 542.668253] __lookup_object+0x94/0xb0 [ 542.668284] delete_object_full+0x27/0x70 [ 542.668315] free_percpu+0x30/0x1160 [ 542.668346] ? arch_uprobe_clear_state+0x16/0x140 [ 542.668384] futex_hash_free+0x38/0xc0 [ 542.668411] mmput+0x2d3/0x390 [ 542.668446] do_exit+0x79d/0x2970 [ 542.668472] ? signal_wake_up_state+0x85/0x120 [ 542.668503] ? zap_other_threads+0x2b9/0x3a0 [ 542.668533] ? __pfx_do_exit+0x10/0x10 [ 542.668558] ? do_group_exit+0x1c3/0x2a0 [ 542.668594] ? lock_release+0xc8/0x290 [ 542.668626] do_group_exit+0xd3/0x2a0 [ 542.668655] __x64_sys_exit_group+0x3e/0x50 [ 542.668682] x64_sys_call+0x18c5/0x18d0 [ 542.668711] do_syscall_64+0xbf/0x360 [ 542.668733] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 542.668756] RIP: 0033:0x7f94594c7b19 [ 542.668773] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 542.668783] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 542.668805] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 542.668820] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 542.668835] RBP: 0000000000000000 R08: 0000001b2cd25060 R09: 0000000000000000 [ 542.668849] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 542.668862] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 542.668893] [ 542.668900] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 542.668914] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 542.668928] kmemleak: min_count = 1 [ 542.668935] kmemleak: count = 1 [ 542.668943] kmemleak: flags = 0x21 [ 542.668950] kmemleak: checksum = 0 [ 542.668957] kmemleak: backtrace: [ 542.668964] pcpu_alloc_noprof+0x87a/0x1170 [ 542.668993] fib_nh_common_init+0x30/0xd0 [ 542.669017] fib6_nh_init+0x968/0x1a00 [ 542.669036] ip6_route_info_create_nh+0x530/0xf80 14:17:15 executing program 6: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440), 0x0) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) [ 542.669056] ip6_route_add.part.0+0x59/0x170 [ 542.669075] ip6_route_add+0x48/0x60 [ 542.669093] addrconf_add_mroute+0x12d/0x190 [ 542.669114] addrconf_add_dev+0x148/0x1c0 [ 542.669138] addrconf_dev_config+0x1e9/0x430 [ 542.669166] addrconf_notify+0xa70/0x1920 [ 542.669197] notifier_call_chain+0xc0/0x360 [ 542.669217] call_netdevice_notifiers_info+0xbe/0x140 [ 542.669239] netif_state_change+0x157/0x330 [ 542.669256] linkwatch_do_dev+0x111/0x150 [ 542.669276] __linkwatch_run_queue+0x2ab/0x710 [ 542.669296] linkwatch_event+0x4e/0x70 [ 542.788390] loop6: detected capacity change from 0 to 264192 14:17:24 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x2}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:17:24 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r2, 0x8905, &(0x7f0000001080)) 14:17:24 executing program 6: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440), 0x0) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:17:24 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:17:24 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 14:17:24 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440), 0x0) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:17:24 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x20, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:17:24 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) r0 = openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) [ 552.080544] loop6: detected capacity change from 0 to 264192 14:17:24 executing program 6: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440), 0x0) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) [ 552.128829] loop0: detected capacity change from 0 to 264192 [ 552.130360] vfat: Unknown parameter 'obj_user' [ 552.147153] loop7: detected capacity change from 0 to 264192 [ 552.203871] loop6: detected capacity change from 0 to 264192 [ 552.238656] FAT-fs (loop2): invalid media value (0x08) [ 552.239550] FAT-fs (loop2): Can't find a valid FAT filesystem [ 552.351931] kmemleak: Found object by alias at 0x607f1a638234 [ 552.351963] CPU: 1 UID: 0 PID: 6574 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 552.352002] Tainted: [W]=WARN [ 552.352009] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 552.352021] Call Trace: [ 552.352028] [ 552.352036] dump_stack_lvl+0xca/0x120 [ 552.352076] __lookup_object+0x94/0xb0 [ 552.352104] delete_object_full+0x27/0x70 [ 552.352133] free_percpu+0x30/0x1160 [ 552.352162] ? arch_uprobe_clear_state+0x16/0x140 [ 552.352197] futex_hash_free+0x38/0xc0 [ 552.352222] mmput+0x2d3/0x390 [ 552.352255] do_exit+0x79d/0x2970 [ 552.352278] ? lock_release+0xc8/0x290 [ 552.352308] ? __pfx_do_exit+0x10/0x10 [ 552.352334] ? find_held_lock+0x2b/0x80 [ 552.352364] ? get_signal+0x835/0x2340 [ 552.352399] do_group_exit+0xd3/0x2a0 [ 552.352426] get_signal+0x2315/0x2340 [ 552.352463] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 552.352492] ? __pfx_get_signal+0x10/0x10 [ 552.352521] ? do_futex+0x135/0x370 [ 552.352546] ? __pfx_do_futex+0x10/0x10 [ 552.352573] arch_do_signal_or_restart+0x80/0x790 [ 552.352604] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 552.352633] ? __x64_sys_futex+0x1c9/0x4d0 [ 552.352655] ? __x64_sys_futex+0x1d2/0x4d0 [ 552.352680] ? fput_close_sync+0x114/0x240 [ 552.352708] ? __pfx___x64_sys_futex+0x10/0x10 [ 552.352731] ? __pfx_fput_close_sync+0x10/0x10 [ 552.352758] ? dnotify_flush+0x79/0x4c0 [ 552.352786] exit_to_user_mode_loop+0x8b/0x110 [ 552.352808] do_syscall_64+0x2f7/0x360 [ 552.352829] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 552.352851] RIP: 0033:0x7f94594c7b19 [ 552.352866] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 552.352876] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 552.352896] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 552.352910] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 552.352923] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 552.352936] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 552.352949] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 552.352978] [ 552.352984] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 552.352997] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 552.353009] kmemleak: min_count = 1 [ 552.353017] kmemleak: count = 1 [ 552.353023] kmemleak: flags = 0x21 [ 552.353030] kmemleak: checksum = 0 [ 552.353037] kmemleak: backtrace: [ 552.353043] pcpu_alloc_noprof+0x87a/0x1170 [ 552.353070] fib_nh_common_init+0x30/0xd0 [ 552.353092] fib6_nh_init+0x968/0x1a00 [ 552.353110] ip6_route_info_create_nh+0x530/0xf80 [ 552.353128] ip6_route_add.part.0+0x59/0x170 [ 552.353146] ip6_route_add+0x48/0x60 [ 552.353162] addrconf_add_mroute+0x12d/0x190 [ 552.353182] addrconf_add_dev+0x148/0x1c0 [ 552.353205] addrconf_dev_config+0x1e9/0x430 [ 552.353230] addrconf_notify+0xa70/0x1920 [ 552.353259] notifier_call_chain+0xc0/0x360 [ 552.353277] call_netdevice_notifiers_info+0xbe/0x140 [ 552.353297] netif_state_change+0x157/0x330 [ 552.353313] linkwatch_do_dev+0x111/0x150 [ 552.353332] __linkwatch_run_queue+0x2ab/0x710 [ 552.353350] linkwatch_event+0x4e/0x70 14:17:34 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:17:34 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) r0 = openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:17:34 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r2, 0x8905, &(0x7f0000001080)) 14:17:34 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440), 0x0) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:17:34 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:17:34 executing program 6: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:17:34 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 14:17:34 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x20, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 562.097472] loop6: detected capacity change from 0 to 264192 [ 562.101188] loop0: detected capacity change from 0 to 264192 [ 562.108048] loop7: detected capacity change from 0 to 264192 [ 562.117282] vfat: Unknown parameter 'obj_user' [ 562.123540] FAT-fs (loop2): invalid media value (0x08) [ 562.124432] FAT-fs (loop2): Can't find a valid FAT filesystem [ 562.184196] kmemleak: Found object by alias at 0x607f1a638234 [ 562.184228] CPU: 1 UID: 0 PID: 6589 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 562.184259] Tainted: [W]=WARN [ 562.184265] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 562.184277] Call Trace: [ 562.184284] [ 562.184291] dump_stack_lvl+0xca/0x120 [ 562.184328] __lookup_object+0x94/0xb0 [ 562.184354] delete_object_full+0x27/0x70 [ 562.184380] free_percpu+0x30/0x1160 [ 562.184407] ? arch_uprobe_clear_state+0x16/0x140 [ 562.184440] futex_hash_free+0x38/0xc0 [ 562.184462] mmput+0x2d3/0x390 [ 562.184493] do_exit+0x79d/0x2970 [ 562.184522] ? __pfx_do_exit+0x10/0x10 [ 562.184544] ? find_held_lock+0x2b/0x80 [ 562.184580] ? get_signal+0x835/0x2340 [ 562.184613] do_group_exit+0xd3/0x2a0 [ 562.184637] get_signal+0x2315/0x2340 [ 562.184666] ? put_task_stack+0xd2/0x240 [ 562.184691] ? __pfx_get_signal+0x10/0x10 [ 562.184717] ? __schedule+0xe91/0x3590 [ 562.184750] arch_do_signal_or_restart+0x80/0x790 [ 562.184778] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 562.184805] ? __x64_sys_futex+0x1c9/0x4d0 [ 562.184825] ? __x64_sys_futex+0x1d2/0x4d0 [ 562.184850] ? __pfx___x64_sys_futex+0x10/0x10 [ 562.184871] ? __pfx_fput_close_sync+0x10/0x10 [ 562.184905] exit_to_user_mode_loop+0x8b/0x110 [ 562.184927] do_syscall_64+0x2f7/0x360 [ 562.184947] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 562.184967] RIP: 0033:0x7f94594c7b19 [ 562.184981] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 562.184990] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 562.185009] RAX: 0000000000000001 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 562.185022] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f94595daf6c [ 562.185034] RBP: 00007f94595daf60 R08: 0000000000000002 R09: 0000000000000000 [ 562.185046] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007f94595daf6c [ 562.185058] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 562.185085] [ 562.185091] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 562.185102] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 562.185114] kmemleak: min_count = 1 [ 562.185120] kmemleak: count = 1 [ 562.185126] kmemleak: flags = 0x21 [ 562.185133] kmemleak: checksum = 0 [ 562.185139] kmemleak: backtrace: [ 562.185145] pcpu_alloc_noprof+0x87a/0x1170 [ 562.185169] fib_nh_common_init+0x30/0xd0 [ 562.185190] fib6_nh_init+0x968/0x1a00 [ 562.185206] ip6_route_info_create_nh+0x530/0xf80 [ 562.185223] ip6_route_add.part.0+0x59/0x170 [ 562.185239] ip6_route_add+0x48/0x60 [ 562.185254] addrconf_add_mroute+0x12d/0x190 [ 562.185272] addrconf_add_dev+0x148/0x1c0 [ 562.185293] addrconf_dev_config+0x1e9/0x430 [ 562.185316] addrconf_notify+0xa70/0x1920 [ 562.185343] notifier_call_chain+0xc0/0x360 [ 562.185359] call_netdevice_notifiers_info+0xbe/0x140 [ 562.185378] netif_state_change+0x157/0x330 [ 562.185393] linkwatch_do_dev+0x111/0x150 [ 562.185410] __linkwatch_run_queue+0x2ab/0x710 [ 562.185426] linkwatch_event+0x4e/0x70 14:17:35 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(0x0, r0) 14:17:35 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 14:17:35 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:17:35 executing program 6: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:17:35 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:17:35 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r2, 0x8905, &(0x7f0000001080)) [ 562.348205] loop0: detected capacity change from 0 to 264192 14:17:35 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x20, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 562.356058] loop6: detected capacity change from 0 to 264192 [ 562.357489] vfat: Unknown parameter 'obj_user' [ 562.359228] loop7: detected capacity change from 0 to 264192 14:17:35 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}, 0x1, 0x0, 0x0, 0x1}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:17:35 executing program 4: syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) [ 562.426172] FAT-fs (loop2): invalid media value (0x08) [ 562.427110] FAT-fs (loop2): Can't find a valid FAT filesystem 14:17:35 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:17:35 executing program 6: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:17:35 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) [ 562.516386] kmemleak: Found object by alias at 0x607f1a638234 [ 562.516409] CPU: 0 UID: 0 PID: 6621 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 562.516427] Tainted: [W]=WARN [ 562.516431] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 562.516438] Call Trace: [ 562.516442] [ 562.516447] dump_stack_lvl+0xca/0x120 [ 562.516472] __lookup_object+0x94/0xb0 [ 562.516488] delete_object_full+0x27/0x70 [ 562.516504] free_percpu+0x30/0x1160 [ 562.516521] ? arch_uprobe_clear_state+0x16/0x140 [ 562.516546] futex_hash_free+0x38/0xc0 [ 562.516560] mmput+0x2d3/0x390 [ 562.516578] do_exit+0x79d/0x2970 [ 562.516591] ? lock_release+0xc8/0x290 [ 562.516608] ? __pfx_do_exit+0x10/0x10 [ 562.516622] ? find_held_lock+0x2b/0x80 [ 562.516639] ? get_signal+0x835/0x2340 [ 562.516659] do_group_exit+0xd3/0x2a0 [ 562.516674] get_signal+0x2315/0x2340 [ 562.516691] ? __pfx_signal_setup_done+0x10/0x10 [ 562.516711] ? __pfx_get_signal+0x10/0x10 [ 562.516727] ? do_futex+0x135/0x370 [ 562.516740] ? __pfx_do_futex+0x10/0x10 [ 562.516752] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 562.516766] arch_do_signal_or_restart+0x80/0x790 [ 562.516784] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 562.516799] ? __x64_sys_futex+0x1c9/0x4d0 [ 562.516811] ? __x64_sys_futex+0x1d2/0x4d0 [ 562.516826] ? __pfx___x64_sys_futex+0x10/0x10 [ 562.516838] ? lock_mm_and_find_vma+0xaa/0x6f0 [ 562.516856] exit_to_user_mode_loop+0x8b/0x110 [ 562.516869] do_syscall_64+0x2f7/0x360 [ 562.516881] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 562.516893] RIP: 0033:0x7f94594c7b19 [ 562.516902] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 562.516907] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 562.516919] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 562.516927] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 562.516934] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 562.516941] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 562.516948] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 562.516964] [ 562.516968] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 562.516974] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 562.516981] kmemleak: min_count = 1 [ 562.516985] kmemleak: count = 1 [ 562.516989] kmemleak: flags = 0x21 [ 562.516992] kmemleak: checksum = 0 [ 562.516996] kmemleak: backtrace: [ 562.516999] pcpu_alloc_noprof+0x87a/0x1170 [ 562.517014] fib_nh_common_init+0x30/0xd0 [ 562.517027] fib6_nh_init+0x968/0x1a00 [ 562.517037] ip6_route_info_create_nh+0x530/0xf80 [ 562.517047] ip6_route_add.part.0+0x59/0x170 [ 562.517057] ip6_route_add+0x48/0x60 [ 562.517065] addrconf_add_mroute+0x12d/0x190 [ 562.517077] addrconf_add_dev+0x148/0x1c0 [ 562.517089] addrconf_dev_config+0x1e9/0x430 [ 562.517103] addrconf_notify+0xa70/0x1920 [ 562.517119] notifier_call_chain+0xc0/0x360 [ 562.517129] call_netdevice_notifiers_info+0xbe/0x140 [ 562.517141] netif_state_change+0x157/0x330 [ 562.517149] linkwatch_do_dev+0x111/0x150 [ 562.517160] __linkwatch_run_queue+0x2ab/0x710 [ 562.517170] linkwatch_event+0x4e/0x70 [ 562.533353] loop6: detected capacity change from 0 to 264192 [ 562.545378] loop0: detected capacity change from 0 to 264192 [ 562.561358] vfat: Unknown parameter 'obj_user' 14:17:35 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 562.568314] loop7: detected capacity change from 0 to 264192 14:17:35 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(0x0, r0) 14:17:35 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:17:35 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 562.722963] FAT-fs (loop2): invalid media value (0x08) [ 562.723540] FAT-fs (loop2): Can't find a valid FAT filesystem [ 562.741408] kmemleak: Found object by alias at 0x607f1a638234 [ 562.741428] CPU: 1 UID: 0 PID: 6643 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 562.741450] Tainted: [W]=WARN [ 562.741454] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 562.741462] Call Trace: [ 562.741467] [ 562.741472] dump_stack_lvl+0xca/0x120 [ 562.741499] __lookup_object+0x94/0xb0 [ 562.741519] delete_object_full+0x27/0x70 [ 562.741537] free_percpu+0x30/0x1160 [ 562.741556] ? arch_uprobe_clear_state+0x16/0x140 [ 562.741585] futex_hash_free+0x38/0xc0 [ 562.741601] mmput+0x2d3/0x390 [ 562.741622] do_exit+0x79d/0x2970 [ 562.741637] ? signal_wake_up_state+0x85/0x120 [ 562.741655] ? zap_other_threads+0x2b9/0x3a0 [ 562.741673] ? __pfx_do_exit+0x10/0x10 [ 562.741688] ? do_group_exit+0x1c3/0x2a0 [ 562.741703] ? lock_release+0xc8/0x290 [ 562.741735] do_group_exit+0xd3/0x2a0 [ 562.741752] __x64_sys_exit_group+0x3e/0x50 [ 562.741768] x64_sys_call+0x18c5/0x18d0 [ 562.741785] do_syscall_64+0xbf/0x360 [ 562.741799] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 562.741811] RIP: 0033:0x7f94594c7b19 [ 562.741822] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 562.741828] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 562.741841] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 562.741850] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 562.741858] RBP: 0000000000000000 R08: 0000001b2cd253e0 R09: 0000000000000000 [ 562.741866] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 562.741873] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 562.741892] [ 562.741896] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 562.741904] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 562.741912] kmemleak: min_count = 1 [ 562.741916] kmemleak: count = 1 [ 562.741920] kmemleak: flags = 0x21 [ 562.741925] kmemleak: checksum = 0 [ 562.741929] kmemleak: backtrace: [ 562.741933] pcpu_alloc_noprof+0x87a/0x1170 [ 562.741951] fib_nh_common_init+0x30/0xd0 [ 562.741965] fib6_nh_init+0x968/0x1a00 [ 562.741977] ip6_route_info_create_nh+0x530/0xf80 [ 562.741988] ip6_route_add.part.0+0x59/0x170 [ 562.742000] ip6_route_add+0x48/0x60 [ 562.742010] addrconf_add_mroute+0x12d/0x190 [ 562.742023] addrconf_add_dev+0x148/0x1c0 [ 562.742038] addrconf_dev_config+0x1e9/0x430 [ 562.742055] addrconf_notify+0xa70/0x1920 [ 562.742073] notifier_call_chain+0xc0/0x360 [ 562.742085] call_netdevice_notifiers_info+0xbe/0x140 [ 562.742099] netif_state_change+0x157/0x330 [ 562.742109] linkwatch_do_dev+0x111/0x150 [ 562.742121] __linkwatch_run_queue+0x2ab/0x710 [ 562.742133] linkwatch_event+0x4e/0x70 14:17:44 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:17:44 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, 0x0, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:17:44 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:17:44 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:17:44 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:17:44 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(0x0, r0) 14:17:44 executing program 4: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:17:44 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:17:44 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 571.502465] loop4: detected capacity change from 0 to 264192 [ 571.536712] loop6: detected capacity change from 0 to 264192 [ 571.541332] loop0: detected capacity change from 0 to 264192 [ 571.542914] loop7: detected capacity change from 0 to 264192 [ 571.549367] vfat: Unknown parameter 'obj_user' [ 571.581288] FAT-fs (loop2): invalid media value (0x08) [ 571.581816] FAT-fs (loop2): Can't find a valid FAT filesystem [ 571.597006] kmemleak: Found object by alias at 0x607f1a638234 [ 571.597022] CPU: 1 UID: 0 PID: 6665 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 571.597042] Tainted: [W]=WARN [ 571.597046] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 571.597055] Call Trace: [ 571.597059] [ 571.597063] dump_stack_lvl+0xca/0x120 [ 571.597092] __lookup_object+0x94/0xb0 [ 571.597111] delete_object_full+0x27/0x70 [ 571.597127] free_percpu+0x30/0x1160 [ 571.597144] ? arch_uprobe_clear_state+0x16/0x140 [ 571.597165] futex_hash_free+0x38/0xc0 [ 571.597180] mmput+0x2d3/0x390 [ 571.597200] do_exit+0x79d/0x2970 [ 571.597214] ? signal_wake_up_state+0x85/0x120 [ 571.597230] ? zap_other_threads+0x2b9/0x3a0 [ 571.597246] ? __pfx_do_exit+0x10/0x10 [ 571.597259] ? do_group_exit+0x1c3/0x2a0 [ 571.597273] ? lock_release+0xc8/0x290 [ 571.597291] do_group_exit+0xd3/0x2a0 [ 571.597306] __x64_sys_exit_group+0x3e/0x50 [ 571.597324] x64_sys_call+0x18c5/0x18d0 [ 571.597340] do_syscall_64+0xbf/0x360 [ 571.597352] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 571.597364] RIP: 0033:0x7f94594c7b19 [ 571.597373] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 571.597378] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 571.597390] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 571.597398] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 571.597405] RBP: 0000000000000000 R08: 0000001b2cd253d8 R09: 0000000000000000 [ 571.597413] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 571.597420] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 571.597436] [ 571.597441] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 571.597448] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 571.597455] kmemleak: min_count = 1 [ 571.597459] kmemleak: count = 1 [ 571.597463] kmemleak: flags = 0x21 [ 571.597467] kmemleak: checksum = 0 [ 571.597471] kmemleak: backtrace: [ 571.597474] pcpu_alloc_noprof+0x87a/0x1170 [ 571.597489] fib_nh_common_init+0x30/0xd0 [ 571.597503] fib6_nh_init+0x968/0x1a00 [ 571.597513] ip6_route_info_create_nh+0x530/0xf80 [ 571.597523] ip6_route_add.part.0+0x59/0x170 [ 571.597533] ip6_route_add+0x48/0x60 [ 571.597542] addrconf_add_mroute+0x12d/0x190 [ 571.597554] addrconf_add_dev+0x148/0x1c0 [ 571.597568] addrconf_dev_config+0x1e9/0x430 [ 571.597582] addrconf_notify+0xa70/0x1920 [ 571.597598] notifier_call_chain+0xc0/0x360 [ 571.597610] call_netdevice_notifiers_info+0xbe/0x140 [ 571.597622] netif_state_change+0x157/0x330 [ 571.597631] linkwatch_do_dev+0x111/0x150 [ 571.597643] __linkwatch_run_queue+0x2ab/0x710 [ 571.597653] linkwatch_event+0x4e/0x70 14:17:54 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x0) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:17:54 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:17:54 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, 0x0, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:17:54 executing program 6: pipe2(0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:17:54 executing program 4: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:17:54 executing program 7: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:17:54 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:17:54 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 581.429338] loop4: detected capacity change from 0 to 264192 [ 581.430725] loop0: detected capacity change from 0 to 264192 [ 581.439270] vfat: Unknown parameter 'obj_user' [ 581.449535] loop6: detected capacity change from 0 to 264192 [ 581.472822] loop7: detected capacity change from 0 to 264192 14:17:54 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 581.549492] FAT-fs (loop2): invalid media value (0x08) [ 581.550543] FAT-fs (loop2): Can't find a valid FAT filesystem 14:17:54 executing program 4: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:17:54 executing program 6: pipe2(0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:17:54 executing program 4: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) 14:17:54 executing program 7: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:17:54 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x0) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 581.734248] loop0: detected capacity change from 0 to 264192 14:17:54 executing program 4: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) [ 581.747966] loop6: detected capacity change from 0 to 264192 [ 581.751554] vfat: Unknown parameter 'obj_user' 14:17:54 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, 0x0, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) [ 581.796905] loop7: detected capacity change from 0 to 264192 14:17:54 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 581.856818] kmemleak: Found object by alias at 0x607f1a638234 [ 581.856848] CPU: 0 UID: 0 PID: 6718 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 581.856881] Tainted: [W]=WARN [ 581.856888] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 581.856900] Call Trace: [ 581.856907] [ 581.856916] dump_stack_lvl+0xca/0x120 [ 581.856956] __lookup_object+0x94/0xb0 [ 581.856985] delete_object_full+0x27/0x70 [ 581.857014] free_percpu+0x30/0x1160 [ 581.857049] ? arch_uprobe_clear_state+0x16/0x140 [ 581.857085] futex_hash_free+0x38/0xc0 [ 581.857109] mmput+0x2d3/0x390 [ 581.857142] do_exit+0x79d/0x2970 [ 581.857166] ? lock_release+0xc8/0x290 [ 581.857196] ? __pfx_do_exit+0x10/0x10 [ 581.857221] ? find_held_lock+0x2b/0x80 [ 581.857252] ? get_signal+0x835/0x2340 [ 581.857288] do_group_exit+0xd3/0x2a0 [ 581.857315] get_signal+0x2315/0x2340 [ 581.857351] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 581.857381] ? __pfx_get_signal+0x10/0x10 [ 581.857410] ? do_futex+0x135/0x370 [ 581.857435] ? __pfx_do_futex+0x10/0x10 [ 581.857463] arch_do_signal_or_restart+0x80/0x790 [ 581.857493] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 581.857523] ? __x64_sys_futex+0x1c9/0x4d0 [ 581.857546] ? __x64_sys_futex+0x1d2/0x4d0 [ 581.857571] ? fput_close_sync+0x114/0x240 [ 581.857599] ? __pfx___x64_sys_futex+0x10/0x10 [ 581.857622] ? __pfx_fput_close_sync+0x10/0x10 [ 581.857649] ? dnotify_flush+0x79/0x4c0 [ 581.857677] exit_to_user_mode_loop+0x8b/0x110 [ 581.857700] do_syscall_64+0x2f7/0x360 [ 581.857721] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 581.857743] RIP: 0033:0x7f94594c7b19 [ 581.857759] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 581.857768] RSP: 002b:00007f9456a1c218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 581.857789] RAX: fffffffffffffe00 RBX: 00007f94595db028 RCX: 00007f94594c7b19 [ 581.857803] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595db028 [ 581.857816] RBP: 00007f94595db020 R08: 0000000000000000 R09: 0000000000000000 [ 581.857829] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595db02c [ 581.857842] R13: 00007ffcd48876ff R14: 00007f9456a1c300 R15: 0000000000022000 [ 581.857870] [ 581.857877] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 581.857890] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 581.857903] kmemleak: min_count = 1 [ 581.857910] kmemleak: count = 1 [ 581.857917] kmemleak: flags = 0x21 [ 581.857923] kmemleak: checksum = 0 [ 581.857930] kmemleak: backtrace: [ 581.857936] pcpu_alloc_noprof+0x87a/0x1170 [ 581.857963] fib_nh_common_init+0x30/0xd0 [ 581.857984] fib6_nh_init+0x968/0x1a00 [ 581.858002] ip6_route_info_create_nh+0x530/0xf80 [ 581.858032] ip6_route_add.part.0+0x59/0x170 [ 581.858050] ip6_route_add+0x48/0x60 [ 581.858067] addrconf_add_mroute+0x12d/0x190 [ 581.858086] addrconf_add_dev+0x148/0x1c0 [ 581.858110] addrconf_dev_config+0x1e9/0x430 [ 581.858135] addrconf_notify+0xa70/0x1920 [ 581.858164] notifier_call_chain+0xc0/0x360 [ 581.858181] call_netdevice_notifiers_info+0xbe/0x140 [ 581.858201] netif_state_change+0x157/0x330 [ 581.858218] linkwatch_do_dev+0x111/0x150 [ 581.858236] __linkwatch_run_queue+0x2ab/0x710 [ 581.858255] linkwatch_event+0x4e/0x70 14:18:03 executing program 6: pipe2(0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:18:03 executing program 4: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) 14:18:03 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:18:03 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:18:03 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x0) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, &(0x7f0000000840)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000800)={&(0x7f0000000640)={0x194, 0x0, 0x406, 0x70bd26, 0x25dfdbff, {}, [@NLBL_CIPSOV4_A_MLSLVLLST={0x9c, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe8}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xe9}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xc4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7b2608ca}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x70940be6}]}, {0x14, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x71e5baec}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7e8a2f21}]}, {0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xd3}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x47be8479}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0xa96f8fd}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xde}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5fe792fa}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x73163359}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6c}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x13afd744}]}]}, @NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MLSLVLLST={0xc8, 0x8, 0x0, 0x1, [{0x3c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x53f4168e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x2}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x8f}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x7e}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x645ec3ef}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x5ef7cfa4}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x9a}]}, {0x1c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x78}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x7105688}]}, {0x34, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x6f}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x44c534d5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x14}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x1e}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa7}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xdf}]}, {0x2c, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x56}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0xa5}, @NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x12626f92}, @NLBL_CIPSOV4_A_MLSLVLREM={0x8, 0x6, 0x3b}]}, {0xc, 0x7, 0x0, 0x1, [@NLBL_CIPSOV4_A_MLSLVLLOC={0x8, 0x5, 0x4f77c612}]}]}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x1}, @NLBL_CIPSOV4_A_TAGLST={0xc, 0x4, 0x0, 0x1, [{0x5}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x4000}, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:18:03 executing program 7: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:18:03 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:18:03 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 590.432190] loop6: detected capacity change from 0 to 264192 [ 590.471502] loop4: detected capacity change from 0 to 264192 14:18:03 executing program 6: pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) [ 590.501338] loop7: detected capacity change from 0 to 264192 [ 590.507104] loop0: detected capacity change from 0 to 264192 [ 590.520222] vfat: Unknown parameter 'obj_user' [ 590.534537] loop6: detected capacity change from 0 to 264192 14:18:03 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:18:03 executing program 4: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 590.615912] FAT-fs (loop2): invalid media value (0x08) [ 590.616888] FAT-fs (loop2): Can't find a valid FAT filesystem 14:18:03 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:18:03 executing program 7: readlinkat(0xffffffffffffffff, 0x0, &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:18:03 executing program 6: pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:18:03 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}}, 0x4044801) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:18:03 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 590.726976] loop6: detected capacity change from 0 to 264192 [ 590.740241] loop0: detected capacity change from 0 to 264192 [ 590.762227] vfat: Unknown parameter 'obj_user' [ 590.765364] loop7: detected capacity change from 0 to 264192 14:18:03 executing program 4: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:18:03 executing program 6: pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) [ 590.844138] kmemleak: Found object by alias at 0x607f1a638234 [ 590.844165] CPU: 0 UID: 0 PID: 6772 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 590.844199] Tainted: [W]=WARN [ 590.844205] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 590.844218] Call Trace: [ 590.844225] [ 590.844233] dump_stack_lvl+0xca/0x120 [ 590.844272] __lookup_object+0x94/0xb0 [ 590.844301] delete_object_full+0x27/0x70 [ 590.844330] free_percpu+0x30/0x1160 [ 590.844358] ? arch_uprobe_clear_state+0x16/0x140 [ 590.844394] futex_hash_free+0x38/0xc0 [ 590.844418] mmput+0x2d3/0x390 [ 590.844451] do_exit+0x79d/0x2970 [ 590.844475] ? lock_release+0xc8/0x290 [ 590.844505] ? __pfx_do_exit+0x10/0x10 [ 590.844530] ? find_held_lock+0x2b/0x80 [ 590.844561] ? get_signal+0x835/0x2340 [ 590.844605] do_group_exit+0xd3/0x2a0 [ 590.844636] get_signal+0x2315/0x2340 [ 590.844667] ? task_mm_cid_work+0x368/0x840 [ 590.844707] ? __pfx_get_signal+0x10/0x10 [ 590.844736] ? do_futex+0x135/0x370 [ 590.844761] ? __pfx_do_futex+0x10/0x10 [ 590.844789] arch_do_signal_or_restart+0x80/0x790 [ 590.844819] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 590.844849] ? __x64_sys_futex+0x1c9/0x4d0 [ 590.844871] ? __x64_sys_futex+0x1d2/0x4d0 [ 590.844899] ? __pfx___x64_sys_futex+0x10/0x10 [ 590.844921] ? __pfx_fput_close_sync+0x10/0x10 [ 590.844950] ? xfd_validate_state+0x55/0x180 [ 590.844987] exit_to_user_mode_loop+0x8b/0x110 [ 590.845010] do_syscall_64+0x2f7/0x360 [ 590.845032] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 590.845052] RIP: 0033:0x7f94594c7b19 [ 590.845069] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 590.845078] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 590.845099] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 590.845113] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 590.845126] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 590.845139] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 590.845152] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 590.845181] [ 590.845187] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 590.845200] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 590.845213] kmemleak: min_count = 1 [ 590.845221] kmemleak: count = 1 [ 590.845227] kmemleak: flags = 0x21 [ 590.845235] kmemleak: checksum = 0 [ 590.845242] kmemleak: backtrace: [ 590.845248] pcpu_alloc_noprof+0x87a/0x1170 [ 590.845275] fib_nh_common_init+0x30/0xd0 [ 590.845297] fib6_nh_init+0x968/0x1a00 [ 590.845314] ip6_route_info_create_nh+0x530/0xf80 [ 590.845333] ip6_route_add.part.0+0x59/0x170 [ 590.845351] ip6_route_add+0x48/0x60 [ 590.845368] addrconf_add_mroute+0x12d/0x190 [ 590.845387] addrconf_add_dev+0x148/0x1c0 [ 590.845410] addrconf_dev_config+0x1e9/0x430 [ 590.845436] addrconf_notify+0xa70/0x1920 [ 590.845465] notifier_call_chain+0xc0/0x360 [ 590.845483] call_netdevice_notifiers_info+0xbe/0x140 [ 590.845503] netif_state_change+0x157/0x330 [ 590.845519] linkwatch_do_dev+0x111/0x150 [ 590.845537] __linkwatch_run_queue+0x2ab/0x710 [ 590.845556] linkwatch_event+0x4e/0x70 [ 590.897359] loop6: detected capacity change from 0 to 264192 14:18:03 executing program 4: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:18:03 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:18:03 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) [ 591.035760] FAT-fs (loop2): invalid media value (0x08) [ 591.036247] FAT-fs (loop2): Can't find a valid FAT filesystem [ 591.101876] kmemleak: Found object by alias at 0x607f1a638234 [ 591.101899] CPU: 1 UID: 0 PID: 6807 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 591.101918] Tainted: [W]=WARN [ 591.101922] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 591.101930] Call Trace: [ 591.101933] [ 591.101939] dump_stack_lvl+0xca/0x120 [ 591.101963] __lookup_object+0x94/0xb0 [ 591.101981] delete_object_full+0x27/0x70 [ 591.101997] free_percpu+0x30/0x1160 [ 591.102014] ? arch_uprobe_clear_state+0x16/0x140 [ 591.102034] futex_hash_free+0x38/0xc0 [ 591.102049] mmput+0x2d3/0x390 [ 591.102068] do_exit+0x79d/0x2970 [ 591.102082] ? lock_release+0xc8/0x290 [ 591.102102] ? __pfx_do_exit+0x10/0x10 [ 591.102117] ? find_held_lock+0x2b/0x80 [ 591.102134] ? get_signal+0x835/0x2340 [ 591.102155] do_group_exit+0xd3/0x2a0 [ 591.102178] get_signal+0x2315/0x2340 [ 591.102198] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 591.102214] ? __pfx_get_signal+0x10/0x10 [ 591.102231] ? do_futex+0x135/0x370 [ 591.102244] ? __pfx_do_futex+0x10/0x10 [ 591.102259] arch_do_signal_or_restart+0x80/0x790 [ 591.102276] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 591.102293] ? __x64_sys_futex+0x1c9/0x4d0 [ 591.102305] ? __x64_sys_futex+0x1d2/0x4d0 [ 591.102318] ? fput_close_sync+0x114/0x240 [ 591.102335] ? __pfx___x64_sys_futex+0x10/0x10 [ 591.102347] ? __pfx_fput_close_sync+0x10/0x10 [ 591.102362] ? dnotify_flush+0x79/0x4c0 [ 591.102378] exit_to_user_mode_loop+0x8b/0x110 [ 591.102390] do_syscall_64+0x2f7/0x360 [ 591.102402] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 591.102418] RIP: 0033:0x7f94594c7b19 [ 591.102427] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 591.102432] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 591.102443] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 591.102451] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 591.102458] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 591.102465] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 591.102472] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 591.102487] [ 591.102491] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 591.102498] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 591.102505] kmemleak: min_count = 1 [ 591.102509] kmemleak: count = 1 [ 591.102513] kmemleak: flags = 0x21 [ 591.102516] kmemleak: checksum = 0 [ 591.102520] kmemleak: backtrace: [ 591.102524] pcpu_alloc_noprof+0x87a/0x1170 [ 591.102539] fib_nh_common_init+0x30/0xd0 [ 591.102551] fib6_nh_init+0x968/0x1a00 [ 591.102562] ip6_route_info_create_nh+0x530/0xf80 [ 591.102572] ip6_route_add.part.0+0x59/0x170 [ 591.102582] ip6_route_add+0x48/0x60 [ 591.102591] addrconf_add_mroute+0x12d/0x190 [ 591.102602] addrconf_add_dev+0x148/0x1c0 [ 591.102615] addrconf_dev_config+0x1e9/0x430 [ 591.102629] addrconf_notify+0xa70/0x1920 [ 591.102645] notifier_call_chain+0xc0/0x360 [ 591.102655] call_netdevice_notifiers_info+0xbe/0x140 [ 591.102667] netif_state_change+0x157/0x330 [ 591.102676] linkwatch_do_dev+0x111/0x150 [ 591.102687] __linkwatch_run_queue+0x2ab/0x710 [ 591.102697] linkwatch_event+0x4e/0x70 14:18:12 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x1) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:18:12 executing program 7: readlinkat(0xffffffffffffffff, 0x0, &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:18:12 executing program 4: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:18:12 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, 0x0, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:18:12 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x3, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:18:12 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:18:12 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:18:12 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) [ 599.780022] loop0: detected capacity change from 0 to 264192 [ 599.806409] loop4: detected capacity change from 0 to 264192 [ 599.807846] vfat: Unknown parameter 'obj_user' [ 599.812800] loop7: detected capacity change from 0 to 264192 [ 599.834191] loop6: detected capacity change from 0 to 264192 14:18:12 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:18:12 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:18:12 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 599.947776] FAT-fs (loop2): invalid media value (0x08) [ 599.948268] FAT-fs (loop2): Can't find a valid FAT filesystem [ 599.997284] loop4: detected capacity change from 0 to 264192 [ 600.050065] kmemleak: Found object by alias at 0x607f1a638234 [ 600.050083] CPU: 0 UID: 0 PID: 6846 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 600.050101] Tainted: [W]=WARN [ 600.050105] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 600.050112] Call Trace: [ 600.050116] [ 600.050121] dump_stack_lvl+0xca/0x120 [ 600.050145] __lookup_object+0x94/0xb0 [ 600.050162] delete_object_full+0x27/0x70 [ 600.050178] free_percpu+0x30/0x1160 [ 600.050194] ? arch_uprobe_clear_state+0x16/0x140 [ 600.050214] futex_hash_free+0x38/0xc0 [ 600.050228] mmput+0x2d3/0x390 [ 600.050247] do_exit+0x79d/0x2970 [ 600.050260] ? lock_release+0xc8/0x290 [ 600.050276] ? __pfx_do_exit+0x10/0x10 [ 600.050290] ? find_held_lock+0x2b/0x80 [ 600.050315] ? get_signal+0x835/0x2340 [ 600.050335] do_group_exit+0xd3/0x2a0 [ 600.050349] get_signal+0x2315/0x2340 [ 600.050369] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 600.050385] ? __pfx_get_signal+0x10/0x10 [ 600.050401] ? do_futex+0x135/0x370 [ 600.050414] ? __pfx_do_futex+0x10/0x10 [ 600.050429] arch_do_signal_or_restart+0x80/0x790 [ 600.050446] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 600.050462] ? __x64_sys_futex+0x1c9/0x4d0 [ 600.050474] ? __x64_sys_futex+0x1d2/0x4d0 [ 600.050487] ? fput_close_sync+0x114/0x240 [ 600.050503] ? __pfx___x64_sys_futex+0x10/0x10 [ 600.050515] ? __pfx_fput_close_sync+0x10/0x10 [ 600.050530] ? dnotify_flush+0x79/0x4c0 [ 600.050545] exit_to_user_mode_loop+0x8b/0x110 [ 600.050557] do_syscall_64+0x2f7/0x360 [ 600.050573] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 600.050585] RIP: 0033:0x7f94594c7b19 [ 600.050594] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 600.050599] RSP: 002b:00007f9456a1c218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 600.050611] RAX: fffffffffffffe00 RBX: 00007f94595db028 RCX: 00007f94594c7b19 [ 600.050619] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595db028 [ 600.050626] RBP: 00007f94595db020 R08: 0000000000000000 R09: 0000000000000000 [ 600.050633] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595db02c [ 600.050640] R13: 00007ffcd48876ff R14: 00007f9456a1c300 R15: 0000000000022000 [ 600.050656] [ 600.050659] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 600.050666] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 600.050673] kmemleak: min_count = 1 [ 600.050677] kmemleak: count = 1 [ 600.050680] kmemleak: flags = 0x21 [ 600.050684] kmemleak: checksum = 0 [ 600.050688] kmemleak: backtrace: [ 600.050692] pcpu_alloc_noprof+0x87a/0x1170 [ 600.050706] fib_nh_common_init+0x30/0xd0 [ 600.050719] fib6_nh_init+0x968/0x1a00 [ 600.050729] ip6_route_info_create_nh+0x530/0xf80 [ 600.050739] ip6_route_add.part.0+0x59/0x170 [ 600.050749] ip6_route_add+0x48/0x60 [ 600.050758] addrconf_add_mroute+0x12d/0x190 [ 600.050769] addrconf_add_dev+0x148/0x1c0 [ 600.050782] addrconf_dev_config+0x1e9/0x430 [ 600.050795] addrconf_notify+0xa70/0x1920 [ 600.050811] notifier_call_chain+0xc0/0x360 [ 600.050821] call_netdevice_notifiers_info+0xbe/0x140 [ 600.050833] netif_state_change+0x157/0x330 [ 600.050842] linkwatch_do_dev+0x111/0x150 [ 600.050852] __linkwatch_run_queue+0x2ab/0x710 [ 600.050862] linkwatch_event+0x4e/0x70 14:18:20 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, 0x0, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:18:20 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:18:20 executing program 4: syz_mount_image$vfat(0x0, 0x0, 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:18:20 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={0x0, 0x0, 0x0}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:18:20 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, 0x0, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:18:20 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 607.931931] loop6: detected capacity change from 0 to 264192 14:18:20 executing program 7: readlinkat(0xffffffffffffffff, 0x0, &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:18:20 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:18:20 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, 0x0, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 607.984182] loop0: detected capacity change from 0 to 264192 [ 607.991502] vfat: Unknown parameter 'obj_user' [ 608.027039] FAT-fs (loop2): invalid media value (0x08) [ 608.027503] FAT-fs (loop2): Can't find a valid FAT filesystem [ 608.031873] loop7: detected capacity change from 0 to 264192 [ 608.035868] loop4: detected capacity change from 0 to 264192 14:18:20 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea677", 0x63, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 608.064353] loop6: detected capacity change from 0 to 264192 14:18:20 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 608.146403] loop0: detected capacity change from 0 to 264192 [ 608.151446] vfat: Unknown parameter 'obj_user' [ 608.173128] loop6: detected capacity change from 0 to 264192 14:18:20 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, 0x0, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:18:20 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:18:20 executing program 4: syz_mount_image$vfat(0x0, 0x0, 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:18:20 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:18:20 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea677", 0x63, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 608.251673] loop6: detected capacity change from 0 to 264192 [ 608.253878] loop0: detected capacity change from 0 to 264192 [ 608.259382] vfat: Unknown parameter 'obj_user' 14:18:21 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea677", 0x63, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:18:21 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 608.350237] loop4: detected capacity change from 0 to 264192 [ 608.361217] loop7: detected capacity change from 0 to 264192 [ 608.375237] kmemleak: Found object by alias at 0x607f1a638234 [ 608.375268] CPU: 0 UID: 0 PID: 6864 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 608.375301] Tainted: [W]=WARN [ 608.375308] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 608.375322] Call Trace: [ 608.375329] [ 608.375337] dump_stack_lvl+0xca/0x120 [ 608.375377] __lookup_object+0x94/0xb0 [ 608.375406] delete_object_full+0x27/0x70 [ 608.375436] free_percpu+0x30/0x1160 [ 608.375464] ? arch_uprobe_clear_state+0x16/0x140 [ 608.375500] futex_hash_free+0x38/0xc0 [ 608.375524] mmput+0x2d3/0x390 [ 608.375558] do_exit+0x79d/0x2970 [ 608.375589] ? lock_release+0xc8/0x290 [ 608.375619] ? __pfx_do_exit+0x10/0x10 [ 608.375645] ? find_held_lock+0x2b/0x80 [ 608.375676] ? get_signal+0x835/0x2340 [ 608.375711] do_group_exit+0xd3/0x2a0 [ 608.375738] get_signal+0x2315/0x2340 [ 608.375774] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 608.375803] ? __pfx_get_signal+0x10/0x10 [ 608.375832] ? do_futex+0x135/0x370 [ 608.375858] ? __pfx_do_futex+0x10/0x10 [ 608.375885] arch_do_signal_or_restart+0x80/0x790 [ 608.375916] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 608.375946] ? __x64_sys_futex+0x1c9/0x4d0 [ 608.375969] ? __x64_sys_futex+0x1d2/0x4d0 [ 608.375994] ? fput_close_sync+0x114/0x240 [ 608.376022] ? __pfx___x64_sys_futex+0x10/0x10 [ 608.376045] ? __pfx_fput_close_sync+0x10/0x10 [ 608.376072] ? dnotify_flush+0x79/0x4c0 [ 608.376101] exit_to_user_mode_loop+0x8b/0x110 [ 608.376123] do_syscall_64+0x2f7/0x360 [ 608.376145] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 608.376167] RIP: 0033:0x7f94594c7b19 [ 608.376183] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 608.376192] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 608.376213] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 608.376227] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 608.376240] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 608.376253] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 608.376266] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 608.376296] [ 608.376303] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 608.376315] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 608.376328] kmemleak: min_count = 1 [ 608.376335] kmemleak: count = 1 [ 608.376342] kmemleak: flags = 0x21 [ 608.376349] kmemleak: checksum = 0 [ 608.376356] kmemleak: backtrace: [ 608.376362] pcpu_alloc_noprof+0x87a/0x1170 [ 608.376389] fib_nh_common_init+0x30/0xd0 [ 608.376410] fib6_nh_init+0x968/0x1a00 [ 608.376428] ip6_route_info_create_nh+0x530/0xf80 [ 608.376447] ip6_route_add.part.0+0x59/0x170 [ 608.376464] ip6_route_add+0x48/0x60 [ 608.376481] addrconf_add_mroute+0x12d/0x190 [ 608.376501] addrconf_add_dev+0x148/0x1c0 [ 608.376524] addrconf_dev_config+0x1e9/0x430 [ 608.376550] addrconf_notify+0xa70/0x1920 [ 608.376579] notifier_call_chain+0xc0/0x360 [ 608.376596] call_netdevice_notifiers_info+0xbe/0x140 [ 608.376617] netif_state_change+0x157/0x330 [ 608.376634] linkwatch_do_dev+0x111/0x150 [ 608.376655] __linkwatch_run_queue+0x2ab/0x710 [ 608.376676] linkwatch_event+0x4e/0x70 [ 608.377807] loop0: detected capacity change from 0 to 264192 [ 608.409183] loop6: detected capacity change from 0 to 264192 14:18:21 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={0x0, 0x0, 0x0}, 0x0) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:18:21 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(0x0, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:18:21 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) [ 608.486464] vfat: Unknown parameter 'obj_user' [ 608.584452] FAT-fs (loop2): invalid media value (0x08) [ 608.585355] FAT-fs (loop2): Can't find a valid FAT filesystem [ 608.657416] kmemleak: Found object by alias at 0x607f1a638234 [ 608.657448] CPU: 0 UID: 0 PID: 6911 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 608.657482] Tainted: [W]=WARN [ 608.657489] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 608.657502] Call Trace: [ 608.657509] [ 608.657517] dump_stack_lvl+0xca/0x120 [ 608.657557] __lookup_object+0x94/0xb0 [ 608.657595] delete_object_full+0x27/0x70 [ 608.657624] free_percpu+0x30/0x1160 [ 608.657654] ? arch_uprobe_clear_state+0x16/0x140 [ 608.657689] futex_hash_free+0x38/0xc0 [ 608.657714] mmput+0x2d3/0x390 [ 608.657748] do_exit+0x79d/0x2970 [ 608.657773] ? signal_wake_up_state+0x85/0x120 [ 608.657801] ? zap_other_threads+0x2b9/0x3a0 [ 608.657830] ? __pfx_do_exit+0x10/0x10 [ 608.657853] ? do_group_exit+0x1c3/0x2a0 [ 608.657878] ? lock_release+0xc8/0x290 [ 608.657909] do_group_exit+0xd3/0x2a0 [ 608.657936] __x64_sys_exit_group+0x3e/0x50 [ 608.657962] x64_sys_call+0x18c5/0x18d0 [ 608.657990] do_syscall_64+0xbf/0x360 [ 608.658011] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 608.658031] RIP: 0033:0x7f94594c7b19 [ 608.658047] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 608.658057] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 608.658077] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 608.658091] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 608.658105] RBP: 0000000000000000 R08: 0000001b2cd2a5e0 R09: 0000000000000000 [ 608.658118] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 608.658130] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 608.658159] [ 608.658165] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 608.658177] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 608.658190] kmemleak: min_count = 1 [ 608.658197] kmemleak: count = 1 [ 608.658204] kmemleak: flags = 0x21 [ 608.658210] kmemleak: checksum = 0 [ 608.658217] kmemleak: backtrace: [ 608.658223] pcpu_alloc_noprof+0x87a/0x1170 [ 608.658251] fib_nh_common_init+0x30/0xd0 [ 608.658272] fib6_nh_init+0x968/0x1a00 [ 608.658297] ip6_route_info_create_nh+0x530/0xf80 [ 608.658324] ip6_route_add.part.0+0x59/0x170 [ 608.658352] ip6_route_add+0x48/0x60 [ 608.658377] addrconf_add_mroute+0x12d/0x190 [ 608.658403] addrconf_add_dev+0x148/0x1c0 [ 608.658427] addrconf_dev_config+0x1e9/0x430 [ 608.658469] addrconf_notify+0xa70/0x1920 [ 608.658499] notifier_call_chain+0xc0/0x360 [ 608.658517] call_netdevice_notifiers_info+0xbe/0x140 [ 608.658537] netif_state_change+0x157/0x330 [ 608.658553] linkwatch_do_dev+0x111/0x150 [ 608.658572] __linkwatch_run_queue+0x2ab/0x710 [ 608.658590] linkwatch_event+0x4e/0x70 14:18:31 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:18:31 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) 14:18:31 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, 0x0, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:18:31 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:18:31 executing program 4: syz_mount_image$vfat(0x0, 0x0, 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:18:31 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={0x0, 0x0, 0x0}, 0x0) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:18:31 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957", 0x74, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:18:31 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 619.222936] loop7: detected capacity change from 0 to 264192 [ 619.224196] loop4: detected capacity change from 0 to 264192 [ 619.269351] loop6: detected capacity change from 0 to 264192 14:18:32 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 619.308105] loop0: detected capacity change from 0 to 264192 14:18:32 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) [ 619.344732] vfat: Unknown parameter 'obj_user' [ 619.392103] FAT-fs (loop2): invalid media value (0x08) [ 619.393223] FAT-fs (loop2): Can't find a valid FAT filesystem [ 619.418929] loop4: detected capacity change from 0 to 264192 [ 619.462756] kmemleak: Found object by alias at 0x607f1a638234 [ 619.462783] CPU: 0 UID: 0 PID: 6930 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 619.462812] Tainted: [W]=WARN [ 619.462818] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 619.462829] Call Trace: [ 619.462835] [ 619.462843] dump_stack_lvl+0xca/0x120 [ 619.462879] __lookup_object+0x94/0xb0 [ 619.462904] delete_object_full+0x27/0x70 [ 619.462929] free_percpu+0x30/0x1160 [ 619.462954] ? arch_uprobe_clear_state+0x16/0x140 [ 619.462985] futex_hash_free+0x38/0xc0 [ 619.463007] mmput+0x2d3/0x390 [ 619.463036] do_exit+0x79d/0x2970 [ 619.463056] ? signal_wake_up_state+0x85/0x120 [ 619.463081] ? zap_other_threads+0x2b9/0x3a0 [ 619.463106] ? __pfx_do_exit+0x10/0x10 [ 619.463127] ? do_group_exit+0x1c3/0x2a0 [ 619.463148] ? lock_release+0xc8/0x290 [ 619.463174] do_group_exit+0xd3/0x2a0 [ 619.463198] __x64_sys_exit_group+0x3e/0x50 [ 619.463220] x64_sys_call+0x18c5/0x18d0 [ 619.463244] do_syscall_64+0xbf/0x360 [ 619.463262] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 619.463280] RIP: 0033:0x7f94594c7b19 [ 619.463293] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 619.463302] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 619.463320] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 619.463332] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 619.463344] RBP: 0000000000000000 R08: 0000001b2cd210b0 R09: 0000000000000000 [ 619.463355] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 619.463366] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 619.463391] [ 619.463397] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 619.463407] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 619.463418] kmemleak: min_count = 1 [ 619.463424] kmemleak: count = 1 [ 619.463430] kmemleak: flags = 0x21 [ 619.463436] kmemleak: checksum = 0 [ 619.463442] kmemleak: backtrace: [ 619.463447] pcpu_alloc_noprof+0x87a/0x1170 [ 619.463471] fib_nh_common_init+0x30/0xd0 [ 619.463489] fib6_nh_init+0x968/0x1a00 [ 619.463505] ip6_route_info_create_nh+0x530/0xf80 [ 619.463521] ip6_route_add.part.0+0x59/0x170 [ 619.463537] ip6_route_add+0x48/0x60 [ 619.463551] addrconf_add_mroute+0x12d/0x190 [ 619.463575] addrconf_add_dev+0x148/0x1c0 [ 619.463595] addrconf_dev_config+0x1e9/0x430 [ 619.463617] addrconf_notify+0xa70/0x1920 [ 619.463642] notifier_call_chain+0xc0/0x360 [ 619.463658] call_netdevice_notifiers_info+0xbe/0x140 [ 619.463676] netif_state_change+0x157/0x330 [ 619.463690] linkwatch_do_dev+0x111/0x150 [ 619.463707] __linkwatch_run_queue+0x2ab/0x710 [ 619.463723] linkwatch_event+0x4e/0x70 14:18:32 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 619.528716] loop7: detected capacity change from 0 to 264192 [ 619.581430] loop6: detected capacity change from 0 to 264192 14:18:42 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x0, 0x0, 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:18:42 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x0) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:18:42 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={0x0, 0x0, 0x0}, 0x0) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:18:42 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:18:42 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) 14:18:42 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:18:42 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0xfb, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:18:42 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957", 0x74, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:18:42 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x0, 0x0, 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 629.523889] loop6: detected capacity change from 0 to 264192 [ 629.527643] loop0: detected capacity change from 0 to 264192 [ 629.533293] loop7: detected capacity change from 0 to 264192 [ 629.543107] vfat: Unknown parameter 'obj_user' 14:18:42 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:18:42 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x0, 0x0, 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 629.650250] FAT-fs (loop2): invalid media value (0x08) 14:18:42 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x0) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 629.651368] FAT-fs (loop2): Can't find a valid FAT filesystem 14:18:42 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957", 0x74, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 629.687361] kmemleak: Found object by alias at 0x607f1a638234 [ 629.687388] CPU: 0 UID: 0 PID: 6978 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 629.687424] Tainted: [W]=WARN [ 629.687431] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 629.687444] Call Trace: [ 629.687451] [ 629.687459] dump_stack_lvl+0xca/0x120 [ 629.687501] __lookup_object+0x94/0xb0 [ 629.687531] delete_object_full+0x27/0x70 [ 629.687561] free_percpu+0x30/0x1160 [ 629.687599] ? arch_uprobe_clear_state+0x16/0x140 [ 629.687636] futex_hash_free+0x38/0xc0 [ 629.687662] mmput+0x2d3/0x390 [ 629.687697] do_exit+0x79d/0x2970 [ 629.687722] ? lock_release+0xc8/0x290 [ 629.687753] ? __pfx_do_exit+0x10/0x10 [ 629.687780] ? find_held_lock+0x2b/0x80 [ 629.687813] ? get_signal+0x835/0x2340 [ 629.687850] do_group_exit+0xd3/0x2a0 [ 629.687879] get_signal+0x2315/0x2340 [ 629.687918] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 629.687949] ? __pfx_get_signal+0x10/0x10 [ 629.687980] ? do_futex+0x135/0x370 [ 629.688007] ? __pfx_do_futex+0x10/0x10 [ 629.688036] arch_do_signal_or_restart+0x80/0x790 [ 629.688069] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 629.688100] ? __x64_sys_futex+0x1c9/0x4d0 [ 629.688124] ? __x64_sys_futex+0x1d2/0x4d0 [ 629.688150] ? fput_close_sync+0x114/0x240 [ 629.688181] ? __pfx___x64_sys_futex+0x10/0x10 [ 629.688205] ? __pfx_fput_close_sync+0x10/0x10 [ 629.688234] ? dnotify_flush+0x79/0x4c0 [ 629.688254] ? xfd_validate_state+0x55/0x180 [ 629.688293] exit_to_user_mode_loop+0x8b/0x110 [ 629.688317] do_syscall_64+0x2f7/0x360 [ 629.688338] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 629.688361] RIP: 0033:0x7f94594c7b19 [ 629.688377] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 629.688388] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 629.688409] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 629.688424] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 629.688438] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 629.688452] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 629.688465] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 629.688497] [ 629.688504] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 629.688517] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 629.688531] kmemleak: min_count = 1 [ 629.688538] kmemleak: count = 1 [ 629.688546] kmemleak: flags = 0x21 [ 629.688553] kmemleak: checksum = 0 [ 629.688560] kmemleak: backtrace: [ 629.688567] pcpu_alloc_noprof+0x87a/0x1170 [ 629.688596] fib_nh_common_init+0x30/0xd0 [ 629.688618] fib6_nh_init+0x968/0x1a00 [ 629.688637] ip6_route_info_create_nh+0x530/0xf80 [ 629.688657] ip6_route_add.part.0+0x59/0x170 [ 629.688676] ip6_route_add+0x48/0x60 [ 629.688694] addrconf_add_mroute+0x12d/0x190 [ 629.688714] addrconf_add_dev+0x148/0x1c0 [ 629.688739] addrconf_dev_config+0x1e9/0x430 [ 629.688766] addrconf_notify+0xa70/0x1920 [ 629.688798] notifier_call_chain+0xc0/0x360 [ 629.688816] call_netdevice_notifiers_info+0xbe/0x140 [ 629.688838] netif_state_change+0x157/0x330 [ 629.688855] linkwatch_do_dev+0x111/0x150 [ 629.688875] __linkwatch_run_queue+0x2ab/0x710 [ 629.688894] linkwatch_event+0x4e/0x70 [ 629.760082] loop0: detected capacity change from 0 to 264192 14:18:42 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) [ 629.769041] loop6: detected capacity change from 0 to 264192 [ 629.773182] vfat: Unknown parameter 'obj_user' 14:18:42 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:18:42 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) 14:18:42 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:18:42 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={0x0, 0x0, 0x0}, 0x0) socketpair(0x0, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) [ 629.841084] loop4: detected capacity change from 0 to 264192 [ 629.845870] loop7: detected capacity change from 0 to 264192 [ 629.955425] FAT-fs (loop2): invalid media value (0x08) [ 629.956314] FAT-fs (loop2): Can't find a valid FAT filesystem [ 629.991142] kmemleak: Found object by alias at 0x607f1a638234 [ 629.991167] CPU: 0 UID: 0 PID: 7001 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 629.991200] Tainted: [W]=WARN [ 629.991207] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 629.991220] Call Trace: [ 629.991227] [ 629.991235] dump_stack_lvl+0xca/0x120 [ 629.991275] __lookup_object+0x94/0xb0 [ 629.991304] delete_object_full+0x27/0x70 [ 629.991333] free_percpu+0x30/0x1160 [ 629.991362] ? arch_uprobe_clear_state+0x16/0x140 [ 629.991399] futex_hash_free+0x38/0xc0 [ 629.991423] mmput+0x2d3/0x390 [ 629.991458] do_exit+0x79d/0x2970 [ 629.991482] ? lock_release+0xc8/0x290 [ 629.991512] ? __pfx_do_exit+0x10/0x10 [ 629.991538] ? find_held_lock+0x2b/0x80 [ 629.991576] ? get_signal+0x835/0x2340 [ 629.991612] do_group_exit+0xd3/0x2a0 [ 629.991640] get_signal+0x2315/0x2340 [ 629.991672] ? fd_install+0x1d8/0x660 [ 629.991691] ? putname.part.0+0x11b/0x160 [ 629.991725] ? __pfx_get_signal+0x10/0x10 [ 629.991755] ? do_futex+0x135/0x370 [ 629.991780] ? __pfx_do_futex+0x10/0x10 [ 629.991808] arch_do_signal_or_restart+0x80/0x790 [ 629.991839] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 629.991869] ? __x64_sys_futex+0x1c9/0x4d0 [ 629.991892] ? __x64_sys_futex+0x1d2/0x4d0 [ 629.991917] ? __x64_sys_openat+0x142/0x200 [ 629.991948] ? __pfx___x64_sys_futex+0x10/0x10 [ 629.991971] ? __pfx_fput_close_sync+0x10/0x10 [ 629.992009] exit_to_user_mode_loop+0x8b/0x110 [ 629.992032] do_syscall_64+0x2f7/0x360 [ 629.992053] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 629.992075] RIP: 0033:0x7f94594c7b19 [ 629.992090] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 629.992099] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 629.992120] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 629.992134] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 629.992147] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 629.992160] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 629.992173] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 629.992202] [ 629.992209] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 629.992221] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 629.992234] kmemleak: min_count = 1 [ 629.992241] kmemleak: count = 1 [ 629.992248] kmemleak: flags = 0x21 [ 629.992255] kmemleak: checksum = 0 [ 629.992262] kmemleak: backtrace: [ 629.992268] pcpu_alloc_noprof+0x87a/0x1170 [ 629.992296] fib_nh_common_init+0x30/0xd0 [ 629.992317] fib6_nh_init+0x968/0x1a00 [ 629.992336] ip6_route_info_create_nh+0x530/0xf80 [ 629.992354] ip6_route_add.part.0+0x59/0x170 [ 629.992372] ip6_route_add+0x48/0x60 [ 629.992389] addrconf_add_mroute+0x12d/0x190 [ 629.992408] addrconf_add_dev+0x148/0x1c0 [ 629.992432] addrconf_dev_config+0x1e9/0x430 [ 629.992458] addrconf_notify+0xa70/0x1920 [ 629.992488] notifier_call_chain+0xc0/0x360 [ 629.992506] call_netdevice_notifiers_info+0xbe/0x140 [ 629.992526] netif_state_change+0x157/0x330 [ 629.992543] linkwatch_do_dev+0x111/0x150 [ 629.992562] __linkwatch_run_queue+0x2ab/0x710 [ 629.992580] linkwatch_event+0x4e/0x70 14:18:50 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:18:50 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x0) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:18:50 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={0x0, 0x0, 0x0}, 0x0) socketpair(0x0, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:18:50 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:18:50 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:18:50 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc10", 0x7c, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:18:50 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) 14:18:50 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 637.785162] loop7: detected capacity change from 0 to 264192 [ 637.791264] FAT-fs (loop2): invalid media value (0x08) [ 637.791815] FAT-fs (loop2): Can't find a valid FAT filesystem [ 637.819414] loop4: detected capacity change from 0 to 264192 [ 637.829291] loop6: detected capacity change from 0 to 264192 [ 637.837452] loop0: detected capacity change from 0 to 264192 [ 637.854040] vfat: Unknown parameter 'obj_user' 14:18:50 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r0) [ 637.943251] loop7: detected capacity change from 0 to 264192 14:18:50 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:18:50 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, 0x0, 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 637.983328] kmemleak: Found object by alias at 0x607f1a638234 [ 637.983352] CPU: 0 UID: 0 PID: 7014 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 637.983371] Tainted: [W]=WARN [ 637.983375] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 637.983386] Call Trace: [ 637.983390] [ 637.983395] dump_stack_lvl+0xca/0x120 [ 637.983419] __lookup_object+0x94/0xb0 [ 637.983436] delete_object_full+0x27/0x70 [ 637.983452] free_percpu+0x30/0x1160 [ 637.983468] ? arch_uprobe_clear_state+0x16/0x140 [ 637.983488] futex_hash_free+0x38/0xc0 [ 637.983502] mmput+0x2d3/0x390 [ 637.983520] do_exit+0x79d/0x2970 [ 637.983533] ? signal_wake_up_state+0x85/0x120 [ 637.983553] ? zap_other_threads+0x2b9/0x3a0 [ 637.983569] ? __pfx_do_exit+0x10/0x10 [ 637.983581] ? do_group_exit+0x1c3/0x2a0 [ 637.983594] ? lock_release+0xc8/0x290 [ 637.983611] do_group_exit+0xd3/0x2a0 [ 637.983625] __x64_sys_exit_group+0x3e/0x50 [ 637.983639] x64_sys_call+0x18c5/0x18d0 [ 637.983654] do_syscall_64+0xbf/0x360 [ 637.983666] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 637.983677] RIP: 0033:0x7f94594c7b19 [ 637.983686] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 637.983691] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 637.983703] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 637.983710] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 637.983718] RBP: 0000000000000000 R08: 0000001b2cd24f34 R09: 0000000000000000 [ 637.983724] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 637.983731] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 637.983747] [ 637.983750] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 637.983757] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 637.983764] kmemleak: min_count = 1 [ 637.983768] kmemleak: count = 1 [ 637.983772] kmemleak: flags = 0x21 [ 637.983775] kmemleak: checksum = 0 [ 637.983779] kmemleak: backtrace: [ 637.983783] pcpu_alloc_noprof+0x87a/0x1170 [ 637.983797] fib_nh_common_init+0x30/0xd0 [ 637.983809] fib6_nh_init+0x968/0x1a00 [ 637.983820] ip6_route_info_create_nh+0x530/0xf80 [ 637.983830] ip6_route_add.part.0+0x59/0x170 [ 637.983840] ip6_route_add+0x48/0x60 [ 637.983849] addrconf_add_mroute+0x12d/0x190 [ 637.983860] addrconf_add_dev+0x148/0x1c0 [ 637.983872] addrconf_dev_config+0x1e9/0x430 [ 637.983887] addrconf_notify+0xa70/0x1920 [ 637.983902] notifier_call_chain+0xc0/0x360 [ 637.983912] call_netdevice_notifiers_info+0xbe/0x140 [ 637.983924] netif_state_change+0x157/0x330 [ 637.983933] linkwatch_do_dev+0x111/0x150 [ 637.983944] __linkwatch_run_queue+0x2ab/0x710 [ 637.983954] linkwatch_event+0x4e/0x70 14:18:50 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc10", 0x7c, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:18:50 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:18:50 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, 0x0, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 638.054332] loop4: detected capacity change from 0 to 264192 [ 638.110402] loop7: detected capacity change from 0 to 264192 [ 638.139898] loop6: detected capacity change from 0 to 264192 [ 638.156680] loop0: detected capacity change from 0 to 264192 [ 638.160309] vfat: Unknown parameter 'obj_user' [ 638.204334] FAT-fs (loop2): invalid media value (0x08) [ 638.204845] FAT-fs (loop2): Can't find a valid FAT filesystem [ 638.236954] kmemleak: Found object by alias at 0x607f1a638234 [ 638.236976] CPU: 0 UID: 0 PID: 7048 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 638.236999] Tainted: [W]=WARN [ 638.237003] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 638.237011] Call Trace: [ 638.237015] [ 638.237020] dump_stack_lvl+0xca/0x120 [ 638.237045] __lookup_object+0x94/0xb0 [ 638.237062] delete_object_full+0x27/0x70 [ 638.237077] free_percpu+0x30/0x1160 [ 638.237094] ? arch_uprobe_clear_state+0x16/0x140 [ 638.237114] futex_hash_free+0x38/0xc0 [ 638.237128] mmput+0x2d3/0x390 [ 638.237147] do_exit+0x79d/0x2970 [ 638.237160] ? signal_wake_up_state+0x85/0x120 [ 638.237176] ? zap_other_threads+0x2b9/0x3a0 [ 638.237191] ? __pfx_do_exit+0x10/0x10 [ 638.237203] ? do_group_exit+0x1c3/0x2a0 [ 638.237217] ? lock_release+0xc8/0x290 [ 638.237234] do_group_exit+0xd3/0x2a0 [ 638.237248] __x64_sys_exit_group+0x3e/0x50 [ 638.237262] x64_sys_call+0x18c5/0x18d0 [ 638.237277] do_syscall_64+0xbf/0x360 [ 638.237289] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 638.237300] RIP: 0033:0x7f94594c7b19 [ 638.237309] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 638.237315] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 638.237326] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 638.237334] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 638.237342] RBP: 0000000000000000 R08: 0000001b2cd24e68 R09: 0000000000000000 [ 638.237349] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 638.237355] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 638.237371] [ 638.237375] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 638.237381] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 638.237388] kmemleak: min_count = 1 [ 638.237392] kmemleak: count = 1 [ 638.237396] kmemleak: flags = 0x21 [ 638.237400] kmemleak: checksum = 0 [ 638.237403] kmemleak: backtrace: [ 638.237407] pcpu_alloc_noprof+0x87a/0x1170 [ 638.237422] fib_nh_common_init+0x30/0xd0 [ 638.237434] fib6_nh_init+0x968/0x1a00 [ 638.237444] ip6_route_info_create_nh+0x530/0xf80 [ 638.237454] ip6_route_add.part.0+0x59/0x170 [ 638.237464] ip6_route_add+0x48/0x60 [ 638.237473] addrconf_add_mroute+0x12d/0x190 [ 638.237484] addrconf_add_dev+0x148/0x1c0 [ 638.237496] addrconf_dev_config+0x1e9/0x430 [ 638.237510] addrconf_notify+0xa70/0x1920 [ 638.237526] notifier_call_chain+0xc0/0x360 [ 638.237536] call_netdevice_notifiers_info+0xbe/0x140 [ 638.237547] netif_state_change+0x157/0x330 [ 638.237556] linkwatch_do_dev+0x111/0x150 [ 638.237571] __linkwatch_run_queue+0x2ab/0x710 [ 638.237581] linkwatch_event+0x4e/0x70 14:19:00 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:19:00 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc10", 0x7c, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:00 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:19:00 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={0x0, 0x0, 0x0}, 0x0) socketpair(0x0, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) 14:19:00 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:19:00 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:19:00 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, 0x0, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:00 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, 0x0, 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 647.346923] FAT-fs (loop2): invalid media value (0x08) [ 647.348236] FAT-fs (loop2): Can't find a valid FAT filesystem [ 647.357903] loop6: detected capacity change from 0 to 264192 [ 647.362375] loop0: detected capacity change from 0 to 264192 [ 647.366601] vfat: Unknown parameter 'obj_user' 14:19:00 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, 0x0, 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:00 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bc", 0x80, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 647.454136] loop6: detected capacity change from 0 to 264192 [ 647.466486] loop4: detected capacity change from 0 to 264192 [ 647.480518] loop7: detected capacity change from 0 to 264192 [ 647.482520] kmemleak: Found object by alias at 0x607f1a638234 [ 647.482536] CPU: 1 UID: 0 PID: 7062 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 647.482554] Tainted: [W]=WARN [ 647.482563] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 647.482570] Call Trace: [ 647.482574] [ 647.482579] dump_stack_lvl+0xca/0x120 [ 647.482604] __lookup_object+0x94/0xb0 [ 647.482620] delete_object_full+0x27/0x70 [ 647.482636] free_percpu+0x30/0x1160 [ 647.482653] ? arch_uprobe_clear_state+0x16/0x140 [ 647.482673] futex_hash_free+0x38/0xc0 [ 647.482687] mmput+0x2d3/0x390 [ 647.482706] do_exit+0x79d/0x2970 [ 647.482719] ? lock_release+0xc8/0x290 [ 647.482735] ? __pfx_do_exit+0x10/0x10 [ 647.482749] ? find_held_lock+0x2b/0x80 [ 647.482766] ? get_signal+0x835/0x2340 [ 647.482786] do_group_exit+0xd3/0x2a0 [ 647.482801] get_signal+0x2315/0x2340 [ 647.482818] ? task_mm_cid_work+0x66a/0x840 [ 647.482840] ? __pfx_get_signal+0x10/0x10 [ 647.482856] ? do_futex+0x135/0x370 [ 647.482870] ? __pfx_do_futex+0x10/0x10 [ 647.482885] arch_do_signal_or_restart+0x80/0x790 [ 647.482903] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 647.482919] ? __x64_sys_futex+0x1c9/0x4d0 [ 647.482931] ? __x64_sys_futex+0x1d2/0x4d0 [ 647.482945] ? __pfx___x64_sys_futex+0x10/0x10 [ 647.482958] ? __pfx_fput_close_sync+0x10/0x10 [ 647.482974] ? xfd_validate_state+0x55/0x180 [ 647.482995] exit_to_user_mode_loop+0x8b/0x110 [ 647.483007] do_syscall_64+0x2f7/0x360 [ 647.483019] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 647.483041] RIP: 0033:0x7f94594c7b19 [ 647.483050] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 647.483055] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 647.483066] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 647.483074] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 647.483081] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 647.483088] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 647.483095] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 647.483111] [ 647.483114] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 647.483121] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 647.483128] kmemleak: min_count = 1 [ 647.483132] kmemleak: count = 1 [ 647.483136] kmemleak: flags = 0x21 [ 647.483139] kmemleak: checksum = 0 [ 647.483143] kmemleak: backtrace: [ 647.483147] pcpu_alloc_noprof+0x87a/0x1170 [ 647.483162] fib_nh_common_init+0x30/0xd0 [ 647.483174] fib6_nh_init+0x968/0x1a00 [ 647.483185] ip6_route_info_create_nh+0x530/0xf80 [ 647.483195] ip6_route_add.part.0+0x59/0x170 [ 647.483204] ip6_route_add+0x48/0x60 [ 647.483214] addrconf_add_mroute+0x12d/0x190 [ 647.483225] addrconf_add_dev+0x148/0x1c0 [ 647.483238] addrconf_dev_config+0x1e9/0x430 [ 647.483252] addrconf_notify+0xa70/0x1920 [ 647.483268] notifier_call_chain+0xc0/0x360 [ 647.483278] call_netdevice_notifiers_info+0xbe/0x140 [ 647.483290] netif_state_change+0x157/0x330 [ 647.483298] linkwatch_do_dev+0x111/0x150 [ 647.483309] __linkwatch_run_queue+0x2ab/0x710 [ 647.483319] linkwatch_event+0x4e/0x70 14:19:00 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0x0, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:19:00 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, 0x0, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:00 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 647.589378] loop7: detected capacity change from 0 to 264192 14:19:00 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) [ 647.621468] loop0: detected capacity change from 0 to 264192 [ 647.631430] vfat: Unknown parameter 'obj_user' 14:19:00 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 647.634668] FAT-fs (loop2): invalid media value (0x08) [ 647.635774] FAT-fs (loop2): Can't find a valid FAT filesystem 14:19:00 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={0x0, 0x0, 0x0}, 0x0) socketpair(0x23, 0x0, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) [ 647.699123] loop6: detected capacity change from 0 to 264192 14:19:00 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 647.771786] loop4: detected capacity change from 0 to 264192 [ 647.893636] kmemleak: Found object by alias at 0x607f1a638234 [ 647.893666] CPU: 0 UID: 0 PID: 7089 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 647.893705] Tainted: [W]=WARN [ 647.893712] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 647.893724] Call Trace: [ 647.893731] [ 647.893740] dump_stack_lvl+0xca/0x120 [ 647.893780] __lookup_object+0x94/0xb0 [ 647.893809] delete_object_full+0x27/0x70 [ 647.893838] free_percpu+0x30/0x1160 [ 647.893866] ? arch_uprobe_clear_state+0x16/0x140 [ 647.893901] futex_hash_free+0x38/0xc0 [ 647.893926] mmput+0x2d3/0x390 [ 647.893959] do_exit+0x79d/0x2970 [ 647.893983] ? lock_release+0xc8/0x290 [ 647.894012] ? __pfx_do_exit+0x10/0x10 [ 647.894038] ? find_held_lock+0x2b/0x80 [ 647.894068] ? get_signal+0x835/0x2340 [ 647.894104] do_group_exit+0xd3/0x2a0 [ 647.894131] get_signal+0x2315/0x2340 [ 647.894163] ? task_mm_cid_work+0x368/0x840 [ 647.894202] ? __pfx_get_signal+0x10/0x10 [ 647.894232] ? do_futex+0x135/0x370 [ 647.894256] ? __pfx_do_futex+0x10/0x10 [ 647.894284] arch_do_signal_or_restart+0x80/0x790 [ 647.894316] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 647.894345] ? __x64_sys_futex+0x1c9/0x4d0 [ 647.894368] ? __x64_sys_futex+0x1d2/0x4d0 [ 647.894395] ? __pfx___x64_sys_futex+0x10/0x10 [ 647.894418] ? __pfx_fput_close_sync+0x10/0x10 [ 647.894447] ? xfd_validate_state+0x55/0x180 [ 647.894484] exit_to_user_mode_loop+0x8b/0x110 [ 647.894507] do_syscall_64+0x2f7/0x360 [ 647.894528] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 647.894549] RIP: 0033:0x7f94594c7b19 [ 647.894565] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 647.894575] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 647.894596] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 647.894610] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 647.894623] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 647.894636] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 647.894649] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 647.894678] [ 647.894685] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 647.894698] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 647.894711] kmemleak: min_count = 1 [ 647.894718] kmemleak: count = 1 [ 647.894725] kmemleak: flags = 0x21 [ 647.894732] kmemleak: checksum = 0 [ 647.894739] kmemleak: backtrace: [ 647.894745] pcpu_alloc_noprof+0x87a/0x1170 [ 647.894772] fib_nh_common_init+0x30/0xd0 [ 647.894794] fib6_nh_init+0x968/0x1a00 [ 647.894812] ip6_route_info_create_nh+0x530/0xf80 [ 647.894831] ip6_route_add.part.0+0x59/0x170 [ 647.894849] ip6_route_add+0x48/0x60 [ 647.894865] addrconf_add_mroute+0x12d/0x190 [ 647.894885] addrconf_add_dev+0x148/0x1c0 [ 647.894908] addrconf_dev_config+0x1e9/0x430 [ 647.894934] addrconf_notify+0xa70/0x1920 [ 647.894963] notifier_call_chain+0xc0/0x360 [ 647.894980] call_netdevice_notifiers_info+0xbe/0x140 [ 647.895001] netif_state_change+0x157/0x330 [ 647.895017] linkwatch_do_dev+0x111/0x150 [ 647.895056] __linkwatch_run_queue+0x2ab/0x710 [ 647.895075] linkwatch_event+0x4e/0x70 14:19:10 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bc", 0x80, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:10 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, 0x0, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:19:10 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:19:10 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:19:10 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:10 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0x0, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:19:10 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:10 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={0x0, 0x0, 0x0}, 0x0) socketpair(0x23, 0x0, 0x0, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000001080)) [ 657.827256] loop6: detected capacity change from 0 to 264192 [ 657.870379] loop7: detected capacity change from 0 to 264192 [ 657.871555] loop4: detected capacity change from 0 to 264192 [ 657.882013] loop0: detected capacity change from 0 to 264192 [ 657.911590] vfat: Unknown parameter 'obj_user' [ 657.922659] FAT-fs (loop2): invalid media value (0x08) [ 657.923517] FAT-fs (loop2): Can't find a valid FAT filesystem 14:19:10 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:10 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bc", 0x80, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:10 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 658.078002] loop6: detected capacity change from 0 to 264192 14:19:10 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0x0, 0xb4, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:19:10 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={0x0, 0x0, 0x0}, 0x0) socketpair(0x23, 0x0, 0x0, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, &(0x7f0000001080)) 14:19:10 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 658.171524] loop0: detected capacity change from 0 to 264192 [ 658.181880] vfat: Unknown parameter 'obj_user' [ 658.200842] loop4: detected capacity change from 0 to 264192 [ 658.214492] loop7: detected capacity change from 0 to 264192 14:19:10 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, 0x0, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:19:10 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x0, 0x0, 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 658.227979] kmemleak: Found object by alias at 0x607f1a638234 [ 658.228004] CPU: 0 UID: 0 PID: 7119 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 658.228038] Tainted: [W]=WARN [ 658.228045] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 658.228058] Call Trace: [ 658.228065] [ 658.228073] dump_stack_lvl+0xca/0x120 [ 658.228111] __lookup_object+0x94/0xb0 [ 658.228140] delete_object_full+0x27/0x70 [ 658.228169] free_percpu+0x30/0x1160 [ 658.228197] ? arch_uprobe_clear_state+0x16/0x140 [ 658.228232] futex_hash_free+0x38/0xc0 [ 658.228256] mmput+0x2d3/0x390 [ 658.228289] do_exit+0x79d/0x2970 [ 658.228312] ? lock_release+0xc8/0x290 [ 658.228342] ? __pfx_do_exit+0x10/0x10 [ 658.228367] ? find_held_lock+0x2b/0x80 [ 658.228397] ? get_signal+0x835/0x2340 [ 658.228440] do_group_exit+0xd3/0x2a0 [ 658.228467] get_signal+0x2315/0x2340 [ 658.228503] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 658.228532] ? __pfx_get_signal+0x10/0x10 [ 658.228561] ? do_futex+0x135/0x370 [ 658.228586] ? __pfx_do_futex+0x10/0x10 [ 658.228613] arch_do_signal_or_restart+0x80/0x790 [ 658.228647] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 658.228677] ? __x64_sys_futex+0x1c9/0x4d0 [ 658.228699] ? __x64_sys_futex+0x1d2/0x4d0 [ 658.228724] ? fput_close_sync+0x114/0x240 [ 658.228752] ? __pfx___x64_sys_futex+0x10/0x10 [ 658.228775] ? __pfx_fput_close_sync+0x10/0x10 [ 658.228801] ? dnotify_flush+0x79/0x4c0 [ 658.228829] exit_to_user_mode_loop+0x8b/0x110 [ 658.228852] do_syscall_64+0x2f7/0x360 [ 658.228873] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 658.228894] RIP: 0033:0x7f94594c7b19 [ 658.228910] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 658.228920] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 658.228940] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 658.228954] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 658.228967] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 658.228980] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 658.228993] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 658.229022] [ 658.229028] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 658.229041] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 658.229053] kmemleak: min_count = 1 [ 658.229060] kmemleak: count = 1 [ 658.229067] kmemleak: flags = 0x21 [ 658.229074] kmemleak: checksum = 0 [ 658.229081] kmemleak: backtrace: [ 658.229087] pcpu_alloc_noprof+0x87a/0x1170 [ 658.229114] fib_nh_common_init+0x30/0xd0 [ 658.229135] fib6_nh_init+0x968/0x1a00 [ 658.229152] ip6_route_info_create_nh+0x530/0xf80 [ 658.229171] ip6_route_add.part.0+0x59/0x170 [ 658.229189] ip6_route_add+0x48/0x60 [ 658.229205] addrconf_add_mroute+0x12d/0x190 [ 658.229224] addrconf_add_dev+0x148/0x1c0 [ 658.229247] addrconf_dev_config+0x1e9/0x430 [ 658.229273] addrconf_notify+0xa70/0x1920 [ 658.229302] notifier_call_chain+0xc0/0x360 [ 658.229319] call_netdevice_notifiers_info+0xbe/0x140 [ 658.229339] netif_state_change+0x157/0x330 [ 658.229356] linkwatch_do_dev+0x111/0x150 [ 658.229374] __linkwatch_run_queue+0x2ab/0x710 [ 658.229393] linkwatch_event+0x4e/0x70 14:19:11 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf", 0x82, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:11 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={0x0, 0x0, 0x0}, 0x0) socketpair(0x23, 0x0, 0x0, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, &(0x7f0000001080)) [ 658.393755] loop0: detected capacity change from 0 to 264192 [ 658.398122] vfat: Unknown parameter 'obj_user' 14:19:20 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf", 0x82, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:20 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:19:20 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:20 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, 0x0, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:19:20 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x0, 0x0, 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:20 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:19:20 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={0x0, 0x0, 0x0}, 0x0) socketpair(0x23, 0x0, 0x0, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, &(0x7f0000001080)) 14:19:20 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0x0, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 667.700464] loop4: detected capacity change from 0 to 264192 [ 667.712647] loop0: detected capacity change from 0 to 264192 [ 667.724794] loop7: detected capacity change from 0 to 264192 [ 667.732969] vfat: Unknown parameter 'obj_user' 14:19:20 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:19:20 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={0x0, 0x0, 0x0}, 0x0) socketpair(0x23, 0x0, 0x0, &(0x7f0000001040)) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, &(0x7f0000001080)) 14:19:20 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x0, 0x0, 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 667.839996] FAT-fs (loop2): invalid media value (0x08) [ 667.841175] FAT-fs (loop2): Can't find a valid FAT filesystem [ 667.842476] loop4: detected capacity change from 0 to 264192 14:19:20 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf", 0x82, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:20 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 667.927827] kmemleak: Found object by alias at 0x607f1a638234 [ 667.927855] CPU: 1 UID: 0 PID: 7188 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 667.927895] Tainted: [W]=WARN [ 667.927903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 667.927919] Call Trace: [ 667.927927] [ 667.927937] dump_stack_lvl+0xca/0x120 [ 667.927987] __lookup_object+0x94/0xb0 [ 667.928022] delete_object_full+0x27/0x70 [ 667.928058] free_percpu+0x30/0x1160 [ 667.928093] ? arch_uprobe_clear_state+0x16/0x140 [ 667.928136] futex_hash_free+0x38/0xc0 [ 667.928166] mmput+0x2d3/0x390 [ 667.928206] do_exit+0x79d/0x2970 [ 667.928236] ? lock_release+0xc8/0x290 [ 667.928276] ? __pfx_do_exit+0x10/0x10 [ 667.928308] ? find_held_lock+0x2b/0x80 [ 667.928346] ? get_signal+0x835/0x2340 [ 667.928389] do_group_exit+0xd3/0x2a0 [ 667.928420] get_signal+0x2315/0x2340 [ 667.928460] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 667.928493] ? __pfx_get_signal+0x10/0x10 [ 667.928526] ? do_futex+0x135/0x370 [ 667.928554] ? __pfx_do_futex+0x10/0x10 [ 667.928592] arch_do_signal_or_restart+0x80/0x790 [ 667.928627] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 667.928660] ? __x64_sys_futex+0x1c9/0x4d0 [ 667.928684] ? __x64_sys_futex+0x1d2/0x4d0 [ 667.928712] ? fput_close_sync+0x114/0x240 [ 667.928744] ? __pfx___x64_sys_futex+0x10/0x10 [ 667.928770] ? __pfx_fput_close_sync+0x10/0x10 [ 667.928800] ? dnotify_flush+0x79/0x4c0 [ 667.928831] exit_to_user_mode_loop+0x8b/0x110 [ 667.928856] do_syscall_64+0x2f7/0x360 [ 667.928880] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.928905] RIP: 0033:0x7f94594c7b19 [ 667.928923] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 667.928934] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 667.928958] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 667.928973] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 667.928988] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 667.929002] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 667.929016] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 667.929049] [ 667.929056] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 667.929070] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 667.929084] kmemleak: min_count = 1 [ 667.929092] kmemleak: count = 1 [ 667.929099] kmemleak: flags = 0x21 [ 667.929107] kmemleak: checksum = 0 [ 667.929115] kmemleak: backtrace: [ 667.929121] pcpu_alloc_noprof+0x87a/0x1170 [ 667.929151] fib_nh_common_init+0x30/0xd0 [ 667.929175] fib6_nh_init+0x968/0x1a00 [ 667.929195] ip6_route_info_create_nh+0x530/0xf80 [ 667.929215] ip6_route_add.part.0+0x59/0x170 [ 667.929235] ip6_route_add+0x48/0x60 [ 667.929254] addrconf_add_mroute+0x12d/0x190 [ 667.929275] addrconf_add_dev+0x148/0x1c0 [ 667.929301] addrconf_dev_config+0x1e9/0x430 [ 667.929329] addrconf_notify+0xa70/0x1920 [ 667.929361] notifier_call_chain+0xc0/0x360 [ 667.929381] call_netdevice_notifiers_info+0xbe/0x140 [ 667.929403] netif_state_change+0x157/0x330 [ 667.929422] linkwatch_do_dev+0x111/0x150 [ 667.929442] __linkwatch_run_queue+0x2ab/0x710 [ 667.929462] linkwatch_event+0x4e/0x70 14:19:20 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={0x0}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 668.038460] loop0: detected capacity change from 0 to 264192 [ 668.053257] vfat: Unknown parameter 'obj_user' [ 668.109158] loop7: detected capacity change from 0 to 264192 14:19:30 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:19:30 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:19:30 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={0x0}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:19:30 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf17", 0x83, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:30 executing program 5: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x4094) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f00000008c0)={'wpan1\x00'}) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000a40), r1) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e40), 0x0, 0x0) sendmsg$AUDIT_USER(r2, &(0x7f0000001000)={0x0, 0x0, 0x0}, 0x0) socketpair(0x23, 0x0, 0x0, &(0x7f0000001040)) ioctl$sock_inet_tcp_SIOCATMARK(0xffffffffffffffff, 0x8905, 0x0) 14:19:30 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:30 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x0) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:30 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0x0, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 677.404437] loop7: detected capacity change from 0 to 264192 [ 677.439339] loop6: detected capacity change from 0 to 264192 [ 677.456978] loop4: detected capacity change from 0 to 264192 14:19:30 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x0) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 677.478202] loop0: detected capacity change from 0 to 264192 [ 677.485369] vfat: Unknown parameter 'obj_user' [ 677.510308] loop7: detected capacity change from 0 to 264192 14:19:30 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={0x0}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:19:30 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 677.565307] FAT-fs (loop2): invalid media value (0x08) [ 677.566464] FAT-fs (loop2): Can't find a valid FAT filesystem 14:19:30 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:19:30 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf17", 0x83, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:30 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0x0, 0xd9, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 677.626539] loop6: detected capacity change from 0 to 264192 14:19:30 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x0) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 677.678789] loop4: detected capacity change from 0 to 264192 14:19:30 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 677.709020] kmemleak: Found object by alias at 0x607f1a638234 [ 677.709051] CPU: 0 UID: 0 PID: 7234 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 677.709086] Tainted: [W]=WARN [ 677.709094] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 677.709107] Call Trace: [ 677.709115] [ 677.709123] dump_stack_lvl+0xca/0x120 [ 677.709164] __lookup_object+0x94/0xb0 [ 677.709196] delete_object_full+0x27/0x70 [ 677.709227] free_percpu+0x30/0x1160 [ 677.709257] ? arch_uprobe_clear_state+0x16/0x140 [ 677.709295] futex_hash_free+0x38/0xc0 [ 677.709321] mmput+0x2d3/0x390 [ 677.709355] do_exit+0x79d/0x2970 [ 677.709381] ? lock_release+0xc8/0x290 [ 677.709412] ? __pfx_do_exit+0x10/0x10 [ 677.709440] ? find_held_lock+0x2b/0x80 [ 677.709472] ? get_signal+0x835/0x2340 [ 677.709510] do_group_exit+0xd3/0x2a0 [ 677.709539] get_signal+0x2315/0x2340 [ 677.709587] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 677.709617] ? __pfx_get_signal+0x10/0x10 [ 677.709649] ? do_futex+0x135/0x370 [ 677.709675] ? __pfx_do_futex+0x10/0x10 [ 677.709705] arch_do_signal_or_restart+0x80/0x790 [ 677.709738] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 677.709770] ? __x64_sys_futex+0x1c9/0x4d0 [ 677.709794] ? __x64_sys_futex+0x1d2/0x4d0 [ 677.709821] ? fput_close_sync+0x114/0x240 [ 677.709851] ? __pfx___x64_sys_futex+0x10/0x10 [ 677.709876] ? __pfx_fput_close_sync+0x10/0x10 [ 677.709905] ? dnotify_flush+0x79/0x4c0 [ 677.709935] exit_to_user_mode_loop+0x8b/0x110 [ 677.709959] do_syscall_64+0x2f7/0x360 [ 677.709981] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 677.710004] RIP: 0033:0x7f94594c7b19 [ 677.710020] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 677.710031] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 677.710053] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 677.710069] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 677.710082] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 677.710096] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 677.710110] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 677.710142] [ 677.710149] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 677.710162] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 677.710176] kmemleak: min_count = 1 [ 677.710183] kmemleak: count = 1 [ 677.710190] kmemleak: flags = 0x21 [ 677.710198] kmemleak: checksum = 0 [ 677.710205] kmemleak: backtrace: [ 677.710211] pcpu_alloc_noprof+0x87a/0x1170 [ 677.710240] fib_nh_common_init+0x30/0xd0 [ 677.710264] fib6_nh_init+0x968/0x1a00 [ 677.710282] ip6_route_info_create_nh+0x530/0xf80 [ 677.710302] ip6_route_add.part.0+0x59/0x170 [ 677.710322] ip6_route_add+0x48/0x60 [ 677.710340] addrconf_add_mroute+0x12d/0x190 [ 677.710361] addrconf_add_dev+0x148/0x1c0 [ 677.710386] addrconf_dev_config+0x1e9/0x430 [ 677.710413] addrconf_notify+0xa70/0x1920 [ 677.710445] notifier_call_chain+0xc0/0x360 [ 677.710464] call_netdevice_notifiers_info+0xbe/0x140 [ 677.710485] netif_state_change+0x157/0x330 [ 677.710503] linkwatch_do_dev+0x111/0x150 [ 677.710523] __linkwatch_run_queue+0x2ab/0x710 [ 677.710543] linkwatch_event+0x4e/0x70 [ 677.778985] loop0: detected capacity change from 0 to 264192 [ 677.787224] vfat: Unknown parameter 'obj_user' [ 677.797219] loop7: detected capacity change from 0 to 264192 [ 677.838920] loop5: detected capacity change from 0 to 264192 14:19:30 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 677.855649] loop4: detected capacity change from 0 to 264192 14:19:39 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:19:39 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:39 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf17", 0x83, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:39 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:19:39 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x0, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:19:39 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:19:39 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, 0x0, 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:39 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 686.327635] loop7: detected capacity change from 0 to 264192 [ 686.364613] loop6: detected capacity change from 0 to 264192 14:19:39 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, 0x0, 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 686.393041] loop4: detected capacity change from 0 to 264192 [ 686.396256] loop0: detected capacity change from 0 to 264192 [ 686.399737] loop5: detected capacity change from 0 to 264192 [ 686.403229] FAT-fs (loop2): invalid media value (0x08) [ 686.404160] FAT-fs (loop2): Can't find a valid FAT filesystem [ 686.410447] vfat: Unknown parameter 'obj_user' 14:19:39 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:39 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:19:39 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6d", 0x21, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:19:39 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 686.526328] loop7: detected capacity change from 0 to 264192 14:19:39 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x0, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 686.614239] loop6: detected capacity change from 0 to 264192 [ 686.647027] loop5: detected capacity change from 0 to 264192 14:19:39 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x0, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 686.662672] loop0: detected capacity change from 0 to 264192 [ 686.672476] vfat: Unknown parameter 'obj_user' [ 686.672914] loop4: detected capacity change from 0 to 264192 14:19:39 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, 0x0, 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 686.708035] kmemleak: Found object by alias at 0x607f1a638234 [ 686.708064] CPU: 1 UID: 0 PID: 7276 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 686.708102] Tainted: [W]=WARN [ 686.708110] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 686.708125] Call Trace: [ 686.708133] [ 686.708142] dump_stack_lvl+0xca/0x120 [ 686.708188] __lookup_object+0x94/0xb0 [ 686.708221] delete_object_full+0x27/0x70 [ 686.708254] free_percpu+0x30/0x1160 [ 686.708287] ? arch_uprobe_clear_state+0x16/0x140 [ 686.708330] futex_hash_free+0x38/0xc0 [ 686.708359] mmput+0x2d3/0x390 [ 686.708396] do_exit+0x79d/0x2970 [ 686.708425] ? lock_release+0xc8/0x290 [ 686.708459] ? __pfx_do_exit+0x10/0x10 [ 686.708487] ? find_held_lock+0x2b/0x80 [ 686.708522] ? get_signal+0x835/0x2340 [ 686.708570] do_group_exit+0xd3/0x2a0 [ 686.708601] get_signal+0x2315/0x2340 [ 686.708642] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 686.708676] ? __pfx_get_signal+0x10/0x10 [ 686.708709] ? do_futex+0x135/0x370 [ 686.708737] ? __pfx_do_futex+0x10/0x10 [ 686.708769] arch_do_signal_or_restart+0x80/0x790 [ 686.708804] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 686.708838] ? __x64_sys_futex+0x1c9/0x4d0 [ 686.708863] ? __x64_sys_futex+0x1d2/0x4d0 [ 686.708891] ? fput_close_sync+0x114/0x240 [ 686.708924] ? __pfx___x64_sys_futex+0x10/0x10 [ 686.708950] ? __pfx_fput_close_sync+0x10/0x10 [ 686.708981] ? dnotify_flush+0x79/0x4c0 [ 686.709014] exit_to_user_mode_loop+0x8b/0x110 [ 686.709039] do_syscall_64+0x2f7/0x360 [ 686.709064] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 686.709089] RIP: 0033:0x7f94594c7b19 [ 686.709107] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 686.709118] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 686.709141] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 686.709158] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 686.709173] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 686.709188] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 686.709203] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 686.709237] [ 686.709245] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 686.709259] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 686.709273] kmemleak: min_count = 1 [ 686.709282] kmemleak: count = 1 [ 686.709289] kmemleak: flags = 0x21 [ 686.709297] kmemleak: checksum = 0 [ 686.709305] kmemleak: backtrace: [ 686.709312] pcpu_alloc_noprof+0x87a/0x1170 [ 686.709342] fib_nh_common_init+0x30/0xd0 [ 686.709367] fib6_nh_init+0x968/0x1a00 [ 686.709387] ip6_route_info_create_nh+0x530/0xf80 [ 686.709408] ip6_route_add.part.0+0x59/0x170 [ 686.709428] ip6_route_add+0x48/0x60 [ 686.709447] addrconf_add_mroute+0x12d/0x190 [ 686.709470] addrconf_add_dev+0x148/0x1c0 [ 686.709497] addrconf_dev_config+0x1e9/0x430 [ 686.709526] addrconf_notify+0xa70/0x1920 [ 686.709559] notifier_call_chain+0xc0/0x360 [ 686.709580] call_netdevice_notifiers_info+0xbe/0x140 [ 686.709603] netif_state_change+0x157/0x330 [ 686.709623] linkwatch_do_dev+0x111/0x150 [ 686.709643] __linkwatch_run_queue+0x2ab/0x710 [ 686.709665] linkwatch_event+0x4e/0x70 [ 686.800805] loop7: detected capacity change from 0 to 264192 14:19:50 executing program 5: syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:19:50 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x0, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:19:50 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x0, 0x70bd25, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:19:50 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:50 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6d", 0x21, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:19:50 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:50 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:19:50 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 697.517875] loop4: detected capacity change from 0 to 264192 [ 697.525895] loop6: detected capacity change from 0 to 264192 [ 697.561909] loop0: detected capacity change from 0 to 264192 [ 697.568034] loop5: detected capacity change from 0 to 264192 [ 697.572029] loop7: detected capacity change from 0 to 264192 [ 697.580270] vfat: Unknown parameter 'obj_user' [ 697.615884] FAT-fs (loop2): invalid media value (0x08) [ 697.616730] FAT-fs (loop2): Can't find a valid FAT filesystem 14:19:50 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:50 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x0, 0x25dfdbfc, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 697.697143] kmemleak: Found object by alias at 0x607f1a638234 [ 697.697169] CPU: 0 UID: 0 PID: 7335 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 697.697194] Tainted: [W]=WARN [ 697.697200] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 697.697211] Call Trace: [ 697.697216] [ 697.697223] dump_stack_lvl+0xca/0x120 [ 697.697259] __lookup_object+0x94/0xb0 [ 697.697283] delete_object_full+0x27/0x70 [ 697.697306] free_percpu+0x30/0x1160 [ 697.697329] ? arch_uprobe_clear_state+0x16/0x140 [ 697.697358] futex_hash_free+0x38/0xc0 [ 697.697378] mmput+0x2d3/0x390 [ 697.697405] do_exit+0x79d/0x2970 [ 697.697424] ? lock_release+0xc8/0x290 [ 697.697447] ? __pfx_do_exit+0x10/0x10 [ 697.697467] ? find_held_lock+0x2b/0x80 [ 697.697491] ? get_signal+0x835/0x2340 [ 697.697520] do_group_exit+0xd3/0x2a0 [ 697.697541] get_signal+0x2315/0x2340 [ 697.697575] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 697.697599] ? __pfx_get_signal+0x10/0x10 [ 697.697622] ? do_futex+0x135/0x370 [ 697.697641] ? __pfx_do_futex+0x10/0x10 [ 697.697663] arch_do_signal_or_restart+0x80/0x790 [ 697.697687] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 697.697711] ? __x64_sys_futex+0x1c9/0x4d0 [ 697.697728] ? __x64_sys_futex+0x1d2/0x4d0 [ 697.697747] ? fput_close_sync+0x114/0x240 [ 697.697770] ? __pfx___x64_sys_futex+0x10/0x10 [ 697.697788] ? __pfx_fput_close_sync+0x10/0x10 [ 697.697809] ? dnotify_flush+0x79/0x4c0 [ 697.697832] exit_to_user_mode_loop+0x8b/0x110 [ 697.697850] do_syscall_64+0x2f7/0x360 [ 697.697867] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 697.697883] RIP: 0033:0x7f94594c7b19 [ 697.697896] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 697.697904] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 697.697919] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 697.697930] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 697.697941] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 697.697951] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 697.697961] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 697.697983] [ 697.697989] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 697.697998] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 697.698008] kmemleak: min_count = 1 [ 697.698013] kmemleak: count = 1 [ 697.698019] kmemleak: flags = 0x21 [ 697.698024] kmemleak: checksum = 0 [ 697.698030] kmemleak: backtrace: [ 697.698035] pcpu_alloc_noprof+0x87a/0x1170 [ 697.698056] fib_nh_common_init+0x30/0xd0 [ 697.698073] fib6_nh_init+0x968/0x1a00 [ 697.698088] ip6_route_info_create_nh+0x530/0xf80 [ 697.698102] ip6_route_add.part.0+0x59/0x170 [ 697.698115] ip6_route_add+0x48/0x60 [ 697.698128] addrconf_add_mroute+0x12d/0x190 [ 697.698144] addrconf_add_dev+0x148/0x1c0 [ 697.698163] addrconf_dev_config+0x1e9/0x430 [ 697.698183] addrconf_notify+0xa70/0x1920 [ 697.698206] notifier_call_chain+0xc0/0x360 [ 697.698221] call_netdevice_notifiers_info+0xbe/0x140 [ 697.698237] netif_state_change+0x157/0x330 [ 697.698249] linkwatch_do_dev+0x111/0x150 [ 697.698264] __linkwatch_run_queue+0x2ab/0x710 [ 697.698279] linkwatch_event+0x4e/0x70 14:19:50 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6d", 0x21, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:19:50 executing program 5: syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:19:50 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 697.784478] loop4: detected capacity change from 0 to 264192 14:19:50 executing program 2: pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:19:50 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:50 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x0, 0x40a, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 697.835537] loop6: detected capacity change from 0 to 264192 [ 697.860159] loop0: detected capacity change from 0 to 264192 14:19:50 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 697.900472] FAT-fs (loop2): invalid media value (0x08) [ 697.901112] FAT-fs (loop2): Can't find a valid FAT filesystem [ 697.902763] loop5: detected capacity change from 0 to 264192 [ 697.918995] vfat: Unknown parameter 'obj_user' [ 697.963880] loop7: detected capacity change from 0 to 264192 [ 697.969416] kmemleak: Found object by alias at 0x607f1a638234 [ 697.969435] CPU: 0 UID: 0 PID: 7354 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 697.969457] Tainted: [W]=WARN [ 697.969462] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 697.969471] Call Trace: [ 697.969476] [ 697.969481] dump_stack_lvl+0xca/0x120 [ 697.969513] __lookup_object+0x94/0xb0 [ 697.969533] delete_object_full+0x27/0x70 [ 697.969551] free_percpu+0x30/0x1160 [ 697.969575] ? arch_uprobe_clear_state+0x16/0x140 [ 697.969598] futex_hash_free+0x38/0xc0 [ 697.969614] mmput+0x2d3/0x390 [ 697.969636] do_exit+0x79d/0x2970 [ 697.969656] ? __pfx_do_exit+0x10/0x10 [ 697.969672] ? find_held_lock+0x2b/0x80 [ 697.969693] ? get_signal+0x835/0x2340 [ 697.969716] do_group_exit+0xd3/0x2a0 [ 697.969733] get_signal+0x2315/0x2340 [ 697.969753] ? put_task_stack+0xd2/0x240 [ 697.969769] ? __pfx_get_signal+0x10/0x10 [ 697.969788] ? __schedule+0xe91/0x3590 [ 697.969811] arch_do_signal_or_restart+0x80/0x790 [ 697.969831] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 697.969849] ? __x64_sys_futex+0x1c9/0x4d0 [ 697.969864] ? __x64_sys_futex+0x1d2/0x4d0 [ 697.969879] ? fput_close_sync+0x114/0x240 [ 697.969898] ? __pfx___x64_sys_futex+0x10/0x10 [ 697.969912] ? __pfx_fput_close_sync+0x10/0x10 [ 697.969929] ? dnotify_flush+0x79/0x4c0 [ 697.969947] exit_to_user_mode_loop+0x8b/0x110 [ 697.969963] do_syscall_64+0x2f7/0x360 [ 697.969977] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 697.969991] RIP: 0033:0x7f94594c7b19 [ 697.970002] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 697.970008] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 697.970021] RAX: 0000000000000001 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 697.970030] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f94595daf6c [ 697.970039] RBP: 00007f94595daf60 R08: 0000000000000002 R09: 0000000000000000 [ 697.970047] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007f94595daf6c [ 697.970055] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 697.970074] [ 697.970079] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 697.970086] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 697.970095] kmemleak: min_count = 1 [ 697.970099] kmemleak: count = 1 [ 697.970104] kmemleak: flags = 0x21 [ 697.970108] kmemleak: checksum = 0 [ 697.970112] kmemleak: backtrace: [ 697.970117] pcpu_alloc_noprof+0x87a/0x1170 [ 697.970134] fib_nh_common_init+0x30/0xd0 [ 697.970148] fib6_nh_init+0x968/0x1a00 [ 697.970160] ip6_route_info_create_nh+0x530/0xf80 [ 697.970172] ip6_route_add.part.0+0x59/0x170 [ 697.970183] ip6_route_add+0x48/0x60 [ 697.970193] addrconf_add_mroute+0x12d/0x190 [ 697.970206] addrconf_add_dev+0x148/0x1c0 [ 697.970221] addrconf_dev_config+0x1e9/0x430 [ 697.970237] addrconf_notify+0xa70/0x1920 [ 697.970255] notifier_call_chain+0xc0/0x360 [ 697.970268] call_netdevice_notifiers_info+0xbe/0x140 [ 697.970281] netif_state_change+0x157/0x330 [ 697.970292] linkwatch_do_dev+0x111/0x150 [ 697.970304] __linkwatch_run_queue+0x2ab/0x710 [ 697.970316] linkwatch_event+0x4e/0x70 14:19:50 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:50 executing program 5: syz_mount_image$vfat(0x0, 0x0, 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:19:50 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:50 executing program 2: pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) [ 698.093849] vfat: Unknown parameter 'obj_user' [ 698.147280] loop6: detected capacity change from 0 to 264192 14:19:50 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:19:50 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:19:50 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x0, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 698.182054] loop5: detected capacity change from 0 to 264192 14:19:50 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 698.215255] loop7: detected capacity change from 0 to 264192 [ 698.262885] loop4: detected capacity change from 0 to 264192 [ 698.271355] FAT-fs (loop2): invalid media value (0x08) [ 698.272342] FAT-fs (loop2): Can't find a valid FAT filesystem [ 698.284138] vfat: Unknown parameter 'obj_user' [ 698.385263] kmemleak: Found object by alias at 0x607f1a638234 [ 698.385294] CPU: 1 UID: 0 PID: 7384 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 698.385330] Tainted: [W]=WARN [ 698.385337] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 698.385352] Call Trace: [ 698.385359] [ 698.385368] dump_stack_lvl+0xca/0x120 [ 698.385413] __lookup_object+0x94/0xb0 [ 698.385445] delete_object_full+0x27/0x70 [ 698.385476] free_percpu+0x30/0x1160 [ 698.385507] ? arch_uprobe_clear_state+0x16/0x140 [ 698.385544] futex_hash_free+0x38/0xc0 [ 698.385580] mmput+0x2d3/0x390 [ 698.385616] do_exit+0x79d/0x2970 [ 698.385642] ? lock_release+0xc8/0x290 [ 698.385674] ? __pfx_do_exit+0x10/0x10 [ 698.385702] ? find_held_lock+0x2b/0x80 [ 698.385735] ? get_signal+0x835/0x2340 [ 698.385773] do_group_exit+0xd3/0x2a0 [ 698.385802] get_signal+0x2315/0x2340 [ 698.385841] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 698.385873] ? __pfx_get_signal+0x10/0x10 [ 698.385905] ? do_futex+0x135/0x370 [ 698.385932] ? __pfx_do_futex+0x10/0x10 [ 698.385962] arch_do_signal_or_restart+0x80/0x790 [ 698.385996] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 698.386028] ? __x64_sys_futex+0x1c9/0x4d0 [ 698.386052] ? __x64_sys_futex+0x1d2/0x4d0 [ 698.386079] ? fput_close_sync+0x114/0x240 [ 698.386110] ? __pfx___x64_sys_futex+0x10/0x10 [ 698.386135] ? __pfx_fput_close_sync+0x10/0x10 [ 698.386164] ? dnotify_flush+0x79/0x4c0 [ 698.386194] exit_to_user_mode_loop+0x8b/0x110 [ 698.386219] do_syscall_64+0x2f7/0x360 [ 698.386242] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 698.386265] RIP: 0033:0x7f94594c7b19 [ 698.386282] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 698.386293] RSP: 002b:00007f9456a1c218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 698.386315] RAX: fffffffffffffe00 RBX: 00007f94595db028 RCX: 00007f94594c7b19 [ 698.386331] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595db028 [ 698.386345] RBP: 00007f94595db020 R08: 0000000000000000 R09: 0000000000000000 [ 698.386360] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595db02c [ 698.386373] R13: 00007ffcd48876ff R14: 00007f9456a1c300 R15: 0000000000022000 [ 698.386405] [ 698.386412] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 698.386425] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 698.386440] kmemleak: min_count = 1 [ 698.386448] kmemleak: count = 1 [ 698.386455] kmemleak: flags = 0x21 [ 698.386463] kmemleak: checksum = 0 [ 698.386470] kmemleak: backtrace: [ 698.386477] pcpu_alloc_noprof+0x87a/0x1170 [ 698.386507] fib_nh_common_init+0x30/0xd0 [ 698.386530] fib6_nh_init+0x968/0x1a00 [ 698.386549] ip6_route_info_create_nh+0x530/0xf80 [ 698.386570] ip6_route_add.part.0+0x59/0x170 [ 698.386589] ip6_route_add+0x48/0x60 [ 698.386607] addrconf_add_mroute+0x12d/0x190 [ 698.386628] addrconf_add_dev+0x148/0x1c0 [ 698.386654] addrconf_dev_config+0x1e9/0x430 [ 698.386682] addrconf_notify+0xa70/0x1920 [ 698.386714] notifier_call_chain+0xc0/0x360 [ 698.386733] call_netdevice_notifiers_info+0xbe/0x140 [ 698.386755] netif_state_change+0x157/0x330 [ 698.386773] linkwatch_do_dev+0x111/0x150 [ 698.386793] __linkwatch_run_queue+0x2ab/0x710 [ 698.386813] linkwatch_event+0x4e/0x70 14:20:00 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x0, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:20:00 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:20:00 executing program 2: pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:20:00 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x0, 0x0, 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:20:00 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:00 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0xc4, 0x3ed, 0x100, 0x0, 0x0, "d7a53a5d0f6cf7b99a8049f090f1f1e6efb9c99c34f55811fd41e5efdc9ea6c5db40081161efca696b5826d15d73a3762e2654489ae57f4a2f893fe9fbc27804f1f35efe12a655dc9ef6b9be0bb407c3613cc33006b9fe99f6185fb0451abb972caa33a1b67e5356da878b4a2a21a4864c08f53f30c733989cde81ee877cc81e05109becdbb8f6e48b3691e1e81e0b624f6ecb29b3f3435b850544767fe8055e2c7c4b500727734bcd20cb1a05ca63b4d4483f16", ["", "", "", "", "", "", "", ""]}, 0xc4}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:20:00 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:00 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x0, 0x0, 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 707.530463] loop4: detected capacity change from 0 to 264192 [ 707.547229] loop6: detected capacity change from 0 to 264192 [ 707.563996] vfat: Unknown parameter 'obj_user' 14:20:00 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x0, 0x0, 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:20:00 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5", 0x11, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 707.588036] FAT-fs (loop2): invalid media value (0x08) [ 707.588488] FAT-fs (loop2): Can't find a valid FAT filesystem [ 707.641140] kmemleak: Found object by alias at 0x607f1a638234 [ 707.641162] CPU: 0 UID: 0 PID: 7409 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 707.641181] Tainted: [W]=WARN [ 707.641185] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 707.641193] Call Trace: [ 707.641197] [ 707.641202] dump_stack_lvl+0xca/0x120 [ 707.641226] __lookup_object+0x94/0xb0 [ 707.641243] delete_object_full+0x27/0x70 [ 707.641259] free_percpu+0x30/0x1160 [ 707.641276] ? arch_uprobe_clear_state+0x16/0x140 [ 707.641296] futex_hash_free+0x38/0xc0 [ 707.641311] mmput+0x2d3/0x390 [ 707.641329] do_exit+0x79d/0x2970 [ 707.641343] ? lock_release+0xc8/0x290 [ 707.641359] ? __pfx_do_exit+0x10/0x10 [ 707.641373] ? find_held_lock+0x2b/0x80 [ 707.641390] ? get_signal+0x835/0x2340 [ 707.641410] do_group_exit+0xd3/0x2a0 [ 707.641425] get_signal+0x2315/0x2340 [ 707.641444] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 707.641460] ? __pfx_get_signal+0x10/0x10 14:20:00 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x0, 0x0, 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 707.641476] ? do_futex+0x135/0x370 [ 707.641490] ? __pfx_do_futex+0x10/0x10 [ 707.641504] arch_do_signal_or_restart+0x80/0x790 [ 707.641522] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 707.641537] ? __x64_sys_futex+0x1c9/0x4d0 [ 707.641549] ? __x64_sys_futex+0x1d2/0x4d0 [ 707.641568] ? fput_close_sync+0x114/0x240 [ 707.641583] ? __pfx___x64_sys_futex+0x10/0x10 [ 707.641596] ? __pfx_fput_close_sync+0x10/0x10 [ 707.641610] ? dnotify_flush+0x79/0x4c0 [ 707.641626] exit_to_user_mode_loop+0x8b/0x110 [ 707.641639] do_syscall_64+0x2f7/0x360 [ 707.641651] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 707.641663] RIP: 0033:0x7f94594c7b19 [ 707.641671] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 707.641677] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 707.641689] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 707.641696] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 707.641703] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 707.641710] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 707.641717] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 707.641733] [ 707.641737] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 707.641746] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 707.641753] kmemleak: min_count = 1 [ 707.641758] kmemleak: count = 1 [ 707.641762] kmemleak: flags = 0x21 [ 707.641766] kmemleak: checksum = 0 [ 707.641770] kmemleak: backtrace: [ 707.641774] pcpu_alloc_noprof+0x87a/0x1170 [ 707.641789] fib_nh_common_init+0x30/0xd0 [ 707.641801] fib6_nh_init+0x968/0x1a00 [ 707.641811] ip6_route_info_create_nh+0x530/0xf80 [ 707.641821] ip6_route_add.part.0+0x59/0x170 [ 707.641831] ip6_route_add+0x48/0x60 [ 707.641840] addrconf_add_mroute+0x12d/0x190 [ 707.641851] addrconf_add_dev+0x148/0x1c0 [ 707.641864] addrconf_dev_config+0x1e9/0x430 [ 707.641878] addrconf_notify+0xa70/0x1920 [ 707.641893] notifier_call_chain+0xc0/0x360 [ 707.641903] call_netdevice_notifiers_info+0xbe/0x140 [ 707.641915] netif_state_change+0x157/0x330 [ 707.641924] linkwatch_do_dev+0x111/0x150 [ 707.641935] __linkwatch_run_queue+0x2ab/0x710 [ 707.641944] linkwatch_event+0x4e/0x70 14:20:00 executing program 2: readlinkat(0xffffffffffffffff, 0x0, 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:20:00 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x0, 0x0, 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:00 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:00 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 707.777490] FAT-fs (loop2): invalid media value (0x08) [ 707.777986] FAT-fs (loop2): Can't find a valid FAT filesystem 14:20:00 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{0x0, 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 707.815492] kmemleak: Found object by alias at 0x607f1a638234 [ 707.815514] CPU: 0 UID: 0 PID: 7425 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 707.815533] Tainted: [W]=WARN [ 707.815537] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 707.815544] Call Trace: [ 707.815548] [ 707.815553] dump_stack_lvl+0xca/0x120 [ 707.815581] __lookup_object+0x94/0xb0 [ 707.815598] delete_object_full+0x27/0x70 [ 707.815614] free_percpu+0x30/0x1160 [ 707.815631] ? arch_uprobe_clear_state+0x16/0x140 [ 707.815651] futex_hash_free+0x38/0xc0 [ 707.815666] mmput+0x2d3/0x390 [ 707.815684] do_exit+0x79d/0x2970 [ 707.815698] ? lock_release+0xc8/0x290 [ 707.815714] ? __pfx_do_exit+0x10/0x10 [ 707.815727] ? find_held_lock+0x2b/0x80 [ 707.815744] ? get_signal+0x835/0x2340 [ 707.815764] do_group_exit+0xd3/0x2a0 [ 707.815778] get_signal+0x2315/0x2340 [ 707.815798] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 707.815814] ? __pfx_get_signal+0x10/0x10 [ 707.815830] ? do_futex+0x135/0x370 [ 707.815843] ? __pfx_do_futex+0x10/0x10 [ 707.815858] arch_do_signal_or_restart+0x80/0x790 [ 707.815875] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 707.815891] ? __x64_sys_futex+0x1c9/0x4d0 [ 707.815903] ? __x64_sys_futex+0x1d2/0x4d0 [ 707.815916] ? fput_close_sync+0x114/0x240 [ 707.815932] ? __pfx___x64_sys_futex+0x10/0x10 [ 707.815954] ? __pfx_fput_close_sync+0x10/0x10 [ 707.815968] ? dnotify_flush+0x79/0x4c0 [ 707.815984] exit_to_user_mode_loop+0x8b/0x110 [ 707.815996] do_syscall_64+0x2f7/0x360 [ 707.816008] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 707.816020] RIP: 0033:0x7f94594c7b19 [ 707.816028] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 707.816034] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 707.816045] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 707.816053] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 707.816060] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 707.816067] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 707.816074] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 707.816090] [ 707.816094] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 707.816100] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 707.816107] kmemleak: min_count = 1 [ 707.816111] kmemleak: count = 1 [ 707.816115] kmemleak: flags = 0x21 [ 707.816119] kmemleak: checksum = 0 [ 707.816123] kmemleak: backtrace: [ 707.816126] pcpu_alloc_noprof+0x87a/0x1170 [ 707.816141] fib_nh_common_init+0x30/0xd0 [ 707.816153] fib6_nh_init+0x968/0x1a00 [ 707.816163] ip6_route_info_create_nh+0x530/0xf80 [ 707.816173] ip6_route_add.part.0+0x59/0x170 [ 707.816183] ip6_route_add+0x48/0x60 [ 707.816192] addrconf_add_mroute+0x12d/0x190 [ 707.816203] addrconf_add_dev+0x148/0x1c0 [ 707.816216] addrconf_dev_config+0x1e9/0x430 [ 707.816229] addrconf_notify+0xa70/0x1920 [ 707.816245] notifier_call_chain+0xc0/0x360 [ 707.816255] call_netdevice_notifiers_info+0xbe/0x140 [ 707.816267] netif_state_change+0x157/0x330 [ 707.816276] linkwatch_do_dev+0x111/0x150 [ 707.816287] __linkwatch_run_queue+0x2ab/0x710 [ 707.816297] linkwatch_event+0x4e/0x70 [ 707.847095] loop4: detected capacity change from 0 to 264192 [ 707.885308] loop0: detected capacity change from 0 to 264192 [ 707.887528] vfat: Unknown parameter 'obj_user' [ 707.898370] loop5: detected capacity change from 0 to 264192 [ 707.952774] loop6: detected capacity change from 0 to 264192 14:20:09 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:20:09 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x0, 0xc, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:20:09 executing program 2: readlinkat(0xffffffffffffffff, 0x0, 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:20:09 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:09 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x0, 0x0, 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:09 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{0x0, 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:09 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:20:09 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 716.980653] loop0: detected capacity change from 0 to 264192 [ 716.981260] loop5: detected capacity change from 0 to 264192 [ 716.986996] vfat: Unknown parameter 'obj_user' [ 717.006449] loop6: detected capacity change from 0 to 264192 [ 717.009291] loop4: detected capacity change from 0 to 264192 14:20:09 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{0x0, 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:09 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 717.079000] FAT-fs (loop2): invalid media value (0x08) [ 717.079866] FAT-fs (loop2): Can't find a valid FAT filesystem 14:20:09 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:09 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 717.142294] kmemleak: Found object by alias at 0x607f1a638234 14:20:09 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 717.142325] CPU: 1 UID: 0 PID: 7447 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 717.142358] Tainted: [W]=WARN [ 717.142365] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 717.142378] Call Trace: [ 717.142385] [ 717.142393] dump_stack_lvl+0xca/0x120 [ 717.142431] __lookup_object+0x94/0xb0 [ 717.142460] delete_object_full+0x27/0x70 [ 717.142497] free_percpu+0x30/0x1160 [ 717.142525] ? arch_uprobe_clear_state+0x16/0x140 [ 717.142560] futex_hash_free+0x38/0xc0 [ 717.142585] mmput+0x2d3/0x390 [ 717.142617] do_exit+0x79d/0x2970 [ 717.142641] ? signal_wake_up_state+0x85/0x120 [ 717.142672] ? zap_other_threads+0x2b9/0x3a0 [ 717.142703] ? __pfx_do_exit+0x10/0x10 [ 717.142726] ? do_group_exit+0x1c3/0x2a0 [ 717.142751] ? lock_release+0xc8/0x290 [ 717.142781] do_group_exit+0xd3/0x2a0 [ 717.142807] __x64_sys_exit_group+0x3e/0x50 [ 717.142833] x64_sys_call+0x18c5/0x18d0 [ 717.142860] do_syscall_64+0xbf/0x360 [ 717.142881] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 717.142901] RIP: 0033:0x7f94594c7b19 [ 717.142917] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 717.142927] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 717.142947] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 717.142961] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 717.142974] RBP: 0000000000000000 R08: 0000001b2cd25890 R09: 0000000000000000 [ 717.142987] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 717.143000] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 717.143028] [ 717.143035] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 717.143047] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 717.143060] kmemleak: min_count = 1 [ 717.143067] kmemleak: count = 1 [ 717.143073] kmemleak: flags = 0x21 [ 717.143080] kmemleak: checksum = 0 [ 717.143087] kmemleak: backtrace: [ 717.143093] pcpu_alloc_noprof+0x87a/0x1170 [ 717.143120] fib_nh_common_init+0x30/0xd0 [ 717.143141] fib6_nh_init+0x968/0x1a00 [ 717.143159] ip6_route_info_create_nh+0x530/0xf80 [ 717.143178] ip6_route_add.part.0+0x59/0x170 [ 717.143196] ip6_route_add+0x48/0x60 [ 717.143213] addrconf_add_mroute+0x12d/0x190 [ 717.143232] addrconf_add_dev+0x148/0x1c0 [ 717.143255] addrconf_dev_config+0x1e9/0x430 [ 717.143281] addrconf_notify+0xa70/0x1920 [ 717.143310] notifier_call_chain+0xc0/0x360 [ 717.143328] call_netdevice_notifiers_info+0xbe/0x140 [ 717.143349] netif_state_change+0x157/0x330 [ 717.143365] linkwatch_do_dev+0x111/0x150 [ 717.143384] __linkwatch_run_queue+0x2ab/0x710 [ 717.143402] linkwatch_event+0x4e/0x70 [ 717.164176] loop5: detected capacity change from 0 to 264192 [ 717.183163] loop0: detected capacity change from 0 to 264192 14:20:09 executing program 2: readlinkat(0xffffffffffffffff, 0x0, 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) [ 717.192389] vfat: Unknown parameter 'obj_user' [ 717.210264] loop4: detected capacity change from 0 to 264192 [ 717.213005] loop7: detected capacity change from 0 to 264192 [ 717.276541] loop6: detected capacity change from 0 to 264192 [ 717.301719] FAT-fs (loop2): invalid media value (0x08) [ 717.302174] FAT-fs (loop2): Can't find a valid FAT filesystem [ 717.414627] kmemleak: Found object by alias at 0x607f1a638234 [ 717.414647] CPU: 0 UID: 0 PID: 7478 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 717.414665] Tainted: [W]=WARN [ 717.414669] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 717.414676] Call Trace: [ 717.414681] [ 717.414686] dump_stack_lvl+0xca/0x120 [ 717.414710] __lookup_object+0x94/0xb0 [ 717.414727] delete_object_full+0x27/0x70 [ 717.414742] free_percpu+0x30/0x1160 [ 717.414759] ? arch_uprobe_clear_state+0x16/0x140 [ 717.414779] futex_hash_free+0x38/0xc0 [ 717.414793] mmput+0x2d3/0x390 [ 717.414812] do_exit+0x79d/0x2970 [ 717.414825] ? lock_release+0xc8/0x290 [ 717.414842] ? __pfx_do_exit+0x10/0x10 [ 717.414855] ? find_held_lock+0x2b/0x80 [ 717.414872] ? get_signal+0x835/0x2340 [ 717.414892] do_group_exit+0xd3/0x2a0 [ 717.414906] get_signal+0x2315/0x2340 [ 717.414926] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 717.414942] ? __pfx_get_signal+0x10/0x10 [ 717.414958] ? do_futex+0x135/0x370 [ 717.414971] ? __pfx_do_futex+0x10/0x10 [ 717.414986] arch_do_signal_or_restart+0x80/0x790 [ 717.415003] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 717.415019] ? __x64_sys_futex+0x1c9/0x4d0 [ 717.415031] ? __x64_sys_futex+0x1d2/0x4d0 [ 717.415045] ? fput_close_sync+0x114/0x240 [ 717.415060] ? __pfx___x64_sys_futex+0x10/0x10 [ 717.415073] ? __pfx_fput_close_sync+0x10/0x10 [ 717.415087] ? dnotify_flush+0x79/0x4c0 [ 717.415103] exit_to_user_mode_loop+0x8b/0x110 [ 717.415116] do_syscall_64+0x2f7/0x360 [ 717.415127] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 717.415139] RIP: 0033:0x7f94594c7b19 [ 717.415148] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 717.415153] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 717.415165] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 717.415173] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 717.415180] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 717.415187] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 717.415194] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 717.415209] [ 717.415213] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 717.415220] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 717.415227] kmemleak: min_count = 1 [ 717.415231] kmemleak: count = 1 [ 717.415234] kmemleak: flags = 0x21 [ 717.415238] kmemleak: checksum = 0 [ 717.415242] kmemleak: backtrace: [ 717.415245] pcpu_alloc_noprof+0x87a/0x1170 [ 717.415260] fib_nh_common_init+0x30/0xd0 [ 717.415273] fib6_nh_init+0x968/0x1a00 [ 717.415283] ip6_route_info_create_nh+0x530/0xf80 [ 717.415293] ip6_route_add.part.0+0x59/0x170 [ 717.415302] ip6_route_add+0x48/0x60 [ 717.415311] addrconf_add_mroute+0x12d/0x190 [ 717.415322] addrconf_add_dev+0x148/0x1c0 [ 717.415335] addrconf_dev_config+0x1e9/0x430 [ 717.415349] addrconf_notify+0xa70/0x1920 [ 717.415365] notifier_call_chain+0xc0/0x360 [ 717.415375] call_netdevice_notifiers_info+0xbe/0x140 [ 717.415387] netif_state_change+0x157/0x330 [ 717.415396] linkwatch_do_dev+0x111/0x150 [ 717.415407] __linkwatch_run_queue+0x2ab/0x710 [ 717.415416] linkwatch_event+0x4e/0x70 14:20:18 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:20:18 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:20:18 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:20:18 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:18 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40), 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:18 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:18 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:20:18 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 726.123943] loop4: detected capacity change from 0 to 264192 [ 726.145743] loop7: detected capacity change from 0 to 264192 [ 726.162697] FAT-fs (loop2): invalid media value (0x08) [ 726.163113] FAT-fs (loop2): Can't find a valid FAT filesystem 14:20:18 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 726.171196] loop5: detected capacity change from 0 to 264192 [ 726.194945] loop0: detected capacity change from 0 to 264192 [ 726.197864] loop6: detected capacity change from 0 to 264192 [ 726.214787] vfat: Unknown parameter 'obj_user' [ 726.218241] loop4: detected capacity change from 0 to 264192 14:20:18 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:20:19 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:19 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40), 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 726.280014] kmemleak: Found object by alias at 0x607f1a638234 [ 726.280030] CPU: 0 UID: 0 PID: 7493 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 726.280048] Tainted: [W]=WARN [ 726.280052] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 726.280059] Call Trace: [ 726.280063] [ 726.280068] dump_stack_lvl+0xca/0x120 [ 726.280090] __lookup_object+0x94/0xb0 [ 726.280105] delete_object_full+0x27/0x70 [ 726.280121] free_percpu+0x30/0x1160 [ 726.280136] ? arch_uprobe_clear_state+0x16/0x140 [ 726.280156] futex_hash_free+0x38/0xc0 [ 726.280169] mmput+0x2d3/0x390 [ 726.280187] do_exit+0x79d/0x2970 [ 726.280200] ? lock_release+0xc8/0x290 [ 726.280215] ? __pfx_do_exit+0x10/0x10 [ 726.280239] ? find_held_lock+0x2b/0x80 [ 726.280256] ? get_signal+0x835/0x2340 [ 726.280275] do_group_exit+0xd3/0x2a0 [ 726.280290] get_signal+0x2315/0x2340 [ 726.280309] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 726.280325] ? __pfx_get_signal+0x10/0x10 [ 726.280341] ? do_futex+0x135/0x370 [ 726.280354] ? __pfx_do_futex+0x10/0x10 [ 726.280368] arch_do_signal_or_restart+0x80/0x790 [ 726.280385] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 726.280401] ? __x64_sys_futex+0x1c9/0x4d0 [ 726.280413] ? __x64_sys_futex+0x1d2/0x4d0 [ 726.280426] ? fput_close_sync+0x114/0x240 [ 726.280442] ? __pfx___x64_sys_futex+0x10/0x10 [ 726.280454] ? __pfx_fput_close_sync+0x10/0x10 [ 726.280469] ? dnotify_flush+0x79/0x4c0 [ 726.280484] exit_to_user_mode_loop+0x8b/0x110 [ 726.280496] do_syscall_64+0x2f7/0x360 [ 726.280507] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 726.280519] RIP: 0033:0x7f94594c7b19 [ 726.280528] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 726.280533] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 726.280544] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 726.280552] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 726.280562] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 726.280569] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 726.280576] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 726.280592] [ 726.280595] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 726.280602] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 726.280609] kmemleak: min_count = 1 [ 726.280613] kmemleak: count = 1 [ 726.280617] kmemleak: flags = 0x21 [ 726.280621] kmemleak: checksum = 0 [ 726.280624] kmemleak: backtrace: [ 726.280628] pcpu_alloc_noprof+0x87a/0x1170 [ 726.280642] fib_nh_common_init+0x30/0xd0 [ 726.280654] fib6_nh_init+0x968/0x1a00 [ 726.280664] ip6_route_info_create_nh+0x530/0xf80 [ 726.280674] ip6_route_add.part.0+0x59/0x170 [ 726.280683] ip6_route_add+0x48/0x60 [ 726.280692] addrconf_add_mroute+0x12d/0x190 [ 726.280703] addrconf_add_dev+0x148/0x1c0 [ 726.280715] addrconf_dev_config+0x1e9/0x430 [ 726.280729] addrconf_notify+0xa70/0x1920 [ 726.280745] notifier_call_chain+0xc0/0x360 [ 726.280754] call_netdevice_notifiers_info+0xbe/0x140 [ 726.280765] netif_state_change+0x157/0x330 [ 726.280774] linkwatch_do_dev+0x111/0x150 [ 726.280785] __linkwatch_run_queue+0x2ab/0x710 [ 726.280795] linkwatch_event+0x4e/0x70 [ 726.320295] loop4: detected capacity change from 0 to 264192 [ 726.326044] loop7: detected capacity change from 0 to 264192 14:20:19 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:19 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:20:19 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 726.394025] loop0: detected capacity change from 0 to 264192 [ 726.405216] vfat: Unknown parameter 'obj_user' [ 726.439132] loop5: detected capacity change from 0 to 264192 [ 726.457300] loop6: detected capacity change from 0 to 264192 14:20:31 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:20:31 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6d", 0x21, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:31 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40), 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:31 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:31 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:20:31 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:20:31 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:20:31 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 739.310376] FAT-fs (loop2): invalid media value (0x08) [ 739.310909] FAT-fs (loop2): Can't find a valid FAT filesystem [ 739.342075] loop6: detected capacity change from 0 to 264192 [ 739.349518] loop4: detected capacity change from 0 to 264192 [ 739.357272] loop5: detected capacity change from 0 to 264192 [ 739.359053] loop7: detected capacity change from 0 to 264192 [ 739.366308] loop0: detected capacity change from 0 to 264192 [ 739.383790] kmemleak: Found object by alias at 0x607f1a638234 14:20:32 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 739.383807] CPU: 1 UID: 0 PID: 7541 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 739.383826] Tainted: [W]=WARN [ 739.383830] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 739.383838] Call Trace: [ 739.383843] [ 739.383847] dump_stack_lvl+0xca/0x120 [ 739.383876] __lookup_object+0x94/0xb0 [ 739.383894] delete_object_full+0x27/0x70 [ 739.383910] free_percpu+0x30/0x1160 [ 739.383927] ? arch_uprobe_clear_state+0x16/0x140 [ 739.383947] futex_hash_free+0x38/0xc0 [ 739.383963] mmput+0x2d3/0x390 [ 739.383982] do_exit+0x79d/0x2970 [ 739.384000] ? __pfx_do_exit+0x10/0x10 [ 739.384014] ? find_held_lock+0x2b/0x80 [ 739.384032] ? get_signal+0x835/0x2340 [ 739.384053] do_group_exit+0xd3/0x2a0 [ 739.384068] get_signal+0x2315/0x2340 [ 739.384085] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 739.384102] ? __pfx_get_signal+0x10/0x10 [ 739.384118] ? __schedule+0xe91/0x3590 [ 739.384143] arch_do_signal_or_restart+0x80/0x790 [ 739.384161] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 739.384177] ? __x64_sys_futex+0x1c9/0x4d0 [ 739.384190] ? __x64_sys_futex+0x1d2/0x4d0 [ 739.384204] ? fput_close_sync+0x114/0x240 [ 739.384220] ? __pfx___x64_sys_futex+0x10/0x10 [ 739.384233] ? __pfx_fput_close_sync+0x10/0x10 [ 739.384248] ? dnotify_flush+0x79/0x4c0 [ 739.384264] exit_to_user_mode_loop+0x8b/0x110 [ 739.384278] do_syscall_64+0x2f7/0x360 [ 739.384290] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 739.384303] RIP: 0033:0x7f94594c7b19 [ 739.384312] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 739.384317] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 739.384329] RAX: 0000000000000001 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 739.384337] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f94595daf6c [ 739.384345] RBP: 00007f94595daf60 R08: 0000000000000002 R09: 0000000000000000 [ 739.384352] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007f94595daf6c [ 739.384360] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 739.384376] [ 739.384379] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 739.384387] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 739.384394] kmemleak: min_count = 1 [ 739.384398] kmemleak: count = 1 [ 739.384402] kmemleak: flags = 0x21 [ 739.384406] kmemleak: checksum = 0 [ 739.384410] kmemleak: backtrace: [ 739.384421] pcpu_alloc_noprof+0x87a/0x1170 [ 739.384436] fib_nh_common_init+0x30/0xd0 [ 739.384449] fib6_nh_init+0x968/0x1a00 [ 739.384460] ip6_route_info_create_nh+0x530/0xf80 [ 739.384471] ip6_route_add.part.0+0x59/0x170 [ 739.384482] ip6_route_add+0x48/0x60 [ 739.384492] addrconf_add_mroute+0x12d/0x190 [ 739.384503] addrconf_add_dev+0x148/0x1c0 [ 739.384517] addrconf_dev_config+0x1e9/0x430 [ 739.384532] addrconf_notify+0xa70/0x1920 [ 739.384548] notifier_call_chain+0xc0/0x360 [ 739.384560] call_netdevice_notifiers_info+0xbe/0x140 [ 739.384572] netif_state_change+0x157/0x330 [ 739.384582] linkwatch_do_dev+0x111/0x150 [ 739.384593] __linkwatch_run_queue+0x2ab/0x710 [ 739.384604] linkwatch_event+0x4e/0x70 [ 739.412283] vfat: Unknown parameter 'obj_user' 14:20:32 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:20:32 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e892", 0x25, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:32 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 739.533643] FAT-fs (loop2): invalid media value (0x08) [ 739.534125] FAT-fs (loop2): Can't find a valid FAT filesystem [ 739.583602] kmemleak: Found object by alias at 0x607f1a638234 [ 739.583619] CPU: 1 UID: 0 PID: 7560 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 739.583639] Tainted: [W]=WARN [ 739.583643] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 739.583651] Call Trace: [ 739.583656] [ 739.583661] dump_stack_lvl+0xca/0x120 [ 739.583689] __lookup_object+0x94/0xb0 [ 739.583707] delete_object_full+0x27/0x70 [ 739.583723] free_percpu+0x30/0x1160 [ 739.583741] ? arch_uprobe_clear_state+0x16/0x140 [ 739.583761] futex_hash_free+0x38/0xc0 [ 739.583777] mmput+0x2d3/0x390 [ 739.583796] do_exit+0x79d/0x2970 [ 739.583815] ? __pfx_do_exit+0x10/0x10 [ 739.583829] ? find_held_lock+0x2b/0x80 [ 739.583848] ? get_signal+0x835/0x2340 [ 739.583868] do_group_exit+0xd3/0x2a0 [ 739.583883] get_signal+0x2315/0x2340 [ 739.583901] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 739.583919] ? __pfx_get_signal+0x10/0x10 [ 739.583935] ? __schedule+0xe91/0x3590 [ 739.583956] arch_do_signal_or_restart+0x80/0x790 [ 739.583974] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 739.583990] ? __x64_sys_futex+0x1c9/0x4d0 [ 739.584003] ? __x64_sys_futex+0x1d2/0x4d0 [ 739.584017] ? fput_close_sync+0x114/0x240 [ 739.584034] ? __pfx___x64_sys_futex+0x10/0x10 [ 739.584047] ? __pfx_fput_close_sync+0x10/0x10 [ 739.584062] ? dnotify_flush+0x79/0x4c0 [ 739.584079] exit_to_user_mode_loop+0x8b/0x110 [ 739.584093] do_syscall_64+0x2f7/0x360 [ 739.584105] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 739.584118] RIP: 0033:0x7f94594c7b19 [ 739.584127] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 739.584133] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 739.584145] RAX: 0000000000000001 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 739.584153] RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f94595daf6c [ 739.584160] RBP: 00007f94595daf60 R08: 0000000000000002 R09: 0000000000000000 [ 739.584173] R10: ffffffffffffffff R11: 0000000000000246 R12: 00007f94595daf6c [ 739.584180] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 739.584197] [ 739.584201] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 739.584209] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 739.584216] kmemleak: min_count = 1 [ 739.584220] kmemleak: count = 1 [ 739.584225] kmemleak: flags = 0x21 [ 739.584229] kmemleak: checksum = 0 [ 739.584233] kmemleak: backtrace: [ 739.584237] pcpu_alloc_noprof+0x87a/0x1170 [ 739.584252] fib_nh_common_init+0x30/0xd0 [ 739.584266] fib6_nh_init+0x968/0x1a00 [ 739.584277] ip6_route_info_create_nh+0x530/0xf80 [ 739.584287] ip6_route_add.part.0+0x59/0x170 [ 739.584297] ip6_route_add+0x48/0x60 [ 739.584307] addrconf_add_mroute+0x12d/0x190 [ 739.584318] addrconf_add_dev+0x148/0x1c0 [ 739.584332] addrconf_dev_config+0x1e9/0x430 [ 739.584347] addrconf_notify+0xa70/0x1920 [ 739.584363] notifier_call_chain+0xc0/0x360 [ 739.584374] call_netdevice_notifiers_info+0xbe/0x140 [ 739.584387] netif_state_change+0x157/0x330 [ 739.584396] linkwatch_do_dev+0x111/0x150 [ 739.584407] __linkwatch_run_queue+0x2ab/0x710 [ 739.584425] linkwatch_event+0x4e/0x70 [ 739.618594] loop0: detected capacity change from 0 to 264192 [ 739.619989] vfat: Unknown parameter 'obj_user' 14:20:40 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:20:40 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:20:40 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e892", 0x25, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:40 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:20:40 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6d", 0x21, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:40 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:20:40 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:20:40 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 748.241110] loop6: detected capacity change from 0 to 264192 [ 748.266091] loop7: detected capacity change from 0 to 264192 [ 748.275181] loop5: detected capacity change from 0 to 264192 [ 748.308156] loop4: detected capacity change from 0 to 264192 [ 748.310921] loop0: detected capacity change from 0 to 264192 14:20:41 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6d", 0x21, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 748.323150] vfat: Unknown parameter 'obj_user' [ 748.516569] kmemleak: Found object by alias at 0x607f1a638234 [ 748.516601] CPU: 0 UID: 0 PID: 7593 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 748.516634] Tainted: [W]=WARN [ 748.516642] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 748.516656] Call Trace: [ 748.516664] [ 748.516673] dump_stack_lvl+0xca/0x120 [ 748.516713] __lookup_object+0x94/0xb0 [ 748.516743] delete_object_full+0x27/0x70 [ 748.516773] free_percpu+0x30/0x1160 [ 748.516801] ? arch_uprobe_clear_state+0x16/0x140 [ 748.516843] futex_hash_free+0x38/0xc0 [ 748.516871] mmput+0x2d3/0x390 [ 748.516907] do_exit+0x79d/0x2970 [ 748.516934] ? lock_release+0xc8/0x290 [ 748.516967] ? __pfx_do_exit+0x10/0x10 [ 748.516995] ? find_held_lock+0x2b/0x80 [ 748.517029] ? get_signal+0x835/0x2340 [ 748.517067] do_group_exit+0xd3/0x2a0 [ 748.517097] get_signal+0x2315/0x2340 [ 748.517132] ? task_mm_cid_work+0x368/0x840 [ 748.517175] ? __pfx_get_signal+0x10/0x10 [ 748.517208] ? do_futex+0x135/0x370 [ 748.517235] ? __pfx_do_futex+0x10/0x10 [ 748.517266] arch_do_signal_or_restart+0x80/0x790 [ 748.517299] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 748.517332] ? __x64_sys_futex+0x1c9/0x4d0 [ 748.517356] ? __x64_sys_futex+0x1d2/0x4d0 [ 748.517387] ? __pfx___x64_sys_futex+0x10/0x10 [ 748.517412] ? __pfx_fput_close_sync+0x10/0x10 [ 748.517444] ? xfd_validate_state+0x55/0x180 [ 748.517484] exit_to_user_mode_loop+0x8b/0x110 [ 748.517509] do_syscall_64+0x2f7/0x360 [ 748.517533] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 748.517556] RIP: 0033:0x7f94594c7b19 [ 748.517573] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 748.517585] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 748.517607] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 748.517623] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 748.517638] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 748.517652] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 748.517667] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 748.517699] [ 748.517707] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 748.517721] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 748.517735] kmemleak: min_count = 1 [ 748.517744] kmemleak: count = 1 [ 748.517751] kmemleak: flags = 0x21 [ 748.517760] kmemleak: checksum = 0 [ 748.517768] kmemleak: backtrace: [ 748.517775] pcpu_alloc_noprof+0x87a/0x1170 [ 748.517804] fib_nh_common_init+0x30/0xd0 [ 748.517828] fib6_nh_init+0x968/0x1a00 [ 748.517848] ip6_route_info_create_nh+0x530/0xf80 [ 748.517868] ip6_route_add.part.0+0x59/0x170 [ 748.517888] ip6_route_add+0x48/0x60 [ 748.517907] addrconf_add_mroute+0x12d/0x190 [ 748.517928] addrconf_add_dev+0x148/0x1c0 [ 748.517954] addrconf_dev_config+0x1e9/0x430 [ 748.517982] addrconf_notify+0xa70/0x1920 [ 748.518014] notifier_call_chain+0xc0/0x360 [ 748.518034] call_netdevice_notifiers_info+0xbe/0x140 [ 748.518056] netif_state_change+0x157/0x330 [ 748.518074] linkwatch_do_dev+0x111/0x150 [ 748.518095] __linkwatch_run_queue+0x2ab/0x710 [ 748.518116] linkwatch_event+0x4e/0x70 14:20:49 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:20:49 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:20:49 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c", 0x32, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:49 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:20:49 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:20:49 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:20:49 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e892", 0x25, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:49 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 756.391312] loop0: detected capacity change from 0 to 264192 [ 756.398857] vfat: Unknown parameter 'obj_user' 14:20:49 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 756.435440] loop6: detected capacity change from 0 to 264192 [ 756.435884] loop7: detected capacity change from 0 to 264192 [ 756.440018] loop5: detected capacity change from 0 to 264192 14:20:49 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e", 0x37, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 756.526335] kmemleak: Found object by alias at 0x607f1a638234 [ 756.526355] CPU: 0 UID: 0 PID: 7609 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 756.526374] Tainted: [W]=WARN [ 756.526378] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 756.526386] Call Trace: [ 756.526390] [ 756.526396] dump_stack_lvl+0xca/0x120 [ 756.526421] __lookup_object+0x94/0xb0 [ 756.526438] delete_object_full+0x27/0x70 [ 756.526454] free_percpu+0x30/0x1160 [ 756.526471] ? arch_uprobe_clear_state+0x16/0x140 [ 756.526491] futex_hash_free+0x38/0xc0 [ 756.526505] mmput+0x2d3/0x390 [ 756.526524] do_exit+0x79d/0x2970 [ 756.526537] ? lock_release+0xc8/0x290 [ 756.526559] ? __pfx_do_exit+0x10/0x10 [ 756.526573] ? find_held_lock+0x2b/0x80 [ 756.526590] ? get_signal+0x835/0x2340 [ 756.526611] do_group_exit+0xd3/0x2a0 [ 756.526625] get_signal+0x2315/0x2340 [ 756.526643] ? task_mm_cid_work+0x368/0x840 [ 756.526665] ? __pfx_get_signal+0x10/0x10 [ 756.526681] ? do_futex+0x135/0x370 [ 756.526695] ? __pfx_do_futex+0x10/0x10 [ 756.526710] arch_do_signal_or_restart+0x80/0x790 [ 756.526728] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 756.526744] ? __x64_sys_futex+0x1c9/0x4d0 [ 756.526756] ? __x64_sys_futex+0x1d2/0x4d0 [ 756.526771] ? __pfx___x64_sys_futex+0x10/0x10 [ 756.526784] ? __pfx_fput_close_sync+0x10/0x10 [ 756.526806] exit_to_user_mode_loop+0x8b/0x110 [ 756.526819] do_syscall_64+0x2f7/0x360 [ 756.526831] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 756.526843] RIP: 0033:0x7f94594c7b19 [ 756.526852] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 756.526858] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 756.526870] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 756.526878] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 756.526885] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 756.526893] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 756.526902] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 756.526920] [ 756.526925] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 756.526932] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 756.526939] kmemleak: min_count = 1 [ 756.526943] kmemleak: count = 1 [ 756.526947] kmemleak: flags = 0x21 [ 756.526951] kmemleak: checksum = 0 [ 756.526955] kmemleak: backtrace: [ 756.526959] pcpu_alloc_noprof+0x87a/0x1170 [ 756.526974] fib_nh_common_init+0x30/0xd0 [ 756.526987] fib6_nh_init+0x968/0x1a00 [ 756.526998] ip6_route_info_create_nh+0x530/0xf80 [ 756.527008] ip6_route_add.part.0+0x59/0x170 [ 756.527018] ip6_route_add+0x48/0x60 [ 756.527028] addrconf_add_mroute+0x12d/0x190 [ 756.527040] addrconf_add_dev+0x148/0x1c0 [ 756.527053] addrconf_dev_config+0x1e9/0x430 [ 756.527067] addrconf_notify+0xa70/0x1920 [ 756.527083] notifier_call_chain+0xc0/0x360 [ 756.527093] call_netdevice_notifiers_info+0xbe/0x140 [ 756.527105] netif_state_change+0x157/0x330 [ 756.527115] linkwatch_do_dev+0x111/0x150 [ 756.527126] __linkwatch_run_queue+0x2ab/0x710 [ 756.527136] linkwatch_event+0x4e/0x70 [ 756.552346] loop0: detected capacity change from 0 to 264192 [ 756.557197] vfat: Unknown parameter 'obj_user' 14:20:49 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:49 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:20:49 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:20:49 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c", 0x32, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:49 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e", 0x37, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 756.624368] loop6: detected capacity change from 0 to 264192 14:20:49 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) [ 756.654050] loop0: detected capacity change from 0 to 264192 [ 756.654358] loop7: detected capacity change from 0 to 264192 14:20:49 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:20:49 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:20:49 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{0x0, 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 756.669309] vfat: Unknown parameter 'obj_user' 14:20:49 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c", 0x32, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 756.702627] loop6: detected capacity change from 0 to 264192 14:20:49 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 756.744385] loop4: detected capacity change from 0 to 264192 [ 756.827894] kmemleak: Found object by alias at 0x607f1a638234 [ 756.827914] CPU: 1 UID: 0 PID: 7647 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 756.827933] Tainted: [W]=WARN [ 756.827937] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 756.827945] Call Trace: [ 756.827949] [ 756.827955] dump_stack_lvl+0xca/0x120 [ 756.827979] __lookup_object+0x94/0xb0 [ 756.827996] delete_object_full+0x27/0x70 [ 756.828013] free_percpu+0x30/0x1160 [ 756.828029] ? arch_uprobe_clear_state+0x16/0x140 [ 756.828050] futex_hash_free+0x38/0xc0 [ 756.828064] mmput+0x2d3/0x390 [ 756.828083] do_exit+0x79d/0x2970 [ 756.828097] ? lock_release+0xc8/0x290 [ 756.828115] ? __pfx_do_exit+0x10/0x10 [ 756.828129] ? find_held_lock+0x2b/0x80 [ 756.828147] ? get_signal+0x835/0x2340 [ 756.828167] do_group_exit+0xd3/0x2a0 [ 756.828182] get_signal+0x2315/0x2340 [ 756.828203] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 756.828220] ? __pfx_get_signal+0x10/0x10 [ 756.828236] ? do_futex+0x135/0x370 [ 756.828251] ? __pfx_do_futex+0x10/0x10 [ 756.828266] arch_do_signal_or_restart+0x80/0x790 [ 756.828285] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 756.828301] ? __x64_sys_futex+0x1c9/0x4d0 [ 756.828313] ? __x64_sys_futex+0x1d2/0x4d0 [ 756.828327] ? fput_close_sync+0x114/0x240 [ 756.828344] ? __pfx___x64_sys_futex+0x10/0x10 [ 756.828357] ? __pfx_fput_close_sync+0x10/0x10 [ 756.828372] ? dnotify_flush+0x79/0x4c0 [ 756.828388] exit_to_user_mode_loop+0x8b/0x110 [ 756.828402] do_syscall_64+0x2f7/0x360 [ 756.828414] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 756.828427] RIP: 0033:0x7f94594c7b19 [ 756.828437] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 756.828442] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 756.828454] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 756.828464] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 756.828472] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 756.828481] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 756.828490] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 756.828506] [ 756.828510] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 756.828517] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 756.828524] kmemleak: min_count = 1 [ 756.828529] kmemleak: count = 1 [ 756.828533] kmemleak: flags = 0x21 [ 756.828537] kmemleak: checksum = 0 [ 756.828541] kmemleak: backtrace: [ 756.828545] pcpu_alloc_noprof+0x87a/0x1170 [ 756.828565] fib_nh_common_init+0x30/0xd0 [ 756.828578] fib6_nh_init+0x968/0x1a00 [ 756.828589] ip6_route_info_create_nh+0x530/0xf80 [ 756.828599] ip6_route_add.part.0+0x59/0x170 [ 756.828609] ip6_route_add+0x48/0x60 [ 756.828618] addrconf_add_mroute+0x12d/0x190 [ 756.828630] addrconf_add_dev+0x148/0x1c0 [ 756.828644] addrconf_dev_config+0x1e9/0x430 [ 756.828658] addrconf_notify+0xa70/0x1920 [ 756.828681] notifier_call_chain+0xc0/0x360 [ 756.828692] call_netdevice_notifiers_info+0xbe/0x140 [ 756.828704] netif_state_change+0x157/0x330 [ 756.828713] linkwatch_do_dev+0x111/0x150 [ 756.828724] __linkwatch_run_queue+0x2ab/0x710 [ 756.828735] linkwatch_event+0x4e/0x70 14:20:57 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), 0x0, 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:20:57 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:20:57 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{0x0, 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:20:57 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e2", 0x3a, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:57 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:57 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:20:57 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 764.572775] loop4: detected capacity change from 0 to 264192 [ 764.577301] loop6: detected capacity change from 0 to 264192 14:20:57 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e", 0x37, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 764.608776] loop0: detected capacity change from 0 to 264192 14:20:57 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{0x0, 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 764.617495] vfat: Unknown parameter 'obj_user' [ 764.640202] loop7: detected capacity change from 0 to 264192 14:20:57 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e2", 0x3a, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:20:57 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826", 0x40, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 764.714204] loop6: detected capacity change from 0 to 264192 14:20:57 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{0x0, 0x0, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 764.756215] loop0: detected capacity change from 0 to 264192 [ 764.766476] vfat: Unknown parameter 'obj_user' 14:20:57 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40), 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 764.795359] kmemleak: Found object by alias at 0x607f1a638234 [ 764.795376] CPU: 0 UID: 0 PID: 7675 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 764.795394] Tainted: [W]=WARN [ 764.795399] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 764.795406] Call Trace: [ 764.795410] [ 764.795415] dump_stack_lvl+0xca/0x120 [ 764.795441] __lookup_object+0x94/0xb0 [ 764.795458] delete_object_full+0x27/0x70 [ 764.795473] free_percpu+0x30/0x1160 [ 764.795490] ? arch_uprobe_clear_state+0x16/0x140 [ 764.795510] futex_hash_free+0x38/0xc0 [ 764.795524] mmput+0x2d3/0x390 [ 764.795543] do_exit+0x79d/0x2970 [ 764.795561] ? lock_release+0xc8/0x290 [ 764.795579] ? __pfx_do_exit+0x10/0x10 [ 764.795593] ? find_held_lock+0x2b/0x80 [ 764.795610] ? get_signal+0x835/0x2340 [ 764.795630] do_group_exit+0xd3/0x2a0 [ 764.795645] get_signal+0x2315/0x2340 [ 764.795665] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 764.795681] ? __pfx_get_signal+0x10/0x10 [ 764.795697] ? do_futex+0x135/0x370 [ 764.795711] ? __pfx_do_futex+0x10/0x10 [ 764.795726] arch_do_signal_or_restart+0x80/0x790 [ 764.795744] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 764.795760] ? __x64_sys_futex+0x1c9/0x4d0 [ 764.795773] ? __x64_sys_futex+0x1d2/0x4d0 [ 764.795787] ? fput_close_sync+0x114/0x240 [ 764.795803] ? __pfx___x64_sys_futex+0x10/0x10 [ 764.795816] ? __pfx_fput_close_sync+0x10/0x10 [ 764.795830] ? dnotify_flush+0x79/0x4c0 [ 764.795846] exit_to_user_mode_loop+0x8b/0x110 [ 764.795859] do_syscall_64+0x2f7/0x360 [ 764.795871] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 764.795883] RIP: 0033:0x7f94594c7b19 [ 764.795892] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 764.795898] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 764.795909] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 764.795917] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 764.795925] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 764.795932] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 764.795939] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 764.795955] [ 764.795959] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 764.795967] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 764.795974] kmemleak: min_count = 1 [ 764.795978] kmemleak: count = 1 [ 764.795982] kmemleak: flags = 0x21 [ 764.795986] kmemleak: checksum = 0 [ 764.795990] kmemleak: backtrace: [ 764.795994] pcpu_alloc_noprof+0x87a/0x1170 [ 764.796009] fib_nh_common_init+0x30/0xd0 [ 764.796022] fib6_nh_init+0x968/0x1a00 [ 764.796032] ip6_route_info_create_nh+0x530/0xf80 [ 764.796043] ip6_route_add.part.0+0x59/0x170 [ 764.796053] ip6_route_add+0x48/0x60 [ 764.796062] addrconf_add_mroute+0x12d/0x190 [ 764.796074] addrconf_add_dev+0x148/0x1c0 [ 764.796087] addrconf_dev_config+0x1e9/0x430 [ 764.796101] addrconf_notify+0xa70/0x1920 [ 764.796117] notifier_call_chain+0xc0/0x360 [ 764.796127] call_netdevice_notifiers_info+0xbe/0x140 [ 764.796139] netif_state_change+0x157/0x330 [ 764.796148] linkwatch_do_dev+0x111/0x150 [ 764.796159] __linkwatch_run_queue+0x2ab/0x710 [ 764.796170] linkwatch_event+0x4e/0x70 [ 764.857046] loop5: detected capacity change from 0 to 264192 14:21:07 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40), 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:21:07 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:21:07 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{0x0, 0x0, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:21:07 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826", 0x40, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:07 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0), 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:07 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), 0x0, 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:21:07 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:21:07 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e2", 0x3a, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 774.925024] loop5: detected capacity change from 0 to 264192 [ 774.925811] loop7: detected capacity change from 0 to 264192 [ 774.953247] loop4: detected capacity change from 0 to 264192 [ 774.968751] loop0: detected capacity change from 0 to 264192 14:21:07 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{0x0, 0x0, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 774.982289] loop6: detected capacity change from 0 to 264192 [ 774.990412] vfat: Unknown parameter 'obj_user' 14:21:07 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 775.044168] loop5: detected capacity change from 0 to 264192 14:21:07 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:21:07 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2f", 0x3e, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:07 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40), 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:21:07 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:21:07 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826", 0x40, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:07 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40), 0x0, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 775.174286] loop5: detected capacity change from 0 to 264192 [ 775.183209] loop0: detected capacity change from 0 to 264192 [ 775.188479] vfat: Unknown parameter 'obj_user' [ 775.217508] kmemleak: Found object by alias at 0x607f1a638234 [ 775.217536] CPU: 0 UID: 0 PID: 7722 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 775.217579] Tainted: [W]=WARN [ 775.217586] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 775.217600] Call Trace: [ 775.217608] [ 775.217617] dump_stack_lvl+0xca/0x120 [ 775.217657] __lookup_object+0x94/0xb0 [ 775.217687] delete_object_full+0x27/0x70 [ 775.217716] free_percpu+0x30/0x1160 14:21:07 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40), 0x0, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 775.217745] ? arch_uprobe_clear_state+0x16/0x140 [ 775.217781] futex_hash_free+0x38/0xc0 [ 775.217806] mmput+0x2d3/0x390 [ 775.217840] do_exit+0x79d/0x2970 [ 775.217865] ? lock_release+0xc8/0x290 [ 775.217895] ? __pfx_do_exit+0x10/0x10 [ 775.217921] ? find_held_lock+0x2b/0x80 [ 775.217952] ? get_signal+0x835/0x2340 [ 775.217987] do_group_exit+0xd3/0x2a0 [ 775.218015] get_signal+0x2315/0x2340 [ 775.218047] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 775.218078] ? __pfx_get_signal+0x10/0x10 [ 775.218108] ? do_futex+0x135/0x370 [ 775.218134] ? __pfx_do_futex+0x10/0x10 [ 775.218166] arch_do_signal_or_restart+0x80/0x790 [ 775.218198] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 775.218228] ? __x64_sys_futex+0x1c9/0x4d0 [ 775.218250] ? __x64_sys_futex+0x1d2/0x4d0 [ 775.218276] ? fput_close_sync+0x114/0x240 [ 775.218306] ? __pfx___x64_sys_futex+0x10/0x10 [ 775.218330] ? __pfx_fput_close_sync+0x10/0x10 [ 775.218357] ? dnotify_flush+0x79/0x4c0 [ 775.218377] ? xfd_validate_state+0x55/0x180 [ 775.218415] exit_to_user_mode_loop+0x8b/0x110 [ 775.218438] do_syscall_64+0x2f7/0x360 [ 775.218460] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 775.218483] RIP: 0033:0x7f94594c7b19 14:21:08 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da", 0x45, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 775.218499] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 775.218509] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 775.218530] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 775.218545] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 775.218558] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 775.218572] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 775.218585] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 775.218615] [ 775.218623] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 775.218635] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 775.218648] kmemleak: min_count = 1 [ 775.218656] kmemleak: count = 1 [ 775.218663] kmemleak: flags = 0x21 [ 775.218671] kmemleak: checksum = 0 [ 775.218678] kmemleak: backtrace: [ 775.218685] pcpu_alloc_noprof+0x87a/0x1170 [ 775.218712] fib_nh_common_init+0x30/0xd0 [ 775.218734] fib6_nh_init+0x968/0x1a00 [ 775.218753] ip6_route_info_create_nh+0x530/0xf80 [ 775.218772] ip6_route_add.part.0+0x59/0x170 [ 775.218791] ip6_route_add+0x48/0x60 [ 775.218808] addrconf_add_mroute+0x12d/0x190 [ 775.218829] addrconf_add_dev+0x148/0x1c0 [ 775.218853] addrconf_dev_config+0x1e9/0x430 [ 775.218879] addrconf_notify+0xa70/0x1920 [ 775.218909] notifier_call_chain+0xc0/0x360 [ 775.218927] call_netdevice_notifiers_info+0xbe/0x140 [ 775.218948] netif_state_change+0x157/0x330 [ 775.218966] linkwatch_do_dev+0x111/0x150 [ 775.218985] __linkwatch_run_queue+0x2ab/0x710 [ 775.219004] linkwatch_event+0x4e/0x70 14:21:08 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 775.268717] loop6: detected capacity change from 0 to 264192 [ 775.318076] loop5: detected capacity change from 0 to 264192 [ 775.321101] loop4: detected capacity change from 0 to 264192 [ 775.326122] loop0: detected capacity change from 0 to 264192 14:21:08 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:08 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2f", 0x3e, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 775.340984] vfat: Unknown parameter 'obj_user' [ 775.407266] loop6: detected capacity change from 0 to 264192 14:21:17 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), 0x0, 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:21:17 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2f", 0x3e, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:17 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:17 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da", 0x45, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:17 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:21:17 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:21:17 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40), 0x0, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:21:17 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e892", 0x25, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 784.551398] loop5: detected capacity change from 0 to 264192 [ 784.566321] loop6: detected capacity change from 0 to 264192 [ 784.573745] loop4: detected capacity change from 0 to 264192 [ 784.575183] loop0: detected capacity change from 0 to 264192 [ 784.591251] loop7: detected capacity change from 0 to 264192 [ 784.593285] vfat: Unknown parameter 'obj_user' [ 784.810794] kmemleak: Found object by alias at 0x607f1a638234 [ 784.810829] CPU: 0 UID: 0 PID: 7785 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 784.810868] Tainted: [W]=WARN [ 784.810876] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 784.810891] Call Trace: [ 784.810900] [ 784.810910] dump_stack_lvl+0xca/0x120 [ 784.810956] __lookup_object+0x94/0xb0 [ 784.810991] delete_object_full+0x27/0x70 [ 784.811026] free_percpu+0x30/0x1160 [ 784.811060] ? arch_uprobe_clear_state+0x16/0x140 [ 784.811103] futex_hash_free+0x38/0xc0 [ 784.811132] mmput+0x2d3/0x390 [ 784.811171] do_exit+0x79d/0x2970 [ 784.811200] ? lock_release+0xc8/0x290 [ 784.811236] ? __pfx_do_exit+0x10/0x10 [ 784.811267] ? find_held_lock+0x2b/0x80 [ 784.811303] ? get_signal+0x835/0x2340 [ 784.811346] do_group_exit+0xd3/0x2a0 [ 784.811379] get_signal+0x2315/0x2340 [ 784.811422] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 784.811458] ? __pfx_get_signal+0x10/0x10 [ 784.811494] ? do_futex+0x135/0x370 [ 784.811524] ? __pfx_do_futex+0x10/0x10 [ 784.811565] arch_do_signal_or_restart+0x80/0x790 [ 784.811603] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 784.811639] ? __x64_sys_futex+0x1c9/0x4d0 [ 784.811666] ? __x64_sys_futex+0x1d2/0x4d0 [ 784.811697] ? fput_close_sync+0x114/0x240 [ 784.811732] ? __pfx___x64_sys_futex+0x10/0x10 [ 784.811759] ? __pfx_fput_close_sync+0x10/0x10 [ 784.811792] ? dnotify_flush+0x79/0x4c0 [ 784.811815] ? xfd_validate_state+0x55/0x180 [ 784.811860] exit_to_user_mode_loop+0x8b/0x110 [ 784.811887] do_syscall_64+0x2f7/0x360 [ 784.811912] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 784.811938] RIP: 0033:0x7f94594c7b19 [ 784.811957] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 784.811969] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 784.811994] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 784.812012] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 784.812027] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 784.812043] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 784.812059] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 784.812094] [ 784.812103] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 784.812118] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 784.812134] kmemleak: min_count = 1 [ 784.812143] kmemleak: count = 1 [ 784.812152] kmemleak: flags = 0x21 [ 784.812161] kmemleak: checksum = 0 [ 784.812170] kmemleak: backtrace: [ 784.812178] pcpu_alloc_noprof+0x87a/0x1170 [ 784.812210] fib_nh_common_init+0x30/0xd0 [ 784.812237] fib6_nh_init+0x968/0x1a00 [ 784.812258] ip6_route_info_create_nh+0x530/0xf80 [ 784.812281] ip6_route_add.part.0+0x59/0x170 [ 784.812303] ip6_route_add+0x48/0x60 [ 784.812324] addrconf_add_mroute+0x12d/0x190 [ 784.812347] addrconf_add_dev+0x148/0x1c0 [ 784.812376] addrconf_dev_config+0x1e9/0x430 [ 784.812407] addrconf_notify+0xa70/0x1920 [ 784.812442] notifier_call_chain+0xc0/0x360 [ 784.812464] call_netdevice_notifiers_info+0xbe/0x140 [ 784.812488] netif_state_change+0x157/0x330 [ 784.812509] linkwatch_do_dev+0x111/0x150 [ 784.812531] __linkwatch_run_queue+0x2ab/0x710 [ 784.812554] linkwatch_event+0x4e/0x70 14:21:27 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da", 0x45, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:27 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e892", 0x25, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:21:27 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:21:27 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:21:27 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea677", 0x63, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:27 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5", 0x40, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:27 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:21:27 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e892", 0x25, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 795.123104] loop5: detected capacity change from 0 to 264192 [ 795.131291] loop4: detected capacity change from 0 to 264192 [ 795.139484] loop6: detected capacity change from 0 to 264192 [ 795.145256] loop0: detected capacity change from 0 to 264192 [ 795.148969] loop7: detected capacity change from 0 to 264192 [ 795.159749] No source specified [ 795.166434] vfat: Unknown parameter 'obj_user' 14:21:27 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e892", 0x25, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:21:28 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5", 0x40, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:28 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:21:28 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea677", 0x63, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:28 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0", 0x47, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 795.357389] loop5: detected capacity change from 0 to 264192 14:21:28 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 795.394418] loop6: detected capacity change from 0 to 264192 [ 795.406317] loop4: detected capacity change from 0 to 264192 [ 795.412538] loop0: detected capacity change from 0 to 264192 [ 795.415672] kmemleak: Found object by alias at 0x607f1a638234 [ 795.415704] CPU: 1 UID: 0 PID: 7815 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 795.415735] Tainted: [W]=WARN [ 795.415742] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 795.415755] Call Trace: [ 795.415762] [ 795.415770] dump_stack_lvl+0xca/0x120 [ 795.415811] __lookup_object+0x94/0xb0 [ 795.415839] delete_object_full+0x27/0x70 [ 795.415865] free_percpu+0x30/0x1160 [ 795.415891] ? arch_uprobe_clear_state+0x16/0x140 [ 795.415924] futex_hash_free+0x38/0xc0 [ 795.415947] mmput+0x2d3/0x390 [ 795.415978] do_exit+0x79d/0x2970 [ 795.416001] ? lock_release+0xc8/0x290 [ 795.416028] ? __pfx_do_exit+0x10/0x10 [ 795.416052] ? find_held_lock+0x2b/0x80 [ 795.416079] ? get_signal+0x835/0x2340 [ 795.416112] do_group_exit+0xd3/0x2a0 [ 795.416136] get_signal+0x2315/0x2340 [ 795.416169] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 795.416196] ? __pfx_get_signal+0x10/0x10 [ 795.416223] ? do_futex+0x135/0x370 [ 795.416246] ? __pfx_do_futex+0x10/0x10 [ 795.416271] arch_do_signal_or_restart+0x80/0x790 [ 795.416299] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 795.416326] ? __x64_sys_futex+0x1c9/0x4d0 [ 795.416346] ? __x64_sys_futex+0x1d2/0x4d0 [ 795.416369] ? fput_close_sync+0x114/0x240 [ 795.416396] ? __pfx___x64_sys_futex+0x10/0x10 [ 795.416417] ? __pfx_fput_close_sync+0x10/0x10 [ 795.416441] ? dnotify_flush+0x79/0x4c0 [ 795.416467] exit_to_user_mode_loop+0x8b/0x110 [ 795.416488] do_syscall_64+0x2f7/0x360 [ 795.416507] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 795.416528] RIP: 0033:0x7f94594c7b19 [ 795.416543] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 795.416558] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 795.416577] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 795.416591] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 795.416603] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 795.416616] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 795.416628] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 795.416655] [ 795.416661] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 795.416673] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 795.416685] kmemleak: min_count = 1 [ 795.416692] kmemleak: count = 1 [ 795.416699] kmemleak: flags = 0x21 [ 795.416706] kmemleak: checksum = 0 [ 795.416712] kmemleak: backtrace: [ 795.416718] pcpu_alloc_noprof+0x87a/0x1170 [ 795.416742] fib_nh_common_init+0x30/0xd0 [ 795.416763] fib6_nh_init+0x968/0x1a00 [ 795.416779] ip6_route_info_create_nh+0x530/0xf80 [ 795.416797] ip6_route_add.part.0+0x59/0x170 [ 795.416813] ip6_route_add+0x48/0x60 [ 795.416828] addrconf_add_mroute+0x12d/0x190 [ 795.416846] addrconf_add_dev+0x148/0x1c0 [ 795.416868] addrconf_dev_config+0x1e9/0x430 [ 795.416891] addrconf_notify+0xa70/0x1920 [ 795.416917] notifier_call_chain+0xc0/0x360 [ 795.416935] call_netdevice_notifiers_info+0xbe/0x140 [ 795.416953] netif_state_change+0x157/0x330 [ 795.416968] linkwatch_do_dev+0x111/0x150 [ 795.416985] __linkwatch_run_queue+0x2ab/0x710 [ 795.417002] linkwatch_event+0x4e/0x70 [ 795.420979] vfat: Unknown parameter 'obj_user' [ 795.467234] loop7: detected capacity change from 0 to 264192 14:21:28 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:21:28 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:21:28 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:21:28 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5", 0x40, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:28 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea677", 0x63, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:28 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e892", 0x25, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 795.578500] loop4: detected capacity change from 0 to 264192 14:21:28 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0", 0x47, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 795.616456] No source specified 14:21:28 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:21:28 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 795.667158] loop6: detected capacity change from 0 to 264192 [ 795.672258] loop7: detected capacity change from 0 to 264192 [ 795.681870] loop0: detected capacity change from 0 to 264192 [ 795.694097] vfat: Unknown parameter 'obj_user' [ 795.694791] loop5: detected capacity change from 0 to 264192 14:21:28 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0", 0x47, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 795.769676] loop4: detected capacity change from 0 to 264192 14:21:28 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957", 0x74, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:28 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e", 0x37, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:21:28 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5", 0x41, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 795.819290] kmemleak: Found object by alias at 0x607f1a638234 [ 795.819313] CPU: 1 UID: 0 PID: 7840 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 795.819336] Tainted: [W]=WARN [ 795.819341] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 795.819351] Call Trace: [ 795.819356] [ 795.819362] dump_stack_lvl+0xca/0x120 [ 795.819401] __lookup_object+0x94/0xb0 [ 795.819423] delete_object_full+0x27/0x70 [ 795.819444] free_percpu+0x30/0x1160 [ 795.819464] ? arch_uprobe_clear_state+0x16/0x140 [ 795.819489] futex_hash_free+0x38/0xc0 [ 795.819507] mmput+0x2d3/0x390 [ 795.819530] do_exit+0x79d/0x2970 [ 795.819549] ? lock_release+0xc8/0x290 [ 795.819571] ? __pfx_do_exit+0x10/0x10 [ 795.819588] ? find_held_lock+0x2b/0x80 [ 795.819609] ? get_signal+0x835/0x2340 [ 795.819634] do_group_exit+0xd3/0x2a0 [ 795.819653] get_signal+0x2315/0x2340 [ 795.819678] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 795.819699] ? __pfx_get_signal+0x10/0x10 [ 795.819719] ? do_futex+0x135/0x370 [ 795.819736] ? __pfx_do_futex+0x10/0x10 [ 795.819755] arch_do_signal_or_restart+0x80/0x790 [ 795.819777] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 795.819797] ? __x64_sys_futex+0x1c9/0x4d0 [ 795.819813] ? __x64_sys_futex+0x1d2/0x4d0 [ 795.819830] ? fput_close_sync+0x114/0x240 [ 795.819851] ? __pfx___x64_sys_futex+0x10/0x10 [ 795.819866] ? __pfx_fput_close_sync+0x10/0x10 [ 795.819885] ? dnotify_flush+0x79/0x4c0 [ 795.819905] exit_to_user_mode_loop+0x8b/0x110 [ 795.819921] do_syscall_64+0x2f7/0x360 [ 795.819937] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 795.819952] RIP: 0033:0x7f94594c7b19 [ 795.819964] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 795.819971] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 795.819985] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 795.819995] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 795.820004] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 795.820014] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 795.820023] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 795.820043] [ 795.820049] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 795.820057] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 795.820066] kmemleak: min_count = 1 [ 795.820072] kmemleak: count = 1 [ 795.820077] kmemleak: flags = 0x21 [ 795.820082] kmemleak: checksum = 0 [ 795.820087] kmemleak: backtrace: [ 795.820093] pcpu_alloc_noprof+0x87a/0x1170 [ 795.820111] fib_nh_common_init+0x30/0xd0 [ 795.820127] fib6_nh_init+0x968/0x1a00 [ 795.820140] ip6_route_info_create_nh+0x530/0xf80 [ 795.820153] ip6_route_add.part.0+0x59/0x170 [ 795.820165] ip6_route_add+0x48/0x60 [ 795.820177] addrconf_add_mroute+0x12d/0x190 [ 795.820191] addrconf_add_dev+0x148/0x1c0 [ 795.820209] addrconf_dev_config+0x1e9/0x430 [ 795.820226] addrconf_notify+0xa70/0x1920 [ 795.820246] notifier_call_chain+0xc0/0x360 [ 795.820260] call_netdevice_notifiers_info+0xbe/0x140 [ 795.820276] netif_state_change+0x157/0x330 [ 795.820287] linkwatch_do_dev+0x111/0x150 [ 795.820301] __linkwatch_run_queue+0x2ab/0x710 [ 795.820313] linkwatch_event+0x4e/0x70 [ 795.881217] loop0: detected capacity change from 0 to 264192 14:21:28 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 795.896130] vfat: Unknown parameter 'obj_user' [ 795.915755] loop5: detected capacity change from 0 to 264192 [ 795.921302] loop6: detected capacity change from 0 to 264192 [ 795.928120] loop7: detected capacity change from 0 to 264192 14:21:36 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:21:36 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e", 0x37, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:21:36 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5", 0x41, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:36 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777", 0x13, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:21:36 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:21:36 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e063", 0x48, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:36 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:21:36 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957", 0x74, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 803.524998] No source specified [ 803.545287] loop4: detected capacity change from 0 to 264192 [ 803.545860] loop6: detected capacity change from 0 to 264192 [ 803.548046] loop0: detected capacity change from 0 to 264192 [ 803.551509] vfat: Unknown parameter 'obj_user' [ 803.569518] loop5: detected capacity change from 0 to 264192 [ 803.591803] loop7: detected capacity change from 0 to 264192 14:21:36 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5", 0x41, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:36 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e063", 0x48, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 803.653053] loop0: detected capacity change from 0 to 264192 [ 803.653807] loop6: detected capacity change from 0 to 264192 [ 803.661603] vfat: Unknown parameter 'obj_user' 14:21:36 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 803.743931] kmemleak: Found object by alias at 0x607f1a638234 [ 803.743961] CPU: 0 UID: 0 PID: 7877 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 803.743997] Tainted: [W]=WARN [ 803.744005] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 803.744019] Call Trace: [ 803.744027] [ 803.744037] dump_stack_lvl+0xca/0x120 [ 803.744079] __lookup_object+0x94/0xb0 [ 803.744111] delete_object_full+0x27/0x70 [ 803.744143] free_percpu+0x30/0x1160 [ 803.744173] ? arch_uprobe_clear_state+0x16/0x140 [ 803.744213] futex_hash_free+0x38/0xc0 [ 803.744240] mmput+0x2d3/0x390 [ 803.744276] do_exit+0x79d/0x2970 [ 803.744303] ? signal_wake_up_state+0x85/0x120 [ 803.744334] ? zap_other_threads+0x2b9/0x3a0 [ 803.744365] ? __pfx_do_exit+0x10/0x10 [ 803.744391] ? do_group_exit+0x1c3/0x2a0 [ 803.744418] ? lock_release+0xc8/0x290 [ 803.744451] do_group_exit+0xd3/0x2a0 [ 803.744480] __x64_sys_exit_group+0x3e/0x50 [ 803.744508] x64_sys_call+0x18c5/0x18d0 [ 803.744538] do_syscall_64+0xbf/0x360 [ 803.744569] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 803.744592] RIP: 0033:0x7f94594c7b19 [ 803.744609] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 803.744620] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 803.744643] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 803.744659] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 803.744674] RBP: 0000000000000000 R08: 0000001b2cd21db8 R09: 0000000000000000 [ 803.744689] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 803.744703] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 803.744735] [ 803.744743] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 803.744757] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 803.744771] kmemleak: min_count = 1 [ 803.744780] kmemleak: count = 1 [ 803.744788] kmemleak: flags = 0x21 [ 803.744796] kmemleak: checksum = 0 [ 803.744804] kmemleak: backtrace: [ 803.744811] pcpu_alloc_noprof+0x87a/0x1170 [ 803.744841] fib_nh_common_init+0x30/0xd0 [ 803.744864] fib6_nh_init+0x968/0x1a00 [ 803.744884] ip6_route_info_create_nh+0x530/0xf80 [ 803.744905] ip6_route_add.part.0+0x59/0x170 [ 803.744925] ip6_route_add+0x48/0x60 [ 803.744943] addrconf_add_mroute+0x12d/0x190 [ 803.744964] addrconf_add_dev+0x148/0x1c0 [ 803.744990] addrconf_dev_config+0x1e9/0x430 [ 803.745018] addrconf_notify+0xa70/0x1920 [ 803.745050] notifier_call_chain+0xc0/0x360 [ 803.745070] call_netdevice_notifiers_info+0xbe/0x140 [ 803.745092] netif_state_change+0x157/0x330 [ 803.745110] linkwatch_do_dev+0x111/0x150 [ 803.745132] __linkwatch_run_queue+0x2ab/0x710 [ 803.745152] linkwatch_event+0x4e/0x70 14:21:45 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:21:45 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x0, &(0x7f0000000d80), 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:21:45 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e063", 0x48, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:45 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e", 0x37, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:21:45 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:45 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957", 0x74, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:45 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:21:45 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 813.075784] loop6: detected capacity change from 0 to 264192 [ 813.089400] loop7: detected capacity change from 0 to 264192 [ 813.092177] loop4: detected capacity change from 0 to 264192 [ 813.098845] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 813.103931] FAT-fs (loop2): unable to read boot sector [ 813.113791] loop5: detected capacity change from 0 to 264192 [ 813.131266] loop0: detected capacity change from 0 to 264192 [ 813.144446] vfat: Unknown parameter 'obj_user' 14:21:45 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:21:45 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc10", 0x7c, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:45 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 813.217539] loop7: detected capacity change from 0 to 264192 [ 813.223252] loop4: detected capacity change from 0 to 264192 [ 813.233747] kmemleak: Found object by alias at 0x607f1a638234 [ 813.233763] CPU: 1 UID: 0 PID: 7925 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 813.233782] Tainted: [W]=WARN [ 813.233786] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 813.233794] Call Trace: [ 813.233799] [ 813.233804] dump_stack_lvl+0xca/0x120 [ 813.233828] __lookup_object+0x94/0xb0 [ 813.233845] delete_object_full+0x27/0x70 [ 813.233861] free_percpu+0x30/0x1160 [ 813.233878] ? arch_uprobe_clear_state+0x16/0x140 [ 813.233898] futex_hash_free+0x38/0xc0 [ 813.233912] mmput+0x2d3/0x390 [ 813.233931] do_exit+0x79d/0x2970 [ 813.233945] ? lock_release+0xc8/0x290 [ 813.233962] ? __pfx_do_exit+0x10/0x10 [ 813.233976] ? find_held_lock+0x2b/0x80 [ 813.233993] ? get_signal+0x835/0x2340 [ 813.234013] do_group_exit+0xd3/0x2a0 [ 813.234028] get_signal+0x2315/0x2340 [ 813.234048] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 813.234064] ? __pfx_get_signal+0x10/0x10 [ 813.234080] ? do_futex+0x135/0x370 [ 813.234094] ? __pfx_do_futex+0x10/0x10 [ 813.234109] arch_do_signal_or_restart+0x80/0x790 [ 813.234127] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 813.234143] ? __x64_sys_futex+0x1c9/0x4d0 [ 813.234155] ? __x64_sys_futex+0x1d2/0x4d0 [ 813.234169] ? fput_close_sync+0x114/0x240 [ 813.234185] ? __pfx___x64_sys_futex+0x10/0x10 [ 813.234198] ? __pfx_fput_close_sync+0x10/0x10 [ 813.234213] ? dnotify_flush+0x79/0x4c0 [ 813.234229] exit_to_user_mode_loop+0x8b/0x110 [ 813.234241] do_syscall_64+0x2f7/0x360 [ 813.234254] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 813.234266] RIP: 0033:0x7f94594c7b19 [ 813.234275] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 813.234280] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 813.234292] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 813.234300] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 813.234308] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 813.234315] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 813.234322] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 813.234338] [ 813.234342] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 813.234349] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 813.234356] kmemleak: min_count = 1 [ 813.234361] kmemleak: count = 1 [ 813.234365] kmemleak: flags = 0x21 [ 813.234369] kmemleak: checksum = 0 [ 813.234373] kmemleak: backtrace: [ 813.234377] pcpu_alloc_noprof+0x87a/0x1170 [ 813.234391] fib_nh_common_init+0x30/0xd0 [ 813.234404] fib6_nh_init+0x968/0x1a00 [ 813.234415] ip6_route_info_create_nh+0x530/0xf80 [ 813.234425] ip6_route_add.part.0+0x59/0x170 [ 813.234435] ip6_route_add+0x48/0x60 [ 813.234444] addrconf_add_mroute+0x12d/0x190 [ 813.234456] addrconf_add_dev+0x148/0x1c0 [ 813.234469] addrconf_dev_config+0x1e9/0x430 [ 813.234483] addrconf_notify+0xa70/0x1920 [ 813.234499] notifier_call_chain+0xc0/0x360 [ 813.234510] call_netdevice_notifiers_info+0xbe/0x140 [ 813.234522] netif_state_change+0x157/0x330 [ 813.234532] linkwatch_do_dev+0x111/0x150 [ 813.234543] __linkwatch_run_queue+0x2ab/0x710 [ 813.234557] linkwatch_event+0x4e/0x70 14:21:45 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:21:46 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:46 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826", 0x40, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 813.370099] loop5: detected capacity change from 0 to 264192 [ 813.372407] vfat: Unknown parameter 'obj_user' 14:21:55 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826", 0x40, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:21:55 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:55 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:21:55 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x0, &(0x7f0000000d80), 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:21:55 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc10", 0x7c, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:55 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:21:55 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:55 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 822.812439] loop6: detected capacity change from 0 to 264192 [ 822.815249] loop5: detected capacity change from 0 to 264192 [ 822.852233] loop4: detected capacity change from 0 to 264192 [ 822.858370] loop7: detected capacity change from 0 to 264192 [ 822.863832] vfat: Unknown parameter 'obj_user' [ 822.868881] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 822.870329] FAT-fs (loop2): unable to read boot sector 14:21:55 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:55 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826", 0x40, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:21:55 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc10", 0x7c, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:55 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:21:55 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8", 0xa, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 823.086020] loop5: detected capacity change from 0 to 264192 [ 823.104608] loop7: detected capacity change from 0 to 264192 [ 823.107063] loop4: detected capacity change from 0 to 264192 [ 823.118504] vfat: Unknown parameter 'obj_user' 14:21:55 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 823.121862] kmemleak: Found object by alias at 0x607f1a638234 [ 823.121890] CPU: 1 UID: 0 PID: 7972 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 823.121923] Tainted: [W]=WARN [ 823.121931] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 823.121944] Call Trace: [ 823.121952] [ 823.121961] dump_stack_lvl+0xca/0x120 [ 823.122002] __lookup_object+0x94/0xb0 [ 823.122031] delete_object_full+0x27/0x70 [ 823.122061] free_percpu+0x30/0x1160 [ 823.122091] ? arch_uprobe_clear_state+0x16/0x140 [ 823.122128] futex_hash_free+0x38/0xc0 [ 823.122154] mmput+0x2d3/0x390 [ 823.122187] do_exit+0x79d/0x2970 [ 823.122213] ? lock_release+0xc8/0x290 [ 823.122243] ? __pfx_do_exit+0x10/0x10 [ 823.122269] ? find_held_lock+0x2b/0x80 [ 823.122301] ? get_signal+0x835/0x2340 [ 823.122337] do_group_exit+0xd3/0x2a0 [ 823.122365] get_signal+0x2315/0x2340 [ 823.122402] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 823.122433] ? __pfx_get_signal+0x10/0x10 [ 823.122463] ? do_futex+0x135/0x370 [ 823.122489] ? __pfx_do_futex+0x10/0x10 [ 823.122517] arch_do_signal_or_restart+0x80/0x790 [ 823.122549] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 823.122587] ? __x64_sys_futex+0x1c9/0x4d0 [ 823.122610] ? __x64_sys_futex+0x1d2/0x4d0 [ 823.122635] ? fput_close_sync+0x114/0x240 [ 823.122665] ? __pfx___x64_sys_futex+0x10/0x10 [ 823.122689] ? __pfx_fput_close_sync+0x10/0x10 [ 823.122717] ? dnotify_flush+0x79/0x4c0 [ 823.122745] exit_to_user_mode_loop+0x8b/0x110 [ 823.122768] do_syscall_64+0x2f7/0x360 [ 823.122790] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 823.122812] RIP: 0033:0x7f94594c7b19 [ 823.122828] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 823.122838] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 823.122859] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 823.122874] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 823.122888] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 823.122901] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 823.122915] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 823.122945] [ 823.122952] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 823.122965] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 823.122979] kmemleak: min_count = 1 [ 823.122987] kmemleak: count = 1 [ 823.122994] kmemleak: flags = 0x21 [ 823.123001] kmemleak: checksum = 0 [ 823.123009] kmemleak: backtrace: [ 823.123016] pcpu_alloc_noprof+0x87a/0x1170 [ 823.123043] fib_nh_common_init+0x30/0xd0 [ 823.123066] fib6_nh_init+0x968/0x1a00 [ 823.123085] ip6_route_info_create_nh+0x530/0xf80 [ 823.123104] ip6_route_add.part.0+0x59/0x170 [ 823.123122] ip6_route_add+0x48/0x60 [ 823.123140] addrconf_add_mroute+0x12d/0x190 [ 823.123160] addrconf_add_dev+0x148/0x1c0 [ 823.123184] addrconf_dev_config+0x1e9/0x430 [ 823.123211] addrconf_notify+0xa70/0x1920 [ 823.123241] notifier_call_chain+0xc0/0x360 [ 823.123260] call_netdevice_notifiers_info+0xbe/0x140 [ 823.123280] netif_state_change+0x157/0x330 [ 823.123297] linkwatch_do_dev+0x111/0x150 [ 823.123317] __linkwatch_run_queue+0x2ab/0x710 [ 823.123336] linkwatch_event+0x4e/0x70 14:21:55 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:21:55 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8", 0xa, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:21:55 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da", 0x45, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:21:56 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x0, &(0x7f0000000d80), 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:21:56 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x0, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 823.321548] loop4: detected capacity change from 0 to 264192 [ 823.325727] loop5: detected capacity change from 0 to 264192 [ 823.370170] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 823.372447] loop0: detected capacity change from 0 to 264192 [ 823.373508] FAT-fs (loop2): unable to read boot sector [ 823.380208] vfat: Unknown parameter 'obj_user' [ 823.498156] kmemleak: Found object by alias at 0x607f1a638234 [ 823.498188] CPU: 1 UID: 0 PID: 8004 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 823.498220] Tainted: [W]=WARN [ 823.498228] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 823.498241] Call Trace: [ 823.498248] [ 823.498257] dump_stack_lvl+0xca/0x120 [ 823.498296] __lookup_object+0x94/0xb0 [ 823.498325] delete_object_full+0x27/0x70 [ 823.498354] free_percpu+0x30/0x1160 [ 823.498383] ? arch_uprobe_clear_state+0x16/0x140 [ 823.498418] futex_hash_free+0x38/0xc0 [ 823.498443] mmput+0x2d3/0x390 [ 823.498476] do_exit+0x79d/0x2970 [ 823.498501] ? lock_release+0xc8/0x290 [ 823.498530] ? __pfx_do_exit+0x10/0x10 [ 823.498561] ? find_held_lock+0x2b/0x80 [ 823.498592] ? get_signal+0x835/0x2340 [ 823.498627] do_group_exit+0xd3/0x2a0 [ 823.498654] get_signal+0x2315/0x2340 [ 823.498690] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 823.498719] ? __pfx_get_signal+0x10/0x10 [ 823.498748] ? do_futex+0x135/0x370 [ 823.498773] ? __pfx_do_futex+0x10/0x10 [ 823.498800] arch_do_signal_or_restart+0x80/0x790 [ 823.498831] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 823.498861] ? __x64_sys_futex+0x1c9/0x4d0 [ 823.498883] ? __x64_sys_futex+0x1d2/0x4d0 [ 823.498909] ? fput_close_sync+0x114/0x240 [ 823.498937] ? __pfx___x64_sys_futex+0x10/0x10 [ 823.498960] ? __pfx_fput_close_sync+0x10/0x10 [ 823.498988] ? dnotify_flush+0x79/0x4c0 [ 823.499006] ? xfd_validate_state+0x55/0x180 [ 823.499043] exit_to_user_mode_loop+0x8b/0x110 [ 823.499066] do_syscall_64+0x2f7/0x360 [ 823.499087] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 823.499108] RIP: 0033:0x7f94594c7b19 [ 823.499123] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 823.499134] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 823.499155] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 823.499172] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 823.499186] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 823.499198] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 823.499211] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 823.499239] [ 823.499247] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 823.499259] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 823.499272] kmemleak: min_count = 1 [ 823.499279] kmemleak: count = 1 [ 823.499286] kmemleak: flags = 0x21 [ 823.499293] kmemleak: checksum = 0 [ 823.499300] kmemleak: backtrace: [ 823.499306] pcpu_alloc_noprof+0x87a/0x1170 [ 823.499333] fib_nh_common_init+0x30/0xd0 [ 823.499355] fib6_nh_init+0x968/0x1a00 [ 823.499372] ip6_route_info_create_nh+0x530/0xf80 [ 823.499391] ip6_route_add.part.0+0x59/0x170 [ 823.499409] ip6_route_add+0x48/0x60 [ 823.499426] addrconf_add_mroute+0x12d/0x190 [ 823.499445] addrconf_add_dev+0x148/0x1c0 [ 823.499469] addrconf_dev_config+0x1e9/0x430 [ 823.499495] addrconf_notify+0xa70/0x1920 [ 823.499524] notifier_call_chain+0xc0/0x360 [ 823.499542] call_netdevice_notifiers_info+0xbe/0x140 [ 823.499563] netif_state_change+0x157/0x330 [ 823.499579] linkwatch_do_dev+0x111/0x150 [ 823.499598] __linkwatch_run_queue+0x2ab/0x710 [ 823.499616] linkwatch_event+0x4e/0x70 14:22:04 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:22:04 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bc", 0x80, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:04 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{0x0}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:22:04 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x0, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:04 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:22:04 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da", 0x45, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:22:04 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:22:04 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 832.216066] loop4: detected capacity change from 0 to 264192 [ 832.218471] loop7: detected capacity change from 0 to 264192 [ 832.231785] loop0: detected capacity change from 0 to 264192 [ 832.249299] loop5: detected capacity change from 0 to 264192 [ 832.276899] vfat: Unknown parameter 'obj_user' 14:22:05 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:22:05 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bc", 0x80, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 832.310752] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 832.311662] FAT-fs (loop2): unable to read boot sector [ 832.368321] loop7: detected capacity change from 0 to 264192 [ 832.455698] kmemleak: Found object by alias at 0x607f1a638234 [ 832.455717] CPU: 0 UID: 0 PID: 8033 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 832.455737] Tainted: [W]=WARN [ 832.455741] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 832.455749] Call Trace: [ 832.455754] [ 832.455759] dump_stack_lvl+0xca/0x120 [ 832.455789] __lookup_object+0x94/0xb0 [ 832.455808] delete_object_full+0x27/0x70 [ 832.455825] free_percpu+0x30/0x1160 [ 832.455842] ? arch_uprobe_clear_state+0x16/0x140 [ 832.455863] futex_hash_free+0x38/0xc0 [ 832.455879] mmput+0x2d3/0x390 [ 832.455898] do_exit+0x79d/0x2970 [ 832.455912] ? lock_release+0xc8/0x290 [ 832.455929] ? __pfx_do_exit+0x10/0x10 [ 832.455944] ? find_held_lock+0x2b/0x80 [ 832.455961] ? get_signal+0x835/0x2340 [ 832.455982] do_group_exit+0xd3/0x2a0 [ 832.455997] get_signal+0x2315/0x2340 [ 832.456017] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 832.456037] ? __pfx_get_signal+0x10/0x10 [ 832.456056] ? do_futex+0x135/0x370 [ 832.456070] ? __pfx_do_futex+0x10/0x10 [ 832.456086] arch_do_signal_or_restart+0x80/0x790 [ 832.456104] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 832.456121] ? __x64_sys_futex+0x1c9/0x4d0 [ 832.456133] ? __x64_sys_futex+0x1d2/0x4d0 [ 832.456147] ? fput_close_sync+0x114/0x240 [ 832.456164] ? __pfx___x64_sys_futex+0x10/0x10 [ 832.456177] ? __pfx_fput_close_sync+0x10/0x10 [ 832.456192] ? dnotify_flush+0x79/0x4c0 [ 832.456209] exit_to_user_mode_loop+0x8b/0x110 [ 832.456222] do_syscall_64+0x2f7/0x360 [ 832.456235] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 832.456248] RIP: 0033:0x7f94594c7b19 [ 832.456258] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 832.456264] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 832.456276] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 832.456284] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 832.456292] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 832.456299] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 832.456306] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 832.456323] [ 832.456328] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 832.456335] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 832.456342] kmemleak: min_count = 1 [ 832.456346] kmemleak: count = 1 [ 832.456350] kmemleak: flags = 0x21 [ 832.456355] kmemleak: checksum = 0 [ 832.456359] kmemleak: backtrace: [ 832.456363] pcpu_alloc_noprof+0x87a/0x1170 [ 832.456378] fib_nh_common_init+0x30/0xd0 [ 832.456392] fib6_nh_init+0x968/0x1a00 [ 832.456403] ip6_route_info_create_nh+0x530/0xf80 [ 832.456413] ip6_route_add.part.0+0x59/0x170 [ 832.456424] ip6_route_add+0x48/0x60 [ 832.456433] addrconf_add_mroute+0x12d/0x190 [ 832.456445] addrconf_add_dev+0x148/0x1c0 [ 832.456459] addrconf_dev_config+0x1e9/0x430 [ 832.456473] addrconf_notify+0xa70/0x1920 [ 832.456490] notifier_call_chain+0xc0/0x360 [ 832.456501] call_netdevice_notifiers_info+0xbe/0x140 [ 832.456514] netif_state_change+0x157/0x330 [ 832.456524] linkwatch_do_dev+0x111/0x150 [ 832.456535] __linkwatch_run_queue+0x2ab/0x710 [ 832.456546] linkwatch_event+0x4e/0x70 14:22:15 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{0x0}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:22:15 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:22:15 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:22:15 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x0, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:15 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da", 0x45, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:22:15 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:22:15 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bc", 0x80, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:15 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 842.676342] loop4: detected capacity change from 0 to 264192 [ 842.681019] loop5: detected capacity change from 0 to 264192 [ 842.682405] loop7: detected capacity change from 0 to 264192 [ 842.707539] loop0: detected capacity change from 0 to 264192 [ 842.719638] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 842.724230] vfat: Unknown parameter 'obj_user' [ 842.728778] FAT-fs (loop2): unable to read boot sector 14:22:15 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{0x0, 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:15 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0", 0x47, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:22:15 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab", 0x6, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 842.864587] loop6: detected capacity change from 0 to 264192 14:22:15 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf", 0x82, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:15 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:22:15 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:22:15 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 842.957921] loop5: detected capacity change from 0 to 264192 [ 842.969273] loop4: detected capacity change from 0 to 264192 [ 842.993998] loop7: detected capacity change from 0 to 264192 14:22:15 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{0x0, 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 843.030144] loop0: detected capacity change from 0 to 264192 [ 843.062800] kmemleak: Found object by alias at 0x607f1a638234 [ 843.062829] CPU: 0 UID: 0 PID: 8054 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 843.062864] Tainted: [W]=WARN [ 843.062872] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 843.062885] Call Trace: [ 843.062892] [ 843.062901] dump_stack_lvl+0xca/0x120 [ 843.062942] __lookup_object+0x94/0xb0 [ 843.062972] delete_object_full+0x27/0x70 [ 843.063002] free_percpu+0x30/0x1160 [ 843.063032] ? arch_uprobe_clear_state+0x16/0x140 [ 843.063068] futex_hash_free+0x38/0xc0 [ 843.063095] mmput+0x2d3/0x390 [ 843.063128] do_exit+0x79d/0x2970 [ 843.063153] ? signal_wake_up_state+0x85/0x120 [ 843.063182] ? zap_other_threads+0x2b9/0x3a0 [ 843.063211] ? __pfx_do_exit+0x10/0x10 [ 843.063235] ? do_group_exit+0x1c3/0x2a0 [ 843.063261] ? lock_release+0xc8/0x290 [ 843.063292] do_group_exit+0xd3/0x2a0 [ 843.063319] __x64_sys_exit_group+0x3e/0x50 [ 843.063356] x64_sys_call+0x18c5/0x18d0 [ 843.063397] do_syscall_64+0xbf/0x360 [ 843.063430] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 843.063463] RIP: 0033:0x7f94594c7b19 [ 843.063486] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 843.063496] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 843.063518] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 843.063532] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 843.063546] RBP: 0000000000000000 R08: 0000001b2cd25154 R09: 0000000000000000 [ 843.063567] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 843.063580] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 843.063610] [ 843.063618] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 843.063631] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 843.063644] kmemleak: min_count = 1 [ 843.063652] kmemleak: count = 1 [ 843.063659] kmemleak: flags = 0x21 [ 843.063667] kmemleak: checksum = 0 [ 843.063674] kmemleak: backtrace: [ 843.063681] pcpu_alloc_noprof+0x87a/0x1170 [ 843.063709] fib_nh_common_init+0x30/0xd0 [ 843.063731] fib6_nh_init+0x968/0x1a00 [ 843.063749] ip6_route_info_create_nh+0x530/0xf80 [ 843.063768] ip6_route_add.part.0+0x59/0x170 [ 843.063787] ip6_route_add+0x48/0x60 [ 843.063804] addrconf_add_mroute+0x12d/0x190 [ 843.063825] addrconf_add_dev+0x148/0x1c0 [ 843.063849] addrconf_dev_config+0x1e9/0x430 [ 843.063875] addrconf_notify+0xa70/0x1920 [ 843.063905] notifier_call_chain+0xc0/0x360 [ 843.063923] call_netdevice_notifiers_info+0xbe/0x140 [ 843.063944] netif_state_change+0x157/0x330 [ 843.063961] linkwatch_do_dev+0x111/0x150 [ 843.063980] __linkwatch_run_queue+0x2ab/0x710 [ 843.063999] linkwatch_event+0x4e/0x70 [ 843.079653] loop6: detected capacity change from 0 to 264192 14:22:15 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{0x0}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:22:15 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0", 0x47, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:22:15 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b\a', 0x2, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:22:15 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf", 0x82, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:15 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 843.190519] loop5: detected capacity change from 0 to 264192 [ 843.246684] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 843.249132] FAT-fs (loop2): unable to read boot sector [ 843.278427] loop4: detected capacity change from 0 to 264192 [ 843.284724] loop7: detected capacity change from 0 to 264192 [ 843.328365] loop0: detected capacity change from 0 to 264192 [ 843.397869] kmemleak: Found object by alias at 0x607f1a638234 [ 843.397889] CPU: 1 UID: 0 PID: 8094 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 843.397915] Tainted: [W]=WARN [ 843.397921] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 843.397932] Call Trace: [ 843.397937] [ 843.397956] dump_stack_lvl+0xca/0x120 [ 843.397990] __lookup_object+0x94/0xb0 [ 843.398012] delete_object_full+0x27/0x70 [ 843.398034] free_percpu+0x30/0x1160 [ 843.398056] ? arch_uprobe_clear_state+0x16/0x140 [ 843.398083] futex_hash_free+0x38/0xc0 [ 843.398103] mmput+0x2d3/0x390 [ 843.398129] do_exit+0x79d/0x2970 [ 843.398147] ? lock_release+0xc8/0x290 [ 843.398170] ? __pfx_do_exit+0x10/0x10 [ 843.398189] ? find_held_lock+0x2b/0x80 [ 843.398213] ? get_signal+0x835/0x2340 [ 843.398240] do_group_exit+0xd3/0x2a0 [ 843.398261] get_signal+0x2315/0x2340 [ 843.398288] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 843.398310] ? __pfx_get_signal+0x10/0x10 [ 843.398332] ? do_futex+0x135/0x370 [ 843.398351] ? __pfx_do_futex+0x10/0x10 [ 843.398372] arch_do_signal_or_restart+0x80/0x790 [ 843.398396] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 843.398418] ? __x64_sys_futex+0x1c9/0x4d0 [ 843.398435] ? __x64_sys_futex+0x1d2/0x4d0 [ 843.398454] ? fput_close_sync+0x114/0x240 [ 843.398476] ? __pfx___x64_sys_futex+0x10/0x10 [ 843.398498] ? __pfx_fput_close_sync+0x10/0x10 [ 843.398518] ? dnotify_flush+0x79/0x4c0 [ 843.398540] exit_to_user_mode_loop+0x8b/0x110 [ 843.398558] do_syscall_64+0x2f7/0x360 [ 843.398575] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 843.398592] RIP: 0033:0x7f94594c7b19 [ 843.398604] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 843.398612] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 843.398628] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 843.398639] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 843.398649] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 843.398660] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 843.398670] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 843.398693] [ 843.398698] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 843.398708] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 843.398718] kmemleak: min_count = 1 [ 843.398724] kmemleak: count = 1 [ 843.398730] kmemleak: flags = 0x21 [ 843.398736] kmemleak: checksum = 0 [ 843.398742] kmemleak: backtrace: [ 843.398747] pcpu_alloc_noprof+0x87a/0x1170 [ 843.398768] fib_nh_common_init+0x30/0xd0 [ 843.398785] fib6_nh_init+0x968/0x1a00 [ 843.398799] ip6_route_info_create_nh+0x530/0xf80 [ 843.398813] ip6_route_add.part.0+0x59/0x170 [ 843.398827] ip6_route_add+0x48/0x60 [ 843.398840] addrconf_add_mroute+0x12d/0x190 [ 843.398855] addrconf_add_dev+0x148/0x1c0 [ 843.398874] addrconf_dev_config+0x1e9/0x430 [ 843.398893] addrconf_notify+0xa70/0x1920 [ 843.398916] notifier_call_chain+0xc0/0x360 [ 843.398930] call_netdevice_notifiers_info+0xbe/0x140 [ 843.398946] netif_state_change+0x157/0x330 [ 843.398959] linkwatch_do_dev+0x111/0x150 [ 843.398974] __linkwatch_run_queue+0x2ab/0x710 [ 843.398988] linkwatch_event+0x4e/0x70 14:22:26 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{0x0, 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:26 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:22:26 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:22:26 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf", 0x82, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:26 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:22:26 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b\a', 0x2, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:22:26 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, 0x0) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:26 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0", 0x47, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 854.075214] loop7: detected capacity change from 0 to 264192 14:22:26 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf17", 0x83, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 854.133306] loop4: detected capacity change from 0 to 264192 [ 854.149756] loop5: detected capacity change from 0 to 264192 [ 854.154799] loop0: detected capacity change from 0 to 264192 [ 854.169539] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 854.172906] loop6: detected capacity change from 0 to 264192 [ 854.173958] FAT-fs (loop2): unable to read boot sector 14:22:27 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b\a', 0x2, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:22:27 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:27 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e063", 0x48, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:22:27 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40), 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 854.406655] loop6: detected capacity change from 0 to 264192 [ 854.409205] loop5: detected capacity change from 0 to 264192 [ 854.415267] loop0: detected capacity change from 0 to 264192 [ 854.416813] loop4: detected capacity change from 0 to 264192 [ 854.435721] vfat: Unknown parameter 'obj_user' [ 854.456289] kmemleak: Found object by alias at 0x607f1a638234 [ 854.456317] CPU: 0 UID: 0 PID: 8115 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 854.456350] Tainted: [W]=WARN [ 854.456358] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 854.456371] Call Trace: [ 854.456378] [ 854.456386] dump_stack_lvl+0xca/0x120 [ 854.456425] __lookup_object+0x94/0xb0 [ 854.456455] delete_object_full+0x27/0x70 [ 854.456484] free_percpu+0x30/0x1160 [ 854.456516] ? arch_uprobe_clear_state+0x16/0x140 [ 854.456559] futex_hash_free+0x38/0xc0 [ 854.456584] mmput+0x2d3/0x390 [ 854.456617] do_exit+0x79d/0x2970 [ 854.456642] ? signal_wake_up_state+0x85/0x120 [ 854.456670] ? zap_other_threads+0x2b9/0x3a0 [ 854.456700] ? __pfx_do_exit+0x10/0x10 [ 854.456724] ? do_group_exit+0x1c3/0x2a0 [ 854.456749] ? lock_release+0xc8/0x290 [ 854.456779] do_group_exit+0xd3/0x2a0 [ 854.456807] __x64_sys_exit_group+0x3e/0x50 [ 854.456833] x64_sys_call+0x18c5/0x18d0 [ 854.456861] do_syscall_64+0xbf/0x360 [ 854.456883] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 854.456904] RIP: 0033:0x7f94594c7b19 [ 854.456920] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 854.456930] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 854.456951] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 854.456966] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 854.456980] RBP: 0000000000000000 R08: 0000001b2cd25178 R09: 0000000000000000 [ 854.456993] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 854.457006] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 854.457036] [ 854.457043] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 854.457056] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 854.457069] kmemleak: min_count = 1 [ 854.457077] kmemleak: count = 1 [ 854.457084] kmemleak: flags = 0x21 [ 854.457092] kmemleak: checksum = 0 [ 854.457099] kmemleak: backtrace: [ 854.457106] pcpu_alloc_noprof+0x87a/0x1170 [ 854.457134] fib_nh_common_init+0x30/0xd0 [ 854.457155] fib6_nh_init+0x968/0x1a00 [ 854.457174] ip6_route_info_create_nh+0x530/0xf80 [ 854.457193] ip6_route_add.part.0+0x59/0x170 [ 854.457211] ip6_route_add+0x48/0x60 [ 854.457228] addrconf_add_mroute+0x12d/0x190 [ 854.457248] addrconf_add_dev+0x148/0x1c0 [ 854.457272] addrconf_dev_config+0x1e9/0x430 [ 854.457298] addrconf_notify+0xa70/0x1920 [ 854.457328] notifier_call_chain+0xc0/0x360 [ 854.457346] call_netdevice_notifiers_info+0xbe/0x140 [ 854.457367] netif_state_change+0x157/0x330 [ 854.457384] linkwatch_do_dev+0x111/0x150 [ 854.457403] __linkwatch_run_queue+0x2ab/0x710 [ 854.457422] linkwatch_event+0x4e/0x70 14:22:36 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:22:36 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf17", 0x83, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:36 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:36 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:22:36 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40), 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:36 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e063", 0x48, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:22:36 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40), 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:22:36 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 864.252244] loop5: detected capacity change from 0 to 264192 [ 864.255053] loop6: detected capacity change from 0 to 264192 [ 864.259688] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 864.261004] FAT-fs (loop2): unable to read boot sector [ 864.283193] loop4: detected capacity change from 0 to 264192 [ 864.308966] loop7: detected capacity change from 0 to 264192 [ 864.319305] loop0: detected capacity change from 0 to 264192 14:22:37 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e063", 0x48, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 864.331271] vfat: Unknown parameter 'obj_user' [ 864.362102] loop5: detected capacity change from 0 to 264192 [ 864.387442] kmemleak: Found object by alias at 0x607f1a638234 [ 864.387479] CPU: 1 UID: 0 PID: 8153 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 864.387515] Tainted: [W]=WARN [ 864.387523] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 864.387536] Call Trace: [ 864.387543] [ 864.387558] dump_stack_lvl+0xca/0x120 [ 864.387598] __lookup_object+0x94/0xb0 [ 864.387627] delete_object_full+0x27/0x70 [ 864.387656] free_percpu+0x30/0x1160 [ 864.387685] ? arch_uprobe_clear_state+0x16/0x140 [ 864.387721] futex_hash_free+0x38/0xc0 [ 864.387746] mmput+0x2d3/0x390 [ 864.387779] do_exit+0x79d/0x2970 [ 864.387804] ? signal_wake_up_state+0x85/0x120 [ 864.387832] ? zap_other_threads+0x2b9/0x3a0 [ 864.387861] ? __pfx_do_exit+0x10/0x10 [ 864.387885] ? do_group_exit+0x1c3/0x2a0 [ 864.387911] ? lock_release+0xc8/0x290 [ 864.387941] do_group_exit+0xd3/0x2a0 [ 864.387969] __x64_sys_exit_group+0x3e/0x50 [ 864.387995] x64_sys_call+0x18c5/0x18d0 [ 864.388023] do_syscall_64+0xbf/0x360 [ 864.388045] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 864.388071] RIP: 0033:0x7f94594c7b19 [ 864.388093] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 864.388104] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 864.388125] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 864.388140] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 864.388154] RBP: 0000000000000000 R08: 0000001b2cd25188 R09: 0000000000000000 [ 864.388167] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 864.388180] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 864.388209] [ 864.388218] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 864.388232] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 864.388246] kmemleak: min_count = 1 [ 864.388254] kmemleak: count = 1 [ 864.388261] kmemleak: flags = 0x21 [ 864.388269] kmemleak: checksum = 0 [ 864.388276] kmemleak: backtrace: [ 864.388283] pcpu_alloc_noprof+0x87a/0x1170 [ 864.388310] fib_nh_common_init+0x30/0xd0 [ 864.388333] fib6_nh_init+0x968/0x1a00 [ 864.388351] ip6_route_info_create_nh+0x530/0xf80 [ 864.388370] ip6_route_add.part.0+0x59/0x170 [ 864.388389] ip6_route_add+0x48/0x60 [ 864.388406] addrconf_add_mroute+0x12d/0x190 [ 864.388426] addrconf_add_dev+0x148/0x1c0 [ 864.388450] addrconf_dev_config+0x1e9/0x430 [ 864.388476] addrconf_notify+0xa70/0x1920 [ 864.388506] notifier_call_chain+0xc0/0x360 [ 864.388524] call_netdevice_notifiers_info+0xbe/0x140 [ 864.388545] netif_state_change+0x157/0x330 [ 864.388562] linkwatch_do_dev+0x111/0x150 [ 864.388581] __linkwatch_run_queue+0x2ab/0x710 [ 864.388600] linkwatch_event+0x4e/0x70 14:22:37 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40), 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:22:37 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", ""]}, 0x10}, 0x1, 0x0, 0x0, 0x8004}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:22:37 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:37 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf17", 0x83, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:37 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:22:37 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40), 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:37 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 864.568093] loop4: detected capacity change from 0 to 264192 [ 864.571179] loop6: detected capacity change from 0 to 264192 14:22:37 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) [ 864.587128] loop7: detected capacity change from 0 to 264192 [ 864.596000] loop0: detected capacity change from 0 to 264192 [ 864.609078] vfat: Unknown parameter 'obj_user' [ 864.702090] I/O error, dev loop2, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 864.714132] FAT-fs (loop2): unable to read boot sector [ 864.846604] kmemleak: Found object by alias at 0x607f1a638234 [ 864.846632] CPU: 1 UID: 0 PID: 8190 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 864.846665] Tainted: [W]=WARN [ 864.846673] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 864.846686] Call Trace: [ 864.846693] [ 864.846702] dump_stack_lvl+0xca/0x120 [ 864.846742] __lookup_object+0x94/0xb0 [ 864.846771] delete_object_full+0x27/0x70 [ 864.846800] free_percpu+0x30/0x1160 [ 864.846829] ? arch_uprobe_clear_state+0x16/0x140 [ 864.846865] futex_hash_free+0x38/0xc0 [ 864.846890] mmput+0x2d3/0x390 [ 864.846924] do_exit+0x79d/0x2970 [ 864.846948] ? lock_release+0xc8/0x290 [ 864.846978] ? __pfx_do_exit+0x10/0x10 [ 864.847004] ? find_held_lock+0x2b/0x80 [ 864.847036] ? get_signal+0x835/0x2340 [ 864.847071] do_group_exit+0xd3/0x2a0 [ 864.847099] get_signal+0x2315/0x2340 [ 864.847136] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 864.847166] ? __pfx_get_signal+0x10/0x10 [ 864.847196] ? do_futex+0x135/0x370 [ 864.847221] ? __pfx_do_futex+0x10/0x10 [ 864.847250] arch_do_signal_or_restart+0x80/0x790 [ 864.847281] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 864.847311] ? __x64_sys_futex+0x1c9/0x4d0 [ 864.847334] ? __x64_sys_futex+0x1d2/0x4d0 [ 864.847360] ? fput_close_sync+0x114/0x240 [ 864.847389] ? __pfx___x64_sys_futex+0x10/0x10 [ 864.847413] ? __pfx_fput_close_sync+0x10/0x10 [ 864.847440] ? dnotify_flush+0x79/0x4c0 [ 864.847469] exit_to_user_mode_loop+0x8b/0x110 [ 864.847492] do_syscall_64+0x2f7/0x360 [ 864.847514] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 864.847535] RIP: 0033:0x7f94594c7b19 [ 864.847558] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 864.847568] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 864.847589] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 864.847604] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 864.847618] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 864.847631] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 864.847645] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 864.847675] [ 864.847682] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 864.847695] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 864.847709] kmemleak: min_count = 1 [ 864.847716] kmemleak: count = 1 [ 864.847724] kmemleak: flags = 0x21 [ 864.847732] kmemleak: checksum = 0 [ 864.847739] kmemleak: backtrace: [ 864.847746] pcpu_alloc_noprof+0x87a/0x1170 [ 864.847773] fib_nh_common_init+0x30/0xd0 [ 864.847795] fib6_nh_init+0x968/0x1a00 [ 864.847814] ip6_route_info_create_nh+0x530/0xf80 [ 864.847833] ip6_route_add.part.0+0x59/0x170 [ 864.847852] ip6_route_add+0x48/0x60 [ 864.847869] addrconf_add_mroute+0x12d/0x190 [ 864.847889] addrconf_add_dev+0x148/0x1c0 [ 864.847912] addrconf_dev_config+0x1e9/0x430 [ 864.847939] addrconf_notify+0xa70/0x1920 [ 864.847968] notifier_call_chain+0xc0/0x360 [ 864.847987] call_netdevice_notifiers_info+0xbe/0x140 [ 864.848007] netif_state_change+0x157/0x330 [ 864.848024] linkwatch_do_dev+0x111/0x150 [ 864.848043] __linkwatch_run_queue+0x2ab/0x710 [ 864.848062] linkwatch_event+0x4e/0x70 14:22:47 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e892", 0x25, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:47 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40), 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:22:47 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:22:47 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:47 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", ""]}, 0x10}}, 0x20000080) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:22:47 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:22:47 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:22:47 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 874.870444] loop0: detected capacity change from 0 to 264192 [ 874.884128] loop7: detected capacity change from 0 to 264192 [ 874.886227] FAT-fs (loop0): invalid media value (0xd5) [ 874.886755] FAT-fs (loop0): Can't find a valid FAT filesystem [ 874.923976] loop6: detected capacity change from 0 to 264192 [ 874.933866] loop4: detected capacity change from 0 to 264192 14:22:47 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:47 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:47 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 875.017697] loop0: detected capacity change from 0 to 264192 14:22:47 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", ""]}, 0x10}}, 0x0) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 875.022873] loop7: detected capacity change from 0 to 264192 [ 875.032438] FAT-fs (loop0): invalid media value (0xd5) [ 875.032915] FAT-fs (loop0): Can't find a valid FAT filesystem 14:22:47 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:22:47 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e892", 0x25, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:47 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:47 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 875.122515] loop6: detected capacity change from 0 to 264192 [ 875.142053] loop7: detected capacity change from 0 to 264192 [ 875.154366] loop0: detected capacity change from 0 to 264192 [ 875.158310] loop4: detected capacity change from 0 to 264192 [ 875.162179] kmemleak: Found object by alias at 0x607f1a638234 [ 875.162204] CPU: 1 UID: 0 PID: 8211 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 875.162238] Tainted: [W]=WARN [ 875.162245] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 875.162258] Call Trace: [ 875.162266] [ 875.162274] dump_stack_lvl+0xca/0x120 [ 875.162316] __lookup_object+0x94/0xb0 [ 875.162346] delete_object_full+0x27/0x70 [ 875.162376] free_percpu+0x30/0x1160 [ 875.162418] ? arch_uprobe_clear_state+0x16/0x140 [ 875.162454] futex_hash_free+0x38/0xc0 [ 875.162479] mmput+0x2d3/0x390 [ 875.162513] do_exit+0x79d/0x2970 [ 875.162537] ? lock_release+0xc8/0x290 [ 875.162574] ? __pfx_do_exit+0x10/0x10 [ 875.162600] ? find_held_lock+0x2b/0x80 [ 875.162632] ? get_signal+0x835/0x2340 [ 875.162668] do_group_exit+0xd3/0x2a0 [ 875.162696] get_signal+0x2315/0x2340 [ 875.162732] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 875.162762] ? __pfx_get_signal+0x10/0x10 [ 875.162793] ? do_futex+0x135/0x370 [ 875.162818] ? __pfx_do_futex+0x10/0x10 [ 875.162847] arch_do_signal_or_restart+0x80/0x790 [ 875.162879] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 875.162909] ? __x64_sys_futex+0x1c9/0x4d0 [ 875.162932] ? __x64_sys_futex+0x1d2/0x4d0 [ 875.162958] ? fput_close_sync+0x114/0x240 [ 875.162987] ? __pfx___x64_sys_futex+0x10/0x10 [ 875.163011] ? __pfx_fput_close_sync+0x10/0x10 [ 875.163038] ? dnotify_flush+0x79/0x4c0 [ 875.163067] exit_to_user_mode_loop+0x8b/0x110 [ 875.163091] do_syscall_64+0x2f7/0x360 [ 875.163113] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 875.163135] RIP: 0033:0x7f94594c7b19 [ 875.163151] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 875.163161] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 875.163182] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 875.163197] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 875.163210] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 875.163223] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 875.163237] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 875.163267] [ 875.163275] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 875.163287] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 875.163301] kmemleak: min_count = 1 [ 875.163308] kmemleak: count = 1 [ 875.163316] kmemleak: flags = 0x21 [ 875.163324] kmemleak: checksum = 0 [ 875.163331] kmemleak: backtrace: [ 875.163338] pcpu_alloc_noprof+0x87a/0x1170 [ 875.163366] fib_nh_common_init+0x30/0xd0 [ 875.163388] fib6_nh_init+0x968/0x1a00 [ 875.163407] ip6_route_info_create_nh+0x530/0xf80 [ 875.163426] ip6_route_add.part.0+0x59/0x170 [ 875.163445] ip6_route_add+0x48/0x60 [ 875.163462] addrconf_add_mroute+0x12d/0x190 [ 875.163483] addrconf_add_dev+0x148/0x1c0 [ 875.163507] addrconf_dev_config+0x1e9/0x430 [ 875.163533] addrconf_notify+0xa70/0x1920 [ 875.163563] notifier_call_chain+0xc0/0x360 [ 875.163582] call_netdevice_notifiers_info+0xbe/0x140 [ 875.163603] netif_state_change+0x157/0x330 [ 875.163620] linkwatch_do_dev+0x111/0x150 [ 875.163639] __linkwatch_run_queue+0x2ab/0x710 [ 875.163659] linkwatch_event+0x4e/0x70 [ 875.172070] FAT-fs (loop0): invalid media value (0xd5) [ 875.192779] FAT-fs (loop0): Can't find a valid FAT filesystem 14:22:47 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e892", 0x25, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:47 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:22:47 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) [ 875.243419] loop6: detected capacity change from 0 to 264192 [ 875.351834] kmemleak: Found object by alias at 0x607f1a638234 [ 875.351852] CPU: 0 UID: 0 PID: 8247 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 875.351872] Tainted: [W]=WARN [ 875.351876] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 875.351885] Call Trace: [ 875.351891] [ 875.351897] dump_stack_lvl+0xca/0x120 [ 875.351926] __lookup_object+0x94/0xb0 [ 875.351943] delete_object_full+0x27/0x70 [ 875.351960] free_percpu+0x30/0x1160 [ 875.351977] ? arch_uprobe_clear_state+0x16/0x140 [ 875.351998] futex_hash_free+0x38/0xc0 [ 875.352013] mmput+0x2d3/0x390 [ 875.352032] do_exit+0x79d/0x2970 [ 875.352046] ? lock_release+0xc8/0x290 [ 875.352064] ? __pfx_do_exit+0x10/0x10 [ 875.352078] ? find_held_lock+0x2b/0x80 [ 875.352095] ? get_signal+0x835/0x2340 [ 875.352115] do_group_exit+0xd3/0x2a0 [ 875.352130] get_signal+0x2315/0x2340 [ 875.352150] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 875.352167] ? __pfx_get_signal+0x10/0x10 [ 875.352183] ? do_futex+0x135/0x370 [ 875.352197] ? __pfx_do_futex+0x10/0x10 [ 875.352212] arch_do_signal_or_restart+0x80/0x790 [ 875.352230] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 875.352247] ? __x64_sys_futex+0x1c9/0x4d0 [ 875.352259] ? __x64_sys_futex+0x1d2/0x4d0 [ 875.352273] ? fput_close_sync+0x114/0x240 [ 875.352289] ? __pfx___x64_sys_futex+0x10/0x10 [ 875.352302] ? __pfx_fput_close_sync+0x10/0x10 [ 875.352317] ? dnotify_flush+0x79/0x4c0 [ 875.352333] exit_to_user_mode_loop+0x8b/0x110 [ 875.352346] do_syscall_64+0x2f7/0x360 [ 875.352358] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 875.352370] RIP: 0033:0x7f94594c7b19 [ 875.352380] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 875.352385] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 875.352397] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 875.352406] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 875.352413] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 875.352421] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 875.352429] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 875.352445] [ 875.352450] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 875.352457] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 875.352464] kmemleak: min_count = 1 [ 875.352469] kmemleak: count = 1 [ 875.352473] kmemleak: flags = 0x21 [ 875.352477] kmemleak: checksum = 0 [ 875.352481] kmemleak: backtrace: [ 875.352485] pcpu_alloc_noprof+0x87a/0x1170 [ 875.352500] fib_nh_common_init+0x30/0xd0 [ 875.352513] fib6_nh_init+0x968/0x1a00 [ 875.352524] ip6_route_info_create_nh+0x530/0xf80 [ 875.352534] ip6_route_add.part.0+0x59/0x170 [ 875.352544] ip6_route_add+0x48/0x60 [ 875.352558] addrconf_add_mroute+0x12d/0x190 [ 875.352569] addrconf_add_dev+0x148/0x1c0 [ 875.352582] addrconf_dev_config+0x1e9/0x430 [ 875.352597] addrconf_notify+0xa70/0x1920 [ 875.352613] notifier_call_chain+0xc0/0x360 [ 875.352623] call_netdevice_notifiers_info+0xbe/0x140 [ 875.352635] netif_state_change+0x157/0x330 [ 875.352645] linkwatch_do_dev+0x111/0x150 [ 875.352655] __linkwatch_run_queue+0x2ab/0x710 [ 875.352666] linkwatch_event+0x4e/0x70 [ 884.784214] loop5: detected capacity change from 0 to 264192 14:22:57 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x0, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:22:57 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:57 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:22:57 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, 0x0) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:22:57 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e", 0x37, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:57 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:22:57 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:22:57 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", ""]}, 0x10}}, 0x0) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 884.817261] loop4: detected capacity change from 0 to 264192 [ 884.853098] loop0: detected capacity change from 0 to 264192 [ 884.862381] loop6: detected capacity change from 0 to 264192 [ 884.865430] vfat: Unknown parameter 'obj_user' 14:22:57 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x0, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:22:57 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 884.906488] loop5: detected capacity change from 0 to 264192 [ 884.943251] loop4: detected capacity change from 0 to 264192 [ 885.067312] kmemleak: Found object by alias at 0x607f1a638234 [ 885.067340] CPU: 0 UID: 0 PID: 8271 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 885.067373] Tainted: [W]=WARN [ 885.067381] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 885.067394] Call Trace: [ 885.067402] [ 885.067410] dump_stack_lvl+0xca/0x120 [ 885.067450] __lookup_object+0x94/0xb0 [ 885.067479] delete_object_full+0x27/0x70 [ 885.067508] free_percpu+0x30/0x1160 [ 885.067537] ? arch_uprobe_clear_state+0x16/0x140 [ 885.067581] futex_hash_free+0x38/0xc0 [ 885.067605] mmput+0x2d3/0x390 [ 885.067638] do_exit+0x79d/0x2970 [ 885.067663] ? lock_release+0xc8/0x290 [ 885.067693] ? __pfx_do_exit+0x10/0x10 [ 885.067719] ? find_held_lock+0x2b/0x80 [ 885.067750] ? get_signal+0x835/0x2340 [ 885.067786] do_group_exit+0xd3/0x2a0 [ 885.067814] get_signal+0x2315/0x2340 [ 885.067850] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 885.067880] ? __pfx_get_signal+0x10/0x10 [ 885.067910] ? do_futex+0x135/0x370 [ 885.067935] ? __pfx_do_futex+0x10/0x10 [ 885.067964] arch_do_signal_or_restart+0x80/0x790 [ 885.067995] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 885.068026] ? __x64_sys_futex+0x1c9/0x4d0 [ 885.068049] ? __x64_sys_futex+0x1d2/0x4d0 [ 885.068074] ? fput_close_sync+0x114/0x240 [ 885.068104] ? __pfx___x64_sys_futex+0x10/0x10 [ 885.068128] ? __pfx_fput_close_sync+0x10/0x10 [ 885.068155] ? dnotify_flush+0x79/0x4c0 [ 885.068174] ? xfd_validate_state+0x55/0x180 [ 885.068212] exit_to_user_mode_loop+0x8b/0x110 [ 885.068235] do_syscall_64+0x2f7/0x360 [ 885.068257] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 885.068279] RIP: 0033:0x7f94594c7b19 [ 885.068295] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 885.068305] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 885.068327] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 885.068342] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 885.068355] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 885.068369] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 885.068382] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 885.068412] [ 885.068420] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 885.068433] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 885.068446] kmemleak: min_count = 1 [ 885.068454] kmemleak: count = 1 [ 885.068461] kmemleak: flags = 0x21 [ 885.068469] kmemleak: checksum = 0 [ 885.068476] kmemleak: backtrace: [ 885.068483] pcpu_alloc_noprof+0x87a/0x1170 [ 885.068511] fib_nh_common_init+0x30/0xd0 [ 885.068533] fib6_nh_init+0x968/0x1a00 [ 885.068551] ip6_route_info_create_nh+0x530/0xf80 [ 885.068570] ip6_route_add.part.0+0x59/0x170 [ 885.068589] ip6_route_add+0x48/0x60 [ 885.068606] addrconf_add_mroute+0x12d/0x190 [ 885.068626] addrconf_add_dev+0x148/0x1c0 [ 885.068650] addrconf_dev_config+0x1e9/0x430 [ 885.068677] addrconf_notify+0xa70/0x1920 [ 885.068706] notifier_call_chain+0xc0/0x360 [ 885.068725] call_netdevice_notifiers_info+0xbe/0x140 [ 885.068746] netif_state_change+0x157/0x330 [ 885.068763] linkwatch_do_dev+0x111/0x150 [ 885.068782] __linkwatch_run_queue+0x2ab/0x710 [ 885.068801] linkwatch_event+0x4e/0x70 14:23:07 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x0, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:23:07 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:23:07 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:23:07 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e", 0x37, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:23:07 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:23:07 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b\a', 0x2}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:23:07 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:23:07 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", ""]}, 0x10}}, 0x0) socketpair(0x23, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 895.024612] loop5: detected capacity change from 0 to 264192 [ 895.048907] loop0: detected capacity change from 0 to 264192 [ 895.053917] loop6: detected capacity change from 0 to 264192 [ 895.081396] vfat: Unknown parameter 'obj_user' 14:23:07 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, 0x0) [ 895.140401] FAT-fs (loop2): invalid media value (0x08) [ 895.141650] FAT-fs (loop2): Can't find a valid FAT filesystem 14:23:07 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:23:07 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b\a', 0x2}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 895.261354] loop5: detected capacity change from 0 to 264192 14:23:08 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e", 0x37, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 895.315234] kmemleak: Found object by alias at 0x607f1a638234 [ 895.315265] CPU: 0 UID: 0 PID: 8298 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 895.315300] Tainted: [W]=WARN [ 895.315307] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 895.315322] Call Trace: [ 895.315330] [ 895.315339] dump_stack_lvl+0xca/0x120 [ 895.315383] __lookup_object+0x94/0xb0 [ 895.315412] delete_object_full+0x27/0x70 [ 895.315442] free_percpu+0x30/0x1160 [ 895.315472] ? arch_uprobe_clear_state+0x16/0x140 [ 895.315508] futex_hash_free+0x38/0xc0 [ 895.315535] mmput+0x2d3/0x390 [ 895.315577] do_exit+0x79d/0x2970 [ 895.315602] ? signal_wake_up_state+0x85/0x120 [ 895.315631] ? zap_other_threads+0x2b9/0x3a0 [ 895.315661] ? __pfx_do_exit+0x10/0x10 [ 895.315685] ? do_group_exit+0x1c3/0x2a0 [ 895.315711] ? lock_release+0xc8/0x290 [ 895.315741] do_group_exit+0xd3/0x2a0 [ 895.315769] __x64_sys_exit_group+0x3e/0x50 [ 895.315795] x64_sys_call+0x18c5/0x18d0 [ 895.315823] do_syscall_64+0xbf/0x360 [ 895.315846] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 895.315868] RIP: 0033:0x7f94594c7b19 [ 895.315884] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 895.315895] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 895.315917] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 895.315931] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 895.315945] RBP: 0000000000000000 R08: 0000001b2cd250d8 R09: 0000000000000000 [ 895.315959] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 895.315973] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 895.316002] [ 895.316010] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 895.316023] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 895.316037] kmemleak: min_count = 1 [ 895.316045] kmemleak: count = 1 [ 895.316052] kmemleak: flags = 0x21 [ 895.316060] kmemleak: checksum = 0 [ 895.316068] kmemleak: backtrace: [ 895.316075] pcpu_alloc_noprof+0x87a/0x1170 [ 895.316103] fib_nh_common_init+0x30/0xd0 [ 895.316125] fib6_nh_init+0x968/0x1a00 [ 895.316144] ip6_route_info_create_nh+0x530/0xf80 [ 895.316163] ip6_route_add.part.0+0x59/0x170 [ 895.316182] ip6_route_add+0x48/0x60 [ 895.316199] addrconf_add_mroute+0x12d/0x190 [ 895.316220] addrconf_add_dev+0x148/0x1c0 [ 895.316244] addrconf_dev_config+0x1e9/0x430 [ 895.316270] addrconf_notify+0xa70/0x1920 [ 895.316300] notifier_call_chain+0xc0/0x360 [ 895.316320] call_netdevice_notifiers_info+0xbe/0x140 [ 895.316341] netif_state_change+0x157/0x330 [ 895.316358] linkwatch_do_dev+0x111/0x150 [ 895.316377] __linkwatch_run_queue+0x2ab/0x710 [ 895.316397] linkwatch_event+0x4e/0x70 [ 895.379511] loop6: detected capacity change from 0 to 264192 14:23:08 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, 0x0) 14:23:08 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", ""]}, 0x10}}, 0x20000080) socketpair(0x0, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) [ 895.450074] loop5: detected capacity change from 0 to 264192 14:23:08 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{0x0, 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:23:08 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:23:08 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826", 0x40, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:23:08 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b\a', 0x2}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:23:08 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:23:08 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:23:08 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, 0x0) [ 895.572522] loop6: detected capacity change from 0 to 264192 [ 895.575920] loop7: detected capacity change from 0 to 264192 [ 895.640486] loop5: detected capacity change from 0 to 264192 [ 895.652676] FAT-fs (loop2): invalid media value (0x08) [ 895.653292] FAT-fs (loop2): Can't find a valid FAT filesystem [ 895.661145] loop0: detected capacity change from 0 to 264192 14:23:08 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 895.694868] vfat: Unknown parameter 'obj_user' 14:23:08 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{0x0, 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 895.730166] kmemleak: Found object by alias at 0x607f1a638234 [ 895.730188] CPU: 1 UID: 0 PID: 8340 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 895.730212] Tainted: [W]=WARN [ 895.730218] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 895.730228] Call Trace: [ 895.730233] [ 895.730240] dump_stack_lvl+0xca/0x120 [ 895.730271] __lookup_object+0x94/0xb0 [ 895.730293] delete_object_full+0x27/0x70 [ 895.730315] free_percpu+0x30/0x1160 [ 895.730342] ? arch_uprobe_clear_state+0x16/0x140 [ 895.730370] futex_hash_free+0x38/0xc0 [ 895.730388] mmput+0x2d3/0x390 [ 895.730413] do_exit+0x79d/0x2970 [ 895.730436] ? __pfx_do_exit+0x10/0x10 [ 895.730455] ? find_held_lock+0x2b/0x80 [ 895.730479] ? get_signal+0x835/0x2340 [ 895.730506] do_group_exit+0xd3/0x2a0 [ 895.730526] get_signal+0x2315/0x2340 [ 895.730553] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 895.730575] ? __pfx_get_signal+0x10/0x10 [ 895.730597] ? do_futex+0x135/0x370 [ 895.730615] ? __pfx_do_futex+0x10/0x10 [ 895.730635] arch_do_signal_or_restart+0x80/0x790 [ 895.730658] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 895.730680] ? __x64_sys_futex+0x1c9/0x4d0 [ 895.730704] ? __x64_sys_futex+0x1d2/0x4d0 [ 895.730723] ? fput_close_sync+0x114/0x240 [ 895.730745] ? __pfx___x64_sys_futex+0x10/0x10 [ 895.730762] ? __pfx_fput_close_sync+0x10/0x10 [ 895.730782] ? dnotify_flush+0x79/0x4c0 [ 895.730803] exit_to_user_mode_loop+0x8b/0x110 [ 895.730819] do_syscall_64+0x2f7/0x360 [ 895.730836] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 895.730851] RIP: 0033:0x7f94594c7b19 [ 895.730863] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 895.730871] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 895.730886] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 895.730896] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 895.730906] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 895.730916] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 895.730926] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 895.730947] [ 895.730953] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 895.730962] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 895.730972] kmemleak: min_count = 1 [ 895.730978] kmemleak: count = 1 [ 895.730983] kmemleak: flags = 0x21 [ 895.730988] kmemleak: checksum = 0 [ 895.730994] kmemleak: backtrace: [ 895.730999] pcpu_alloc_noprof+0x87a/0x1170 [ 895.731019] fib_nh_common_init+0x30/0xd0 [ 895.731036] fib6_nh_init+0x968/0x1a00 [ 895.731049] ip6_route_info_create_nh+0x530/0xf80 [ 895.731063] ip6_route_add.part.0+0x59/0x170 [ 895.731077] ip6_route_add+0x48/0x60 [ 895.731089] addrconf_add_mroute+0x12d/0x190 [ 895.731104] addrconf_add_dev+0x148/0x1c0 [ 895.731122] addrconf_dev_config+0x1e9/0x430 [ 895.731141] addrconf_notify+0xa70/0x1920 [ 895.731163] notifier_call_chain+0xc0/0x360 [ 895.731176] call_netdevice_notifiers_info+0xbe/0x140 [ 895.731192] netif_state_change+0x157/0x330 [ 895.731205] linkwatch_do_dev+0x111/0x150 [ 895.731219] __linkwatch_run_queue+0x2ab/0x710 [ 895.731232] linkwatch_event+0x4e/0x70 14:23:08 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b\a', 0x2, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x0, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:23:08 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:23:08 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826", 0x40, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:23:08 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 895.860940] loop5: detected capacity change from 0 to 264192 [ 895.879398] loop7: detected capacity change from 0 to 264192 [ 895.892195] loop6: detected capacity change from 0 to 264192 [ 895.893754] FAT-fs (loop2): invalid media value (0x08) [ 895.894336] FAT-fs (loop2): Can't find a valid FAT filesystem [ 895.909778] loop4: detected capacity change from 0 to 264192 [ 896.092735] kmemleak: Found object by alias at 0x607f1a638234 [ 896.092762] CPU: 0 UID: 0 PID: 8349 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 896.092794] Tainted: [W]=WARN [ 896.092801] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 896.092813] Call Trace: [ 896.092820] [ 896.092829] dump_stack_lvl+0xca/0x120 [ 896.092867] __lookup_object+0x94/0xb0 [ 896.092894] delete_object_full+0x27/0x70 [ 896.092922] free_percpu+0x30/0x1160 [ 896.092949] ? arch_uprobe_clear_state+0x16/0x140 [ 896.092985] futex_hash_free+0x38/0xc0 [ 896.093010] mmput+0x2d3/0x390 [ 896.093041] do_exit+0x79d/0x2970 [ 896.093065] ? lock_release+0xc8/0x290 [ 896.093093] ? __pfx_do_exit+0x10/0x10 [ 896.093118] ? find_held_lock+0x2b/0x80 [ 896.093147] ? get_signal+0x835/0x2340 [ 896.093180] do_group_exit+0xd3/0x2a0 [ 896.093206] get_signal+0x2315/0x2340 [ 896.093240] ? __call_rcu_common.constprop.0+0x4c1/0x960 [ 896.093268] ? __pfx_get_signal+0x10/0x10 [ 896.093296] ? do_futex+0x135/0x370 [ 896.093320] ? __pfx_do_futex+0x10/0x10 [ 896.093346] arch_do_signal_or_restart+0x80/0x790 [ 896.093376] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 896.093403] ? __x64_sys_futex+0x1c9/0x4d0 [ 896.093424] ? __x64_sys_futex+0x1d2/0x4d0 [ 896.093449] ? fput_close_sync+0x114/0x240 [ 896.093476] ? __pfx___x64_sys_futex+0x10/0x10 [ 896.093498] ? __pfx_fput_close_sync+0x10/0x10 [ 896.093523] ? dnotify_flush+0x79/0x4c0 [ 896.093540] ? xfd_validate_state+0x55/0x180 [ 896.093583] exit_to_user_mode_loop+0x8b/0x110 [ 896.093605] do_syscall_64+0x2f7/0x360 [ 896.093625] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 896.093646] RIP: 0033:0x7f94594c7b19 [ 896.093662] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 896.093671] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 896.093690] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 896.093704] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 896.093717] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 896.093730] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 896.093743] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 896.093771] [ 896.093778] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 896.093790] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 896.093803] kmemleak: min_count = 1 [ 896.093810] kmemleak: count = 1 [ 896.093817] kmemleak: flags = 0x21 [ 896.093824] kmemleak: checksum = 0 [ 896.093830] kmemleak: backtrace: [ 896.093837] pcpu_alloc_noprof+0x87a/0x1170 [ 896.093862] fib_nh_common_init+0x30/0xd0 [ 896.093883] fib6_nh_init+0x968/0x1a00 [ 896.093900] ip6_route_info_create_nh+0x530/0xf80 [ 896.093918] ip6_route_add.part.0+0x59/0x170 [ 896.093935] ip6_route_add+0x48/0x60 [ 896.093951] addrconf_add_mroute+0x12d/0x190 [ 896.093970] addrconf_add_dev+0x148/0x1c0 [ 896.093992] addrconf_dev_config+0x1e9/0x430 [ 896.094016] addrconf_notify+0xa70/0x1920 [ 896.094043] notifier_call_chain+0xc0/0x360 [ 896.094061] call_netdevice_notifiers_info+0xbe/0x140 [ 896.094080] netif_state_change+0x157/0x330 [ 896.094096] linkwatch_do_dev+0x111/0x150 [ 896.094113] __linkwatch_run_queue+0x2ab/0x710 [ 896.094131] linkwatch_event+0x4e/0x70 14:23:17 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:23:17 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", ""]}, 0x10}}, 0x20000080) socketpair(0x0, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:23:17 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(0x0, r1) 14:23:17 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{0x0, 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:23:17 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) 14:23:17 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826", 0x40, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:23:17 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:23:17 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b\a', 0x2, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x0, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 904.899323] loop7: detected capacity change from 0 to 264192 [ 904.923199] loop5: detected capacity change from 0 to 264192 14:23:17 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40), 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) [ 904.945468] loop4: detected capacity change from 0 to 264192 [ 904.965195] loop0: detected capacity change from 0 to 264192 [ 904.966537] loop6: detected capacity change from 0 to 264192 [ 904.985875] vfat: Unknown parameter 'obj_user' [ 905.027691] FAT-fs (loop2): invalid media value (0x08) [ 905.028479] FAT-fs (loop2): Can't find a valid FAT filesystem [ 905.048824] kmemleak: Found object by alias at 0x607f1a638234 [ 905.048850] CPU: 0 UID: 0 PID: 8371 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 905.048884] Tainted: [W]=WARN [ 905.048892] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 905.048905] Call Trace: [ 905.048913] [ 905.048922] dump_stack_lvl+0xca/0x120 [ 905.048962] __lookup_object+0x94/0xb0 [ 905.048992] delete_object_full+0x27/0x70 [ 905.049022] free_percpu+0x30/0x1160 [ 905.049051] ? arch_uprobe_clear_state+0x16/0x140 [ 905.049087] futex_hash_free+0x38/0xc0 [ 905.049113] mmput+0x2d3/0x390 [ 905.049148] do_exit+0x79d/0x2970 [ 905.049172] ? signal_wake_up_state+0x85/0x120 [ 905.049201] ? zap_other_threads+0x2b9/0x3a0 [ 905.049231] ? __pfx_do_exit+0x10/0x10 [ 905.049256] ? do_group_exit+0x1c3/0x2a0 [ 905.049281] ? lock_release+0xc8/0x290 [ 905.049312] do_group_exit+0xd3/0x2a0 [ 905.049340] __x64_sys_exit_group+0x3e/0x50 [ 905.049366] x64_sys_call+0x18c5/0x18d0 [ 905.049395] do_syscall_64+0xbf/0x360 [ 905.049416] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 905.049437] RIP: 0033:0x7f94594c7b19 [ 905.049453] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 905.049463] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 905.049485] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 905.049499] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 905.049513] RBP: 0000000000000000 R08: 0000001b2cd253f4 R09: 0000000000000000 [ 905.049527] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 905.049540] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 905.049576] [ 905.049583] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 905.049597] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 905.049610] kmemleak: min_count = 1 [ 905.049618] kmemleak: count = 1 [ 905.049625] kmemleak: flags = 0x21 [ 905.049633] kmemleak: checksum = 0 [ 905.049640] kmemleak: backtrace: [ 905.049647] pcpu_alloc_noprof+0x87a/0x1170 [ 905.049675] fib_nh_common_init+0x30/0xd0 [ 905.049697] fib6_nh_init+0x968/0x1a00 [ 905.049716] ip6_route_info_create_nh+0x530/0xf80 [ 905.049735] ip6_route_add.part.0+0x59/0x170 [ 905.049754] ip6_route_add+0x48/0x60 [ 905.049771] addrconf_add_mroute+0x12d/0x190 [ 905.049791] addrconf_add_dev+0x148/0x1c0 [ 905.049815] addrconf_dev_config+0x1e9/0x430 [ 905.049842] addrconf_notify+0xa70/0x1920 [ 905.049873] notifier_call_chain+0xc0/0x360 [ 905.049891] call_netdevice_notifiers_info+0xbe/0x140 [ 905.049911] netif_state_change+0x157/0x330 [ 905.049928] linkwatch_do_dev+0x111/0x150 [ 905.049947] __linkwatch_run_queue+0x2ab/0x710 [ 905.049967] linkwatch_event+0x4e/0x70 [ 905.088127] loop7: detected capacity change from 0 to 264192 14:23:17 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) 14:23:17 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", ""]}, 0x10}}, 0x20000080) socketpair(0x0, 0x4, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:23:17 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) 14:23:17 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) [ 905.202096] loop5: detected capacity change from 0 to 264192 [ 905.292445] FAT-fs (loop2): invalid media value (0x08) [ 905.293332] FAT-fs (loop2): Can't find a valid FAT filesystem [ 905.323409] kmemleak: Found object by alias at 0x607f1a638234 [ 905.323435] CPU: 0 UID: 0 PID: 8402 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 905.323470] Tainted: [W]=WARN [ 905.323478] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 905.323491] Call Trace: [ 905.323498] [ 905.323506] dump_stack_lvl+0xca/0x120 [ 905.323546] __lookup_object+0x94/0xb0 [ 905.323583] delete_object_full+0x27/0x70 [ 905.323613] free_percpu+0x30/0x1160 [ 905.323642] ? arch_uprobe_clear_state+0x16/0x140 [ 905.323678] futex_hash_free+0x38/0xc0 [ 905.323703] mmput+0x2d3/0x390 [ 905.323737] do_exit+0x79d/0x2970 [ 905.323762] ? lock_release+0xc8/0x290 [ 905.323791] ? __pfx_do_exit+0x10/0x10 [ 905.323817] ? find_held_lock+0x2b/0x80 [ 905.323848] ? get_signal+0x835/0x2340 [ 905.323885] do_group_exit+0xd3/0x2a0 [ 905.323912] get_signal+0x2315/0x2340 [ 905.323945] ? __pfx_signal_setup_done+0x10/0x10 [ 905.323984] ? __pfx_get_signal+0x10/0x10 [ 905.324014] ? do_futex+0x135/0x370 [ 905.324040] ? __pfx_do_futex+0x10/0x10 [ 905.324062] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 905.324089] arch_do_signal_or_restart+0x80/0x790 [ 905.324120] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 905.324150] ? __x64_sys_futex+0x1c9/0x4d0 [ 905.324172] ? __x64_sys_futex+0x1d2/0x4d0 [ 905.324200] ? __pfx___x64_sys_futex+0x10/0x10 [ 905.324224] ? lock_mm_and_find_vma+0xaa/0x6f0 [ 905.324258] exit_to_user_mode_loop+0x8b/0x110 [ 905.324281] do_syscall_64+0x2f7/0x360 [ 905.324303] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 905.324325] RIP: 0033:0x7f94594c7b19 [ 905.324342] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 905.324352] RSP: 002b:00007f9456a3d218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 905.324373] RAX: fffffffffffffe00 RBX: 00007f94595daf68 RCX: 00007f94594c7b19 [ 905.324387] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94595daf68 [ 905.324401] RBP: 00007f94595daf60 R08: 0000000000000000 R09: 0000000000000000 [ 905.324415] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94595daf6c [ 905.324428] R13: 00007ffcd48876ff R14: 00007f9456a3d300 R15: 0000000000022000 [ 905.324458] [ 905.324465] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 905.324478] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 905.324492] kmemleak: min_count = 1 [ 905.324499] kmemleak: count = 1 [ 905.324506] kmemleak: flags = 0x21 [ 905.324514] kmemleak: checksum = 0 [ 905.324521] kmemleak: backtrace: [ 905.324527] pcpu_alloc_noprof+0x87a/0x1170 [ 905.324555] fib_nh_common_init+0x30/0xd0 [ 905.324577] fib6_nh_init+0x968/0x1a00 [ 905.324595] ip6_route_info_create_nh+0x530/0xf80 [ 905.324614] ip6_route_add.part.0+0x59/0x170 [ 905.324633] ip6_route_add+0x48/0x60 [ 905.324650] addrconf_add_mroute+0x12d/0x190 [ 905.324670] addrconf_add_dev+0x148/0x1c0 [ 905.324694] addrconf_dev_config+0x1e9/0x430 [ 905.324720] addrconf_notify+0xa70/0x1920 [ 905.324750] notifier_call_chain+0xc0/0x360 [ 905.324769] call_netdevice_notifiers_info+0xbe/0x140 [ 905.324790] netif_state_change+0x157/0x330 [ 905.324807] linkwatch_do_dev+0x111/0x150 [ 905.324827] __linkwatch_run_queue+0x2ab/0x710 [ 905.324846] linkwatch_event+0x4e/0x70 [ 905.654785] ------------[ cut here ]------------ [ 905.655338] percpu ref (css_release) <= 0 (-1) after switching to atomic [ 905.655758] WARNING: lib/percpu-refcount.c:197 at percpu_ref_switch_to_atomic_rcu+0x3cc/0x480, CPU#1: syz-executor/8403 [ 905.657076] Modules linked in: [ 905.657387] CPU: 1 UID: 0 PID: 8403 Comm: syz-executor Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 905.658367] Tainted: [W]=WARN [ 905.658654] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 905.659328] RIP: 0010:percpu_ref_switch_to_atomic_rcu+0x3cc/0x480 [ 905.659851] Code: 00 00 00 00 00 fc ff df 48 89 f9 48 c1 e9 03 80 3c 01 00 0f 85 9e 00 00 00 49 8b 75 e8 48 c7 c7 80 97 e2 84 e8 75 c5 e9 fe 90 <0f> 0b 90 90 e9 2b ff ff ff e8 f6 de 5f ff e9 9e fe ff ff e8 7c df [ 905.661323] RSP: 0018:ffff88806cf08e20 EFLAGS: 00010286 [ 905.661774] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff8139de70 [ 905.662343] RDX: ffff88800f535280 RSI: ffffffff8139de7e RDI: 0000000000000001 [ 905.662947] RBP: 7fffffffffffffff R08: 0000000000000001 R09: ffffed100d9e4801 [ 905.663514] R10: 0000000000000000 R11: fffffffffffdbf30 R12: ffff88800a161c00 [ 905.664105] R13: ffff88800a161c20 R14: 0000000000000002 R15: 0000000000000003 [ 905.664690] FS: 0000555568c6b400(0000) GS:ffff8880e56dd000(0000) knlGS:0000000000000000 [ 905.665329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 905.665807] CR2: 00007f115ab5b178 CR3: 000000000e723000 CR4: 0000000000350ef0 [ 905.666368] Call Trace: [ 905.666596] [ 905.666780] ? rcu_core+0x7c3/0x1800 [ 905.667103] rcu_core+0x7c8/0x1800 [ 905.667400] ? __pfx_rcu_core+0x10/0x10 [ 905.668114] ? mark_held_locks+0x49/0x80 [ 905.668782] handle_softirqs+0x1b1/0x770 [ 905.669476] __irq_exit_rcu+0xc4/0x100 [ 905.670091] irq_exit_rcu+0x9/0x20 [ 905.670640] sysvec_apic_timer_interrupt+0x70/0x80 [ 905.671372] [ 905.671757] [ 905.672131] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 905.672859] RIP: 0010:_raw_spin_unlock_irqrestore+0x34/0x50 [ 905.673593] Code: c7 18 53 48 89 f3 48 8b 74 24 10 e8 16 f5 93 fc 48 89 ef e8 4e 40 94 fc 80 e7 02 74 06 e8 b4 48 be fc fb 65 ff 0d 6c 4c c6 02 <74> 07 5b 5d e9 33 23 00 00 0f 1f 44 00 00 5b 5d e9 27 23 00 00 0f [ 905.676508] RSP: 0018:ffff88803c447c30 EFLAGS: 00000286 [ 905.677288] RAX: 000000000009d9cf RBX: 0000000000000286 RCX: 0000000000000040 [ 905.678294] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff84bde3bc [ 905.679325] RBP: ffffffff85d091e0 R08: 0000000000000001 R09: 0000000000000001 [ 905.680392] R10: ffffffff8643ac57 R11: 0000000000000001 R12: 000000000007ffe0 [ 905.681361] R13: ffff88807ffdcb40 R14: ffffea00002cb900 R15: 0000000000000024 [ 905.682649] ? _raw_spin_unlock_irqrestore+0x2c/0x50 [ 905.683131] kmemleak_scan+0x49a/0xe00 [ 905.683494] kmemleak_write+0x410/0x4f0 [ 905.683895] ? lock_acquire+0x15e/0x2f0 [ 905.684273] ? ksys_write+0x121/0x240 [ 905.684657] full_proxy_write+0x133/0x1a0 [ 905.685053] vfs_write+0x2b7/0x1150 [ 905.685387] ? __pfx_full_proxy_write+0x10/0x10 [ 905.685857] ? __pfx_vfs_write+0x10/0x10 [ 905.686233] ? find_held_lock+0x2b/0x80 [ 905.686637] ? __up_read+0x197/0x750 [ 905.687001] ? __pfx___up_read+0x10/0x10 [ 905.687382] ksys_write+0x121/0x240 [ 905.687741] ? __pfx_ksys_write+0x10/0x10 [ 905.688122] ? trace_irq_enable.constprop.0+0xc2/0x100 [ 905.688618] do_syscall_64+0xbf/0x360 [ 905.688973] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 905.689438] RIP: 0033:0x7fd167f9f5c3 [ 905.689809] Code: 16 00 00 00 eb ae 90 b8 6e 00 00 00 eb a6 e8 44 ef 04 00 0f 1f 40 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 55 c3 0f 1f 40 00 48 83 ec 28 48 89 54 24 18 [ 905.691457] RSP: 002b:00007ffdef0a8f28 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 905.692161] RAX: ffffffffffffffda RBX: 00007ffdef0a9568 RCX: 00007fd167f9f5c3 [ 905.692826] RDX: 0000000000000004 RSI: 00007fd168055ed9 RDI: 0000000000000003 [ 905.693469] RBP: 0000000000000003 R08: 0011cf5cc138c30a R09: 00007fd1680dc000 [ 905.694139] R10: 00007fd1680dc010 R11: 0000000000000246 R12: 00007fd167fa1b10 [ 905.694803] R13: 00007ffdef0aaee7 R14: 0000000000000000 R15: 00000000000dd053 [ 905.695460] [ 905.695709] irq event stamp: 646340 [ 905.696044] hardirqs last enabled at (646348): [] __up_console_sem+0x78/0x80 [ 905.696846] hardirqs last disabled at (646357): [] __up_console_sem+0x5d/0x80 [ 905.697651] softirqs last enabled at (639282): [] handle_softirqs+0x50c/0x770 [ 905.698444] softirqs last disabled at (645585): [] __irq_exit_rcu+0xc4/0x100 [ 905.699263] ---[ end trace 0000000000000000 ]--- [ 905.699709] percpu_ref_switch_to_atomic_rcu: percpu_ref_switch_to_atomic_rcu(): percpu_ref underflow slab kmalloc-64 start ffff88800a161c00 pointer offset 0 size 64 [ 905.707464] percpu_ref_switch_to_atomic_rcu: percpu_ref_switch_to_atomic_rcu(): percpu_ref underflow slab kmalloc-64 start ffff88803d04f880 pointer offset 0 size 64 14:23:27 executing program 1: syz_genetlink_get_family_id$tipc(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_DEL_SEC_DEV(r0, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x2c, 0x0, 0x200, 0x70bd2c, 0x25dfdbff, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x300000003}, @NL802154_ATTR_WPAN_DEV={0xc}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0) perf_event_open$cgroup(&(0x7f0000000a40)={0x0, 0x80, 0x0, 0xff, 0xb4, 0x0, 0x0, 0x7fffffff, 0x40a, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x80000001, 0x4, @perf_bp={&(0x7f0000000a00)}, 0x0, 0x8, 0x1, 0x5, 0x5, 0x800, 0x80, 0x0, 0x401, 0x0, 0x4}, 0xffffffffffffffff, 0xb, 0xffffffffffffffff, 0xd) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000b80)={'wpan0\x00'}) syz_open_dev$vcsu(&(0x7f0000000bc0), 0x7c, 0x482) 14:23:27 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(0x0, r1) 14:23:27 executing program 2: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440), 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b', 0x1}], 0x0, &(0x7f0000000dc0)) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) 14:23:27 executing program 3: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_LEVEL(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x20, 0x0, 0x0, 0x0, 0x0, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}}, 0x4094) sendmsg$NLBL_CIPSOV4_C_LIST(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000001000)={&(0x7f0000000e80), 0xc, &(0x7f0000000fc0)={&(0x7f0000000ec0)={0x10, 0x3ed, 0x100, 0x0, 0x0, "", ["", "", "", "", "", ""]}, 0x10}}, 0x20000080) socketpair(0x23, 0x0, 0x3, &(0x7f0000001040)={0xffffffffffffffff}) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000001080)) 14:23:27 executing program 7: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40), 0x0, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:23:27 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}]}) 14:23:27 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da", 0x45, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:23:27 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b\a', 0x2, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x0, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) [ 914.597771] loop5: detected capacity change from 0 to 264192 [ 914.615396] loop0: detected capacity change from 0 to 264192 [ 914.619818] loop6: detected capacity change from 0 to 264192 [ 914.626692] vfat: Unknown parameter 'obj_user' [ 914.628460] loop4: detected capacity change from 0 to 264192 [ 914.637707] loop7: detected capacity change from 0 to 264192 [ 914.685675] FAT-fs (loop2): invalid media value (0x08) [ 914.686804] FAT-fs (loop2): Can't find a valid FAT filesystem 14:23:27 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(0x0, r1) 14:23:27 executing program 5: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {0x0, 0x0, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}]}) [ 914.733113] loop0: detected capacity change from 0 to 264192 [ 914.737158] vfat: Unknown parameter 'obj_user' 14:23:27 executing program 6: pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, 0x0}, 0x4881) syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da", 0x45, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a582", 0x42, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), r1) 14:23:27 executing program 0: readlinkat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/194, 0xc2) pipe2(&(0x7f0000000440)={0xffffffffffffffff}, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000000a40)={&(0x7f0000000540), 0xc, &(0x7f0000000a00)={0x0}}, 0x4881) syz_mount_image$vfat(&(0x7f0000000bc0), &(0x7f0000000c00)='./file0\x00', 0x8, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)="0807c709c2ab7bb811b8f2c7207d2c5ee30777e649823561f1d115315f0feb5fc6ef31e89230efc3f95701aa2c37987c2b11e87be9042e144f09975cf3a9b826d7c08805da44e0639d", 0x49, 0x7fffffff}, {&(0x7f0000000cc0)="9042fbce80c98c05f16c75920c3fe9bdd5e95a20efcb46deadf5293f6b21664c6ddf10f840b42faaed7ed6cd4fe2c7fe7f5c026ba56df4a236e258a38b2fd4a5a5826a45d47bcaa0f7b8e0eb0e427d413788f074364c9e97c117d54bc0fc48c62ea67711a79db8445d6bf314a675e7588f20a957c806b92da7e9dc104a04e7bce4bf1725", 0x84, 0x5}], 0x400, &(0x7f0000000dc0)={[{@shortname_winnt}], [{@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}]}) openat$vcs(0xffffffffffffff9c, &(0x7f0000000e00), 0x0, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f00000010c0), 0xffffffffffffffff) 14:23:27 executing program 4: syz_mount_image$vfat(0x0, &(0x7f0000000c00)='./file0\x00', 0x0, 0x2, &(0x7f0000000d80)=[{&(0x7f0000000c40)='\b\a', 0x2, 0x7fffffff}, {&(0x7f0000000cc0)="90", 0x1, 0x5}], 0x0, 0x0) [ 914.843200] kmemleak: Found object by alias at 0x607f1a638234 [ 914.843232] CPU: 1 UID: 0 PID: 8414 Comm: syz-executor.2 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary) [ 914.843269] Tainted: [W]=WARN [ 914.843277] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 914.843291] Call Trace: [ 914.843299] [ 914.843309] dump_stack_lvl+0xca/0x120 [ 914.843352] __lookup_object+0x94/0xb0 [ 914.843384] delete_object_full+0x27/0x70 [ 914.843416] free_percpu+0x30/0x1160 [ 914.843448] ? arch_uprobe_clear_state+0x16/0x140 [ 914.843487] futex_hash_free+0x38/0xc0 [ 914.843514] mmput+0x2d3/0x390 [ 914.843559] do_exit+0x79d/0x2970 [ 914.843586] ? signal_wake_up_state+0x85/0x120 [ 914.843617] ? zap_other_threads+0x2b9/0x3a0 [ 914.843650] ? __pfx_do_exit+0x10/0x10 [ 914.843676] ? do_group_exit+0x1c3/0x2a0 [ 914.843704] ? lock_release+0xc8/0x290 [ 914.843738] do_group_exit+0xd3/0x2a0 [ 914.843768] __x64_sys_exit_group+0x3e/0x50 [ 914.843797] x64_sys_call+0x18c5/0x18d0 [ 914.843828] do_syscall_64+0xbf/0x360 [ 914.843852] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 914.843875] RIP: 0033:0x7f94594c7b19 [ 914.843893] Code: Unable to access opcode bytes at 0x7f94594c7aef. [ 914.843904] RSP: 002b:00007ffcd4887928 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 914.843927] RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f94594c7b19 [ 914.843943] RDX: 00007f945947a72b RSI: ffffffffffffffbc RDI: 0000000000000000 [ 914.843959] RBP: 0000000000000000 R08: 0000001b2cd25400 R09: 0000000000000000 [ 914.843973] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 914.843987] R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcd4887a10 [ 914.844019] [ 914.844028] kmemleak: Object (percpu) 0x607f1a638230 (size 8): [ 914.844042] kmemleak: comm "kworker/u9:2", pid 42, jiffies 4294774726 [ 914.844057] kmemleak: min_count = 1 [ 914.844065] kmemleak: count = 1 [ 914.844074] kmemleak: flags = 0x21 [ 914.844082] kmemleak: checksum = 0 [ 914.844090] kmemleak: backtrace: [ 914.844097] pcpu_alloc_noprof+0x87a/0x1170 [ 914.844128] fib_nh_common_init+0x30/0xd0 [ 914.844152] fib6_nh_init+0x968/0x1a00 [ 914.844173] ip6_route_info_create_nh+0x530/0xf80 [ 914.844194] ip6_route_add.part.0+0x59/0x170 [ 914.844215] ip6_route_add+0x48/0x60 [ 914.844234] addrconf_add_mroute+0x12d/0x190 [ 914.844256] addrconf_add_dev+0x148/0x1c0 [ 914.844282] addrconf_dev_config+0x1e9/0x430 [ 914.844312] addrconf_notify+0xa70/0x1920 [ 914.844347] notifier_call_chain+0xc0/0x360 [ 914.844367] call_netdevice_notifiers_info+0xbe/0x140 [ 914.844390] netif_state_change+0x157/0x330 [ 914.844409] linkwatch_do_dev+0x111/0x150 [ 914.844431] __linkwatch_run_queue+0x2ab/0x710 [ 914.844452] linkwatch_event+0x4e/0x70 [ 914.900579] loop0: detected capacity change from 0 to 264192 [ 914.907280] vfat: Unknown parameter 'obj_user' [ 914.957094] loop6: detected capacity change from 0 to 264192 [ 914.962654] loop4: detected capacity change from 0 to 264192 [ 914.978773] loop5: detected capacity change from 0 to 264192 VM DIAGNOSIS: 14:23:18 Registers: info registers vcpu 0 RAX=0000000000000001 RBX=ffff888014b03700 RCX=4b952e4da9267483 RDX=00000000915d54c6 RSI=000000005e406224 RDI=0000000000104185 RBP=ffff888014b04158 RSP=ffff8880177c7628 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000001 R12=ffff888014b04158 R13=00000000ef9db6ea R14=0000000000000000 R15=4b952e4da9267483 RIP=ffffffff8151c03f RFL=00000097 [--S-APC] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 00007f54a54488c0 00000000 00000000 GS =0000 ffff8880e55dd000 00000000 00000000 LDT=0000 fffffe4400000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007fcbeec0107c CR3=000000000e696000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=000000000000002f002f2e2e2f002e2e XMM01=0000000000000000696c61766e49002f XMM02=ffffffffffffff0f0e0d0c0b0a090807 XMM03=0000000000000000000035706f6f6c2f XMM04=2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f2f XMM05=000055c98dc7caa0000055c98dca5c30 XMM06=000055c98dc6bf400000000000000000 XMM07=00000000000000000000000000000000 XMM08=2f63697361622f6372732f2e2e000d0a XMM09=00000000000000000000000000000000 XMM10=00000020000000000000002000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000 info registers vcpu 1 RAX=000000000000000d RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff828e32c5 RDI=ffffffff88724180 RBP=ffffffff88724140 RSP=ffff88806cf08688 R8 =0000000000000000 R9 =ffffed10013bd046 R10=0000000000000000 R11=0000000000000001 R12=000000000000000d R13=0000000000000010 R14=ffffffff88724140 R15=ffffffff828e32b0 RIP=ffffffff828e331d RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000555568c6b400 00000000 00000000 GS =0000 ffff8880e56dd000 00000000 00000000 LDT=0000 fffffe0e00000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f115ab5b178 CR3=000000000e723000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 XMM00=00000000000000000000000000000000 XMM01=0b2c498b17e27cb1724635a510fad4f8 XMM02=a3797342f9eb3dd9000000000010ec80 XMM03=68a8aee3740b9fad000000000010edf0 XMM04=819028b3e9e8f25200000000000ae988 XMM05=24c64055c656df0000000000005de6a8 XMM06=079bacc6b211020400000000005d8580 XMM07=ea899072da79512f000000000010ef48 XMM08=d12871896912de2d000000000010ecd0 XMM09=00000000000000000000000000000000 XMM10=00000020200000000000000000000000 XMM11=00000000000000000000000000000000 XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000 XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000